UBES Privacy Policy

What personal information does UBES store about me, and why is this information collected?

Our normal legal basis for processing your data is that we believe it is in our legitimate interests as a Bristol University society to do so. Processing your data enables us to run trips and events for our members safely and efficiently, to keep our members and alumni informed about what’s happening in the society, and to promote the society to the wider university community. We collect the minimum amount of data possible in order to carry out these interests. When we update our privacy policy, we will contact you by email if you are a member and will publish the updated version here on our website.

If you visit our website
We automatically receive and save certain types of information whenever you interact with this website. We use this information to monitor website traffic and to assist with the navigation and user experience of the website.

Information that we will automatically receive includes:

• Requested URL (the webpage you are visiting)
• Domain name from which you access the internet
• Referring URL (the webpage you came from)
• Software (browser/operating system) used to access the page
• Date and time pages were visited
• IP (Internet Protocol) address (which may or may not identify your specific computer)

We may use and analyse the information we collect so that we can manage and improve the services on the website. Statistical information about user behaviour may be collected and used to analyse the popularity and effectiveness of the website.

We also use services from Google on this website to measure and analyse visitor information. For further information please see Google Analytics’ privacy policy. Declining cookies will disable this feature.

If you register for our mailing list

• Your email address – otherwise there is no mailing list! We use your email address to send you our weekly newsletter during the academic year.

If you sign up as a member

• Your full name, email address, date of birth, and Bristol username (e.g. ab12345). We need this information so that we can verify your membership of the SU and uniquely identify you within our trip system; verify your age to fulfil our obligations regarding the protection of under 18s; and to send you our weekly newsletter to keep you updated about upcoming trips and events so you can make the most of your membership. We also use your email to send you important information about any trips you sign up for.
• If you are an experienced and active member of the club, we also store information about your outdoors qualifications and experience (e.g. ML, RCI, first aid, walk leader, ability to lead climb) and outdoor memberships (e.g. BMC, UKC username) in our Qualifications Database. This information will be stored together with your full name and Bristol username for as long as we believe you are still an active member of the society (i.e. it may not be deleted at the end of the academic year). This data is essential to help us organise trips and events, for example to ensure we have enough people at an event who are trained first aiders, or to ensure we have enough walk leaders on a trip. If you consent to your logged climbs appearing on our website, then your UKC (UKClimbing) username is used for this.

If you take part in any UBES event or trip

• To promote our society to the wider university community we post on our blog and social media about our trips and events, and also publish print media such as posters, leaflets, and our annual newsletter (NUBES). Photos of you (and if you’re a member, potentially also your name) may feature in this media, unless you specifically request during the event/trip not to appear in UBES media. If you request this we will do our best to ensure we don’t use your name or photo in UBES media, but we can’t prevent you from appearing in other participants’ personal photos and personal social media.

If you sign up for a trip

• Your phone number so we can contact you during the trip if needed (e.g. if your driver can’t find you when they come to pick you up).
• Medical and dietary requirements so we can organise meals for the trip (e.g. providing you with vegan meals, or warning everyone not to bring any food containing nuts) and keep you safe and healthy (e.g. if you have an allergy and carry an epipen, we need to know about it in case you have a severe allergic reaction).
• Address details (for most trips: Bristol SU vs. Stoke Bishop pick-up; Scotland trip only: your requested pick up and drop off addresses). If we don’t know where to pick you up from, we can’t bring you on the trip!
• For overseas summer trips only: next of kin contact details and insurance policy details in case of an emergency whilst overseas.

If you sign up as a trip driver

• The licence plate, model, colour, and capacity of your vehicle, and your driver approval status with the SU. We need this information to ensure that you are covered under the SU’s insurance, to work out how many people we can bring on a trip, and to identify your vehicle during a trip.

If you sign up to UBES Alumni

• Your full name, email address, current city, and brief details of your time in the society (e.g. how many years you were a member for, and if you were a committee member)

Who has access to this information?

UBES is the data controller. You can contact us at:

UoB Expeditions Society, c/o Bristol SU, Richmond Building, Bristol, BS8 1LN
ubes-committee@bristol.ac.uk

The current UBES committee have access to your information so that they can carry out UBES’ legitimate interests, such as running trips and events.

