Your Data and Bristol SU
Last revised: 24 June 2025
This page tells you what to expect when Bristol SU (“the Students’ Union”, “we”, “us”) collects or processes your personal information. All data is held in accordance with the guidelines set out in the General Data Protection Regulation (GDPR) and the Privacy of Electronic Communication Regulation (PECR) and the incoming Data Use and Access Act 2025 (DUAA).
We think it's important that you have a clear understanding of how your data is being used, and your rights in this space. We've tried to make this policy as clear and transparent as possible.
If you have any questions, or would like anything in this policy explained in more detail please see the contact information at the bottom of this page.
What do we mean by "personal information"?
For us, "personal information" means information which either directly identifies you (like your name, email address, or billing information) or can be reasonably linked or combined to identify you (like a Student ID or library card number). We’ll always be clear about what personal information we’re collecting from you and we'll only ever hold personal information that we actually need.
Any information that falls outside of this is "non-personal information."
If we store your personal information with information that is non-personal, we will consider the combination as personal information.
If we remove all personal information from a set of data then the remaining is non-personal information. We refer to these processes as 'anonymisation' (where the original data has been securely deleted and can never be relinked to your personal information) or 'pseudonymisation' (where anonymised data can be reidentified using a key. In this case, your data is still considered to be personal information.)
How do we learn information about you?
There are three main ways that we gather your personal information:
Personal information provided by you:
When you interact with our website and services we might require you to give us your information to adequately deliver that service
You might give us your personal data by filling in forms on our website, by registering to use our website, joining a student group, booking tickets to events or registering to be updated on upcoming events.
In addition where you book or purchase tickets for events, join a student group or use on of our services we may ask for the following information such as: your date of birth to ensure compliance with age-related law, your bank details to facilitate payments or information relating to your health or emergency contacts if you take part in a high risk activity.
Personal information provided by The University:
If you are a student at the University of Bristol some of your personal data is shared with us by the University of Bristol to enable us to perform our functions as your Students’ Union.
The University share the following information about your course and study with us:
| Data Set | Example | How we use it |
| University email address | ab12345@bristol.ac.uk | Communications, account administration, event attendee information, Volunteering information, Intramural participant information, Academic Rep information |
| Forename | Joe | Tailored communications, event attendee information, Volunteering information, Intramural participant information, Academic Rep information |
| Surname | Bloggs | Tailored communications, event attendee information, Volunteering information, Intramural participant information, Academic Rep information |
| Term time address |
Senate House |
Service improvement, demographic analysis |
| Year of study | 1 | Tailored communications, election eligibility, demographic analysis |
| Level of study | PGT | Tailored communications, election eligibility, demographic analysis, group eligibility |
| Student ID number | ab12345 | Linking datasets, account administration, group eligibility |
| Date of birth | 1/1/2001 | Election eligibility, demographic analysis |
| School | School of Physics | Election eligibility |
| Faculty | Faculty of Science | Election eligibility |
| Programme code | BSU0001 | Election eligibility |
| Nationality (From ISO code) | GBR | Tailored communications, demographic analysis |
| Domicile Country (From ISO code) | GBR | Tailored communications, demographic analysis |
| Fee status | UK, EU, IN | Election eligibility, demographic analysis |
| Personal email address | bristolsu@bristol.ac.uk | Account administration |
| Course start date | 1/9/2024 | Account administration, election eligibility |
| Course end date | 31/7/2027 | Account administration, election eligibility |
| U Card number | 1234567890 | Event attendee information, Linking datasets |
The University also shares some of your special category demographic data with us:
| Data Set |
OptionsThe below definitions are provided by the ONS and don't necessary reflect the language that we would choose to use. Where appropriate we use more modern language and map the data sets to ONS provided definitions.
|
How we use it |
| Sex | Female, Male, Not Listed, Not Answered | election eligibility, tailored communications, demographic analysis, service improvement, reporting against charitable objectives |
| Sexual Orientation |
Higher Education Statistics Agency (HESA) Definitions, are provided by the Office for National Statistics (ONS). These are: Code, Label: |
election eligibility, tailored communications, demographic analysis, service improvement, reporting against charitable objectives |
| Gender identity matches sex assigned at birth | Yes, No, Not Answered | election eligibility, tailored communications, demographic analysis, service improvement, reporting against charitable objectives |
| Reported disability category | Awaiting categories (This section will be updated when we receive this information) | election eligibility, tailored communications, demographic analysis, service improvement, reporting against charitable objectives |
| Ethnicity |
Higher Education Statistics Agency (HESA) Definitions, are provided by the Office for National Statistics (ONS). These are: Code, Label |
election eligibility, tailored communications, demographic analysis, service improvement, reporting against charitable objectives |
This sharing of data is governed by a formal Data Sharing Agreement (DSA) with the University that dictates how and when your data is shared, the lawful basis for doing so and the ways in which your data can be accessed and stored.
