Privacy Notice

When someone visits www.su.rhul.ac.uk we use a number of third party services, Google Analytics and New Relic, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site so that we can improve the content we offer to visitors. This information is only processed in a way which does not identify anyone.

We do not make, and do not allow Google or New Relic to make any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

We also make use of the third party service, Facebook Pixel, to collect information on the performance of our advertising so that we can continually optimise our marketing activity. You can review your Facebook privacy settings and opt out of Facebook Pixel within the ‘Ad Preferences’ section of your Facebook account.

Membership Services Limited (MSL)

We use a third party service, Membership Services Limited, to manage our membership functionality and provide our content management system. In order to provide these services we collect information through two different methods:

i. During enrolment with the University

We have a data processing agreement with Royal Holloway, University of London, whereby the University shares the following student data with the Students’ Union at the stage of enrolment:

• Name
• College card number
• Date of birth
• College email address
• Gender
• Year of study
• Course
• Department
• Home postcode

The data processing agreement (Memorandum of Cooperation, Appendix 5: Data Processing Agreement) enables RHSU to collect and use the above information to meet our legal obligation protected within the Education Act 1994, which requires that appointment to major union offices is by election in a secret ballot in which all members are entitled to vote.

The following legitimate interests are also applicable for the collection and processing of the above data:

• To verify your identity as a student of Royal Holloway and ensure that you can access all areas of our website
• To ensure that you can attend our events
• To ensure that you can access our services
• To analyse, develop and improve services and activities that we offer
• To ask your views on our services
• To communicate with you regarding our membership services

If we want to process your data for any other reason we will inform you of the processing activity and always ensure that the appropriate legal basis is applied.

At the point of enrolment all students are informed of their right to opt out of Students’ Union membership and given relevant information to enable you to do so.

Members are free to amend their membership status at will. For more information on membership of the Students’ Union see our dedicated webpage.

ii. During guest registration on our website

Guests to our website are required to submit a range of data if they wish to make purchases on the website, access our services, join the Students’ Union as an Associate Member or join a student group. The data collected includes:

• Name
• Date of birth
• Email address
• Marketing preferences

The lawful basis for processing this data is for the performance of a contract. This data also enables you to access our wider website and services.

We won’t use this information to target or profile you based on prior purchases and we will only send you marketing messages if you have consented to this.

Use of cookies by RHSU

You can read more about how we use cookies on our Cookies page.

Forms

At times we use a number of third party providers, Cognito LLC and Google, to collect data through embedded forms on our website. We do not allow Cognito LLC or Google to make any attempt to access the data we have collected or share it.

At the point of collection we will be explicit about what personal data we are collecting and the purpose for processing and the retention period.

For more information, please see Cognito LLC’s privacy notice or Google’s privacy notice.

We only retain data on our system that is relevant and for time periods that are not longer than is necessary. This can be broken down into a number of different categories:

i. Ordinary and Associate Members of the Students’ Union

When an ordinary/associate member of RHSU graduates, leaves the University or opts-out of membership they cease to be a member. In this case their data is given a ‘nominal leaving date’ which takes effect on our ‘global expiry date’ which is the 31 July every year.

Following this their data enters the ‘full retention period’ during which the data is fully retained on the MSL systems and measured from the nominal leaving date.

At the end of the ‘full retention period’ all data relating to a members account is pseudonymised and all data and content linked to the account can no longer be attributed to a named individual.

At the end of the ‘final deletion period’ all personal data records are securely deleted. The dates for this activity is defined in the table below.

ii. Honorary Membership

If you are granted Honorary Lifetime Membership of the Students’ Union you are given access to all of RHSU’s services (except standing/voting in elections) for life. To enable this access, the data for these types of members remains on the system for the period of time they continue to login to the website. We review the last login date on an annual basis and will send a reminder to anyone who has not logged in within the previous calendar year. After a further 12 months of inactivity the last login date will then become the ‘nominal leaving date’, activating the process below.

Should you wish to opt-out of Honorary Membership please contact us. The date at which you confirm the end of your Honorary Membership will become your ‘nominal leaving date’ and activate the process defined in the table below.

iii. Guest Accounts

If you have registered for a guest account on our website you are given access to all of RHSU’s services (except standing/voting in elections) for life. To enable this access, the data for these types of members remains on the system for the period of time they continue to login to the website. We review the last login date on an annual basis and will mark your account with a ‘nominal leaving date’ based on your last login after 12 months of inactivity.