We use the following data processors:

• G Suite (Google Apps for Business, including Google Mail, Drive, Docs, Slides, Sheets, and Forms) under the control of Bristol University, to store and process your data. This includes any data you email to us. You can view Google’s privacy policy here and Bristol University’s information security policies here.
• Bristol SU. As an affiliated society, data about our memberships, insurance and finances is processed by Bristol SU (privacy policy), and we are required to share your data with them for certain purposes (such as getting SU driver approval).
• MailChimp (privacy policy), to manage our newsletter.

We may share your information with other trip participants when necessary for the organisation of the trip. For example, your name and phone number will be shared with drivers for the trip you are attending so that they can contact you when picking you up, and your dietary requirements may be shared with the trip participants preparing meals. We will only share information when absolutely necessary.

How long does UBES store this information for?

• As your medical information is particularly sensitive, we delete all medical information immediately after the trip it was supplied for.
• All other personal information is stored for the current academic year.
• During the summer we remove the previous academic year’s personal details before handing over access to the next year’s committee. You will not be personally identifiable from the remaining information (e.g. we may store the total number of trip participants and the total number of drivers, but no personal information about each participant).
• The exception to this is our Qualifications Database. If you are an experienced and active member of the club, we have a legitimate interest to retain information about your qualifications and experience beyond the current academic year for as long as we believe you are still actively involved with the society. This information is stored together with your full name and Bristol username. Once you are no longer an active member of the society then your information will be deleted during the next summer.
• Before we remove your personal details, we may contact you to ask if you wish to sign up for UBES Alumni.

What are my rights?

Under the GDPR you have the following rights with regard to your personal data:

• The right to be informed: you have the right to be informed about the collection and use of your personal data. The purpose of this privacy policy is to inform you about how we collect and use your data, but if you have any further questions you are welcome to contact us.
• The right of access and the right to data portability: you have the right to obtain a copy of the personal data we hold about you and to use this data however you wish. You can contact us at any time to request this. We cannot however provide you with direct access to your data in our G Suite documents because your data is stored together with other people’s personal data (for example in a trip participants spreadsheet). You can also contact MailChimp to request access to any information they hold about you.
• The right to rectification: if you believe any of the personal data we hold about you is incorrect, simply contact us with the correct information and we will update your data. A link to update your email address is included at the bottom of every newsletter.
• The right to erasure (‘right to be forgotten’): you can unsubscribe from our newsletter at any time by clicking the ‘unsubscribe’ link in any newsletter we have emailed to you. If you wish us to delete any other personal data then please contact us and we will ensure it is permanently deleted.
• The right to restrict processing: you have the right to request restriction of how we process your personal data, e.g. so the data’s accuracy can be confirmed or so you can confirm our reasons for storing your data. You can also request restriction of processing as an alternative to erasure of your data.
• The right to object: you have the right to object to our processing of your personal data if we use it for marketing purposes. You also have the right to object to our processing of your personal data for our legitimate interests, but this is not an absolute right; please see the ICO’s explanation for further details.
• Rights in relation to automated decision making and profiling: UBES does not carry out any automated decision making or profiling activities.
• Right to make a complaint: if you believe we are processing your data unlawfully, please contact us immediately – we will do our best to try and resolve the situation. If you are still unhappy with our processing of our data, or you are unhappy with our response, you also have the right to make a complaint to the ICO (Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF) or to any other EU data protection authority.

Please note that your full name, date of birth, and Bristol username  – information provided to us by Bristol SU – are essential for your membership. Without your name and username we no longer have a unique identifier to verify your membership of UBES and of the SU, and without your date of birth we cannot meet our obligations regarding the protection of under 18s. Therefore if you object to the processing of, or request the erasure or restriction of processing of, this data then you will no longer be able to be a member of UBES. If you object to Bristol SU’s processing of your information, please see their privacy policy here.

Similarly if you object to the processing of, or request the erasure or restriction of processing of, personal data we require in order to organise a given trip safely and efficiently, then you will not be able to participate in the trip. Your medical and dietary requirements are the exception to this; you may request these to be erased at any time and still attend the trip. However please consider that if we are not fully aware of your medical requirements this could have very serious consequences for your health in an emergency situation, and we cannot be held accountable for not securing you the appropriate treatment if we were unaware of your condition.

For further information about your rights under the GDPR please see the ICO’s detailed guide.

Privacy policy last updated: 19th August 2018