University of Bradford Students’ Union Data Protection and Privacy Policy
The University of Bradford Students’ Union (UBU) is committed to protecting and respecting your privacy, whether you are a student, staff member, or other person engaging with UBU services.
UBU adheres to the University of Bradford’s policies on data protection. As part of this, UBU adopts the UBU Information Security Policy and supporting policies including the Data Protection Policy which can be found at https://www.bradford.ac.uk/about/legal-and-governance/policies-statements/data-protection-policy/.
This privacy notice sets out how any personal data we collect from you through your electronic and/or paper application to UBU will be processed by us. This notice also sets out the basis on which any personal data related to your application which is passed to us by individuals and by third parties is collected and processed. Please read the following carefully to understand how we collect, process and share your personal data.
What are UBU’s data protection obligations?
Processing of personal data is controlled by the UK General Data Protection Regulations (UK GDPR) and the Data Protection Act 2018 (DPA) governs the use of information about people (personal data), with UBU acting as the Data Controller. This means that we are legally responsible for the personal data we collect and hold about you. One of our responsibilities is to tell you about the different ways in which we use your personal data – what information we collect, our legal basis for doing so, why we collect it, where we collect it from and whether and with whom we will share it with. We also need to tell you about your rights in relation to your personal data.
UBU will use the personal data you provide, as well as personal data for which you have given consent for UBU to receive, in order to manage your UBU membership, or to enable you to interact with UBU services. In addition to the information in this statement, you may be given further information about the uses of your personal data when you sign up to use specific services and facilities we offer, and in certain situations, you may be asked whether you give your consent to us processing information about you.
UBU agrees that Personal Data shall be:
- Processed lawfully, fairly and in a transparent manner in relation to the data subject.
- Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
- Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
- Accurate and, where necessary, kept up to date.
- Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed, in accordance with UBU and University data retention schedules designed for this purpose;
- Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures
- Be able to demonstrate compliance with the above principles
On what basis does UBU collect and process personal data?
Data Protection Laws require that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a "legal basis" for the processing. We take our responsibilities under Data Protection Laws extremely seriously, including meeting these conditions. The legal bases on which your personal data are collected are explained below.
Consent: We may ask you to provide us with a special category or sensitive personal data as detailed in this document, which we will agree only to process with your express consent.
Legitimate interests: The processing of your personal data may be necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or by fundamental rights and freedoms which require protection of personal data. It may be necessary for our legitimate interests to collect your personal data to enable us to manage certain operations and services of UBU effectively.
Performance of contract: The processing of your personal data may be necessary in relation to the contract we have entered into with you to provide UBU’ services to you or because you have asked for something to be done so you can enter into such contract.
What personal data does UBU hold?
'Personal data' means any information which identifies you as an individual. It may include your name but it may also be other information such as your date of birth, nationality and gender which when combined identify you.
After enrolment we receive the following data from UoB for current students who have not opted out of UBU membership:
- Name
- Student number
- UoB email address
- Username
- Gender
- Date of birth
- Course code
- Student enrolment status
- Mode of attendance
- Fee status
- Course Block
- Student Course Start
- Student Course End
- Department code
- Faculty code
- Student contact address, including postcode
- Term time address code
- Course Name
Depending on your relationship to UBU, we will collect additional information for us to manage membership, involvement with UBU, or contract of employment which could include bank account details; next of kin details; visa status; and event attendance.
The data required will be covered during the on-boarding process and enrolment in a service.
Some of the personal data used for the above purposes are classed as being within 'special categories of personal data' under the Data Protection Legislation, for example, information relating to your ethnicity or any disability. This is collected to monitor our equalities responsibilities.
Some of this information may also be collected to allow us to manage any ongoing case with the UBU advice Service. Details of what is information is collected will be discussed with you during registration with the Advice Service. Further details about how the Advice Service may use your information can be viewed in the separate Advice Service data protection statement.
How does UBU collect data?
The bulk of student data is received directly and securely from UoB, and is provided at the time of enrolment unless you have opted out for this data to be shared.
