Student Data Privacy Statement 

1. Introduction 

Nottingham Trent Students’ Union (“NTSU”, “we”, “our” or “us”) promises to respect any personal data you share with us, or that we get from other organisations, and keep it safe and in line with data protection laws and best practice.  We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect.  Developing a better understanding of our members through your personal data allows us deliver better services and communicate with you effectively.  

2. Where we collect information about you from 

We collect information in the following ways; 

2.i When you become a member of NTSU 

As a student at Nottingham Trent University (NTU) you automatically become a member of NTSU unless you opt out during enrolment. NTU shares and keeps up-to-date information about you and your course. When NTU gives us this data we become responsible for it and use this as our central record of your membership.  When you leave NTU this data is deleted by them in line with their retention schedule.   

2.ii When you give it to us directly 

You may give us information in order to sign up to a student group, an election, one of our events, undertake research activities, use our Information & Advice Service, purchase our products, apply for positions or communicate with us.  When you give us this information we take responsibility for looking after it and we will, if required, cross reference this data against our central record of your membership. 

2.iii When you give it to us indirectly 

Your information may be shared with us by independent organisations, NTU, event partners.  These independent third parties will only do so when you have indicated that you have given consent to share this data with us. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.   

2.iv When you give permission to other organisations to share it 

We may combine information you provide to us with information available from external sources in order to gain a better understanding of our members to improve our communication methods, products, services or respond to complaints. The information we get from other organisations may depend on your privacy settings or the responses you give, so you should regularly check them.  This information comes from the following sources: 

2.v Third party organisations 

You may have provided permission for a company or other organisation to share your data with third parties such as NTSU.  This could be when you buy a product, register for an online competition or sign up with a service provider. 

2.vi Social Media 

Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp, Twitter, Snapchat and Instagram, you might give us permission to access information from those accounts or services. 

2.vii Information available publicly 

This may include information found in places such as Companies House, the electoral roll, and information that has been published in articles/ newspapers.   

2.viii When we collect it as you use our websites 

Like most websites, we use “cookies” to help us make our site work and make the way you use it better.  Cookies mean that a website will remember you.  They’re small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier – for example by automatically filling your name and address in text fields or remembering items in shopping baskets.  There are more details in our cookie statement. In addition, the type of device you’re using to access our website and the settings on that device may provide us with information about your device, including what type of device it is, what specific device you have and what operating system you’re using. Your device manufacturer or operating system provider will have more details about what information your device makes available to us. 

2.ix When you buy a product from us 

To place an order with us online registration will be required if you don’t already have an account.  At the point of registration and at the point of sale, we request certain information including your name, delivery address, email address and phone number.  This information is required to enable us to process your order and notify you of its progress.  Once an order has been placed, we may contact you by email to confirm your order details and again once your order has been accepted and despatched.  Should we need to contact you for any reason regarding your order, we will use the email address or the telephone number where provided. If you purchase some products in person, for example event tickets, we will ask for your student ID number.  This enables us to verify your student status, associate your purchase with your student account, maintain maximum per person sales and process entry and refunds effectively.   

2.x When other people give us information 

Information may be given to us by other students, staff or members of the public in the form of nominations (eg. for elections, awards and prizes), complaints and communications.   

3. The personal data we collect and how we use it 

The type and quantity of information we collect and how we use it depends on why you are providing it, or why we are receiving it.  

