Introduction

Hallam Students' Union is a 'data controller'. This means that we are responsible for deciding how we hold and use your personal data. We process personal data in accordance with Data Protection Act 2018 (DPA), the UK General Data Protection Regulations 2018 (UK GDPR) and other applicable legislation.

Hallam Students' Union ("HSU", "we", "our" or "us") promises to respect any personal data that you share with us, or that we get from other organisations, and keep it safe. We aim to be clear when we collect your data and to not do anything you wouldn't reasonably expect.

Developing a better understanding of our members through your personal data allows us to; make better decisions, communicate more efficiently, and ultimately help us to provide our range of services, thereby reaching our goal of having a positive impact on every Hallam student.

This Privacy Notice applies to:

  • Current students
  • Prospective students

Contact details

We have appointed a Data Protection Officer (DPO), who can be contacted should you have any questions regarding the ways in which your data is processed.

Address: Hallam Students' Union, 1 Howard Street, Sheffield, S1 2LW
Phone: 0114 697 3455
DPO email: dpo@bruceandbutler.com

How we collect your personal data

We collect information about you in the following ways:

When you become a member

Each year that you enrol on a Sheffield Hallam University (SHU) accredited course, you automatically become a member of HSU, unless you opt out. SHU shares a register of members with us, which includes information about you and your course. When the University gives us a copy of this data, we become responsible for it and use this as our core central record of your membership.

When you give it to us directly

You may give us your information when you sign up to a student group, for one of our events, undertake research activities, use our advice service, purchase our products, or communicate with us. When you give us this information, we take responsibility for looking after it and ensuring it is secure, and we may cross reference this data against our register of members.

When you give it to us indirectly

Your information may be shared with us by independent organisations, if you have given them consent to share this data with us. You should check their Privacy Policy when you provide your information to fully understand how they will process your data.

We may combine information you provide to us with information available from external sources to gain a better understanding of our members, to improve our communication methods, products, and services.

The information we get from other organisations may depend on their privacy settings or the responses you give, so you should regularly check them. This information may come from the following sources:

  • Third party organisations: You may have provided permission for a company or other organisation to share your data with third parties such as HSU. This could be when you buy a product or service, register for an online competition, or sign up with a comparison site.
  • Social media: We do not use the accounts of people who 'follow', 'like' or similar social media actions, except for interaction on that social media platform.
  • Information available publicly: This may include information found in places such as Companies House and information that has been published in articles or newspapers.

When we collect it as you use our WEBSITES

Like most websites, we use "cookies" to help us make our site, and the way you use it, better. There are more details in our Cookie Policy, found on the HSU website.

When you BUY A PRODUCT from us

When you place an order with us online, we request certain information including your name, delivery address, and email address.

This information is required to enable us to process your order and notify you of its progress. Once an order has been placed, we may contact you by email to confirm your order details, and again once your order has been accepted and dispatched. Should we need to contact you for any reason regarding your order, we will use the email address registered to your account, or the telephone number where provided.

We also ask for your Student ID number; to allow us to track the products you purchase, provide better customer service standards, and develop the product range we offer to students. You are under no obligation to provide us with this information.

What personal data we collect and how we use it

The type and quantity of information we collect and how we use it depends on why you are providing it.

Our members

If you are one of our members, the University, in line with their obligations to you, provide us with key information that you provide at enrolment. When you use our services or participate in one of our activities, we will use this information to provide the best possible standards of administration and communication.

Personal data you provide to the University on enrolment that is provided to HSU includes:

  • Identity data: student number, first name, last name, image data, date of birth (DOB), gender.
  • Contact data: email address, phone number, home address, term time address.
  • Education data: details of your course and length of study.

When you attend an event, join a student group, or use one of our services, we may ask for additional information such as:

  • Your date of birth, to ensure compliance with age-related laws.
  • Your bank details, to facilitate payments.
  • Information relating to your health if you are taking part in a high-risk activity.
  • Any disabilities, so we can provide assistance where needed.
  • Information you provide when filling out surveys. This may include sensitive or demographic data.
  • Emergency contact details.

We process your information for the following reasons:

  • To provide you with the services, products, or information you asked for.
  • To administer your membership at HSU.
  • To keep a record of your relationship with us.
  • To ensure we know how you prefer to be contacted and answer any enquiries you make to us.
  • To enhance your customer service experience through our AI driven chatbot feature.
  • To enable you to receive marketing or take part in our feedback surveys.
  • To understand how we can improve our services, products, or information through anonymised data analysis.
  • To review and act upon incidents/concerns to safeguard students.
  • To keep on top of events and trips that you may have signed up to.
  • To sign you up for elections and keep a record of your voting history.
  • To manage Course Reps.
  • To sign you up to our wellbeing service, workshops, and subscription schemes.
  • To produce internal reports and analytics using student activity data.

