UCD Students’ Union Privacy Notice (Personal and Special Category Data)

1. This Privacy Notice tells you what we do with information we collect about you. The notice is addressed to individuals who are [users of our services, customers, website users and third parties]. We refer to all these individuals as “[users]” or “you” in this notice.

WHO WE ARE

2. We are UCD Students’ Union (“we”, “us” and “our”). This notice relates specifically to UCD Students’ Union and the events, programmes, opportunities, campaigns, competitions and services operated by it.

PERSONAL DATA WE USE

3. When providing our events, programmes, competitions and services we will ask for information about you, such as your [name, student number, address, DOB, etc.] This is known as your “Personal Data”. We may also ask you for some special categories of information (for example [religion, health etc). This is known as your “Special Category Data”. For the purpose of reference, we may collect your correspondence and communications with UCDSU.

DATA FROM OTHER SOURCES

4. We also collect information about you from other persons and this also forms part of “personal data”. This includes information from:

4.1 University College Dublin

4.2 MSL – Membership Solutions Limited

HOW WE USE YOUR PERSONAL DATA

5. We use your Personal Data and Special Category Data in the following ways:

To accurately record data about you and respond appropriately if you complete one of our forms on our website, such as:

  • Complaints Procedure / Feedback Form

  • Registering your details to become a Student Representative

  • Registering your details in order to vote in UCDSU elections

  • Asking for Advice from Advice SU

  • Registering your interest in or participating in UCDSU’s opportunities and/or training programmes

  • Signing up to UCDSU’s Newsletter

  • Signing up to a competition run by the Students’ Union

  • To provide goods and services to you

  • To manage any registered account(s) that you hold with us

  • To verify your identity

  • For crime and fraud prevention, detection and related purposes

  • With your agreement, to contact you electronically about promotional offers and products and services which we think may interest you

  • Where we have a legal right or duty to use or disclose your information (for example in relation to an investigation by a public authority or in a legal dispute)

To accurately record data about you and respond appropriately if you complete a survey in which we have built on Survey Monkey, such as:

  • SU Survey

  • Competition sign ups

  • Feedback of services, programmes, campaigns and events

To accurately record data about you and respond appropriately if you have registered for an event on Eventbrite, via a Microsoft Form or via Future Ticketing.

To contact you regarding the events, programmes, competitions and services of the Students’ Union.

REASONS WE CAN COLLECT AND USE YOUR PERSONAL DATA

6. We will only use your Personal Data if we have valid reasons for doing so. These reasons are known as our “legal basis for processing”. In certain circumstances we may ask for your consent to process your information. At other times we may be required to process your information to enable us to fulfil our part of the contract we have with you. There are circumstances where we have a legitimate interest to process your personal data, for example to provide you with a service which you have requested. 


The legal bases for processing your Personal Data are:

  • We have a ‘legitimate business interest’ for processing your data. This allows us to provide details of areas of the Students’ Union in which you have expressed an interest

  • We will also contact you regarding past, existing, future or potential the events, programmes, opportunities, campaigns, competitions and services operated by UCD Students’ Union.

  • To continually improve the engagement of our services/work

WHO WE SHARE YOUR DATA WITH

UCDSU only allows its service providers to handle your personal data when we have confirmed that they apply appropriate data protection and security controls.

7. For administrative purposes, your data will be shared and processed by third party software companies:

  • Mail Chimp

  • Survey Monkey

  • Eventbrite

  • Stripe

  • MSL – Membership Services Limited

8. We can share your information including Personal Data and Special Category Data with the following parties for the purposes set out above. This is done in line with our Data Protection Policy and Procedures.

  • Mailchimp - to contact you regarding the events, programmes, competitions and services of the Students’ Union.

  • Judging Panels of competitions where agreed

  • Stripe - Payment gateway & parment processing

  • MSL – for the purpose of verifying student accounts, and conducting online election processes.

9. Sometimes we will not stop using your information when you ask us to, for the reasons described in this notice, but we will tell you about this if you make a request.

10. In other cases, if we stop using your information we will not be able to provide the services that you are asking us to give you. We will tell you about this if you make a request.

OTHER THIRD PARTIES

Aside from our service providers, UCDSU will not disclose your personal data to any third party, except as set out below. We will never sell or rent our customer data to other organisations for marketing purposes. We may share your data with governmental bodies, regulators, law enforcement agencies, courts/tribunals and insurers where we are required to do so:

  • To comply with our legal obligations,

  • To exercise our legal rights (for example in court cases),

  • For the prevention, detection, investigation of crime or prosecution of offenders, and

  • For the protection of our employees and customers.

DATA PROCESSING OUTSIDE EUROPE​

11. We will not transfer your Personal Data and Sensitive Personal Data outside of the European Economic Area

HOW LONG DATA PROCESSING INFORMATION WILL BE KEPT

12. We will keep your Personal Data and Sensitive Personal Data for up to 6 years from termination of service/student relationship. We are only allowed to keep your information if we need it for one of the reasons described above.

YOUR RIGHTS

13. You can contact us at the address above for one or more of the following reasons:

13.1.1 To ask us to fix information about you that is wrong or incomplete, this is known as your right to rectification.

13.1.2 To ask us to delete information about you, this is known as your right to erasure.

13.1.3 To tell us you no longer agree to us using your information about you and ask us to stop, this is known as the right to object.

13.1.4 To tell us to stop using information about you to sell you products and services, which is known as the right to restrict processing.

13.1.5 To make “subject access requests” - which is a request for us to send you the information we have about you.

13.1.6 To ask us to provide you or someone else (on your request) in a structured; commonly used machine-readable format with the information you have provided to us about yourself. This is known as “data portability” right.

13.1.7 To ask us not to use information about you in a way that allows computers to make decisions about you based solely on automated processing.

CONTACTING US

14. Data Controller

UCD Students’ Union

Student Centre

Belfield

Dublin 4

COMPLAINTS

15. You have the right to complain about how we treat your Personal Data and Special Category Data to:

The Data Protection Commission

21 Fitzwilliam Square South

Dublin 2

D02 RD28

Ireland

CHANGES TO THIS NOTICE

16. We may update this Privacy Notice from time to time. We will notify you of the changes where we are required by law to do so.