Membership 

As part of your enrolment with NTU they provide us with a set of key information. When you use our services or participate in one of our activities we use this information to verify your student status and provide the best possible standards of administration and communication.  The information provided to NTSU is; 

• Student ID 
• Forename 
• Surname 

• Date of Birth 
• Gender 
• NTU Email address 
• Fee status (UK/EU/International) 
• Programme Code 

• Study Type (UG/PG/FE) 
• Programme Level 
• Start date 
• End date 

In addition, when you register on our website, signup to a mailing list, attend an event or activity, join a student group or use one of our services we may ask for additional information such as: 

• Your interests 
• Demographics  
• Your bank details to facilitate payments 
• Information relating to your health or next of kin if you are taking part in a high-risk activity 
• Any disabilities so that we can provide assistance where needed 

• Personal information on accident, incident or first aid forms  

We use your data to 

• Provide you with the services, products or information you asked for 
• Ensure we know how you prefer to be contacted 
• Administer your membership 

• Keep a record of your relationship with us 
• Understand how we can improve our services, products or information 
• Build profiles of members and target communications relevant to you 

4. How we keep your data safe and who has access 

Personal data collected and processed by us may be shared with Students’ Union employees, officers and volunteers in the process of their work.  Under strictly controlled conditions the following groups where necessary: 

• Contractors 
• Advisors 
• Agents 
• Service provider partners 

When we allow access to your information, we will always have complete control of what they see, what they are allowed to do with it and how long they can see it. We do not sell or share your personal information for other organisations to use. 

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors. 

Some of our suppliers may run their operations outside the European Economic Area (EEA).  We will always ensure they provide an equal or greater level of protection in accordance with UK data protection law. By submitting your personal information to any of these systems, you agree to this transfer, storing or processing at a location outside the EEA. 

We may need to disclose your details if required by law to the police, regulatory bodies or legal advisors.  We will only ever share your data in other circumstances if we have your explicit and informed consent. 

5. Profiling, Marketing & Communications Preferences 

Profiling allows us to target our resources effectively and contact you about relevant services.  We do this because it allows us to understand the background of our members and helps us to deliver appropriate services and information to members who need it.  When doing this we may analyse geographic, demographic and other information relating to you in order to better understand your interests and preferences in order to contact you with the most relevant communications. Your data would only ever be analysed or profiled through encrypted and protected data processes, which only ever identifies broad statistics. In doing this, we may use additional information from third party sources when it is available. 

5.i Membership Communications 

As a member we believe you have a legitimate interest in hearing from us about the products and services we offer, what we’re doing to represent you and opportunities that might be of interest to you. You may opt out of these communications during registration on our website, at any stage by clicking the unsubscribe link contained within the email or by visiting your account/profile on our website. 

5.ii Direct Marketing 

As a charity we need to fundraise to provide the services we offer to our members we do this in part through our trading activities including retail outlets, media sales, diners, bars/nightclubs and events activities. We send marketing materials about our trading activities and on behalf of our media sales operation to our members where you have told us that we can. We do not sell or share personal details to third parties for the purposes of marketing.  You may opt out of these communications during registration on our website, at any stage by clicking the unsubscribe link contained within the email or by visiting your account/profile on our website. 

5.iii Controlling what you want to hear about 

We make it easy for you to tell us how and what you want us to communicate to you during registration on our website.  You can change these settings at any time through your account/profile on our website. 

6. Keeping your information up to date 

NTU keep your details up-to-date on our website through daily information updates.   

Our website also provides options for you to edit your information, and/or let us know when information is inaccurate or you would like it changing.  The best way to keep your information up-to-date is to keep your NTU records accurate.   

It is your responsibility to keep your information up-to-date relating to any employment you have with us, you can do this through your line manager or HR.  There are specific policies related to employment which can be accessed through HR. 

If give us data relating to any of our services or activities, for example your email address and phone number as a committee member of a society or in a case file for the Information and Advice Service please contact the service area direct to update your information.  There are specific policies relating to each service area which can be accessed through each service area.   

7. Understanding the detail of our data security measures 

When we process your data we will have already carefully assessed the lawful justification for doing so, the parameters in which the data is processed, the length of time the data is held for, the secure storage of your data and undertaken impact assessments to ensure your rights are delivered.  

NTSU operates a Data Protection and Information Security Policy and supplements this with a Data Protection Handbook for our employees and volunteers.  All employees and volunteers handling data are required to undertake data protection training and third parties handling data are required to provide a contract which meets the requirements of the Information Commissioner's Office. 