We rely on the following lawful basis for processing your information:

  • Where we respond or answer queries, we process data under Article (6)(f) Legitimate interests.
  • Where we manage and provide students with advice, we do so under Article (6)(f) Legitimate Interests.
  • Where we act on your behalf and share your information with relevant third parties, this is done with Article (6)(a) Consent.
  • Where your enquiry to advice may be reviewed as part of a quality audit, we get your authority to do so – Article (6)(a) Consent.
  • Where you agree to receive marketing, we contact you using your personal data under Article 6(a) Consent.
  • Where you purchase tickets for events, we process this data under Article (6)(b) Performance of a contract.
  • Where you sign up for societies and trips, we process this data under Article (6)(f) Legitimate Interests.
  • Where we reach out to external agencies with safeguarding concerns, we process this data under Article 6(f) Legitimate Interests.
  • Where you sign up to our wellbeing service, we process this data under Article (6)(a) Consent.
  • Where we process your data received to understand how students engage with Students’ Union activities. We do this by transferring data from our Membership Management System, Membership Solutions Ltd, to our CRM and analytics platform, HubSpot. This involves temporarily storing your data in our secure Google Cloud setup as a staging area under Article 6(f) Legitimate Interests.

Building profiles of members and targeting communications

Where you have given us consent, we use profiling and screening techniques to ensure communications are relevant and timely, and to provide an improved experience for our members. Profiling also allows us to target our resources effectively, which members consistently tell us is a key priority. We do this because it allows us to understand the background of the people who study at the University and helps us to deliver appropriate services and information to members who need it.

When building a profile, we may analyse geographic, demographic, and other information relating to you to better understand your interests and preferences to contact you with the most relevant communications. Your data would only ever be analysed or profiled through encrypted and protected data processes, which only ever identifies broad statistics. In doing this, we may use additional information from third party sources when it is available.

How we keep your data safe, how long we hold it for, and who has access

Personal data collected and processed by us may be shared with and used by relevant Students' Union employees and volunteers, only for legitimate reasons, and the following groups: Advisers, Agents, Contractors, and Service Provider partners, where necessary. This includes, where necessary, the use of an external professional adviser acting on behalf of HSU. This provider acts as a data processor and operates only within HSU's systems under a Data Processing Agreement. This means they only handle your personal data in line with our instructions, with the sole purpose of delivering advice to you.

In the exceptional cases that we allow access to personal information, we will always have control of what they see, what they are allowed to do with it, and how long they can see it.

We undertake regular reviews of who has access to information that we hold, to ensure your information is only accessible by appropriately trained staff, volunteers, and contractors, and for legitimate purposes.

When you submit a query to HSU, your submission will go through to our CRM system, HubSpot, where it may be viewed by the wider Outreach team before being responded to in the first instance, or triaged to the relevant team. If you are uncomfortable with your query being viewed by the Outreach team, please send your communication directly to the team who you wish to deal with your query or tick the box in our 'Ask us' form which denotes that your query includes sensitive data. Your data will typically be held within HubSpot for 3 years, or for the length of time that you study with the University.

In line with the UK data protection legislation, we only collect sufficient personal data that is required for each specified purpose, and it is only retained as long as is reasonably required. In most areas of our operations, personal data is deleted at the end of the academic year. Notable exceptions being for example current society committee members, current advice cases, or where required to keep them for example by law or for insurance purposes.

Some of our suppliers may run their operations outside the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to make sure we provide only relevant data and that they provide an adequate level of protection in accordance with UK data protection law. By submitting your personal information to us you agree to this transfer, storing, or processing at a location outside the EEA.

We may need to disclose your details, if required, to the police, regulatory bodies, or legal advisors. We will only share your data in other circumstances, other than as explained elsewhere in this notice, if we have your explicit and informed consent.

Marketing and communications preferences

Membership communications

As a member, we believe there is a legitimate interest in you hearing from us about the products and services we offer, what we're doing to represent you, and opportunities that might be of interest to you. You may opt-out of these communications at any stage by clicking the unsubscribe link contained within emails or by amending your preferences on your account.

Direct marketing

As a charity we need to fundraise, to provide the services that we offer to SHU students, through retail and events activities. We may send marketing material on our retail and events offers to our members, where you have told us that we can. We do not sell or share personal details to third parties for the purposes of marketing.

