Privacy Notice

Students

Who we are

We are your Union of Students. We support students by providing advice & signposting, representation, community activities, elections, campaigns, events and other services that help improve the student experience.

For the purposes of data protection law, we are the data controller for the personal information described in this notice.

The information we collect

Depending on the service you use, we may collect:

Your name, student ID number and university email address
Contact details such as your phone number or personal e-mail address
Information about your course, year of study and faculty
Records of your involvement in Union activity including student groups, elections, committees and representative roles
Information you provide when requesting funding, submitting forms or attending training
Feedback, survey responses and student issues raised with us
Information relating to advice, support or safeguarding cases
Financial information where reimbursement or funding payments are required
Information relating to vehicle use where you drive on behalf of a student group

When you access services in the Union we may process special category information such as health information, disability, ethnicity, sexuality, safeguarding information or details relating to a complaint or support case.

Why we use your information

We use your information to enable you to access the services, opportunities and activities the Union offers, as well as understanding trends in student engagement to improve our services. This includes using your information to:

Deliver Students' Union services and activities
Support academic representatives and community leaders
Provide advice, wellbeing and support services
Manage elections and democratic processes
Administer student groups
Process funding requests, expense claims and payments
Organise events, training and volunteering opportunities
Collect student feedback and represent student views
Meet our legal and regulatory obligations
Safeguard students where appropriate

Our lawful basis for processing

Under UK GDPR, we rely on one or more of the following lawful bases:

Consent
Performance of a contract
Legitimate interests
Legal obligation
Public task

Where we process special category information, we will only do so where an additional legal condition applies, or you have provided explicit consent and where it is necessary to provide support, fulfil legal obligations or protect individuals.

How long we keep information

Most student records are retained for up to six years after the activity, service or engagement has ended.

Some records may be kept for shorter or longer periods where required by law, regulatory requirements or our retention schedule.

How we keep information secure

We use appropriate technical and organisational measures to protect personal information. These include secure systems, controlled access to records, staff training and procedures designed to prevent unauthorised access, loss or misuse.

Your rights

Under UK data protection law, you have the right to:

Be informed about how your information is used
Access the information we hold about you
Request correction of inaccurate information
Request deletion of information in certain circumstances
Restrict or object to processing in certain circumstances
Withdraw consent where processing is based on consent
Request transfer of your information where applicable

Complaints

If you have concerns about how your information is being used, please contact us via dataprotection@derbyunion.co.uk.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.