Privacy Statement
INTRODUCTION
Anglia Ruskin Students’ Union is strongly committed to protecting personal data. This Privacy Statement describes why and how we collect and use personal data and provides information about an individuals’ rights. It applies to personal data provided to us, whether by individuals themselves or by others. We may use personal data provided to us for any of the purposes described in this privacy statement or as is otherwise specified at the point it is collected.
In this Privacy Statement “Anglia Ruskin Students’ Union” (and “we”, “us”, or “our”) refers to the company limited by guarantee registered in England and Wales under company number 08064796 with its registered office at Helmore Building, East Road, Cambridge, CB1 1PT and the charity registered in England and Wales under charity number 1148574, that you:
- have, or wish to have, a role or relationship with; and/or
- already contract with, or that you want to contract with, for the purposes of providing or receiving services; and/or
- are applying to in response to a role or position which they have advertised.
Personal data is any information relating to an identified or identifiable living person. When “you” or “your” are used in this Privacy Statement, we are referring to the individual who is the subject of the personal data. Anglia Ruskin Students’ Union processes personal data for a variety of reasons, and the means of collection, lawful basis of processing, use, disclosure, and retention periods for each purpose may differ.
By providing us with your personal data and using our services, you agree to the collection and use of this information in accordance with the purposes set out in this Privacy Statement or as is otherwise explained to you.
This website is not intended for children and we do not knowingly collect data relating to children.
CHANGES TO THIS PRIVACY STATEMENT
We recognise that transparency is an ongoing responsibility, so we will keep this privacy statement under regular review.
This privacy statement was last updated on 25 May 2018.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
DATA CONTROLLER AND CONTACT INFORMATION
We are generally controllers for the personal data we process, however, we may provide some services as a processor. If you have any questions about this privacy statement or how and why we process personal data, please contact us at:
Email: privacy@angliastudent.com
INDIVIDUALS’ RIGHTS AND HOW TO EXERCISE THEM
Individuals have certain rights over their personal data and controllers are responsible for fulfilling these rights.
Individuals’ rights may include the right of access to personal data, to rectification of personal data, to erasure of personal data / right to be forgotten, to restrict processing of personal data, to object to processing of personal data, to data portability, the right to withdraw consent at any time (where processing is based on consent) and the right to lodge a complaint with a supervisory authority.
Please see further information about these rights, when they are available, and how to exercise them below.
YOUR RIGHT OF ACCESS TO PERSONAL DATA
You have the right to obtain confirmation as to whether we process personal data about you, receive a copy of your personal data held by us as a controller and obtain certain other information about how and why we process your personal data (similar to the information provided in this privacy statement). If you wish to exercise this right, please email us at privacy@angliastudent.com.
We aim to respond to any requests for information promptly, and in any event within the legally required time limits. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
YOUR RIGHT TO RECTIFICATION / AMENDMENT OF PERSONAL DATA
You have the right to request for your personal data to be amended or rectified where it is inaccurate (for example, if you change your name or address) and to have incomplete personal data completed. To update personal data submitted to us, you may email us at privacy@angliastudent.com.
When practically possible, once we are informed that any personal data processed by us is no longer accurate, we will make updates as appropriate based on your updated information.
YOUR RIGHT TO ERASURE / RIGHT TO BE FORGOTTEN
You have the right to obtain deletion of your personal data in the following cases:
- the personal data are no longer necessary in relation to the purposes for which they were collected and processed;
- our legal grounds for processing is consent, you withdraw consent and we have no other lawful basis for the processing;
- our legal grounds for processing is that the processing is necessary for legitimate interests pursued by us or a third party, you object to our processing and we do not have overriding legitimate grounds;
- you object to our processing for direct marketing purposes;
- your personal data have been unlawfully processed; or
- your personal data must be erased to comply with a legal obligation to which we are subject.
To request deletion of your personal data, please email us at privacy@angliastudent.com.
YOUR RIGHT TO RESTRICT PROCESSING
You have the right to restrict our processing of your personal data in the following cases:
- for a period enabling us to verify the accuracy of your personal data where you have contested the accuracy of the personal data;
- your personal data have been unlawfully processed and you request restriction of processing instead of deletion;
- your personal data are no longer necessary in relation to the purposes for which they were collected and processed but the personal data are required by you to establish, exercise or defend legal claims; or
- for a period enabling us to verify whether the legitimate grounds relied on by us override your interests where you have objected to processing based on it being necessary for the pursuit of a legitimate interest identified by us.
To restrict our processing of your personal data, please email us at privacy@angliastudent.com.
YOUR RIGHT TO OBJECT TO PROCESSING
You have the right to object to our processing of your personal data in the following cases:
- our legal grounds for processing is that the processing is necessary for a legitimate interest pursued by us or a third party; or
- our processing is for direct marketing purposes.
