At Royal Holloway Students’ Union, we’re committed to protecting and respecting your privacy.
This notice explains when and why we collect personal information about people who visit our website or use our services, how we use it, the conditions under which we may disclose it to others and how we keep it secure.
Last modified: 29 April 2022
Download PDF version
We’re Royal Holloway Students’ Union (RHSU), a charity dedicated to making life better for students at Royal Holloway. RHSU is a registered charity (no. 1141998). Our registered address is: The Students’ Union, Royal Holloway University of London, Egham Hill, Egham, TW20 0EX.
This privacy notice tells you what to expect when RHSU collects personal information. It applies to the following types of information:
Also contained within this policy is:
When someone visits www.su.rhul.ac.uk we use a number of third party services, Google Analytics and New Relic, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site so that we can improve the content we offer to visitors. This information is only processed in a way which does not identify anyone.
We do not make, and do not allow Google or New Relic to make any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.
We also make use of the third party service, Facebook Pixel, to collect information on the performance of our advertising so that we can continually optimise our marketing activity. You can review your Facebook privacy settings and opt out of Facebook Pixel within the ‘Ad Preferences’ section of your Facebook account.
We use a third party service, Membership Services Limited, to manage our membership functionality and provide our content management system. In order to provide these services we collect information through two different methods:
i. During enrolment with the University
We have a data processing agreement with Royal Holloway, University of London, whereby the University shares the following student data with the Students’ Union at the stage of enrolment:
The data processing agreement (Memorandum of Cooperation, Appendix 5: Data Processing Agreement) enables RHSU to collect and use the above information to meet our legal obligation protected within the Education Act 1994, which requires that appointment to major union offices is by election in a secret ballot in which all members are entitled to vote.
The following legitimate interests are also applicable for the collection and processing of the above data:
If we want to process your data for any other reason we will inform you of the processing activity and always ensure that the appropriate legal basis is applied.
At the point of enrolment all students are informed of their right to opt out of Students’ Union membership and given relevant information to enable you to do so.
Members are free to amend their membership status at will. For more information on membership of the Students’ Union see our dedicated webpage.
ii. During guest registration on our website
Guests to our website are required to submit a range of data if they wish to make purchases on the website, access our services, join the Students’ Union as an Associate Member or join a student group. The data collected includes:
The lawful basis for processing this data is for the performance of a contract. This data also enables you to access our wider website and services.
We won’t use this information to target or profile you based on prior purchases and we will only send you marketing messages if you have consented to this.
At times we use a number of third party providers, Cognito LLC and Google, to collect data through embedded forms on our website. We do not allow Cognito LLC or Google to make any attempt to access the data we have collected or share it.
At the point of collection we will be explicit about what personal data we are collecting and the purpose for processing and the retention period.
For more information, please see Cognito LLC’s privacy notice or Google’s privacy notice.
We only retain data on our system that is relevant and for time periods that are not longer than is necessary. This can be broken down into a number of different categories:
i. Ordinary and Associate Members of the Students’ Union
When an ordinary/associate member of RHSU graduates, leaves the University or opts-out of membership they cease to be a member. In this case their data is given a ‘nominal leaving date’ which takes effect on our ‘global expiry date’ which is the 31 July every year.
Following this their data enters the ‘full retention period’ during which the data is fully retained on the MSL systems and measured from the nominal leaving date.
At the end of the ‘full retention period’ all data relating to a members account is pseudonymised and all data and content linked to the account can no longer be attributed to a named individual.
At the end of the ‘final deletion period’ all personal data records are securely deleted. The dates for this activity is defined in the table below.
ii. Honorary Membership
If you are granted Honorary Lifetime Membership of the Students’ Union you are given access to all of RHSU’s services (except standing/voting in elections) for life. To enable this access, the data for these types of members remains on the system for the period of time they continue to login to the website. We review the last login date on an annual basis and will send a reminder to anyone who has not logged in within the previous calendar year. After a further 12 months of inactivity the last login date will then become the ‘nominal leaving date’, activating the process below.
Should you wish to opt-out of Honorary Membership please contact us. The date at which you confirm the end of your Honorary Membership will become your ‘nominal leaving date’ and activate the process defined in the table below.
iii. Guest Accounts
If you have registered for a guest account on our website you are given access to all of RHSU’s services (except standing/voting in elections) for life. To enable this access, the data for these types of members remains on the system for the period of time they continue to login to the website. We review the last login date on an annual basis and will mark your account with a ‘nominal leaving date’ based on your last login after 12 months of inactivity.
Should you wish to delete your account please contact us. The date at which you confirm the end of your account will become your ‘nominal leaving date’ and activate the process defined in the table below.
Nominal Leaving Date
Global Expiry Date = Annually on 31 July
i.e. at the end of that 12 month period in which the Actual Leaving Date falls
Full Retention Period
Measured from the Nominal Leaving Date
Final Deletion Period
RHSU uses surveys to improve our understanding of issues that directly affect our members. This can relate to the services we offer, the development of specific policy around issues on campus or the performance of our communications activity.
At the point of conducting surveys we will be explicit about what personal data we are processing, the purpose for processing and the retention period.
We use a third party service, Survey Monkey, to manage the collection and analysis of our survey work. We do not allow Survey Monkey to make any attempt to access the data we have collected or share it. For more information, please see Survey Monkey’s privacy notice.
We use a third party provider, Sprout Social, to manage our social media interactions. As such, information you make publicly available on social media platforms may be transferred to Sprout Social to allow our team to quickly respond to your enquiries. For more information, please see Sprout Social’s privacy notice.
