The Education Act 1994 sets out the requirements for the University to have a Students’ Union. In order for us to provide this service we receive certain data as per Schedule 2 part 6 of the Data Protection Act 1998 (“legitimate interests”). Knowing basic information about our members enables us to communicate key messages, allows for fair and transparent elections and additional services to be delivered which support the student experience.

As a student here, you are automatically a member of The SU. When you complete Registration Online, we are sent the following information which at the same time activates your account on thesubath.com (accessed using your Single Sign On):

  • Student ID
  • Title
  • First name
  • Middle names
  • Surname
  • Preferred name
  • Date of birth
  • University email address
  • Mobile phone number (provided on UCAS application)
  • Home address (provided on UCAS application)
  • Faculty
  • Department
  • Course name
  • Course code
  • Course end date (year only)
  • Year of study
  • UG/PGT/Doctoral
  • Home, EU, Overseas student
  • Mode of study
  • On placement y/n
  • Gender (as defined on SAMIS)
  • SAMIS student status (Current student, suspended etc)

This data is stored on UK servers managed by our service provider MSL. They provide the applications we use to manage our membership data and website content.

Student records are kept in full for three years after the end of your final year of study (year end is 31 July). At this point your record is anonymised so that we still have the ability to look back on engagement statistics but without knowing any personal details.  After three further years, this anonymised record is permanently deleted.

Where else is your data processed

Most of our data processing takes place on the MSL system alongside University-managed IT services. In some situations we use other third party applications and systems:

Advice and Support Centre

Often when we speak to a student about a problem they are having, we raise a case file on a third party system called AdvicePro. This is hosted on UK servers and the specific data we add can only be accessed by members of our Advice and Support Centre.

We have chosen AdvicePro because it is designed for this very purpose and keeps case note data completely separate from University-managed systems. See the AdvicePro GDPR statement.

Storing case notes helps keep track of complex issues a student may be facing, allowing us to offer the best possible support.

We delete the case notes and anonymise any remaining information six years after a student leaves the University. This is the recommended time services like ours keep case note data, in case a compensation claim is made. We keep basic anonymised information about each case so that we can still report on trends and changes in the types of problem our students are facing.

Our lawful basis for processing data on AdvicePro:

Legitimate Interests

So that our service is best able to support our students’ wellbeing needs

So that a record of the advice given is recorded for insurance purposes

Special category data

As a Students' Union we are able to work with the sensitive data of our members if we believe it is in their interests. The lawful basis we use is part (d) of Article 9(2).

Note that unless there is a lawful basis for doing so, we will never share the information you give us without your explicit consent, which we will discuss and agree with you at the time.

Alterline

We send Alterline some basic details about all our members which includes:

  • first name
  • department
  • username
  • encrypted engagement code

These details are used to send personalised emails inviting students to participate in their survey. Throughout the year The SU will receive anonymised summary reports (cross-referenced against our encrypted engagement code) which help us analyse and improve our services and identify the particular issues students at this University are most affected by.

Our lawful basis for doing this:

Legitimate Interest

It is in the interests of all our members that we find ways to analyse and improve our services, through qualitative and quantitative means.

Note that the lawful basis for Alterline to collect and process the information you provide them if you choose to complete the survey is Consent. You can find out more on their website: www.alterline.co.uk/gdpr/

Blues Award nominations

We use an online form tool called Zoho Creator to capture nominations for the Blues Awards. This tool is used because it offers the most simplified and user-friendly version of a complex process.

No data is added automatically, everything is input by a nominator or nominee.

Nominator or if nominating yourself:

  • First name
  • Surname
  • Email
  • UG/PGT/Doctoral
  • Department
  • Course
  • Year of study
  • Sport played for
  • Photo of person
  • Reasons for nomination
  • Injury absence information

Person you are nominating:

  • First name
  • Surname
  • Email
  • UG/PGT/Doctoral
  • Department
  • Course
  • Year of study
  • Sport played for
  • Reason for nomination
  • Photo of person

This information is downloaded to University servers and deleted from Zoho Creator as soon as nominations close.

Our lawful basis for processing:

Legitimate Interest

Any information added about another individual is done so by their peers in order for them to be nominated for an award.

Consent

Any data about a nominee (including Special Category Data) is uploaded by that individual directly to Zoho Creator, and by doing so is consenting to the data being processed for the purposes described.

CCTV in our bars

Our licenced premises (The Plug and The Tub) are covered by a CCTV network which is part of the wider University network. We follow University policy on its use:

www.bath.ac.uk/corporate-information/cctv-code-of-practice/

Event plan submissions

We currently use a Google Form to collect details about your event but will update to an application on University-managed servers in the near future.

The form asks you for:

  • Name
  • Committee Position
  • Email
  • Phone

Our lawful basis for processing:

Consent

The personal data is added directly by the individual, and by doing so is consenting to the data being processed for the purposes described.

Online Surveys (formerly BOS)

Online Surveys (formerly Bristol Online Surveys) is a web platform that enables us to build and deliver more complex data-capture surveys with a suite of analytical tools built in.

We remove any data you submit to our surveys from this system when we have finished analysing responses. Please see the Online Surveys Security Statement.

Photography and filming at our events

We show signs at our events to indicate that filming or photography is taking place, giving you the chance to avoid the cameras or indicate to those recording footage that you do not wish to be included.

Sometimes images will be shared on social media or on our website, if you see an image that you wish us to remove please contact the Data Co-ordinator at suweb@bath.ac.uk

We will seek explicit consent for certain types of photo if they are to be used in any promotional material.

More detail can be found in our Data Protection Policy

Student group reimbursements

To facilitate reimbursements when they are owed, we will ask you to complete a yellow form for ouyr Finance Team, including:

  • Name
  • Bank account
  • Sortcode
  • Sometimes username
  • Sometimes home address

This paperwork is kept securely and the details are added to our Exchequor system (hosted on University servers) in order to initiate a transfer of the money you have requested.

Records are kept for up to seven years for legal compliance.

Our lawful basis for processing your data on Exchequor is:

Legitimate Interest

Processing your data through this electronic system is the only way for us to keep appropriate accounting records for HMRC.

Vehicle bookings

We use a form on www.thesubath.com to collect various details about an individual, including insurance and driving history and any medical details that are asked in relation to holding a licence. These details are downloaded to University-managed servers and then deleted from MSL servers.

Certain details are then uploaded manually to the Transport System which is hosted on a University-managed server.

Any details provided in relation to driving a private vehicle are stored on University-managed servers and deleted when no longer required.

Our lawful basis for processing:

Consent

Any data provided to the Transport Office is done so through online forms with consent mechanisms or via direct interaction with our staff who explain to individuals why they are requesting this information.

Email communications

As a member of The SU you will occasionally receive emails from us that are important and relevant to your time as a student at the University of Bath. They include news about major campus events, information about the support that is available to you, opportunities for you to speak-out about your experiences, and more. Relevant promotional offers and opportunities may also be included within these emails.

Many of our student groups are sponsored by local or national businesses which offer benefits to the group and help keep membership costs down. Communications from the groups you join may contain promotional material from your group’s sponsors, including discounts and opportunities. 

So you know, your details will never be shared with these companies.

You can alter which emails you receive on the Contact Options page.

If you would like any more information please contact our Data Co-ordinator at suweb@bath.ac.uk