To object to our processing of your personal data, please email us at privacy@angliastudent.com.
YOUR RIGHT TO DATA PORTABILITY
You have a right to receive your personal data provided by you to us and have the right to send the data to another organisation (or ask us to do so if technically feasible) where our lawful basis for processing the personal data is consent or necessity for the performance of our contract with you and the processing is carried out by automated means.
To exercise your right to data portability, please email us at privacy@angliastudent.com.
YOUR RIGHT TO WITHDRAW CONSENT
Where we process personal data based on consent, individuals have a right to withdraw consent at any time. We do not generally process personal data based on consent (as we can usually rely on another legal basis). Where we rely on your consent for our processing of your personal data, to withdraw your consent please email us at privacy@angliastudent.com or, to stop receiving an email from an Anglia Ruskin Students’ Union marketing list, please click on the unsubscribe link in the relevant email. Please see the relevant “Use of personal data” sections of this privacy statement for further details about our processing of personal data based on consent.
DATA SECURITY
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
COMPLAINTS
We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to privacy@angliastudent.com. We will look into and respond to any complaints we receive.
You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work or the country in which an alleged infringement of data protection law has occurred within the EU. The Information Commissioner's Office (“ICO”) is the UK data protection regulator/supervisory authority. For further information on your rights and how to complain to the ICO, please refer to the ICO website.
CHANGE OF PURPOSE
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above, where this is required or permitted by law.
HOW LONG WILL YOU USE MY PERSONAL DATA FOR?
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
PROSPECTIVE/CURRENT/ALUMNI STUDENTS
WHERE DO WE COLLECT INFORMATION ABOUT YOU FROM?
We collect information about you in the following ways:
- when you become a MEMBER
You automatically become a member of Anglia Ruskin Students’ Union when you register on an Anglia Ruskin University Higher Education Corporation (or “ARU”) accredited course (unless you opt out during registration). ARU shares information about its current members (including information about you and your course) with us periodically. We then use this information as our own record of your membership.
- when you give it to us DIRECTLY
You may give us information about yourself when you enter a competition, promotion or survey, give us some feedback, attend one of our events, use our advice service, join a club or society, undertake research activities, purchase our products or communicate with us in some way. When you give us this information we may cross reference or add it to our register of members.
- when you give it to us INDIRECTLY
On condition that you have given your consent for an independent organisation to share your details with us, we may receive information about you from them (check each organisation’s privacy notice if you want to know more about how and why they process your information). Such organisations could be acting on behalf of ARU, or may be an event partner, or our own trading company.
- when you give permission to OTHER ORGANISATIONS to share it
We may combine information you provide to us with information available from external sources in order to gain a better understanding of our members to improve our communication methods, products and services. This information may come from social media or may be otherwise publicly available (such as the electoral roll or Companies House).
- when you use automated technologies or interactions
As you interact with our website, we may automatically collect information about your equipment, browsing actions and patterns. We collect this personal data by using cookies, and other similar technologies. Please see our Cookies Statement for further details.
USE OF INFORMATION ABOUT YOU
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- where you have given us your consent to do so;
- where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; and
- where we need to comply with a legal or regulatory obligation.
We collect and use contact details about you in order to manage and maintain our relationship with you. Given the diversity of the services we provide, we process various categories of personal data, including personal details (e.g. name, age/date of birth, gender, marital status, country of residence) and contact details (e.g. email address, contact number, postal address). In certain circumstances, we may process special categories of personal data which involve us processing government identification documents that may contain biometric data or data revealing racial or ethnic origin.
PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
|
Purpose/Activity
|
Lawful basis for processing including basis of legitimate interest
|
|
To register you as a new student member of Anglia Ruskin Students’ Union and to enable you to make use of the products and services we provide
|
- performance of a contract with you (when you registered for an ARU accredited course you entered into a contract of study with ARU to provide that course to you. The provision of that course obliges ARU to provide you with membership of Anglia Ruskin Students’ Union in accordance with section 22 of the 1994 Education Act (unless you have opted out of such membership)
- where we process special categories of personal data, we rely on a relevant public interest condition or consent.