NTSU uses NTU Information systems to store and process all information.  NTU keeps these systems safe and secure in line with industry best practice, you can access their policies here.  NTSU and NTU have a legal data sharing agreement which covers all information shared. 

NTSU uses One Voice Digital as our website and membership system provider.  One Voice Digital keeps these systems safe and secure in line with industry best practice.  NTSU and One Voice Digital have a legal data sharing agreement which covers all information shared. 

NTSU uses Machforms to collect and process information through online forms.  The type of data these forms collect will vary depending on the purpose however the data is kept securely on NTU servers and we have a legal data sharing agreement which covers this system.  

NTSU does not store any sensitive card data on our systems following online transactions. We use payment processor contracted through our website provider One Voice Digital to handle these matters.  Payments taken in store are handled through worldpay. 

8. Your rights  

The General Data Protection Regulations sets out the following rights for individuals  

8.i   The right to be informed 

This Student Data Privacy Statement and associated documents set out what data we collect and how we process it.  At the point of collection, we will direct you to these documents and inform you of why we are collecting data.   

8.ii The right of access  

You have a right to ask for a copy of the information we hold about you, you can do this by contacting us on dataprotection@su.ntu.ac.uk .  If you want to access your information the Information Commissioner’s Office can provide you with guidance on your rights and on making this request.  Subject to the complexity of your request NTSU has 1 month to respond and will not normally levy any charges. As a minimum you should contact us with your name, address, telephone number, any information we might know you by (previous names, student number etc.) and a detailed description of the information you would like (including the topic it is relating to including systems, times and dates).  If we request clarification from you to identify the data you are requesting any delays in responding may impact on the response period, and in complex cases we have the right to extend this by a further 2 months, however we will always do our best to respond as soon as possible.   

We may also request further information, including identification and verification to ensure you are who you say you are before we give you your information. 

Where requests are manifestly unfounded or excessive we will either charge a fee taking into account he administrative costs or refuse to respond.   

8.iii    The right to rectification  

If your data is inaccurate or incomplete and you have not been able to rectify it with the area of NTSU responsible, or you don’t know who to contact to rectify this information please contact dataprotection@su.ntu.ac.uk .  In most cases we will rectify your data within 1 month or respond to justify why this cannot be done.   

8.iv   The right to erasure 

If you would like us to erase all data we hold on you then you must Opt out of NTSU by contacting NTU who will remove your data from our central membership record.  If you believe we hold other data you can request this is erased by contacting us on dataprotection@su.ntu.ac.uk.  This right of erasure does not cover data which is required to be kept by law, this may include for example accident reports, HR records, finance records. 

8.v   The right to restrict processing 

You have a right to ask us to stop processing your personal data, and if it’s not necessary for the purpose you provided it to us for (e.g. processing your membership or registering you for an event) we will do so.   If you want to opt-out of all communications and all data processing you will be required to opting out of NTSU, this will limit your access to activities and services. You can do this by writing to NTU who will remove your data from our systems.  Contact us on dataprotection@su.ntu.ac.uk if you have any concerns.   

8.vi    The right to data portability  

We work with our suppliers to ensure any data you request from us will be in an easily readable electronic format.   

8.vii   The right to object 

If you would like to object about any of our data processing please contact us on dataprotection@su.ntu.ac.uk  

8.viii   Rights in relation to automated decision making and profiling  

We only use profiling as detailed above in section 5, we do not use profiling to make and automated decisions.

9. Our data protection officer?

The NTSU Data Protection Officer is currently Phil Kynaston and can be contacted on dataprotection@su.ntu.ac.uk  

10. Communicating changes to this statement

We may change this Privacy Statement from time to time in line with new or updated policies, procedures or legislation.  If we make any significant changes in the way we treat your personal information we will make this clear on our website or by contacting you directly. 

If you have any questions, comments or suggestions, please let us know by contacting:  

dataprotection@su.ntu.ac.uk