Standard Privacy Policy
1. Introduction
Winchester Student Union (“we”, “our” or “us”) promises to respect any personal data you share with us, or that we get from other organisations, and keep it safe and in line with data protection laws and best practice. We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect. Developing a better understanding of our members through your personal data allows us deliver better services and communicate with you effectively.
2. Where we collect information about you from
We collect information in the following ways;
2.a When you become a member of the University of Winchester
As a student at the University of Winchester you automatically become a member of Winchester Student Union unless you opt out, either during enrolment or any other time. The University of Winchester keeps up-to-date information about you as a student and share this information with us, subject to a formal data sharing agreement. This data is shared with us for the express purpose of promoting your interests as a student. When the University of Winchester gives us this data we become responsible for it and use this as our central record of your membership. When you leave the University of Winchester this data is deleted by them and us in line with an agreed retention schedule.
2.b When you give it to us directly
You may give us information in order to sign up to a student group, an election, one of our events, undertake research activities, use our Information & Advice Service, purchase our products, apply for positions or communicate with us. When you give us this information we take responsibility for looking after it and we will, if required, cross reference this data against our central record of your membership.
2.c When you give it to us indirectly
Your information may be shared with us by independent organisations, the University of Winchester, event partners. These independent third parties will only do so when you have indicated that you have given consent to share this data with us. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.
2.d When you give permission to other organisations to share it
We may combine information you provide to us with information available from external sources in order to gain a better understanding of our members to improve our communication methods, products, services or respond to complaints. The information we get from other organisations may depend on your privacy settings or the responses you give, so you should regularly check them. This information comes from the following sources:
2.e Third party organisations
You may have provided permission for a company or other organisation to share your data with third parties such as Winchester Student Union. This could be when you buy a product, register for an online competition or sign up with a service provider.
2.f Social Media
Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp, Twitter, Snapchat and Instagram, you might give us permission to access information from those accounts or services.
2.g Information available publicly
This may include information found in places such as Companies House, the electoral roll, and information that has been published in articles/ newspapers.
2.h When we collect it as you use our websites
Like most websites, we use “cookies” to help us make our site work and make the way you use it better. Cookies mean that a website will remember you. They’re small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier – for example by automatically filling your name and address in text fields or remembering items in shopping baskets. In addition, the type of device you’re using to access our website and the settings on that device may provide us with information about your device, including what type of device it is, what specific device you have and what operating system you’re using. Your device manufacturer or operating system provider will have more details about what information your device makes available to us.
2.i When you buy a product from us
To place an order with us online registration will be required if you don’t already have an account. At the point of registration and at the point of sale, we request certain information including your name, delivery address, email address and phone number. This information is required to enable us to process your order and notify you of its progress. Once an order has been placed, we may contact you by email to confirm your order details and again once your order has been accepted and despatched. Should we need to contact you for any reason regarding your order, we will use the email address or the telephone number where provided. If you purchase some products in person, for example event tickets, we will ask for your student ID number. This enables us to verify your student status, associate your purchase with your student account, maintain maximum per person sales and process entry and refunds effectively.
2.j When other people give us information
Information may be given to us by other students, staff or members of the public in the form of nominations (eg. for elections, awards and prizes), complaints and communications.
3. The personal data we collect and how we use it
The type and quantity of information we collect and how we use it depends on why you are providing it, or why we are receiving it.
Membership
As part of your enrolment with the University of Winchester they provide us with a set of key information. When you use our services or participate in one of our activities we use this information to verify your student status and provide the best possible standards of administration and communication. The information provided to Winchester Student Union may include;
- Student ID / number
- Forename
- Surname
- Date of Birth
- Gender
- University of Winchester Email address
- Fee status (UK/EU/International)
- Programme Code
- Study Type (UG/PG/FE)
- Programme Level
- Start date
- End date
In addition, when you register on our website, signup to a mailing list, attend an event or activity, join a student group or use one of our services we may ask for additional information such as:
- Your interests
- Demographics
- Your bank details to facilitate payments
- Information relating to your health or next of kin
- Any disabilities so that we can provide assistance where needed
- Personal information on accident, incident or first aid forms
We use your data to
- Provide you with the services, products or information you asked for
- Ensure we know how you prefer to be contacted
- Administer your membership
- Keep a record of your relationship with us
- Understand how we can improve our services, products or information
- Build profiles of members and target communications relevant to you
The information contained in our records may also be used for anonymous reporting, both internally and to external bodies, in line with our charitable purpose to represent the generality of interests of our student members.