For members of the Students’ Union, we will also process your personal data for marketing purposes. When we talk about ‘marketing’ we mean to keep you updated with access to relevant products, offers, activities and services. We will rely on the lawful basis of legitimate interests to process your data in this way as we believe the information we share with you will enhance your experience as a student of Royal Holloway. We will also use analytics to enable us to enhance and personalise the experience we offer to you as members of the Students’ Union.
We will not share your personal data with any third parties and you can ask us to stop sending you marketing messages by contacting us at any time.
We use a third party provider, Campaign Monitor, to deliver our e-newsletter updates. We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-newsletter.
Our E-Newsletter is only sent to members of the Students’ Union and individuals have the right to unsubscribe at any point and are given information about how to do this in the footer of every email. Campaign Monitor only uses the data we have supplied in order to send emails from us. They won’t share this data with anyone else or send you emails about their services.
For more information, please see Campaign Monitor’s privacy notice.
You can read more about what data we collect and how we process it as part of the recruitment process on our Work With Us page or our Employment Data information page.
As part of our Give It A Go offer, the Students’ Union offers numerous day-time and evening events throughout the year. At most of these events we will scan your College Card before you gain entry to the event. This gives us access to the following data:
We collect this data for our legitimate interests of:
We will only retain this information for the academic year in which it is collected. If the data is required for comparative analysis after this period, the data will be pseudonymised so that the data cannot be attributed to a named individual. It will not be retained for any more than one further academic year.
The Students’ Union provides a number of night-time events across all of our venues throughout the year. Entry to all ticketed events is via your College Card, which is scanned to identify any purchase of tickets, any age restrictions and any venue access restrictions. This is used for validity purposes only and no further data is collected.
Some of our events are open to the general public and the majority of the tickets related to these are purchased through our website. The data related to these transactions is used to enable entry into the event and never used for marketing purposes unless explicitly agreed at the time of purchase.
For large events we may use an external third party ticketing platform. For our Founder’s Calling event we are using TicketWeb to facilitate ticket sales. The data related to these transactions is used to enable entry into the event and never used for marketing purposes unless explicitly agreed at the time of purchase.
For more information, please see TicketWeb's privacy notice.
Where a member of the Students’ Union wishes to bring a guest with them to any of our late night events, they will be required to sign the guest in. The following personal details of the guest will be collected:
Additionally a copy of a driving licence, passport or national identity card will be scanned and a photograph of the individual taken. This information is required to enable us to fulfil our legal obligations under the Licensing Act 2003 and will be retained for the duration of the academic term in which the event is attended. After this point it will be deleted unless it needs to be retained as part of an investigation following an accident or incident.
We take photographs and video footage at the majority of our events but we will always make it clear when we are doing so and the purposes for this activity. Should you not wish your photograph/video to be taken at an event please inform our photographer/videographer and they will ensure your image is not taken.
We do not use any facial recognition software to identify individuals within images and in the instances where we wish to identify an individual, such as in our democratic elections, we will always ask for permission.
To ensure compliance with health and Safety and licensing legislation, we are required to record all accidents, incidents and near misses within our venues. The personal data we request when completing a report on the above is as follows:
We use a third party provider, Cognito LLC, to capture and store this data. For further information please see Cognito LLC’s privacy notice. We will retain accident report forms for a duration of three years and incident forms for a period of 12 months from the date of incident, unless required to support ongoing disciplinary action, health and safety or insurance investigations.
The Students’ Union operates an independent Advice Centre, offering specialist advice in academic and housing issues. Our advisors are also able to signpost you to other services and support where necessary. This service is confidential and at your first appointment the advisors will discuss with you the personal data (and any special categories of data) that they require to enable them to support you appropriately. Your permission to process this data will be sought.
There may be circumstances where your personal data needs to be shared with a third party. This will be discussed with you and your permission to share this data will be sought, except where they may be reason to protect your vital interests, in which case your permission will not be obtained.
We operate a number of surveillance systems to enable the prevention, investigation and detection of crime and monitoring of the security and safety of the premises at RHSU.
This includes CCTV around our venues, body worn cameras on licensed security individuals and dash cams on our Union Bus service. We’re registered with the ICO as a data controller operating closed circuit surveillance systems and you can see our Surveillance Systems Policy in full for more information.
This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.
Within the Data Protection Act 2018, the UK General Data Protection Regulations (UK GDPR) set out the rights you have as an individual which you can exercise in relation to the information we hold about you.
You can read more about these rights on the Information Commissioner’s Office website but they can be broken down into the following areas:
You can request a copy of the data we hold on you by contacting us. We endeavour to respond to requests within 30 days but where a request is complex this may take up to 90 days – if this happens we’ll let you know the reasons why.
You have the right to question any information that we have about you that you think is incorrect. We’ll take reasonable steps to check this for you and, if required, correct it.
You can ask us to delete, remove, or stop using your personal information if there is no need for us to keep it. This is known as the ‘right to erasure’ or the ‘right to be forgotten’.
If you believe the information we hold on you is inaccurate, being processed unlawfully or no longer required you have the right to restrict the processing of your personal data.
You have the right to get your personal information from us in a format that can be easily re-used. You can also ask us to pass on your personal information in this format to other organisations.
You can object to us keeping or using your personal information. This is known as the ‘right to object’.
You are protected under UK GDPR in instances where automated decision-making has a legal or similarly significant effects on you. We don’t currently conduct any such automated decision making or profiling.
You can invoke your right to any of the above verbally or in writing. Please contact us at email@example.com.
RHSU tries to meet the highest standards when collecting and using personal information and we take any complaints we receive about this seriously.
You have the right to complain to the Information Commissioner’s Office. You can find out how to report a concern on their website.
The Students’ Union
29 April 2022
08 October 2021
Registered charity no: 1141998
The Students’ Union, Royal Holloway
Egham, TW20 0EX