Guild Student Groups Privacy Statement

Introduction

The University of Birmingham Guild of Students’ Student Groups (the Student Groups) are committed to complying with the Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (GDPR).

We will make sure that when we collect and process personal data about you we will comply with the DPA and the GDPR. We will comply with the six data protection principles in the GDPR and make sure that your data is: 

• processed fairly, lawfully and transparently;
• collected and processed only for specified, explicit and legitimate purposes;
• adequate, relevant and limited to what is necessary for the purposes for which it is processed;
• accurate and kept up to date. Any inaccurate data must be deleted or rectified without delay;
• not kept for longer than is necessary for the purposes for which it is processed; and
• processed securely. 

We are accountable for these principles and must be able to show that we are compliant. The DPA makes a distinction between personal data and “special” personal data. ‘Special’ categories of personal data include personal data regarding: 

• your racial or ethnic origin;
• your political opinions;
• your religious or philosophical beliefs;
• your trade union membership;
• your genetic or biometric data;
• your health; or
• your sex life and sexual orientation. 

We will only process your personal data if:

• We have your consent;
• Processing is necessary for the performance of a contract with you or to take steps to enter into a contract; 
• Processing is necessary for compliance with a legal obligation;
• Processing is necessary to protect your vital interests or those of another person; or
• Processing is necessary because it is in our legitimate interests, or those of a third party, unless these interests are overridden by yours. 

It is in our legitimate interests to process your data as a member of a Student Group. 

We will only process your “special” personal data (see list above) if:

• We have your explicit consent;
• Processing is necessary to protect your vital interests or those of another individual if you are physically or legally incapable of giving consent;
• Processing is carried out by a not-for-profit body with a political, philosophical, religious or trade union aim provided the processing relates only to members or former members (or those who have regular contact with it in connection with those purposes) and provided there is no disclosure to a third party without consent;
• Processing relates to personal data which you have manifestly made public;
• Processing is necessary for the public interest in the area of public health; or
• Processing is necessary for archiving in the public interest, or scientific and historical research purposes or statistical purposes. 

If we want to process your “special” data, we shall usually seek your consent, unless we consider that one of the other circumstances above applies. 

How we use your personal and special personal information

All Student Groups

For all student groups we shall use your personal information for the following purposes:

• to contact you about events and activities and about your membership;
• to arrange events and activities related to your membership;
• to enrol or enter you in any relevant associations, events, competitions or award schemes;
• to send you information from our official sponsors, for example as part of our newsletter, website and through our various social media platforms. All sponsorship information will be sent through us. We will never send or share your personal details with our sponsors, unless you ask us to do this;
• if you are an officer of our group to market our events and our group; and 
• we may also use your images (photographs and video) for marketing where you have given your consent for this. 

If you decide to provide us with information about your health so that we can make reasonable adjustments and for health and safety reasons, we shall use the information provided for these purposes and hold it in line with the DPA and with this Privacy Statement. 

Volunteering Activity in Student Groups

If your group involves volunteering, we may also use your personal information:

• to ensure that you are safe when you volunteer, for example we may keep your personal details on file so that we can contact you about your volunteering and in case anything goes wrong. This may also involve collecting “special” information about you, for example information about your health or gender; and
• for the purposes of safeguarding others when this is relevant to your volunteering. This may involve obtaining a DBS check which will involve collecting information about any criminal convictions.

Groups which engage in Sport, Recreational and Competitive Activities

If your group engages in sport, recreational or competitive activities, we may process your data, and also “special” data on your health, so that we can: 

• enter you in sports and other associations and for events and competitions;
• make reasonable adjustments to any activities and services which we provide for you; and
• carry out any health and safety measures required.

Performance Groups

If your group carries out musical, theatrical or other performances, we may process personal and also “special” data on you so that we can:

• market and advertise performances; and
• use your images (photographs and video) for marketing where you have given your consent for this. 

Sharing your personal and special information with others

We sometimes need to share the personal information we process with other organisations. If so we will always comply with all aspects of the DPA and data protection law. For example, we may need to share your information with: 

• The University of Birmingham
• Other sports associations, sports bodies or sports organisations where we are competing, taking part in events or using their facilities
• Other society/club associations, bodies or organisations where we are competing, taking part in events or using their facilities
• Organisations where you are volunteering
• Theatres and venues where you are performing
• U-Check, in order to process your DBS check where required
• Organisations to which you have asked us to send a reference
• Tour operators and travel organisations where you are participating in a trip
• Religious venues and organisations to which the Student Groups are affiliated or are using their facilities
• The Guild of Students’ database MSL

Where unforeseen data sharing situations arise, we may seek your consent on an individual basis.

How long we keep your personal information

We will generally keep your information for as long as you are a member of the Group and will then delete it. 

If you have been a Committee Member of the Student Group we may keep a record of your name and position for a period of up to 7 years after you leave the Student Group in our group records. If you have volunteered for a Group for which you required a DBS check, we may keep a record of your name and position for 25 years for safeguarding reasons. 

If we have used images of you, with your consent, we will use your images for a maximum of 5 years on digital media after which we shall remove the images. 

Images used in marketing material will be used for the length of the marketing campaign and then destroyed with any unused marketing material, where this can be removed from circulation.

Images of you used by Performance Groups with your consent may be kept permanently, unless your consent is withdrawn, in which case we shall delete these images and/or not use them in future publications or electronic media although they may continue to appear in publications or electronic media already in circulation.

How we protect your personal information

We are fully committed to keeping your personal data safe. We protect your personal information with the following measures:

• We keep your data on the Guild of Students’ databases, including MSL.
• All our Committee Members undergo Guild of Students’ approved data protection training, including regarding data security.
• Access to your personal data is limited to data protection trained Student Group Committee Members and Guild of Students Officers and employees.
• We are fully supported by the Guild of Students’ Data Protection Officer.

Your data protection rights

You have the right to request: 

• Access to the personal data we hold about you, free of charge in the majority of cases.
• The correction of your personal data when incorrect, out of date or incomplete.
• That we erase your personal data where we were not allowed to process it or it is no longer necessary to process it for the purpose for which it was collected or once the purpose for which we hold the data has come to an end (such as the end of our data retention period).
• That we stop data processing where we are relying on a legitimate interest and you think that your rights and interests outweigh our own and you wish us to stop, for example, when you withdraw consent, or object and we have no legitimate overriding interest.
• That we stop using your personal data for direct marketing (for example, via email).
• While you are requesting that your personal data is corrected or erased or are contesting the lawfulness of our processing, you can apply for its use to be restricted while the application is made.
• That we stop any consent-based processing of your personal data after you withdraw that consent. 

You have the right to request a copy of any information about you that we hold at any time, and also to have that information corrected if it is inaccurate.

If we do hold information about you we will: 

• give you a description of it;
• tell you why we are holding it;
• tell you to whom it could be disclosed; and
• let you have a copy of the information in an intelligible form.

This information will be provided to you within one month.

To ask for your personal data or exercise any of your rights above, please contact the Guild of Students’ Data Protection Officer at dataprotectionofficer@guild.bham.ac.uk

You also have the right to complain to the Information Commissioner if you think there is a problem with how we handle your data. For further guidance on matters relating to Data Protection and Privacy, please refer to Information Commissioner’s Office by calling 0303 123 1113 or online via www.ico.org.uk/concerns.