In certain specific circumstances linked also to the purpose of the data collected, and where there is also an additional ‘lawful basis’ for this further processing, the Union may process a specific amount of sensitive personal data. This is done in line with ICO guidance, and may include information about an individuals’ health for example in excursions, society participation or physical activities such as sport.
Sometimes the Union will have a requirement to share this information with groups of recipients. They include sharing details with the University of Winchester.
4. How we keep your data safe and who has access
Personal data collected and processed by us may be shared with Winchester Student Union employees, officers and volunteers in the process of their work. Under strictly controlled conditions the following groups where necessary:
- The University of Winchester
- Contractors
- Advisors
- Agents
- Service provider partners
When we allow access to your information, we will always have complete control of what they see, what they are allowed to do with it and how long they can see it. We do not sell or share your personal information for other organisations to use.
We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors.
Some of our suppliers may run their operations outside the European Economic Area (EEA). We will always ensure they provide an equal or greater level of protection in accordance with UK data protection law. By submitting your personal information to any of these systems, you agree to this transfer, storing or processing at a location outside the EEA.
We may need to disclose your details if required by law to the police, regulatory bodies or legal advisors. We will only ever share your data in other circumstances if we have your explicit and informed consent.
5. Profiling, Marketing & Communications Preferences
Profiling allows us to target our resources effectively and contact you about relevant services. We do this because it allows us to understand the background of our members and helps us to deliver appropriate services and information to members who need it. When doing this we may analyse geographic, demographic and other information relating to you in order to better understand your interests and preferences in order to contact you with the most relevant communications. Your data would only ever be analysed or profiled through encrypted and protected data processes, which only ever identifies broad statistics. In doing this, we may use additional information from third party sources when it is available.
5.a Membership Communications
As a member we believe you have a legitimate interest in hearing from us about the products and services we offer, what we’re doing to represent you and opportunities that might be of interest to you. You may opt out of these communications during registration on our website, at any stage by clicking the unsubscribe link contained within the email or by visiting your account/profile on our website.
5.b Direct Marketing
As a charity we need to fundraise to provide the services we offer to our members we do this in part through our trading activities including retail outlets, media sales, diners, bars/nightclubs and events activities. We send marketing materials about our trading activities and on behalf of our media sales operation to our members where you have told us that we can. We do not sell or share personal details to third parties for the purposes of marketing. You may opt out of these communications during registration on our website, at any stage by clicking the unsubscribe link contained within the email or by visiting your account/profile on our website.
5.c Controlling what you want to hear about
We make it easy for you to tell us how and what you want us to communicate to you during registration on our website. You can change these settings at any time through your account/profile on our website.
6. Keeping your information up to date
The University of Winchester keep your details up-to-date on our website through scheduled information updates.
Our website also provides options for you to edit your information, and/or let us know when information is inaccurate or you would like it changing. The best way to keep your information up-to-date is to keep your University of Winchester records accurate.
It is your responsibility to keep your information up-to-date relating to any employment you have with us, you can do this through your line manager. There are specific policies related to employment which can be accessed through your line manager.
If you give us data relating to any of our services or activities, for example your email address and phone number as a committee member of a sport, society, STAR or other volunteer position, please contact student.union@winchester.ac.uk to update your information.
7. Understanding the detail of our data security measures
When we process your data we will have already carefully assessed the lawful justification for doing so, the parameters in which the data is processed, the length of time the data is held for, the secure storage of your data and undertaken impact assessments to ensure your rights are delivered.
Winchester Student Union operates a Data Protection Policy. All employees and volunteers handling data are required to undertake data protection training and third parties handling data are required to provide a contract which meets the requirements of the Information Commissioner's Office.
Winchester Student Union uses the University of Winchester Information systems to store and process all information. The University of Winchester keeps these systems safe and secure in line with industry best practice, you can access their policies here. Winchester Student Union and the University of Winchester have a legal data sharing agreement which covers all information shared.
