Skip to main content

Students' Union UCL ( "the Union","we", "our", "us") are committed to protecting and respecting your privacy, whether you are a student, staff member, or other person interacting with Union services.

The Union adheres to UCL's policies on data protection. As part of this, the Union adopts the UCL Information Security Policy and supporting policies including the Data Protection Policy which can be found at https://www.ucl.ac.uk/informationsecurity/policy

This privacy notice sets out how any personal data we collect from you through your electronic and/or paper application to the UCL will be processed by us. This notice also sets out the basis on which any personal data related to your application which is passed to us by individuals and by third parties is collected and processed. Please read the following carefully to understand how we process your personal data.

What is 'personal data'?

'Personal data' means any information which identifies you as an individual. It may include your name but it may also be other information such as your date of birth, nationality and gender which when combined identify you.

The Union's data protection obligations

The Union will use the personal data you provide, as well as personal data for which you have given consent for the Union to receive in order to manage your Union membership, or to enable you to interact with Union services as a non-member.

If you enrol as a student at UCL you also become a member of Students' Union UCL. From the 2018 intake you would have been informed of how we would use your personal data to manage your Union membership as part of enrolment.

In accordance with the Data Protection Act (1998) and the GDPR, and any data protection legislation enacted in the UK (the "Data Protection Legislation") we are a data controller and this means that we are legally responsible for the personal data we collect and hold about you. One of our responsibilities is to tell you about the different ways in which we use your personal data – what information we collect, our legal basis for doing so, why we collect it, where we collect it from and whether and with whom we will share it with. We also need to tell you about your rights in relation to your personal data. In addition to the information in this statement, you may be given further information about the uses of your personal data when you sign up to use specific services and facilities we offer, and in certain situations, you may be asked whether you give your consent to us processing information about you.

In addition to the information in this statement, you may be given further information about the uses of your personal data when you use specific services and facilities offered by the Union.

Information about students

After enrolment we receive the following data from UCL for current students who have not opted out of Union membership:

  • Surname
  • Forename
  • Middle initial
  • Student code
  • Student UPI
  • UCL email address
  • Username
  • Gender
  • Date of birth
  • Course code
  • Student enrolment status
  • Mode of attendance
  • Fee status
  • Course Block
  • Student Course Start
  • Student Course End
  • Department code
  • Faculty code
  • Student contact address, including postcode
  • Term time address code
  • Course Name
  • Hall of Residence
  • Caring Responsibility

As a student, data held on you can be found via the student 'My Profile' page on the Students' Union Website

Information we collect about any kind of users  

We will collect additional Information in order for us to manage your membership, involvement with the Union, or contract of employment which includes:

  • Bank Account Details
  • Next of Kin Details
  • Visa Status
  • Event attendance
  • Membership of Club or Society

The data required will be covered during the on-boarding process and enrolment in a service.

Both your image and voice may be recorded during our attendance at Union events.

Information we receive from other sources

We work closely with third parties including, for example volunteering partner's or event organisers, who may receive information about you from them if you have provided specific consent to this sharing of your personal data in your agreements with those third parties. If you have provided such consent, we may receive and process any of the information from third parties in relation to you.

Purposes for which we process your personal data

We process information we hold about you for the following purposes

  • to facilitate your Union membership

  • to manage your involvement in the democratic process such as standing for election and voting

  • to administer the financial aspects of your relationship with us – ie payroll, reimbursement of payment requests

  • to manage your membership and participation for Student activities and events

  • to manage your interest and involvement in volunteering opportunities facilitated by the Union

  • to manage access to Union systems such as the website

  • to enable effective communications with you in relation to Union activities and updates

  • to support your training, health, safety and welfare requirements including registering and using the Advice service

  • to produce statistics and research for internal and statutory reporting purposes

  • to monitor our responsibilities under equalities legislation

Information we collect about you

We will use this information for the following purposes:

  • to manage your Students' Union Membership; and/or

  • to provide the services you request or initiate with the Union.

Information we receive from other sources

We will combine this information with information you give to us in your application and the information we collect about you. We will use this information and the combined information for the purposes set out above.

Sensitive personal data

Some of the personal data used for the above purposes are classed as being within 'special categories of personal data' under the Data Protection Legislation, for example, information relating to your ethnicity or any disability. This is collected to monitor our equalities responsibilities. Disability information will also be shared with relevant UCL staff in order to provide you with the best possible support for your studies. Access to, and the sharing of, this information is controlled very carefully. You will be given more details about our use of any sensitive personal data when we collect it from you.

Some of this information may also be collected to allow us to manage any ongoing case with the Union advice Service. Details of what is information is collected will be discussed with you during registration with the Advice Service. Further details about how the Advice Service may use your information can be viewed in the separate Advice Service data protection statement. 

Using your Information in accordance with data protection laws

Data Protection Laws require that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a "legal basis" for the processing. We take our responsibilities under Data Protection Laws extremely seriously, including meeting these conditions. The legal bases on which your personal data are collected are explained below.

