Privacy Notice

This Notice sets out the basis on which any personal data we at UCC Students Union (UCC SU) collect from you, or from others, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

This Notice is divided into several sections – if you click on a heading in the Table of Contents, you will be taken directly to that section. More detailed information is available in several sections, or on request in some instances.

Table of Contents

1.     Who are we? How can you contact us? 3

2.     What information about me do you collect & use? Where do we get your personal data from? 4

3.     Do you collect information from children (under 16yr olds)? 6

4.     How and why do we use your personal information? 7

5.     Do you share my information? 10

6.     Is my information sent outside the European Union? 11

7.     What is the legal basis for you collecting and processing my information? 12

8.     What are my rights, and how do I exercise them? 1

9.     Can I stop getting emails, text messages and other communications from you? 3

10.        Is my information secure? 3

11.        How long do you keep my information? 5

12.        How do you contact us? 5

13.        Miscellaneous/Photos 6

14.        Links to other sites 6

15.        Social Networks 6

16.        Changes to this Notice 7

1.Who are we?
How can you contact us?

“We” are UCC Students Union,(“UCC SU”).

This Notice applies to UCC SU as the DATA CONTROLLER for the purposes of the General Data Protection Regulation EU2016/679, and the Data Protection Acts 1988 – 2018 .

For data protection issues, please email our Data Protection Officer at dpo@uccsu.ie

2.What information about me do you collect & use? Where do we get your personal data from?

“Personal Data” is data that can identify you, either directly or indirectly, as an identified or identifiable individual.”

There are many elements of Personal data which may be sought and recorded at enrolment and may be collated and compiled during the course of participation with us.

At all times we are conscious that our processing of personal data, including sensitive personal data will be limited to only what is necessary and proportionate for the purposes for which it is collected.

We receive the following data directly from University College Cork following your enrollment as a Student:

i.          Student ID Number;

ii.         Forename;

iii.        Surname;

iv.        Date of Birth;

v.         Gender;

vi.        University email address;

vii.       Fee Status;

xi.        Year of Study;

xii.       Course Start Date;

xiii.      Course End Date;

xiv.       Department of Study;

When you use our services, we may obtain personal data from others to include: University College Cork, Government Agencies and Community Services, or your authorised Representatives or involved agencies and statutory bodies.

Also, the UCC SU collects, and processes additional data based upon:

i.          Participation in Union activities and services;

ii.         Participation in market research and student voice survey initiatives;

iii.        Bank details for the processing of expense claims should this be required;

v.         Election to a representative post or function and election form details;

vi.        Use of the student advice service;

ix.        The joining of sports clubs and societies;

x.         Photos and film footage from Union events and CCTV images from the student common room (as CCTV is used in the common room to monitor health and safety standards and for security);

xi.        Applying for employment opportunities within the organisation;

You may also give us personal data by:

• Corresponding with us by phone, e-mail or otherwise. We ask you to disclose only as much information as is necessary to provide you with our services or to submit a question/suggestion/comment in relation to our services.
• Filling in forms on the website, via download or in person UCC SU will use the personal information you provide in connection with our projects and services.
• your Personal Data that will be collected and processed for the purposes of the various programs including to facilitate the operation, management and coordination of these services including the Leap card. Personal Data relating to your emergency contacts and parents or guardian details for under 18s may be processed by us.
• Taking part in events. Photographs and recorded images of attendees are taken to celebrate students’ achievements.
• Applying to work with us. The type of information you may provide in your CV, a cover letter, your name, address, e-mail address and phone number. CVs should include information relevant to your employment history and education (degrees obtained, places worked, positions held, relevant awards, and so forth). When you apply to work with us we may share your Personal Data with our various Funders and or Auditors.
• The processing of your Personal Data may include personal data relating to your socio-economic background such as your ethnic or cultural background and/or living circumstances) or otherwise which is regarded as Special category data.
• Garda Vetting
  • Where required, as stipulated in The National Vetting Bureau (Children and Vulnerable Persons) Acts 2012 to 2016 all staff, volunteers, voluntary officers and other individuals who provide services to us and who interact with children or vulnerable persons must be vetted by An Gardaí Síochána.
  • Garda Vetting is a procedure through which An Garda Síochána is asked, with a person’s permission, to disclose any information held on Garda file. The vetting process requires the provision of verified proof of identify and proof of address by all vetting candidates and, subsequently, checks by An Gardaí Síochána of their records The purpose for processing your Personal Data in this context is that it is necessary to comply with our legal obligations under the National Vetting Bureau (Children and Vulnerable Persons) Acts 2012 to 2016.

We may also process other data, which is not personal data.

When you access our website your device’s browser provides us with information such as your IP address, browser type, access time and referring URL which is collected and used to compile statistical data. This information may be used to help us to improve our website and the services we offer, and to offer services to you.