Winchester Student Union uses One Voice Digital as our website and membership system provider. One Voice Digital keeps these systems safe and secure in line with industry best practice. Winchester Student Union and One Voice Digital have a legal data sharing agreement which covers all information shared.
Winchester Student Union uses Online Surveys and Typeform to collect and process information through online forms. The type of data these forms collect will vary depending on the purpose however the data is kept securely on the University of Winchester servers and we have a legal data sharing agreement which covers this system.
Winchester Student Union does not store any sensitive card data on our systems following online transactions. We use payment processor contracted through our website provider One Voice Digital to handle these matters. Payments taken in store are handled through worldpay.
8. Your rights
The General Data Protection Regulations sets out the following rights for individuals
8.a The right to be informed
This Student Data Privacy Policy sets out what data we collect and how we process it. At the point of collection, we will direct you to this document and inform you of why we are collecting data.
8.b The right of access
You have a right to ask for a copy of the information we hold about you, you can do this by contacting us on Student.union@winchester.ac.uk . If you want to access your information the Information Commissioner’s Office can provide you with guidance on your rights and on making this request. Subject to the complexity of your request Winchester Student Union has 1 month to respond and will not normally levy any charges. As a minimum you should contact us with your name, address, telephone number, any information we might know you by (previous names, student number etc.) and a detailed description of the information you would like (including the topic it is relating to including systems, times and dates). If we request clarification from you to identify the data you are requesting any delays in responding may impact on the response period, and in complex cases we have the right to extend this by a further 2 months, however we will always do our best to respond as soon as possible.
We may also request further information, including identification and verification to ensure you are who you say you are before we give you your information.
Where requests are manifestly unfounded or excessive we will either charge a fee taking into account he administrative costs or refuse to respond.
8.c The right to rectification
If your data is inaccurate or incomplete and you have not been able to rectify it with the area of Winchester Student Union responsible, or you don’t know who to contact to rectify this information please contact Student.union@winchester.ac.uk . In most cases we will rectify your data within 1 month or respond to justify why this cannot be done.
8.d The right to erasure
If you would like us to erase all data we hold on you then you must Opt out of Winchester Student Union by contacting the University of Winchester who will remove your data from our central membership record. If you believe we hold other data you can request this is erased by contacting us on Student.union@winchester.ac.uk. This right of erasure does not cover data which is required to be kept by law, this may include for example accident reports, HR records, finance records.
8.e The right to restrict processing
You have a right to ask us to stop processing your personal data, and if it’s not necessary for the purpose you provided it to us for (e.g. processing your membership or registering you for an event) we will do so. If you want to opt-out of all communications and all data processing you will be required to opting out of Winchester Student Union, this will limit your access to activities and services. You can do this by writing to the University of Winchester who will remove your data from our systems. Contact us on Student.union@winchester.ac.uk if you have any concerns.
8.f The right to data portability
We work with our suppliers to ensure any data you request from us will be in an easily readable electronic format.
8.g The right to object
If you would like to object about any of our data processing please contact us on Student.union@winchester.ac.uk
8.h Rights in relation to automated decision making and profiling
We only use profiling as detailed above in section 5, we do not use profiling to make any automated decisions.
9. Our data protection officer?
Winchester Student Union's Data Protection Officer is currently Andrew Hodgson and can be contacted on Student.union@winchester.ac.uk
10. Communicating changes to this statement
We may change this Privacy Statement from time to time in line with new or updated policies, procedures or legislation. If we make any significant changes in the way we treat your personal information we will make this clear on our website or by contacting you directly.
If you have any questions, comments or suggestions, please let us know by contacting:
student.union@winchester.ac.uk
By law, you have a number of rights as a data subject, such as the, right to be informed, the right to access information held about you, the right to rectification on any inaccurate data that we hold about you. You have the right to request that we erase personal data about you that we hold (although this is not an absolute right). You have the right to request that we restrict processing of personal data about you that we hold in certain circumstances. You have the right to object to processing of personal data about you on grounds relating to your particular situation (also again this right is not absolute). If you are unhappy or wish to complain about how your information is used, you should contact a member of staff in the first instance to resolve your issue.
If you are still not satisfied, you can complain to the Information Commissioner’s Office.
Winchester Student Union's Data Protection Officer is currently Andrew Hodgson and can be contacted on Student.union@winchester.ac.uk
