Student Privacy Notice: How we use your personal information at CUSU
This page provides information about the use of your personal information by CUSU, whether this is as part of a single survey, an ongoing campaign, or participation in CUSU elections and activities. For statements regarding the Students’ Unions’ Advice Service (SUAS), please see www.studentadvice.cam.ac.uk/about/
1. What is ‘personal information’?
‘Personal information’ means any information which relates to or identifies you as an individual.
2. How does this webpage relate to other information about data protection?
CUSU engages with you in a number of ways in the course of its legitimate activities as a students’ union. In the course of your interaction with CUSU your data may be retained, and where this occurs, CUSU will be able to demonstrate a legal basis for doing so and will, wherever required, inform you of its collection. This page outlines how CUSU processes data and aims to notify you of how your data is processed.
When you applied to become a student you were told how the University and the relevant College(s) would use your personal information to process your application and for related purposes (see here). The University has its own notice for students detailing how its protocols for managing your privacy.
In addition to the information published here, when you use specific activities and facilities offered by CUSU, you will be told about any other uses of your personal information for that specific purpose, where consent is required.
3. Who will process my personal information?
The information published here applies to the use, sharing and disclosure of your personal information by Cambridge University Students’ Union (‘CUSU’). CUSU is a separate legal entity from both the University of Cambridge (http://www.cam.ac.uk/), and each of the 31 Cambridge Colleges for these purposes. The University and your College will provide you with its own statement setting out how it will use, share and disclose your personal information while you are a student.
4. What personal information will be processed?
CUSU will keep a record of the information you submit in the course of participation in any of its activities and/or with its personnel: such as any given survey, campaign-orientated or consultative exercise, involvement in any schemes or outreach programs, correspondence, or use of CUSU services and facilities. CUSU will keep a record of the details you provide in these instances, as well as any supplementary personal information from the University regarding your College, course, or student status. This personal information may include data such as your name, home address, date of birth, equality and diversity data, course studied and involvement in the activities of CUSU.
Your personal information is created, stored and transmitted securely in a variety of paper and electronic formats. Access to your personal information is limited to CUSU employees who have a legitimate interest in this data collected for the purpose of carrying out their contractual duties relating to the legitimate charity activities of the students’ union. Our use of your personal information will not be excessive or unwarranted. We do not give out any of your details to third-parties for the purpose of marketing or solicitation.
The University will include your basic contact details in their internal online directory, Lookup, though you can opt out of this (https://www.lookup.cam.ac.uk/). You may also choose to include your email address in our external online directory, Jackdaw. CUSU is able to access this these directories and, in order to undertake its legitimate activities as a students’ union, may cross-reference existing data it legitimately processes with personal information from these directories.
In addition to this, CUSU may process some information about you that is classed as ‘sensitive’ or ‘special category’ personal data, and which requires additional protections. This includes information concerning your ethnicity, sexual orientation, religious beliefs or health/disability that we use for planning and monitoring purposes, or in order to provide care, help or suitable adjustments, as well as to assess the equalities-culture of the student body and the University. Access to, and the sharing of, your ‘sensitive’ personal data is controlled very carefully.
5. What is the purpose and legal basis of the processing?
CUSU will process your personal information for a range of contractual, legitimate and internal purposes, including the following:
- to represent your interests as a student of the University of Cambridge in accordance with the Union’s constitution and democratic functioning;
- to provide, run and coordinate activities and facilities to you (e.g. student campaigns, member services, Students’ Unions’ Advice Service etc.);
- to enable your participation in organised activities and events (e.g. student schemes such as the Shadowing Scheme; attendance at training, forum or social events organised for you to attend; society stands at Freshers’ Fair; participation or attendance at CUSU Council meetings; etc.);
- to communicate effectively with you (predominantly via email and online/via digital means), including the distribution of relevant [e-]newsletters, memos and circulars, and notice of student elections and campaigns;
- to gauge member satisfaction and gather feedback, operate security (including CCTV), deal with complaints and issues, and for monitoring purposes;
- to support your training, medical, safety, welfare and religious requirements; and
- to compile statistics and conduct research for internal reporting purposes.
When we seek to obtain information for a specific campaign, cause or survey, which aims to solicit student opinion, we will seek your consent at the point of collection (which you can withdraw at any time); this will detail the purposes that this data will be used for. However, this data may also be used for equalities monitoring and student welfare, and as this processing is in the course of the official duties of CUSU, the law does not require your consent for us to use your data in this way. However, your data will not be processed in such a way as to make you as an individual identifiable to any external or unauthorised parties, except where your explicit consent is given.