We work closely with other third parties including, for example volunteering partner's or event organisers, who may receive information about you from them if you have provided specific consent to this sharing of your personal data in your agreements with those third parties. If you have provided such consent, we may receive and process any of the information from third parties in relation to you.
Both your image and voice may be recorded during our attendance at UBU events.
How does UBU use and process personal data?
We process information we hold about you for the following purposes
- To facilitate and manage your UBU membership
- To provide the services you request or initiate with UBU.
- To manage your involvement in the democratic process such as standing for election and voting
- To administer the financial aspects of your relationship with us – ie payroll, reimbursement of payment requests
- To manage your membership and participation for Student Activities and Events
- To manage your interest and involvement in volunteering opportunities facilitated by the UBU.
- To manage access to UBU systems such as the website
- To enable effective communications with you in relation to UBU activities and updates
- To support your training, health, safety and welfare requirements including registering and using the Advice service
- To produce statistics and research for internal and statutory reporting purposes
- To monitor our responsibilities under equalities legislation.
Access to your personal information is limited to staff who have a legitimate need to see it for the purpose of carrying out their job at the UBU in furtherance of the objectives outlined above.
When and why is my personal information shared with others?
In all cases, UBU endeavours to share the least possible amount of personal data with other agencies. However, in some cases the services of UBU require data sharing, and/or you may otherwise consent to more data being shared for other purposes.
As part of a student's UBU membership, your personal data may be disclosed to other organisations as required by law, for crime prevention, investigation or detection purposes. We may also share it in emergency situations where it is in your vital interests for us to do so.
We also use third party services ("processors") to facilitate our operations. Where we engage with such third parties, we insist upon strict contractual requirements to be adhered to by in order to protect the personal data. Current processors currently include:
Data may be shared or disclosed by the UBU in other circumstances when needed. In these cases, we will share only the minimum required for the purpose. Such situations may include:
- HEAR: As a student, some of your personal data will be shared with UoB which will be to allow your achievements via the UBU to be accredited, for example by inclusion in the Higher Education Achievement Report.
- Volunteering: If you undertake any voluntary activity facilitated by the UBU, with a third party organisation or institution in the UK or in another country, personal data relating to you may be shared with the partner organisation/institution for the purposes of administering the placement.
- Disciplinaries: in accordance with our Code of Conduct Policy we may share the results of student disciplinaries with UBU staff.
Sensitive personal data relating to your health or a disability will not be shared without your express consent unless required by law or in your vital interests in an emergency situation.
How long does UBU keep personal data?
Your data will be retained in accordance with the UBU’s Data Retention Schedule.
After you leave UBU or cease to be a member of UBU, certain parts of your data may be retained as a permanent archival record for research purposes and to confirm your award and period of study. At this point, all identifiable fields will be 'pseudonymised' to ensure it cannot be identified as you.
How do I access my data?
You have the right to access information held about you. For UBU, details are set out on the University's Data Protection policy: https://www.bradford.ac.uk/about/legal-and-governance/policies-statements/data-protection-policy/
Your right of access can also be exercised at any time by contacting us at ubu@bradford.ac.uk
How do I change or delete the data UBU holds about me?
The Data Protection Laws require us to take reasonable steps to ensure that any personal data we process is accurate and up-to-date.
Students are able to make changes to some personal data that they have supplied during the course of their UBU membership. Basic personal details can be when logged into the UBU website.
For other data changes or deletions, contact ubu@bradford.ac.uk
Who regulates the use of my personal information?
UBU is registered on the Information Commissioners' Register of Data Controllers.
The UBU's registration number is ZA781603 and sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal information. See the Information Commissioners Office website for details https://ico.org.uk/ESDWebPages/Entry/ZA781603
Who do I contact with questions?
If you need further assistance, please contact UBU via ubu@bradford.ac.uk For general UBU data protection queries contact the UBU’s Data Protection Officer, Aleem Bashir, via m.a.p.bashir2@bradford.ac.uk or by visiting the University's data protection web pages.
How are staff members covered?
UBU complies with the UBU Staff Privacy Notice. Note we also may share some information, e.g. about roles and structure, with data processors to manage staff surveys and analysis on our behalf.