Often when we speak to a student about a problem they are having, we raise a case file on a third party system called AdvicePro. This is hosted on UK servers and the specific data we add can only be accessed by members of our Advice and Support Centre.

We have chosen AdvicePro because it is designed for this very purpose and keeps case note data completely separate from University-managed systems. See the AdvicePro GDPR statement.

Storing case notes helps keep track of complex issues a student may be facing, allowing us to offer the best possible support.

We delete the case notes and anonymise any remaining information six years after a student leaves the University. This is the recommended time services like ours keep case note data, in case a compensation claim is made. We keep basic anonymised information about each case so that we can still report on trends and changes in the types of problem our students are facing.

Our lawful basis for processing data on AdvicePro:

Legitimate Interests

So that our service is best able to support our students’ wellbeing needs

So that a record of the advice given is recorded for insurance purposes

Special category data

As a Students' Union we are able to work with the sensitive data of our members if we believe it is in their interests. The lawful basis we use is part (d) of Article 9(2).

Note that unless there is a lawful basis for doing so, we will never share the information you give us without your explicit consent, which we will discuss and agree with you at the time.

We send Alterline some basic details about all our members which includes:

• first name
• department
• username
• encrypted engagement code

These details are used to send personalised emails inviting students to participate in their survey. Throughout the year The SU will receive anonymised summary reports (cross-referenced against our encrypted engagement code) which help us analyse and improve our services and identify the particular issues students at this University are most affected by.

Our lawful basis for doing this:

Legitimate Interests

It is in the interests of all our members that we find ways to analyse and improve our services, through qualitative and quantitative means.

Note that the lawful basis for Alterline to collect and process the information you provide them if you choose to complete the survey is Consent. You can find out more on their website: www.alterline.co.uk/gdpr/

We use an online form tool called Zoho Creator to capture nominations for the Blues Awards. This tool is used because it offers the most simplified and user-friendly version of a complex process.

No data is added automatically, everything is input by a nominator or nominee.

Nominator or if nominating yourself:

• First name
• Surname
• Email
• UG/PGT/Doctoral
• Department
• Course
• Year of study
• Sport played for
• Photo of person
• Reasons for nomination
• Injury absence information

Person you are nominating:

• First name
• Surname
• Email
• UG/PGT/Doctoral
• Department
• Course
• Year of study
• Sport played for
• Reason for nomination
• Photo of person

This information is downloaded to University servers and deleted from Zoho Creator as soon as nominations close.

Our lawful basis for processing:

Legitimate Interests

Any information added about another individual is done so by their peers in order for them to be nominated for an award.

Consent

Any data about a nominee (including Special Category Data) is uploaded by that individual directly to Zoho Creator, and by doing so is consenting to the data being processed for the purposes described.

Our licenced premises (The Plug and The Tub) are covered by a CCTV network which is part of the wider University network. We follow University policy on its use:

www.bath.ac.uk/corporate-information/cctv-code-of-practice/

We currently use a Google Form to collect details about your event but will update to an application on University-managed servers in the near future.

The form asks you for:

• Name
• Committee Position
• Email
• Phone

Our lawful basis for processing:

Consent

The personal data is added directly by the individual, and by doing so is consenting to the data being processed for the purposes described.

Online Surveys (formerly Bristol Online Surveys) is a web platform that enables us to build and deliver more complex data-capture surveys with a suite of analytical tools built in.

We remove any data you submit to our surveys from this system when we have finished analysing responses. Please see the Online Surveys Security Statement.

We show signs at our events to indicate that filming or photography is taking place, giving you the chance to avoid the cameras or indicate to those recording footage that you do not wish to be included.

Sometimes images will be shared on social media or on our website, if you see an image that you wish us to remove please contact the Data Co-ordinator at suweb@bath.ac.uk

We will seek explicit consent for certain types of photo if they are to be used in any promotional material.

More detail can be found in our Data Protection Policy

To facilitate reimbursements when they are owed, we will ask you to complete a yellow form for ouyr Finance Team, including:

• Name
• Bank account
• Sortcode
• Sometimes username
• Sometimes home address

This paperwork is kept securely and the details are added to our Exchequor system (hosted on University servers) in order to initiate a transfer of the money you have requested.

Records are kept for up to seven years for legal compliance.

Our lawful basis for processing your data on Exchequor is:

Legitimate Interests

Processing your data through this electronic system is the only way for us to keep appropriate accounting records for HMRC.

We use a form on www.thesubath.com to collect various details about an individual, including insurance and driving history and any medical details that are asked in relation to holding a licence. These details are downloaded to University-managed servers and then deleted from MSL servers.

Certain details are then uploaded manually to the Transport System which is hosted on a University-managed server.

Any details provided in relation to driving a private vehicle are stored on University-managed servers and deleted when no longer required.

Our lawful basis for processing:

Consent

Any data provided to the Transport Office is done so through online forms with consent mechanisms or via direct interaction with our staff who explain to individuals why they are requesting this information.

To improve the quality and content of our communications we use Zoho Campaigns to compose and send some of our core messages via email. The data we add to the Zoho servers:

• First name
• Surname
• University email address

Our lawful basis for processing:

Legitimate Interests

It is in the interests of all our members that we use communications tools that are fit for purpose.