You can learn more about how we use your personal information below, or by clicking here.
Automated Information
We automatically receive and save certain types of information whenever you interact with this website. We use the information to monitor website traffic and to assist with the navigation and user experience of the website.
Information that we will automatically receive includes:
-
Requested URL (the page on our website you are currently viewing)
-
IP (Internet Protocol) addressIt is possible for IP addresses to be traced to individuals. Bristol SU is not aware of any situation when IP addresses captured during everyday businesses would be used, except where there was systems or security need, such as to prove fraud.(this may or may not identify a specific computer)
-
Referring URL (the name of the website where you clicked a link to the Bristol SU website e.g. Google Search, Instagram etc.)
-
Software (browser/operating system) used to access the page e.g. Google Chrome, Firefox etc.
-
Date and time pages were visited
-
The device used to access our website e.g. desktop, iPhone SE etc.
This information isn't generally linked to you specifically and tends to be used to find out more about how our website is used.
Demographic and statistical information about user behaviour may be collected and used to analyse the popularity and effectiveness of the website. Any disclosure of this information will be in aggregate form and will not identify individual users.
Bristol SU also uses services from Google on this website (Google Analytics, Google Webmaster Tools) to measure and analyse visitor information.
Tracking cookies for Meta products (Facebook, Instagram etc.) and Snap Inc (SnapChat) are used to understand more about our website users. If you actively use the above services, we may use this information to tailor our advertising and to analyse the performance of our adverts.
Bristol SU also uses more in-depth analysis tools like HotJar to capture usage information about our websites including recordings of user sessions and pop up surveys. This information is used to improve our service and resolve website issues and don't provide your personal information without explicitly asking.
Bristol SU will not (nor will it allow any third party to) use the statistical analytics tools to track or to collect personally identifiable information of visitors to this website. Bristol SU will not associate any data gathered with any personally identifying information from any source as part of our use of the statistical analytics tools.
What do we do with your information once we have it?
| Activity | Description |
| Communications |
Used to send emails from Bristol SU. You have the option to opt out of communication and commercial emails, however there are some emails we're required to send you by law. Such as emails about our elections, membership meetings and elected representative activity. We may also be contractually obligated to send you some emails such as receipts and tickets. |
| Tailored Communications | Used to customise or segment emails from Bristol SU to make them more relevant. For example, we might target an email with Postgraduate specific events. |
| Account Administration | Used to make sure your Bristol SU account can function properly or to link duplicate accounts together. |
| Event Attendee Information | Shared with event organisers or linked to ticket redemption systems to enable them to keep track of who can access events. May also include information about access or dietary requirements. |
| Volunteering Information | Used to capture information about our Volunteers, the opportunities they've taken part in and for safeguarding. May be shared with Volunteering organisations if consent given. |
| Intramural Participant Information | Used to capture information about students taking part in Intramural and the sports they've taken part in. Information may be shared with club captains or used for health and safety and safeguarding purposes. |
| Academic Rep Information | Used to record information about our Academic Reps if applicable. This information may be shared with the University and made available to the wider student body. |
| Service Improvement | Used to find out more about how our services are used and opportunities to improve them. For example, we might use aggregated postcode data to decide where we host events. |
| Demographic Analysis | Aggregated datasets used to understand how students are using our services and taking part in activities, identifying cohorts of students who are under represented and how satisfied different students are with their SU. |
| Election Eligibility | Used to make sure students can nominate themselves for, and vote in the correct elections. For example, A second year Maths student being able to nominate themselves to be the rep for that course. |
| Group Eligibility | Used to make sure students can join clubs and societies. |
| Linking Datasets | Used to connect student records across a range of systems. For example the Bristol SU website and our Volunteering Hub. |
| Reporting against charitable objectives |
Used to report against our charitable mission of being "A Union for All." Ensuring our provision is available and accessible to all students regardless of background and that we're actively working to engage students who have yet to make use of their SU. |
When do we share your information?
We use the term 'sharing' to cover a few types of action. Sharing can mean directly giving information to another party (a bit like sharing an Instagram post on What'sApp) or moving your data from one system to another (for example copying text from a Word document to a PowerPoint slide).
There are some ways that we will never share your information. We won't:
-
Sell, or otherwise provide your information to third parties in exchange for financial compensation or in return for good and services.
-
Use your information to train AI Large Language Models (LLMs) e.g. ChatGPT or use AI tools to otherwise process your information unless you have given us explicit permission (for example, to provide translation services.)
-
Use tools to process your data that don't meet our standard for data protection and compliance.
We could share your information in the following circumstances:
-
For analytics reasons, to improve our services and provide improvements to the wider University community. When we do this we will remove your personal identifying information and aggregate it in a way that minimises the risk of your information being re-identified.