We consider the processing of your personal information for these purposes to be either necessary for the performance of our contractual obligations with you (e.g. to manage your student experience and welfare while studying at Cambridge), or necessary for compliance with a legal obligation (e.g. equal opportunities monitoring), or necessary for the performance of tasks we carry out in the public interest (e.g. Widening Participation activities, representation of student interests to the University), or necessary for the pursuit of the legitimate interests of CUSU or an external organisation (e.g. to enable your access to external services).
We will not use your personal information to carry out any wholly automated decision-making that affects you.
We will ensure that:
- data is kept safe and secure;
- data is handled legally, responsibly, and ethically;
- we are open and transparent about what data we are using and why; and
- all legal requirements are met regarding data privacy.
6. Who will my personal information be shared with?
In the course of its legitimate activities as a students’ union, CUSU may share your information with service-providers contracted to support its operations. For example, CUSU may engage the services of an email client to process its email; may utilise online storage services; or may engage in services that help to securely manage sensitive datasets such as mailing lists or survey data. In the course of engaging with any third party services your data will only ever be shared for legitimate administrative purposes and for CUSU’s own legitimate activities; your data will never be sold to third parties and strict contractual provisions will be in place, along with internal management controls, to ensure contracted services facilitate CUSU’s legitimate use of your data only.
In the course of informing university-wide campaigns CUSU may share your information with either the University or individual Colleges, especially concerning matters of student welfare. When matters concerning the well-being of a specific student arise, you may be identified to your College or the University, but only when this is necessary for the health or safety of an individual (such as for law-abiding purposes).
As described above, your personal information is shared with relevant staff at the Cambridge Colleges as required and with the University. In addition, it is shared as permitted or required by law, on a considered and confidential basis, with a range of external organisations, which may include the following where necessary for legitimate processing:
- external individuals involved in relevant CUSU committees or procedures;
- relevant Higher Education bodies (e.g. Office for Students, Office of the Independent Adjudicator, National Union of Students, the organisation(s) running the National Student Survey and other student and leaver surveys);
- on occasion and where necessary, the police and other law enforcement agencies;
- on occasion and where necessary, independent auditors or Government taxation agencies;
- on occasion and where necessary, subsidiary companies of the University;
- companies or organisations providing specific services to, or on behalf of CUSU, the University and/or one or more Colleges; or
- the providers of any external/collaborative learning and training placements or opportunities.
On occasion, the above types of sharing may involve the transfer of your personal information outside the European Economic Area (e.g. to facilitate your participation in an activity, or to utilise a secure administrative service for CUSU’s day-to-day activities). Such transfers usually are necessary in order to meet our legal or contractual business obligations, and are carried out with appropriate safeguards in place to ensure the confidentiality and security of your personal information.
Other than as set out above, we will not normally publish or disclose any personal information about you to other external enquirers or organisations unless you have requested it or consented to it, or unless it is in your vital interests to do so (e.g. in an emergency situation).
7. How long is my information kept?
Any information that you submit to CUSU, or that was otherwise collected, is kept for a period of seven years, or longer dependent upon the use of your data as outlined at the point of collection – such as the use of multi-year statistics in order to inform campaigns and initiatives. Anonymised forms of your data may be kept beyond this.
8. How can I access my personal information?
You have the right to access the personal information that is held about you by CUSU through a ‘Subject Access’ request. You also have the right to ask us to correct any inaccurate personal information we hold about you, to delete personal information, or otherwise restrict our processing, object to processing or to receive an electronic copy of the personal information you provided to us. For details on how to do this, please contact firstname.lastname@example.org.
10. Who can I contact?
If you have any questions about how your personal information is used, or wish to exercise any of your rights, please contact email@example.com.
11. How do I complain?
If you are not happy with the way your information is being handled, or with the response received from us, you have the right to lodge a complaint with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, SK9 5AF (https://ico.org.uk/).
12. Are changes made to this webpage?
This webpage was last updated in [May 2018]. It is reviewed when necessary. Any changes will be published here and you will be notified via this webpage and/or by email.
 Automated decision making is the ability to make decisions without human involvement. In practice, profiling can often be a precursor to automated decision making. ‘Profiling’ is a form of ‘automated processing’ of personal data used to analyse or predict matters relating to an individual.
 CUSU is only able to share the data it collects (e.g. via correspondence, or its daily activities), and only obligations to the law or safety of individuals shall necessitate a conflict to confidentiality expressed during collection.