Choose who represents your academic interests this year Start Voting

Jump to section

Students' Union UCL is committed to protecting and respecting your privacy, whether you are a student, staff member, or other person engaging with Union services.

The Union adheres to UCL's policies on data protection. As part of this, the Union adopts the UCL Information Security Policy and supporting policies including the Data Protection Policy which can be found at https://www.ucl.ac.uk/informationsecurity/policy.

This privacy notice sets out how any personal data we collect from you through your electronic and/or paper application to UCL will be processed by us. This notice also sets out the basis on which any personal data related to your application which is passed to us by individuals and by third parties is collected and processed. Please read the following carefully to understand how we collect, process and share your personal data. 

What are the Union's data protection obligations?

In accordance with the Data Protection Act (1998) and the GDPR, and any data protection legislation enacted in the UK (the "Data Protection Legislation") we are a data controller and this means that we are legally responsible for the personal data we collect and hold about you. One of our responsibilities is to tell you about the different ways in which we use your personal data – what information we collect, our legal basis for doing so, why we collect it, from where we collect it, and whether and with whom we will share it. We also need to tell you about your rights in relation to your personal data.

The Union will use the personal data you provide, as well as personal data for which you have given consent for the Union to receive in order to manage your Union membership, or to enable you to interact with Union services as a non-member. In addition to the information in this statement, you may be given further information about the uses of your personal data when you sign up to use specific services and facilities we offer, and in certain situations, you may be asked whether you give your consent to us processing information about you.

The Union agrees to comply with the following Data Protection principles. Personal Data shall be:

  • processed lawfully, fairly and in a transparent manner in relation to the data subject.
  • collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
  • adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
  • accurate and, where necessary, kept up to date.
  • kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed, in accordance with UCL and Union data retention schedules designed for this purpose.
  • processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

On what basis does the Union collect and process personal data?

Data Protection Laws require that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a 'legal basis' for the processing. We take our responsibilities under Data Protection Laws extremely seriously, including meeting these conditions. The legal bases on which your personal data are collected are explained below.

Consent:  We may ask you to provide us with a special category or sensitive personal data as detailed in this document, which we will agree only to process with your express consent.

Legitimate interests:  The processing of your personal data may be necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or by fundamental rights and freedoms which require protection of personal data. It may be necessary for our legitimate interests to collect your personal data to enable us to manage certain operations and services of the Union effectively. 

Performance of contract: The processing of your personal data may be necessary in relation to the contract we have entered into with you to provide the Unions services to you or because you have asked for something to be done so you can enter into such contract.

What personal data does the Union hold?

'Personal data' means any information which identifies you as an individual. It may include your name, but it may also be other information, such as your date of birth, nationality and gender, which when combined identify you.

After enrolment we receive the following data from UCL for current students who have not opted out of Union membership:

  • Name
  • Student code
  • Student UPI
  • UCL email address
  • Username
  • Gender
  • Date of birth
  • Course code
  • Student enrolment status
  • Mode of attendance
  • Fee status
  • Course Block
  • Student Course Start
  • Student Course End
  • Department code
  • Faculty code
  • Student contact address, including postcode
  • Term time address code
  • Course Name
  • Hall of Residence
  • Caring Responsibility

Depending on your relationship with the Union, we will collect additional information to manage your membership, involvement with the Union, or contract of employment. This could include bank account details, next of kin details, visa status, and event attendance.

The data required will be covered during the on-boarding process and enrolment in a service.

Some of the personal data used for the above purposes is classed as 'special categories of personal data' under the Data Protection Legislation, such as information relating to your ethnicity or any disability. This is collected to monitor our equalities responsibilities. Disability information will also be shared with relevant UCL staff in order to provide you with the best possible support for your studies. Access to and sharing of this information is controlled very carefully. You will be given more details about our use of sensitive data when we collect it from you.

Some of this information may also be collected to allow us to manage any ongoing case with the Union Advice Service. Details of what information is collected will be discussed with you during registration with the Advice Service. Further details about how the Advice Service may use your information can be viewed in the separate Advice Service data protection statement. 

How does the Union collect data?

The majority of student data is received directly and securely from UCL and is provided only if the student has consented to share this data with the Union.

The Union works closely with selected third parties, including volunteering partners or event organisers. If you have given specific consent to those third parties to share your personal data, we may receive and process that information.

During Union events, we may capture your image, likeness, and voice through photography, audio recording, and video filming.

How does the Union use and process personal data?