3.Do you collect information from children (under 16yr olds)?

Children’s Personal Data: We do collect and manage information about children. Where possible and appropriate we will seek consent from a parent or guardian before collecting information about children.

4.How and why do we use your personal information?

UCC SU collects a variety of different personal data to ensure we fulfil our obligations to represent students and conduct fair and democratic elections and to ensure we meet our objectives.

In summary, we use the personal data we hold:

1. To provide an interactive website that provides information that you’re most interested in.

1. To facilitate student activities and groups that you express interest in or join such as sports, societies and volunteering.

1. To communicate membership services and opportunities that aid your student experience.

1. To undertake diversity monitoring and engagement to ensure we can engage and fully represent you.

1. To gain representational insight to allow elected representatives to fully represent your views at University committees and meetings.

1. To support students to resolve issues, complaints and disputes with the University or external organisations and bodies.

1. To communicate social and cultural activities run by the UCC SU or closely chosen partner providers.

1. To promote the events and services of the UCC SU through social media, publications, online content and other relevant digital media mediums.

1. To facilitate democratic processes

1. To provide welfare support to the student community.

1. To provide event ticketing for UCC SU events/activities and sports and societies events/activities to ensure smooth and effective administration.

1. To otherwise deliver services to students or to meet our statutory, regulatory or commercial obligations.

1. To administer and improve our website and for internal operations, including troubleshooting, and statistical and survey purposes where consent is given; as part of our efforts to keep our website safe and secure;

Special Category Data and the lawful basis for that processing activity.

The processing of your Personal Data may include personal data relating to your socio economic background such as your ethnic or cultural background and/or living circumstances, your health and wellbeing or otherwise which is regarded as Special category of Personal data under the GDPR.

The legal bases for the processing of your special category data or sensitive data are:

• That you have explicitly provided consent.
• Processing necessary for compliance with a legal obligation to which we are subject.

Where data is collected and processed, explicit and informed consent is gained at the point of the collection which can be withdrawn at any point by contacting dpo@uccsu.ie

5.Do you share my information?

We may share your personal data with our selected suppliers and contractors to provide you with our services. The Personal Data held on your record will be disclosed to relevant staff/volunteers of UCC SU and other parties on a need-to know basis. All staff/volunteers are made aware of the procedures they must follow to ensure your Personal Data is appropriately protected.

The Personal Data you provide may be disclosed to third parties if we are under a duty to disclose or share your Personal Data in order to comply with any legal or regulatory obligation or request or to perform a public function. It may also be necessary to disclose your Personal Data to comply with reporting obligations where you are a participant of a European Union co-funded programme and the transfer of your personal data is required by that programme. Some of your Personal Data will be disclosed to allow monitoring, reporting and evaluating of programmes where the programme is co-funded by the European Union.

We may also disclose your Personal Data to governmental, regulatory and/or public bodies.

In addition, we may disclose your personal information to third parties:

• If we are under a duty to disclose or share your information in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect our rights, property, or safety, our students, or others.
• Statutory and regulatory bodies (including central and local government) and law enforcement authorities in order to comply with any applicable laws, grant applications and /or court orders.
• Your Authorised representatives.
• Third parties with whom: (i) we need to share your information to facilitate transactions you have requested, and/or (ii) you ask us to share your information.

6.Is my information sent outside the European Union?

We will, from time to time, make use of services provided by 3rd parties for the delivery of our services which may necessitate the transfer of personal data outside the EU/EEA. For example, we use a variety of cloud-based tools such as Office 365/Microsoft. Where Personal Data needs to be transferred or processed outside the EU/EEA, we chose providers who process Personal Data on the basis of

•  Standard Contractual Clause (s)(SCC’s)
• An Adequacy Decision from the European Commission.
• Technical and Organisational measures where SCCs alone are not sufficient.

7.What is the legal basis for you collecting and processing my information?

Irish and EU law sets out the grounds upon which data controllers such as UCC SU can rely on to lawfully process personal data.

We rely on the following grounds:

1. Student data collection and processing is undertaken on the legal basis of the UCC SU being required to do so to fulfil a legal contract which is signed by students upon joining University College Cork or on the basis of legitimate interest, depending on the nature of the data collected and its purposes.

1. You become a member of UCC SU from the enrolment process and you can withdraw from UCC SU at anytime by emailing us directly at dpo@uccsu.ie

1. Additionally, UCC SU data collection and processing concerning student representation and elections is conducted in order to allow for the UCC SU to fulfil its duties as the representative voice of the students and conducting fair and democratic elections.

1. Where you have given us consent to the processing of your personal data for a specific purpose, for example for marketing purposes