UBES Privacy Policy

Last updated: 27 September 2026

The University of Bristol Expeditions Society (“UBES”, “we”, “us” or “our”) takes the privacy of our members, trip participants, volunteers, alumni and website visitors seriously.

This policy explains what personal information we collect, why we use it, who it may be shared with, how long we keep it, and your rights under UK data protection law.

Who is responsible for my information?

UBES is the data controller for the personal information described in this policy, except where another organisation, such as Bristol SU, acts as a separate controller for information it collects for its own purposes.

Why do we process personal information?

We use personal information where it is necessary to run UBES safely and effectively. Depending on the purpose, our lawful basis may include:

Legitimate interests – for example, administering the society, organising trips and events, checking membership, maintaining appropriate records, managing qualifications and experience, improving our services, maintaining website security, and communicating relevant information to members.
Contract – where processing is necessary to provide something you have signed up or paid for, such as a place on a trip.
Consent – where we specifically ask for your agreement, such as for some communications or uses of information.
Legal obligations – where we are required to retain or provide information by law or as part of applicable financial, safeguarding or regulatory requirements.

Where information you choose to provide includes health information or other special-category personal data, we will also identify an appropriate condition under Article 9 of the UK GDPR. Where applicable, we rely on your explicit consent to process medical information you provide for the purpose of organising a trip or event safely.

In a genuine emergency, information may also be used where necessary to protect somebody’s vital interests.

We aim to collect only the information reasonably necessary for the relevant purpose.

What information do we collect?

If you visit our website

When you use the UBES website, certain technical information may be received automatically by our website, hosting provider and associated services. This may include:

the pages or URLs you request;
your IP address;
your browser and operating system;
the referring page or website;
the date and time of your visit; and
technical information required to operate, secure and diagnose the website.

We may use this information to maintain website security, diagnose problems, understand how the website is being used and improve the user experience.

Where analytics or other non-essential cookies are used, these will only operate in accordance with our cookie settings and applicable consent requirements.

If you join our mailing list

We may collect your name and email address so that we can send you UBES news, trip announcements and other society information.

You can unsubscribe from marketing emails at any time using the unsubscribe option provided or by contacting us.

If you are a UBES member

We may process information including your:

full name;
Bristol username;
University or other relevant email address;
membership status;
date of birth or age information where required to identify under-18s and meet safeguarding requirements; and
committee or other society role, where applicable.

Some membership information may be obtained from Bristol SU membership records rather than being supplied directly by you. We use it to verify membership, identify members accurately, administer trips and events, and meet our responsibilities towards members who are under 18.

Qualifications, experience and expert status

For members involved in leading, supervising or supporting UBES activities, we may store information about relevant outdoor qualifications, training, experience and competencies. Examples may include first aid, Mountain Leader or climbing qualifications, UBES walk-leading experience, Redpoint supervision, winter skills and similar information.

We use this information to organise activities safely, identify appropriately experienced people, allocate leaders and supervisors, and determine eligibility for activities or signup periods where relevant.

Where you have voluntarily linked an external outdoor profile, such as a UKClimbing username, we may also process that information for the purpose for which you supplied it.

If you sign up for a UBES trip or event

Depending on the activity, we may collect:

your name, username and contact details;
your phone number;
your membership status;
your requested pickup or departure location;
dietary requirements;
medical information that you choose to provide;
equipment requests or information about equipment you can provide;
answers to activity-specific questions;
your signup, waiting-list, payment and attendance status;
information relevant to driving or transport;
timestamps and other administrative information associated with your signup; and
for some overseas or extended expeditions, emergency contact, next-of-kin and insurance information.

We use this information to allocate places, communicate with participants, arrange transport and equipment, organise food, collect payment and operate trips safely.

Medical information

Medical information is particularly sensitive and is treated accordingly.

We ask you to provide information that may be relevant to your safety or wellbeing during the activity. This could include, for example, asthma, severe allergies, coeliac disease, migraines or another condition that may affect you during day-to-day activity or exercise.

