Edge Hill Students’ Union Privacy Notice
How we use your information
This privacy notice tells you what to expect when Edge Hill Students’ Union (EHSU) collects personal information. It applies to information we collect about:
- Visitors to our website and/or create an account for membership
- People who contact us via social media
- People who email us
- People who use our advice centre
- People who make complaints
- People who give us feedback, make suggestions, or complete questionnaires
- People who nominate individuals for EHSU Awards
- Job applicants and our current and former employees
Visitors to Our Website
When someone visits www.edgehillsu.org.uk we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.
Our website contains public areas, which may be viewed from any Internet connected device. Other areas are restricted to access by members of EHSU. It is important to EHSU that its members and customers retain their privacy when they take advantage of all that EHSU and its services have to offer.
Your privacy is important to us. We therefore operate based on a number of principles:
The information you give us in registering your membership of the EHSU website, will be stored securely. Information is shared by Edge Hill University (EHU) as a data sharing partner (in line with the Data Protection Act 1998 (DPA) and the General Data Protection Regulation (GDPR) for the purposes of the Union seeking to deliver on its aims and objectives and the data will be used only for this purpose). This website is hosted by a third party, OneVoice Digital Limited, who is under an obligation to hold the information securely and confidentially in compliance with the DPA and the GDPR and is prohibited from making use of the information itself.
If any of the information you have given us changes at any time, you can directly change this record yourself by clicking the 'my profile' button in the top right box on your page, after you are logged in.
EHSU will use this information to communicate with you by e-mail to improve our website and to personalise our service to you. For example, we may provide you with newsletters, activity information, pointers, advice, recommendations or advertisements for goods or services that we think will interest you, according to the preferences you have determined. We will also use the information for our own internal membership administration, the facilitation of Union elections and for statistical analysis.
We will not disclose or exchange any information personal to you to any third party without your prior express approval. EHSU will not store or transfer your personal data to countries outside the United Kingdom.
By disclosing information about you to us on our website or in any other way, you consent to the use of that information in the manner set out in this policy.
As required under DPA and the GDPR, EHSU complies with all the relevant data sharing agreements (including with EHU with whom the Union operates a data sharing agreement for the purpose of delivering on its aims and objectives) and Acts in relation to the types of information we hold, the purposes for which we hold it.
This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.
People who contact us via social media.
If you send us a private or direct message via social media the message will be stored for three months. We get a huge variety of enquiries from students, requests for help and support from our advice centre, information requests and messages from potential business partners. When you contact us via social media, we may need to discuss your request with a relevant individual to assist and you will be notified on an individual to contact, or be asked to supply your details so the individual can contact you – in these instances, the reason for sharing your data is legitimate interest. Your data will NEVER be shared with anyone outside the organisation without notification.
People who email us
We receive a variety of emails to our SU email accounts on a daily basis - requests for help and support from our advice centre, information requests and messages from potential business partners. When you contact us via email, we may need to discuss your request with a relevant individual to assist and you will be notified on an individual to contact, or be asked to supply your details so the individual can contact you – in these instances, the reason for sharing your data is legitimate interest. Your data will NEVER be shared with anyone outside the organisation without notification
We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.
People who use our Advice Centre
Edge Hill Students’ Union’s Advice Centre will require some basic personal information from you, in order to give you effective advice. When contacting the Advice Centre for the first time, whether by email, telephone, or in person, you will be asked to book an appointment with one of our advisors via SimplyBook.me, a secure, GDPR-compliant booking management system hosted on our website. To make your appointment, you will be asked to provide your name, telephone number, email address, course details and the nature of your enquiry.
By providing this information, you are agreeing that EHSU Advice Centre can create a case file for you on our confidential, GDPR-compliant case management system, Advice Pro. In accordance with Article 6 of GDPR, there is a legitimate interest in processing this data, since such information is integral for us to provide advice, progress your case, and keep you informed of any developments related to it.
In addition to the personal information listed above, we may also request that you provide us with certain demographic data about yourself. This data might relate to, among other things, your gender, sexual orientation, ethnic origin, or disability status.
Under GDPR, the kinds of demographic information referred to above are considered “special category” personal data and, as such, can only be recorded and processed by us with your explicit consent. Therefore, you are under no obligation to share this information with us. Moreover, refusal to do so will in no way affect your right to receive advice from us.