We process the information we hold about you for the following purposes:

  • to facilitate and manage your Union membership;
  • to provide the services you request or initiate with the Union;
  • to manage your involvement in the democratic process, such as standing for election and voting;
  • to administer the financial aspects of your relationship with us – i.e., payroll and reimbursement of payment requests;
  • to manage your membership and participation in student activities and events;
  • to manage your interest and involvement in volunteering opportunities facilitated by the Union;
  • to manage access to Union systems, such as the website;
  • to enable effective communications with you in relation to Union activities and updates;
  • to support your training, health, safety, and welfare requirements, including registering for and using the Advice Service;
  • to produce statistics and research for internal and statutory reporting purposes;
  • to monitor our responsibilities under equalities legislation.

Access to your personal information is restricted to staff who need it to carry out their duties and fulfill the purposes outlined above.

When and why is my personal information shared with others?

The Union endeavours to share the minimum amount of personal data necessary. However, certain services require data sharing with third parties, or you may explicitly consent to additional sharing for other purposes.

As part of your Students' Union membership, your personal data may be disclosed to other organisations as required by law, including for crime prevention, investigation, or detection purposes. We may also share your information in emergency situations where it is in your vital interests to do so.

We also use third party services ("processors") to facilitate our operations. Where we engage these third parties, we insist upon strict contractual compliance to protect your personal data. Current processors include:

Data may be shared or disclosed by the Union in other circumstances when needed. In these cases, we will share only the minimum required for the purpose. Such situations may include:

  • HEAR: As a student, some of your personal data will be shared with UCL to ensure your Union achievements are officially accredited, such as through inclusion in the Higher Education Achievement Report (HEAR).
  • Student Quality Reviewers scheme (jointly run with the UCL Arena Centre): If you register your interest to become a Student Quality Reviewer, some of your personal data will be shared with UCL, including name, UCL email and UPI.
  • Payroll: As a student staff member, UCL act as payroll service for the Union and process student staff wages on our behalf. Personal data including name, payroll number and bank details are shared with UCL to manage payment of wages.
  • Volunteering: If you undertake a placement or undertake any voluntary activity facilitated by the Union, with a third party organisation or institution in the UK or in another country, personal data relating to you may be shared with the partner organisation/institution for the purposes of administering the placement.
  • Disciplinaries: In accordance with our governing documents (Bye-law 15) we may share the results of student disciplinaries with UCL staff. 

Sensitive personal data relating to your health or a disability will not be shared without your express consent unless required by law or in your vital interests in an emergency situation.

How long does the Union keep personal data?

Your data will be retained in accordance with UCL's Records Retention Schedule.

After you leave UCL or cease to be a member of the Union, certain parts of your data may be retained as a permanent archival record for research purposes and to confirm your award and period of study. At this point, all identifiable fields will be pseudonymised to protect your identity, meaning your data will be stored separately from any identifiers.

How do I access my data?

You have the right to access information held about you. For information held by UCL, details on how to exercise this right are set out in the university's Data Protection Policy.

As a student, you can view the data held about you via the 'My Account' page on the Students' Union website.

Other website users can view their basic personal details via the 'My Account' page on the Students' Union website.

Your right of access can also be exercised at any time by contacting us at [email protected].

How do I change or delete the data the Union holds about me?

Data protection laws require us to take reasonable steps to ensure that any personal data we process is accurate and up to date.

Where data is supplied directly by UCL, students must update their records via UCL's Portico services.

Students can update specific personal data they have supplied during their Union membership. These basic details can be changed via the Students' Union website.

For other data changes or deletions, contact [email protected].

Who regulates the use of my personal information?

The Union is registered on the Information Commission’s Office (ICO) Register of Data Controllers. The Union's registration number is Z2701645.

Our public entry in the register sets out, in general terms, the full range of purposes for which we use student, staff, and other personal information. See the Information Commission’s Office website for details.

If you need further assistance, please contact the Union via [email protected].

For general UCL data protection queries, contact the university's Data Protection Officer via [email protected]. For more information, visit the university's Data Protection website.

How are staff members covered?

The Students' Union UCL complies with the UCL Staff Privacy Notice. We may also share relevant information, such as organizational roles and structures, with data processors like Investors in People to manage staff surveys and performance analysis on our behalf.

Freedom of information

Freedom of Information requests do not apply to Students’ Union UCL as we are an incorporated, limited by guarantee company and a registered charity, not a 'public authority' subject to the legislation outlined in the Freedom of Information Act.

However, you are welcome to ask us directly for this data. We will try to support any legitimate requests with a response. This can be done using the Union's "Contact us" form and selecting the 'Data protection or privacy request' option and including request details and reason or by e-mailing us directly at [email protected].

For general UCL Freedom of Information queries, contact the university's Freedom of Information Officer via [email protected]. For more information, visit the university's Data Protection website.

Last updated 1 day ago