You may also contact the committee directly at ubes-committee@bristol.ac.uk if you would prefer to provide relevant medical information separately.

Medical information is only made available where it is reasonably necessary for organising or operating the relevant activity safely.

If you sign up as a driver

We may process information supplied through our driver and vehicle-compliance systems, including:

your name and Bristol username;
your vehicle make or model;
your vehicle registration number;
the number of passenger seats available;
relevant transport or departure information; and
your driver or vehicle compliance/approval status.

We use this information to organise transport, determine trip capacity, allocate passengers and confirm that drivers and vehicles meet applicable UBES and Bristol SU requirements.

If you make a payment

Where a UBES trip or activity is paid for through our website, payments may be processed by Stripe.

UBES may store information such as:

the amount due or paid;
payment status;
the date and time of payment;
refund information;
an order or transaction reference; and
a Stripe payment or checkout reference.

UBES does not receive or store your full payment card number, security code or full card details. Card information is handled by Stripe through its payment systems.

Payment information may be used to reconcile trip finances, confirm places, issue refunds, investigate payment problems and meet applicable financial record-keeping requirements.

If you attend a UBES activity

UBES may take photographs or videos at trips, socials and other activities for use on our website, social media, publications and other society communications.

We normally rely on our legitimate interest in documenting and promoting the society for ordinary event photography. If you do not wish to appear in UBES media, please tell a committee member and we will make reasonable efforts not to publish identifiable photographs of you.

This does not allow UBES to control photographs independently taken and published by other participants.

If you join UBES Alumni

We may collect information including your full name, email address, current city and brief information about your involvement with UBES, such as the years you were a member or committee roles you held.

Where does our information come from?

Most personal information is supplied directly by you when you join the society, complete a form, sign up for an activity, make a payment, contact the committee or use one of our services.

We may also receive relevant information from:

Bristol SU, particularly membership and administrative information;
existing UBES records, such as our qualifications or committee records;
Stripe, to confirm the status of payments and refunds; and
other services you have chosen to connect or provide information from.

Who can access my information?

Members of the current UBES committee may have access to personal information where this is necessary to perform their role.

Access to sensitive or confidential information should be limited to those who reasonably need it. We use the access controls available within our systems and do not intentionally make trip participants’ personal information publicly available.

Information may also be shared with another participant where necessary to organise an activity. For example:

a driver may receive the name and contact details of passengers they are collecting;
people organising food may receive relevant dietary requirements; and
trip leaders may receive information reasonably required to operate the trip safely.

We aim to share only the minimum information necessary.

Which external services process information?

UBES uses external organisations and services to operate the society. These may include:

Google Workspace, including Google Drive, Sheets, Docs, Forms and Gmail, for society administration, communication and storage of information. University-provided Google services may be administered through the University of Bristol. Google’s privacy information is available at policies.google.com/privacy.
Bristol SU, which processes membership, financial, insurance and other information associated with UBES as an affiliated society. Bristol SU’s privacy information is available on the Bristol SU website.
Stripe, which processes online payments. Stripe receives the payment information necessary to process transactions. Stripe’s privacy information is available at stripe.com/gb/privacy.
Our website and hosting providers, where necessary to host, secure and operate the UBES website and services provided through it.
Mailchimp, where used to operate UBES mailing lists and newsletters. Mailchimp’s privacy information is available at intuit.com/privacy/statement/.

Some service providers may process information outside the United Kingdom. Where this happens, the relevant provider is responsible for using appropriate international data-transfer safeguards required by applicable data protection law.

How long do we keep personal information?

We do not aim to retain identifiable personal information indefinitely.

