Where we get your data
We hold data for our legitimate interests (e.g. facilitating your membership of LSU), to fulfil our legal contracts with you (e.g. if you are an employee, or if you have purchased a product such as Platinum), and with your explicit consent (e.g. if you join a club or society, you give your consent to hold data by joining).
We have a Data Sharing Agreement in place with Loughborough University and Loughborough College which allows us to use your data to administer your membership of LSU. The agreement also allows us to pass limited data back to the university and college for the purposes of administering clubs, and disciplinary status/records.
You were requested to opt in to membership of LSU at the point of your registration with your institution. You can withdraw this at any time using the Self-Serve portal, but this means that you will not be able to make use of any of the membership services we offer. You can also opt back in if you wish, and it takes approximately 48 hours to reinstate your membership status so you have full access to our services.
Opting out of membership of LSU does not prevent you from using our retail outlets, or from attending evening events such as our nightclubs (however you must be signed in by a full member as a visitor), or using Student Voice in the case of dispute with your institution. You must be opted in to LSU in order to vote in any of our elections.
A full breakdown of data we share with the institutions is later in this document. When you update any of your data with your institution (for example your home address) we receive the update in an overnight data feed.
Much of the other data we hold comes directly from you – this includes information you may have given to LSU when you took part in one of our services; for example by opening a case with Student Voice, taking part in our Rag or Action activities, or joining one of our Clubs or Societies, attending one of our training & development sessions, or attending one of our evening events where we need to monitor ID and building capacity for the fulfilment of our Licensing Conditions.
If you are employed by LSU as a member of student staff, we collect your data, such as your bank details, as part of our contract with you.
We also hold data that has been created by LSU for our legitimate interests, for example the operation of our Loyalty Scheme, training and development records, lists of attendance at events.
Types of data we hold
The information stored and processed by LSU may include:
- Contact details
- DBS Status – for relevant Action or Rag projects only
- Photographs, videos and media articles – for example, at public events such as awards ceremonies, we take photographs and videos which may be displayed on our website or shared on our social media outlets
- Disciplinary records and your disciplinary status (i.e. if you are subject to a ban from our premises or activities under the Disciplinary Policy; this data is shared where required if your status restricts your access to activities).
- Accident/incident reporting
- Dietary and mobility/access requirements
- CCTV footage
- Purchase history or information for processing a refund for you, as requested by you (we do not store credit or debit card details; we use SSL protocols for purchases made via our website)
- Bank details for payments for claims you have made (eg reimbursements via a club or society)
- List of events you have attended where we scan your student card or write down your ID number or email address
- Communications sent to you or received from you
- Information about your membership of clubs, societies and sections, including that necessary for insurance purposes
- Employment information including proof of your identity and bank details (if you are a member of student staff)
- Information about your dispute with your institution (if you use the LSU Advice service; includes academic misconduct, impaired performance, etc.)
How we use your data
We use your data to communicate with you via email and the LSU website. This includes direct mailing for marketing purposes, invitations to events, news and updates from LSU, information about how you can get involved with the activities we offer. Please see the ‘Your rights’ section of this policy for more information about how you can update your communications preferences.
To try and make sure we are sending you communications that are relevant and of interest we may analyse and group data using a range of factors including demographic, geographic, education, employment details and details of past engagements with LSU. When sending communications our policy is to keep information to a minimum, and not an inappropriate amount or for projects that are not of interest.
We recommend that you use your university email address for your membership of LSU.
Who has access to your data
Your membership data is held in a secure database operated by a third party, MSL Ltd with controls in place to limit who has access to it.
If you are employed by LSU as a member of student staff, your data is held on the secure database StaffSavvy (operated by SmartBlue Ltd) and on Sage Payroll in-house. For payroll purposes we are obliged to share your data with HMRC. If you are eligible for pension auto-enrolment we are obliged to pass on your data to NEST for processing and administering your contributions.
Your Loyalty Card data is held on internally stored secure databases. This gives administrators of our till systems complete access to your purchase history so we can give you special offers like meal deals or free entry into evening events, and record your points accrued so you can spend them. If you have purchased a product from our Platinum range, this is the system where that data is stored, to allow you free entry into your selected events and related promotions.
Operation of Clubs and Societies is conducted via our website, with no contact details displayed. You may choose to give your data, e.g. your mobile number or personal email address directly to a committee member.
For Rag and Action, some of our projects are run with our charitable partnership organisations, who will collect your data in order to process your participation. In some cases (eg for an overseas project) this may involve transferring your data outside the European Economic Area. In these instances, we will ensure that an adequate level of protection is in place for the processing of your personal data.