Should you wish to delete your account please contact us. The date at which you confirm the end of your account will become your ‘nominal leaving date’ and activate the process defined in the table below.

RHSU uses surveys to improve our understanding of issues that directly affect our members. This can relate to the services we offer, the development of specific policy around issues on campus or the performance of our communications activity.

At the point of conducting surveys we will be explicit about what personal data we are processing, the purpose for processing and the retention period.

We use a third party service, Survey Monkey, to manage the collection and analysis of our survey work. We do not allow Survey Monkey to make any attempt to access the data we have collected or share it. For more information, please see Survey Monkey’s privacy notice.

We use a third party provider, Sprout Social, to manage our social media interactions. As such, information you make publicly available on social media platforms may be transferred to Sprout Social to allow our team to quickly respond to your enquiries. For more information, please see Sprout Social’s privacy notice.

For members of the Students’ Union, we will also process your personal data for marketing purposes. When we talk about ‘marketing’ we mean to keep you updated with access to relevant products, offers, activities and services. We will rely on the lawful basis of legitimate interests to process your data in this way as we believe the information we share with you will enhance your experience as a student of Royal Holloway. We will also use analytics to enable us to enhance and personalise the experience we offer to you as members of the Students’ Union.

We will not share your personal data with any third parties and you can ask us to stop sending you marketing messages by contacting us at any time.

E-Newsletter

We use a third party provider, Campaign Monitor, to deliver our e-newsletter updates. We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-newsletter.

Our E-Newsletter is only sent to members of the Students’ Union and individuals have the right to unsubscribe at any point and are given information about how to do this in the footer of every email. Campaign Monitor only uses the data we have supplied in order to send emails from us. They won’t share this data with anyone else or send you emails about their services.

For more information, please see Campaign Monitor’s privacy notice.

You can read more about what data we collect and how we process it as part of the recruitment process on our Work With Us page or our Employment Data information page.

Day-time Events

As part of our Give It A Go offer, the Students’ Union offers numerous day-time and evening events throughout the year. At most of these events we will scan your College Card before you gain entry to the event. This gives us access to the following data:

• Name
• College card number
• Date of birth
• College email address
• Sex
• Year of study
• Course
• Department

We collect this data for our legitimate interests of:

• Analysing event attendance to identify where there may be certain demographics who are not engaging with our events and to help build targeted programmes of events.
• Contacting you to gain your feedback on the event and help us improve future events.

We will only retain this information for the academic year in which it is collected. If the data is required for comparative analysis after this period, the data will be pseudonymised so that the data cannot be attributed to a named individual. It will not be retained for any more than one further academic year.

Night-time Events

The Students’ Union provides a number of night-time events across all of our venues throughout the year. Entry to all ticketed events is via your College Card, which is scanned to identify any purchase of tickets, any age restrictions and any venue access restrictions. This is used for validity purposes only and no further data is collected.

Some of our events are open to the general public and the majority of the tickets related to these are purchased through our website. The data related to these transactions is used to enable entry into the event and never used for marketing purposes unless explicitly agreed at the time of purchase.

For large events we may use an external third party ticketing platform. For our Founder’s Calling event we are using TicketWeb to facilitate ticket sales. The data related to these transactions is used to enable entry into the event and never used for marketing purposes unless explicitly agreed at the time of purchase.

For more information, please see TicketWeb's privacy notice.

Guest Sign-in

Where a member of the Students’ Union wishes to bring a guest with them to any of our late night events, they will be required to sign the guest in. The following personal details of the guest will be collected:

• Name
• Date of birth

Additionally a copy of a driving licence, passport or national identity card will be scanned and a photograph of the individual taken. This information is required to enable us to fulfil our legal obligations under the Licensing Act 2003 and will be retained for the duration of the academic term in which the event is attended. After this point it will be deleted unless it needs to be retained as part of an investigation following an accident or incident.

Photography

We take photographs and video footage at the majority of our events but we will always make it clear when we are doing so and the purposes for this activity. Should you not wish your photograph/video to be taken at an event please inform our photographer/videographer and they will ensure your image is not taken.