Medical information supplied for a trip is normally deleted one week after the end of that trip. It may need to be retained for longer in exceptional circumstances, for example if an incident, safeguarding matter, insurance issue or legal requirement means the information must be preserved.
Other trip signup and participant information is normally retained only for as long as it is required for administration of the trip and the relevant academic year. At the end of the year, information that is no longer required is deleted or anonymised where practicable.
We may retain anonymous statistical information, such as the number of people attending trips, after identifying information has been removed.
Payment and financial records may be retained for longer where reasonably necessary for reconciliation, refunds, disputes, Bristol SU requirements or applicable financial and legal record-keeping obligations.
Qualifications and experience information may be retained beyond a single academic year while we reasonably believe you remain an active member of, or contributor to, UBES. These records should be reviewed periodically and removed when no longer required.
Alumni information may be retained while you remain part of UBES Alumni, unless you ask us to remove it.
Website and analytics information is retained according to the retention settings of the relevant website or analytics service and should not be retained for longer than necessary.

Automated processing within the UBES trip system

The UBES website and trip system may automatically carry out routine administrative checks or calculations using information already held about you.

Examples include checking membership status, determining whether signup is available, calculating trip prices or discounts, updating signup and waiting-list status, checking capacity, and identifying whether a member meets defined eligibility criteria for a particular signup or activity.

These systems are intended to automate administration rather than make decisions that have legal or similarly significant effects on individuals. Where appropriate, a committee member can review and correct information or an outcome produced by the system.

How do we protect personal information?

We take reasonable organisational and technical measures to protect the personal information we hold. These include restricting access to systems and information, using authentication and permissions, limiting access to sensitive information where practicable, and removing information when it is no longer needed.

No online system can be guaranteed to be completely secure. If you believe personal information held by UBES has been accessed, disclosed or used improperly, please contact us as soon as possible at ubes-committee@bristol.ac.uk.

What are my rights?

Depending on the circumstances and the lawful basis on which information is being processed, UK data protection law gives you a number of rights.

Right to be informed: you have the right to know how and why your personal information is being collected and used. This privacy policy is intended to provide that information.
Right of access: you can ask us for a copy of personal information UBES holds about you.
Right to rectification: you can ask us to correct inaccurate or incomplete personal information.
Right to erasure: in certain circumstances, you can ask us to delete personal information we hold about you.
Right to restriction: in certain circumstances, you can ask us to restrict how we use your information.
Right to data portability: where the legal requirements for this right are met, you may request personal information you have supplied to us in a structured, commonly used and machine-readable format or ask for it to be transferred to another controller.
Right to object: you may object to processing based on legitimate interests. We must consider your objection and whether there are compelling reasons for the processing to continue.
Right to object to direct marketing: you can ask us to stop using your information for direct marketing at any time.
Right to withdraw consent: where we rely on your consent or explicit consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.
Rights relating to automated decision-making: you have protections relating to certain decisions made solely through automated processing. UBES does not intentionally use solely automated decision-making that produces legal or similarly significant effects.
Right to complain: if you are concerned about how UBES has handled your personal information, please contact us so that we can investigate the issue. You also have the right to complain to the UK Information Commissioner’s Office (ICO).

More information about your data protection rights is available from the Information Commissioner’s Office.

Information required to provide a service

Some information is necessary for us to provide particular services safely and effectively.

For example, we need enough information to identify you and confirm your membership when membership is required for an activity. We also need certain information to administer a trip, such as your name and appropriate contact, payment or transport information.

If you ask us to erase or stop processing information that is genuinely necessary to provide a particular activity or service, we may no longer be able to provide that activity or service to you.

Providing medical information is treated differently. You may withdraw consent for UBES to process medical information you have provided. However, if UBES does not know about a medical condition, allergy or other relevant requirement, this may limit the information available to committee members or trip leaders in an emergency.

Changes to this privacy policy

We may update this privacy policy when our systems, activities, service providers or legal obligations change.

The date at the top of this page shows when the policy was last updated. Where a change is particularly significant, we may also notify members through an appropriate UBES communication channel.

Contact us

If you have a question about this policy, want to exercise a data protection right, or have a concern about how your information is being handled, please contact:

ubes-committee@bristol.ac.uk

Privacy Policy