|
|
To manage our relationship with you which will include:
(a) notifying you about changes to our terms or privacy policy
(b) asking you to leave a review or take a survey
|
- performance of a contract with you
- necessary to comply with a legal obligation
- necessary for our legitimate interests (to keep our records updated and to study how members use our products/services)
|
|
To enable you to partake in a prize draw, competition or complete a survey
|
- performance of a contract with you
- necessary for our legitimate interests (to study how members use our services, to develop them and help to grow our services)
|
|
To administer and protect our organisation and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)
|
- necessary for our legitimate interests (for running our organisation, provision of administration and IT services, network security, to prevent fraud and in the context of an organisational restructure)
- necessary to comply with a legal obligation
|
|
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you
|
necessary for our legitimate interests (to study how members use our products/services, to develop them, to grow our services and to inform our marketing strategy)
|
|
To use data analytics to improve our website, products/services, marketing, member relationships and experiences
|
Necessary for our legitimate interests (to define types of members for our products and services, to keep our website updated and relevant, to develop our organisation and to inform our marketing strategy)
|
|
To make suggestions and recommendations to you about goods or services that may be of interest to you
|
Necessary for our legitimate interests (to develop our products/services and grow our organisation)
|
|
To hold and administer elections
|
- necessary to comply with a legal obligation
- necessary for our legitimate interests (in pursuit of an activity that supports or promotes democratic engagement and our legitimate interests to engage with the electorate)
- public interest
|
|
To provide advice services
|
- necessary for our legitimate interests (in pursuit of an activity that supports members with their particular challenges including, for example, academic appeals and/or fitness to practice hearings)
|
|
Administration of Anglia Ruskin Students’ Union clubs, societies and volunteering services
|
- performance of a contract with you
|
|
To administer and enable student representation on ARU’s committees, panels, boards and other representative bodies
|
a) performance of a contract with you
b) necessary to comply with a legal obligation
c) necessary for our legitimate interests (in pursuit of an activity that supports or promotes democratic engagement and our legitimate interest to inform the electorate about what Anglia Ruskin Students’ Union is doing)
|
|
Ticket sales/club and society memberships
|
- performance of a contract with you
- necessary to comply with a legal obligation
|
|
To allow email communication between Anglia Ruskin Students’ Union and its members
|
a) performance of a contract with you
b) necessary to comply with a legal obligation
c) necessary for our legitimate interests (in pursuit of an activity that supports or promotes democratic engagement and our legitimate interest to inform the electorate about what Anglia Ruskin Students’ Union is doing)
|
|
To allow email communication between participants in Anglia Ruskin Students’ Union clubs and societies and other relevant individuals (which may include volunteers)
|
a) performance of a contract with you
b) necessary to comply with a legal obligation
c) necessary for our legitimate interests (in pursuit of an activity that supports or promotes democratic engagement)
|
|
To verify the status of current students (eg. to check whether an individual has changed course, is no longer a student or has changed from a part-time to a full-time course)
|
a) performance of a contract with you
b) necessary to comply with a legal obligation
|
|
For reporting and analysis purposes. We are continually looking for ways to help our members and improve our services. We may use information that we receive in the course of providing services for reporting and analysis purposes to:
- better understand a particular issue;
- provide insights back to our members;
- improve our service delivery and offerings;
- to develop new technologies and offerings; and
- to enable ARU to fulfil its legal obligations and to better understand particular issues.
To the extent that the information that we receive in the course of providing services contains personal data, we will remove the personal data prior to using the information for these purposes.
|
- necessary for our legitimate interests (in pursuit of an activity that supports or promotes democratic engagement, our legitimate interest in de-identifying data to help our members, to improve our organisation, service delivery and offerings and to develop new technologies and offerings, including by performing benchmarking and analysis)
- performance of a contract with you
- public interest
|
|
To process your advertising enquiry with our media partner native
|
Necessary for our legitimate interests (to respond to your enquiry about advertising opportunities)
|
WHO DO WE SHARE INFORMATION ABOUT YOU WITH?
We will only share personal data with others when we are legally permitted to do so. When we share data with others, we put contractual arrangements and security mechanisms in place as appropriate to protect the data and to comply with our data protection, confidentiality and security standards.
We may share information about you with:
- Anglia Ruskin Students’ Union employees and volunteers
Our employees and volunteers may need to use information about you in order to provide goods and services to you and for the purposes of administration.
- Third party organisations that provide applications/functionality, data processing, IT services to us, or who manage our media and advertising
We use third parties to support us in providing our services and to help provide, run and manage our internal IT systems. For example, providers of information technology, cloud-based software as a service provider, identity management, website hosting and management, data analysis, data back-up, security and storage services. The servers powering and facilitating that cloud infrastructure are located in secure datacentres around the world, and personal data may be stored in them.
- auditors, insurers and professional advisers
Our auditors are Knox Cropper. We have a number of business insurance policies in place and we may need to share personal data with the insurer, for example, in the event of a claim. We use other professional advisers, for example, law firms, as necessary to establish, exercise or defend our legal rights and obtain advice in connection with the running of our business. Personal data may be shared with these advisers as necessary in connection with the products and services they have been engaged to provide.
- law enforcement or other government and regulatory agencies or to other third parties as required by, and in accordance with, applicable law or regulation
Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, to establish, exercise or defend legal rights. We will only fulfil requests for personal data where we are permitted to do so in accordance with applicable law or regulation.