We request this kind of information primarily for progressing your case, but we also use it for statistical and monitoring purposes. Doing so allows us to enhance our services through the identification of relevant trends among those accessing the advice centre. In any analysis or promotional work based on demographic data, information will be anonymised to ensure that no individuals can be identified from it.
For more information on how we process your data in our Advice Centre, please visit www.edgehillsu.org.uk/advice
People who make a complaint to us
When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide.
We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.
We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for two years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
Similarly, where enquiries are submitted to us we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.
People who give us feedback, make suggestions, or complete questionnaires
Gathering student feedback is a crucial part of an organisation shaped by students, and something we actively encourage at every opportunity in order to improve our service offering and quality. People can give us feedback in a variety of ways – after events we use anonymous feedback postcards, and for specific projects/events we sometimes ask for student/staff feedback or input via email. When these emails are received, we extract the feedback and use it anonymously – the data of the individual is not used, unless the individual has asked a question, or wants to be involved further (i.e. they have asked to run an event themselves or take part in a future event). Emails received will typically be deleted once the information has been extracted, but may be put into a project folder in which case it will be deleted after two years. This information is NEVER passed to anyone outside the organisation without prior notification.
We sometimes ask for feedback through social media, encouraging students to vote or comment with feedback. Again, this information is only used from a statistical perspective (i.e. the number of students who vote “Yes” or “no”, or feedback is extracted in verbatim form. Unless the individual has asked a question or asked for a follow-up discussion, we do not need their data.
People who nominate individuals for EHSU Awards;
When individuals complete a nomination for an EHSU award (including Student Led Staff Awards, Rep Awards, Societies Awards and Sports Awards), they submit their information and that of the nominee in an application form. Any personal information that is provided, are used only for the purpose of reviewing the nomination. The information of about the winner will also be published on our own website.
Job Applicants and our current and Former Employees
When individuals apply to work at EHSU (or subsidiary companies), we will only use the information they supply to us to process their application and to monitor recruitment statistics.
Where we want to disclose information to a third party, for example where we want to take up a reference or obtain a ‘disclosure’ from the Criminal Records Bureau we will not do so without informing them beforehand unless the disclosure is required by law.
Personal information about unsuccessful candidates will be held for 12 months after the recruitment exercise has been completed, it will then be destroyed or deleted. We retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.
Once a person has taken up employment with EHSU, we will compile a personnel file relating to their employment on our GDPR-compliant software People HR. We will also require data for our GDPR-compliant Sage Accounting Package in order to process salary payment. The information contained in this will be kept secure and will only be used for purposes directly relevant to that person’s employment. Once their employment with EHSU has ended, we will retain the file for 5 years for the purpose of legitimate interest and then destroy it.
Data Sharing Agreement with Edge Hill University
We have a data sharing agreement with Edge Hill University.
This agreement permits the transfer of part of your personal information from the University to our UnionCloud database for the purposes of allowing EHSU to carry out activities detailed in section 2.5 of the data share agreement. You can opt in to receive further marketing communications emails from us by activating your account at www.edgehillsu.org.uk. This is also where you can change your preferences or opt out of receiving any communications from us.
You can tell the University that you do not wish the Students’ Union to have this data by opting out at enrolment or by withdrawing your permission by logging on to edgehillsu.org.uk and editing permissions in ‘my account’.
Access to personal information
We want to be transparent in the way we handle your data, and individuals can find out if we hold any personal information by making a ‘subject access request’. The request must be in writing (including e-mails and faxes), and we must respond to such requests within a month. If we do hold information about you, you will be:
• told whether any personal data is being processed;
• given a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people;
• given a copy of the personal data; and
• given details of the source of the data (where this is available).
If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
If we do hold information about you, you can ask us to correct any mistakes by, once again, contacting us in writing.
Changes to this privacy notice
We keep our privacy notice under regular review. This privacy notice was last updated on 24th May 2018.
How to contact us
If you want to request information about our privacy notice you can email us at sucomms@edgehill.ac.uk or write to:
FAO Chief Executive
Edge Hill Students’ Union
Edge Hill University
Ormskirk
L39 4QP