Our LSU Advice service is a member of Advice UK (www.adviceuk.org.uk) and administers its services using AdvicePro. Please note that by contacting LSU Advice for advice, either by email, phone or in person, LSU Advice will open a confidential case file for you and record your personal information, details of your enquiry and any advice given. Information such as your course, school, reason for contacting us etc may be used for statistical purposes only and we will not identify you when compiling reports. Your details will be recorded and stored securely, usually for the duration of your studies plus one year. If you do not agree that the details of your case can be recorded and stored by us, please let us know. Your information will not be shared with anyone outside of the service unless we have your express authority; this includes the University. We may however be required to breach confidentiality where there are safeguarding concerns i.e. we believe that the client may cause serious harm to others, or themselves or have harm caused to them. We may also need to breach confidentiality where legal obligation, such as responding to a subpoena or under statutory acts of law, require disclosure of confidential information for example in circumstances covered by the Prevention of Terrorism Acts.
As required by law LSU may also provide information to relevant authorities such as the Police, HMRC or the HSE.
How your data is maintained
You can update your data at any time by visiting your profile, emailing us at firstname.lastname@example.org or writing to us at LSU, Loughborough, LE11 3TT or calling us on 01509 635000.
To opt out of membership of LSU at any time, you need to visit your student account on the University’s systems. For the university, information about the data sharing agreement and opting out can be found here. To opt out of membership if you are a College student, you need to do this in person at the College's administration office.
Some anonymised data is kept indefinitely for research and monitoring purposes.
You can update your communication preferences and opt-out of receiving some or all communications from us at any time. To do so please visit your profile (sign in first).
Additional Information for Athletic Union Club members who play in BUCS and non-BUCS leagues
If you a member of an AU club which enters teams into BUCS league games, we have to process your data for the purposes of following BUCS regulations and administering your participation in training and fixtures. To do this we share your data as follows:
- Under a Data Sharing Agreement with the Loughborough University Sports Development Centre, we share:
- If you are on a Club committee, your title and name, student number and email, club membership(s), and position
- If you are on the AU Executive, your name, student number, position and email
- Your name, student number, club(s), team(s) and your gender on Team Sheets
- If you are a coach, we share your name, contact number, club, email, qualification proof, address, date of birth and details of how you are paid
- Your name, email address and contact number if you book an event
- Your membership of clubs including your name, student number, email and gender
- Accident reports which contain your personal data and details of the injury you have received
- Your discipline status if the status restricts your access to activities.
- BUCS requires us to share the following information to check your eligibility to play in a BUCS fixture:
- Your course name and duration
- Team sheets including your name, student number, team, sport and gender (also shared reciprocally with the participating university teams).
- If you take part in a BUCS championship or other non-regular event (such as Indoor Athletics Championship), BUCS also request the following information to confirm your eligibility to compete:
- Competitor information including Name, home Club information, email address, date of birth, emergency contact details, phone number, gender, ranking, license number, personal bests, qualification times, and highest competition level.
- National Governing Body for your sport: in order to fulfil the regulations set out by the NGB for your sport, we pass on team details including competitor information, and check Coach registration with the NGB to permit you to coach.
- Other sports teams that your team plays receive team sheets and the contact for your club (this is a reciprocal arrangement).
- External bus companies are required by law to have a passenger list for their journeys. We keep contact details of the drivers.
- If you are a registered minibus driver, we keep your name, NI number, Driving License number, address, date of birth, gender, student number and a contact number for insurance purposes, as well as the date your minibus test expires.
- If you use your own vehicle, for insurance purposes and financial claims, we keep your name, gender, date of birth, address, student number, driving license number, vehicle registration, vehicle tax status and expiry date, vehicle insurance status and expiry date, vehicle MOT status and expiry date and contact phone number.
- Vehicles hired for transport and driven by students: as part of the legal contract with hire companies, we pass on your name, gender, date of birth, driving license number, national insurance number (or your Unique Number if you have undertaken your convictions check yourself within 14 days of the hire date – this depends on the hire company's individual policy) and contact phone number.
- Vehicles insured under our Union insurance policy held with Endsleigh: Endsleigh require a declaration to be filled in by all drivers to qualify for insurance. This includes details about any traffic offence convictions you may hold. This data is held by Endsleigh.
- Medical services: if you are referred to the University’s Medical Services by the Athletic Union, we pass on your name, date of birth, student number and address. Depending on the treatment required, they may pass data back to us to assist us with your training programme.
- Kit is supplied by Kukri. In order for you to have the regulation kit for your sport, we pass on your name, email address, team and sizes to Kukri.
- Alumni: We keep records of payments of subs made by alumni, and their contact and athlete information, in order to permit alumni members to train and play.
If you wish to opt out of the above sharing, this would mean you would leave the team and no longer be eligible to train with your team or play in BUCS fixtures, and you would lose any automatic access to training or other support services. You can still take part in IMS or casual sports.
If you have any questions about the data shared between the Athletic Union and other parties, please email sportEO@lsu.co.uk.