Consent:  We may ask you to provide us with a special category or sensitive personal data as detailed above which we will agree only to process with your express consent.

Performance of contract: The processing of your personal data may be necessary in relation to the contract we have entered into with you to provide the Unions services to you or because you have asked for something to be done so you can enter into such contract.

Public interest: The processing of your personal data may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Legitimate interests:  The processing of your personal data may be necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or by fundamental rights and freedoms which require protection of personal data. It may be necessary for our legitimate interests to collect your personal data to enable us to manage certain operations of the Union effectively.

As a student, who is my personal information shared with?

As part of a student's Union membership, your personal data may be disclosed to other organisations as required by law, for crime prevention, investigation or detection purposes. Disclosures may also be made by the Union as outlined below:

  • As a student, some of your personal data will be shared with UCL which will be to allow your achievements via the Union to be accredited, for example by inclusion in the Higher Education Achievement Report.
  • As a student staff member, UCL act as Payroll service for the Union and process student staff wages on our behalf. Name, payroll number and bank details are shared with UCL to manage payment of wages.
  • If you undertake a placement or undertake any voluntary activity facilitated by the Union, with a third party organisation or institution in the UK or in another country, personal data relating to you may be shared with the partner organisation/institution for the purposes of administering the placement.

Sensitive personal data relating to your health or a disability will not be shared without your express consent unless required by law or in your vital interests in an emergency situation.

We will not disclose any other personal information about your application to other external enquirers or organisations without your consent unless it is in your vital interests to do so (e.g. in an emergency situation).

Access to your personal information is limited to staff who have a legitimate need to see it for the purpose of carrying out their job at the Union in furtherance of the objectives outlined above.

The information we process may be held on Union Corporate systems some of which may be owned and operated by third parties.  Where we engage with such third parties, we insist upon strict contractual requirements to be adhered to by in order to protect the personal data.

Principles

The Union agrees that Personal Data shall be:

  • processed lawfully, fairly and in a transparent manner in relation to the data subject.
  • collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
  • adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
  • accurate and, where necessary, kept up to date.
  • kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed, in accordance with UCL and Union data retention schedules designed for this purpose;
  • processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures
  • be able to demonstrate compliance with the above principles

Data Retention

Your data will be retained in accordance with the Unions Data Retention Schedule.

After you leave UCL or cease to be a member of the Union, certain parts of your data may be retained as a permanent archival record for research purposes and to confirm your award and period of study.

Your Rights

You have the following rights in relation to your personal data:

Right 1: A right to access personal data held by us about you (please see the section entitled "How can I access my personal information" below).

Right 2: A right to require us to rectify any inaccurate personal data held by us about you.

Right 3: A right to require us to erase personal data held by us about you.  This right will only apply where, for example, we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with Right 6 below).

Right 4: A right to restrict our processing of personal data held by us about you.  This right will only apply where, for example, you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but we require the data for the purposes of dealing with legal claims.

Right 5: A right to receive personal data, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to require us to transfer this personal data to another organisation.

Right 6: A right to object to our processing of personal data held by us about you.

Right 7: A right to withdraw your consent, where we are relying on it to use your personal data.

Right 8: A right to ask us not to use information about you in a way that allows computers to make decisions about you and ask us to stop. 

Requesting Information

As noted above, you have the right to access information held about you. Your right of access can be exercised at any time by contacting us at SU.data-protection@ucl.ac.uk

Keeping Personal data up-to-date

The Data Protection Laws require us to take reasonable steps to ensure that any personal data we process is accurate and up-to-date.

If the data is received from UCL then the student should contact UCL Portico services to update their data.

Students are able to make changes to some personal data that they have supplied during the course of their Union membership. Basic personal details can be updated via the My Profile page on the Union website

How can I access my personal data?

As noted above, you have the right to access information held about you. Details are set out on the University's Data Protection policy https://www.ucl.ac.uk/informationsecurity/policy/public-policy/DataProtection.

You can view basic personal details via the My Profile page on the Union website.

Your right of access can be exercised at any time by contacting us at SU.data-protection@ucl.ac.uk

Changes to this Privacy Notice

Any changes we make to this privacy notice in the future will be posted on this page and, where appropriate, notified to you by e-mail.

Who regulates the use of my personal information?

The Union is registered on the Information Commissioners' Register of Data Controllers.

The Unions registration number is Z2701645 and sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal information. See the Information Commissioners Office website for details http://www.ico.org.uk/what_we_cover/register_of_data_controllers.aspx.

Who do I contact with questions?

The data controller for the purposes of the Data Protection Legislation is the Students Union UCL who have adopted the UCL's Data Protection Policy.

If you have any questions about how your personal data is used, please consult the University's data protection web pages.

If you need further assistance, please contact the Union via SU.data-protection@ucl.ac.uk, or for general data protection queries the University Data Protection Officer via data-protection@ucl.ac.uk or Data Protection Officer, UCL Gower Street, London WC1E 6BT

UCL Staff Privacy Policy

The Students Union UCL complies with the UCL Staff Policy Notice.