-
For internal analysis we may need to move your information between tools. For example, moving a survey response from SurveyMonkey to Power BI. When we do this we will pseudonymise your information and fully anonymise it in line with our retention policies.
-
To provide a product or service. For example, if you order something from the SU shop we would need to give your name and address to a postal service or if you told us you had an allergy or access need we might need to share that with an event organiser.
-
When we move to different services. For example, if we changed our website provider we would migrate your information to a new platform.
-
When we believe it is necessary to prevent serious harm to you, or someone else. We will only share information in this way if we have a good faith belief that the sharing is necessary to protect the safety of you, other members of the student community or the public. For example, a disclosure to the Student Resolution Service, Wellbeing Services, Campus Security or the police. Data will only ever be shared to relevant professional staff.
-
In other instances where we've asked for your explicit consent.
How do we store and protect your personal information?
We're committed to protecting your personal data, following business and technical policies to keep your data safe and secure.
We observe the following practices:
- Information is only stored and processed on platforms that meet ISO/IEC 27001 standards (an internationally recognised framework for managing information security) and that use data warehouses located in the UK or a country with adequate levels of data security legislation, in compliance with GDPR
- A principle of data minimisation, meaning that we only hold data that we need to use.
- Deletion or anonymisation of data in line with our retention policies.
- Minimising access to your data so that staff members are only able to access what they need to fulfil their roles at the SU
If, despite our efforts, we learn of a data breach we will inform anyone who has been affected so that they can take appropriate protective steps, we will share an audit detailing what personal information was affected and in the event of a significant breach report it to the University and the Information Commissioner’s Office (ICO).
How long do we hold your data for?
We maintain a record of your activity with Bristol SU for the duration of your study and for 365 days after your course ends. After this time any identifying data in your account will be anonymised and cannot be used to re-identify you.
If you return to study in the year after graduating (prior to account anonymisation) your account will be reactivated and anonymised 365 days after your new period of study has ended.
If you opt out of Student Union membership or otherwise request for your information to be deleted we will maintain a record of your student ID (ab12345) and course finishing date to ensure that your data is no longer processed. This information will be held until 365 days after your course end date.
What if we change this, or any of our other privacy notices?
We review these policies annually, but from time to time we may need to update this and other privacy notices on an ad-hoc basis.
If we significantly change this agreement or our other privacy notices or expand the range of personal identifying information we collect we'll get in touch to let you know. We'll do this by emailing the primary email address that we have on file for you. If you're a current student this will be your University email address (the one that looks like ab12345@bristol.ac.uk or firstname.lastname@bristol.ac.uk).
If we make a minor change, or a change that doesn't increase the scope of the data we'll capture then we won't message you, but will update the last edited time at the top of this page and highlight changes from the previous version to enable you to review how your data is being used.
Get in touch with Bristol SU
If you've got any questions about how we use your data please email bristolsu@bristol.ac.uk.
Requesting a copy of your data that we hold
You have the right to ask us for a copy of your personal data that we hold. To do so, please complete the Subject Data Access Form and email it to bristolsu@bristol.ac.uk with the subject line "Data Subject Access Request" making sure to include proof of your identity.
We will respond to your request within 30 days with the information you've requested or to let you know we need an extension if your request is complex. We may reject your request if you can't prove your identity or if you submit a large quantity of requests within a short period of time.
Let us know if our data is inaccurate
We'll do our utmost to ensure your information is up to date and accurate but if you spot something you'd like amended please let us know by emailing bristolsu@bristol.ac.uk with the subject line "Data Correction Request." In many cases you can also update this information by logging into your account and navigating to your profile.
We appreciate that for many reasons you might change your name during your time at university, or choose to go by a name that's different to what's on record with the University. You can make this change by editing your profile at any time.
We'll do our best to respect your changes here, but please be aware that the changes may revert when we get updated data files from the University. To avoid this, it's worth also updating your name preferences with the University data team where appropriate.
It may also take some time for our other systems to update when you make changes, especially for things like personalised emails that we send. Please accept our apologies if this happens.
If you've changed your name and it hasn't updated across our systems get in touch at bristolsu@bristol.ac.uk.
Ask us to stop processing your data
Due to the laws governing Student Unions if you'd like to completely opt out of data processing you'll need to surrender your membership to Bristol SU.
This would remove your access to:
- Affiliated student societies and sports clubs
- Democratic events (Student Council and the Annual Members Meeting)
- Voting in SU Elections
- Bristol SU events
You would still be able to access:
- Bristol SU Academic Advice
- Bristol SU's Housing Advice service
- Bristol SU spaces on campus (e.g. The Balloon Bar, Bristol SU Living Room)
- Bristol SU Lettings
To surrender your membership to Bristol SU please email bristolsu@bristol.ac.uk with the subject line "Suspend Bristol SU membership."
Learn more about your personal data rights
In addition to the information on this page you can find out more about your individual rights by visiting the ICO's information pages.
