The Education Act 1994 sets out the requirements for the University to have a Students’ Union. In order for us to provide this service we receive certain data as per Schedule 2 part 6 of the Data Protection Act 1998 (“legitimate interests”).
Knowing basic information about our members enables us to communicate key messages, allows for fair and transparent elections and additional services to be delivered which support the student experience.
As a student here, you are automatically a member of The SU. When you complete Registration Online, we are sent the following information which at the same time activates your account on thesubath.com (accessed using your Single Sign On):
- Student ID
- Title
- First name
- Middle names
- Surname
- Preferred name
- Date of birth
- University email address
- Mobile phone number (provided on UCAS application)
- Home address (provided on UCAS application)
- Faculty
- Department
- Course name
- Course code
- Course end date (year only)
- Year of study
- UG/PGT/Doctoral
- Home, EU, Overseas student
- Mode of study (full time/part time)
- Nationality and country of domicile
- On placement y/n
- Gender (as defined on SAMIS)
- SAMIS student status (Current student, suspended etc)
- Expected end date
This data is stored securely on UK servers managed by our service provider MSL. They provide the applications we use to manage our membership data and website content.
Student records are kept in full for three years after the end of your final year of study (year end is 31 July). At this point your record is anonymised so that we still have the ability to look back on engagement statistics but without knowing any personal details. After three further years, this anonymised record is permanently deleted.
When registering with the Univesity, students can choose for their information not to be shared with The SU.
Where else is your data processed
Most of our data processing takes place on the MSL system alongside University-managed IT services. In some situations we use other third party applications and systems:
Often when we speak to a student about a problem they are having, we raise a case file on a third party system called AdvicePro. This is hosted on UK servers and the specific data we add can only be accessed by members of our Advice and Support Centre.
We have chosen AdvicePro because it is designed for this very purpose and keeps case note data completely separate from University-managed systems. See the AdvicePro GDPR statement.
Storing case notes helps keep track of complex issues a student may be facing, allowing us to offer the best possible support.
We delete the case notes and anonymise any remaining information six years after a student leaves the University. This is the recommended time services like ours keep case note data, in case a compensation claim is made. We keep basic anonymised information about each case so that we can still report on trends and changes in the types of problem our students are facing.
Our lawful basis for processing data on AdvicePro:
Legitimate Interests
So that our service is best able to support our students’ wellbeing needs
So that a record of the advice given is recorded for insurance purposes
Special category data
As a Students' Union we are able to work with the sensitive data of our members if we believe it is in their interests. The lawful basis we use is part (d) of Article 9(2).
Note that unless there is a lawful basis for doing so, we will never share the information you give us without your explicit consent, which we will discuss and agree with you at the time.
Our licenced premises are covered by a CCTV network which is part of the wider University network. We follow University policy on its use:
www.bath.ac.uk/corporate-information/cctv-code-of-practice/
We currently use a Google Form to collect details about your event but will update to an application on University-managed servers in the near future.
The form asks you for:
- Name
- Committee Position
- Email
- Phone
Our lawful basis for processing:
Consent
The personal data is added directly by the individual, and by doing so is consenting to the data being processed for the purposes described.
JISC Online Surveys is a web platform that enables us to build and deliver more complex data-capture surveys with a suite of analytical tools built in. They are the Data Processor for our surveys created through this platform.
All surveys produced by The SU using this tool will have a data statement relating to the use, access to and storage of your data in relation to that survey.
Please see JISC Online Surveys' Trust Centre
We show signs at our events to indicate that filming or photography is taking place, giving you the chance to avoid the cameras or indicate to those recording footage that you do not wish to be included.
Sometimes images will be shared on social media or on our website, if you see an image that you wish us to remove please contact sumarketing@bath.ac.uk with as much information as possible to help us to locate the image.
We will seek explicit consent for certain types of photo if they are to be used in any promotional material.
To facilitate reimbursements when they are owed, we will ask you to complete a yellow form for our Finance Team, including:
- Name
- Bank account
- Sortcode
- University username
- Sometimes home address
This paperwork is kept securely and the details are added to our Exchequor system (hosted on University servers) in order to initiate a transfer of the money you have requested.
Records are kept for up to seven years for legal compliance.
Our lawful basis for processing your data on Exchequor is:
Legitimate Interests
Processing your data through this electronic system is the only way for us to keep appropriate accounting records for HMRC.
We use Microsoft Forms to gather data, and that data is stored on UK-hosted Microsoft servers under the University's IT Policy, and deleted in line with consent mechanisms outlined at the time of gathering.
Certain details are then uploaded manually to the Transport System which is hosted on a University-managed server.
Any details provided in relation to driving a private vehicle are stored on University-managed servers and deleted when no longer required.
Our lawful basis for processing:
Consent
Any data provided to the Transport Office is done so through online forms with consent mechanisms or via direct interaction with our staff who explain to individuals why they are requesting this information.
All data capture related to Zoho forms (Awards, Event planner, Product Forms etc) are created and manged by SU and Universiy staff members ONLY (All of which have completed Data Handler Training provided by the University of Bath). The information is never accessed by third-parties outside the University and stored securely by Zoho.
Our lawful basis for processing:
Legitimate Interests (Awards)
Any information added about another individual is done so by their peers in order for them to be nominated for an award.
Consent (Awards)
Any data about a nominee (including Special Category Data) is uploaded by that individual directly to Zoho Forms and by doing so is consenting to the data being processed for the purposes described.
Email communications
As a member of The SU you will occasionally receive emails from us that are important and relevant to your time as a student at the University of Bath. They include news about major campus events, information about the support that is available to you, opportunities for you to speak-out about your experiences, and more. Relevant promotional offers and opportunities may also be included within these emails.
Many of our student groups are sponsored by local or national businesses which offer benefits to the group and help keep membership costs down. Communications from the groups you join may contain promotional material from your group’s sponsors, including discounts and opportunities.
So you know, your details will never be shared with these companies.
You can alter which emails you receive on the Contact Options page.
If you would like any more information please contact our Website and Digital Manager at suweb@bath.ac.uk