We do not use any facial recognition software to identify individuals within images and in the instances where we wish to identify an individual, such as in our democratic elections, we will always ask for permission.

Accidents and/or Incidents

To ensure compliance with health and Safety and licensing legislation, we are required to record all accidents, incidents and near misses within our venues. The personal data we request when completing a report on the above is as follows:

• Your name
• College Card number (if applicable)
• Your address

We use a third party provider, Cognito LLC, to capture and store this data. For further information please see Cognito LLC’s privacy notice. We will retain accident report forms for a duration of three years and incident forms for a period of 12 months from the date of incident, unless required to support ongoing disciplinary action, health and safety or insurance investigations.

The Students’ Union operates an independent Advice Centre, offering specialist advice in academic and housing issues. Our advisors are also able to signpost you to other services and support where necessary. This service is confidential and at your first appointment the advisors will discuss with you the personal data (and any special categories of data) that they require to enable them to support you appropriately. Your permission to process this data will be sought.

There may be circumstances where your personal data needs to be shared with a third party. This will be discussed with you and your permission to share this data will be sought, except where they may be reason to protect your vital interests, in which case your permission will not be obtained.

We operate a number of surveillance systems to enable the prevention, investigation and detection of crime and monitoring of the security and safety of the premises at RHSU.

This includes CCTV around our venues, body worn cameras on licensed security individuals and dash cams on our Union Bus service. We’re registered with the ICO as a data controller operating closed circuit surveillance systems and you can see our Surveillance Systems Policy in full for more information.

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

Within the Data Protection Act 2018, the UK General Data Protection Regulations (UK GDPR) set out the rights you have as an individual which you can exercise in relation to the information we hold about you.

You can read more about these rights on the Information Commissioner’s Office website but they can be broken down into the following areas:

The right to be informed

You have the right to be informed about how we’re using your data. We do this by using a combination of physical notices (such as photography notices at events), just in time notices (such as an opt in check box when making a purchase) and layered documentation (such as this privacy policy).

The right to access your data

You can request a copy of the data we hold on you by contacting us. We endeavour to respond to requests within 30 days but where a request is complex this may take up to 90 days – if this happens we’ll let you know the reasons why.

The right to rectification

You have the right to question any information that we have about you that you think is incorrect. We’ll take reasonable steps to check this for you and, if required, correct it.

The right to erasure

You can ask us to delete, remove, or stop using your personal information if there is no need for us to keep it. This is known as the ‘right to erasure’ or the ‘right to be forgotten’.

The right to restrict processing

If you believe the information we hold on you is inaccurate, being processed unlawfully or no longer required you have the right to restrict the processing of your personal data.

The right to data portability

You have the right to get your personal information from us in a format that can be easily re-used. You can also ask us to pass on your personal information in this format to other organisations.

The right to object

You can object to us keeping or using your personal information. This is known as the ‘right to object’.

Rights in relation to automated decision making and profiling

You are protected under UK GDPR in instances where automated decision-making has a legal or similarly significant effects on you. We don’t currently conduct any such automated decision making or profiling.

You can invoke your right to any of the above verbally or in writing. Please contact us at helpdesk@su.rhul.ac.uk.

RHSU tries to meet the highest standards when collecting and using personal information and we take any complaints we receive about this seriously.

You have the right to complain to the Information Commissioner’s Office. You can find out how to report a concern on their website.

If you want to request information about our privacy policy, or to invoke your rights as outlined above, you can email us or write to:

The Students’ Union
Royal Holloway
Egham Hill
Egham
TW20 0EX

29 April 2022

• We have added a section related to events that the general public can attend and the third party providers we use to facilitate ticket sales to that audience – TicketWeb.

08 October 2021

• We have removed all references to our HouseSearch service after the platform was transferred to StudentPad Limited.
• We’ve updated our language throughout the document to bring it in-line with language used by the Information Commissioner’s Office and within the Data Protection Act 2018.
• We have explicitly named the Memorandum of Cooperation, Appendix 5: Data Processing Agreement, which governs our data sharing agreement with Royal Holloway, University of London.
• We’ve added links to documentation available online to make it easier to quickly find additional policies.