Introduction

Published on 24 May 2018

‘Personal data’ means any information relating to an identifiable person who can be directly or indirectly identified.

Our data protection practices are in accordance with the General Data Protection Act (GDPR); an EU directive effective from 25 May 2018.

Who this notice applies to

This notice applies to the personal information we collect about:

• Users of our website.
• People who use our services.
• People who give us feedback, make suggestions, complete questionnaires, polls or make complaints.
• Suppliers and agents.
• Sponsors and supporters.

These people are classified as ‘data subjects’ under the GDPR. As a data subject, you have rights as an individual which you can exercise in relation to the information we hold about you. These include:

1. The right to be informed.
2. The right of access.
3. The right to rectification.
4. The right to erasure.
5. The right to restrict processing.
6. The right to data portability.
7. The right to object.
8. Rights in relation to automated decision-making and profiling.

You can read more about these rights here and access our Subject Access Request Form here.

When we collect personal information

We collect personal information about you when you give it to us directly.

How we use your information

We process personal data in accordance with a minimum of one valid lawful basis, as defined by the GDPR, for the following reasons:

• To provide you with the services you have requested.
• To manage your relationship with us.
• To keep you informed about our services, events and activities.
• To comply with legal obligations.
• To improve our services and website.
• To process payments and donations.

Use of personal data is compliant with the GDPR and specifically with the 6 principles that are set out within it, requiring that data be:

1. Processed lawfully, fairly and transparently.
2. Collected for specified, legitimate purposes and not further processed in a manner that is incompatible with those purposes.
3. Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
4. Accurate and, where necessary, kept up to date.
5. Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
6. Processed in a manner that ensures appropriate security of the personal data.

Your communication preferences

We may use your personal information to contact you about your Students’ Association services. At each of these points of contact you will have the option to select preferences or opt-out of communications (unless they are required in order for us to comply with any relevant legal or contractual obligations).

Disclosure of personal information

Your personal information will not be sold, traded, or rented to individuals or other entities. However, we may need to share your personal information with third parties to charge your credit card or deliver specific services to you such as support services. These third parties will be bound by a data-sharing agreement and are required not to use your personal information other than to provide the services requested by the Students’ Association.

We may disclose your personal information if we believe in good faith that such disclosure is necessary to:
a. comply with any relevant legal obligations or
b. protect and defend the rights or property of the Students’ Association

Website and app privacy

Our website and app comply with the GDPR. All data processed is stored securely within the EEA.

Website Cookies

The Students’ Association website uses cookies to distinguish you from other users. Some cookies are essential for the site to function and are set automatically; others help improve your experience.

Strictly Necessary Cookies in Use

• csrftoken – Protects our website and users from cross-site request forgery (CSRF) attacks by ensuring that any action you take (e.g., submitting a form) is intentional and from your browser. This cookie is session-based, stores no personal data, and is essential for site security.

You can disable cookies in your browser, but essential cookies are required for the website to work properly.

Information links

The Students’ Association website contains links to other websites. We are not responsible for the content, accuracy or opinions express in such websites, and such websites are not investigated, monitored or checked for accuracy or completeness by us.

Inclusion of any linked website on or through the website or the service does not imply approval or endorsement of the linked website by us. If you decide to leave the website and access these third-party sites, you do so at your own risk.

About this notice

This privacy notice is in accordance with the General Data Protection Act (GDPR); an EU directive effective from 25 May 2018.

We are happy to provide any additional information or explanation needed on this notice. Any requests for this should be sent to the address below.

FAO: Director of Marketing & Communications Edinburgh University Students’ Association
Potterrow
5/2 Bristo Square
Edinburgh
EH8 9AL

Email: data@eusa.ed.ac.uk

Updating our privacy notice

Changes to this notice may be required from time to time. If we make substantial changes to this notice we will make this clear on our website and/or contact you directly. The ‘published on’ date at the top of this notice will reflect the version of the notice you are viewing.

Further information

Edinburgh University Students’ Association is registered with the ICO under the Data Protection Act and appears on its public register here (registration number ZA047742).

For further guidance on matters relating to the GDPR and privacy, please refer to the UK Information Commissioner’s Office.