Controlling what you want to hear about

We make it easy for you to tell us how you want us to communicate, in a way that suits you. We include information on how to opt-out when we send you marketing, and our forms have clear marketing preference questions. If you don't want to hear from us, that's fine, just let us know by updating your preferences.

Keeping your information up to date

We mostly use the record of members provided by SHU to maintain data about you as described above. To ensure data held is accurate, both HSU and Sheffield Hallam University would appreciate you updating SHU if your details change.

Understanding the detail of our data security measures

We have compiled a register of all personal data sets held by HSU. For each data set we carefully assess the lawful justification for its storage and use, the parameters in which the data is processed, the length of time the data is held for, the secure storage location of your data, and, where applicable, undertaken impact assessments to ensure your rights are protected.

HSU operates a Data Protection and Information Security Policy, supported by a practical handbook for our employees and volunteers. All employees and volunteers handling data are required to undertake general data protection training and third parties handling data are required to provide a contract which meets the requirements of the Information Commissioner's Office.

HSU does not store any sensitive card data on our systems following online or face to face transactions. For online transactions, HSU utilises payment processor SagePay and ecommerce partner MSL to handle these matters.

Your rights under the UK GDPR

The right to erasure: You have the right to ask us to delete your personal data that we hold, and if it's not necessary for the purpose you provided it to us for (e.g. processing your membership or registering you for an event), we will do so. Please contact our Data Protection Officer at dpo@bruceandbutler.com if you would like to express this right.

The right of access: You have a right to request a copy of the information we hold about you. If there are any discrepancies in the information we provide, please let us know and we will correct them.

If you want to access your information, you can complete the Subject Access Request Form, available through the Students' Union website, with a description of the information you want to see and send this with the required proof of your identity by post to Hallam Students' Union, 1 Howard Street, Sheffield, S1 2LW. Alternatively, you can make this request by emailing the DPO at dpo@bruceandbutler.com along with suitable proof of identification.

The right to object: You can ask for your data to be no longer processed if we use it for direct marketing purposes. There will also be circumstances where you can object to the processing of your personal data where we rely on legitimate interests. However, in some cases we may demonstrate that we have compelling legitimate reasons to process your data which override your rights and freedoms.

The right to rectification: You have the right for the personal data we hold on you to be corrected, enabling you to correct any inaccurate or incomplete personal data that we hold on you.

The right to restrict processing: You can suspend the processing of your personal data where you request that we verify the accuracy of your data, where you may need us to hold data so that you can establish, exercise, or defend legal claims, where you believe we are processing your data unlawfully, or you have objected to our use of your data and we need to verify whether our legitimate grounds override your rights and freedoms in the circumstances.

The right to data portability: You can request that data is transferred to you or another third party of your choice in a structured, commonly used, machine-readable format. This right only applies to automated processing based on student's consent or where we use the information to perform a contract with you.

The right not to be subject to automated decision-making: You have the right to understand the reasons for decisions made about you by automated processing, as well as challenge decisions based solely on automated processing where no human intervention was involved. Note that this can only be done if the decision has an impact on your legal rights, or other matters of significance whereby you are adversely affected.

Opting out

Communication preference options are available on your account, but if you want to opt-out of all communications and data processing you will be required to surrender your membership to the Students' Union, which will limit your access to activities and services. You can do this by writing to:

  • Data Protection Officer, Hallam Students' Union, 1 Howard Street, Sheffield, S1 2LW

As a member-led charitable organisation, it is important that our elected representatives are publicly accountable to members. We publish the names of all elected representatives alongside their assigned @shu.ac.uk email addresses; we may also publish University email addresses where appropriate to the individual and their role. Where University email addresses (@shu.ac.uk) are published, the individual will be entitled to opt-out of this through means provided or contacting the Students' Union Data Protection Officer. Committee members may currently opt-out of sharing their email with group members by updating their profile on the Students' Union's membership system.

Not happy?

If you are unhappy with any of the information in this Privacy Notice, or want further information on the above rights, please reach out to the Data Protection Officer at dpo@bruceandbutler.com.

You also have the right to complain to the supervisory authority, who are the Information Commissioner's Office (ICO) in the UK.

ICO contact details can be found at www.ico.org.uk; however, please do express your concerns to us first as we would be grateful for the opportunity to deal with your concerns in the first instance.

Changes to this Privacy Notice

We may change this Privacy Notice from time to time. If we make any significant changes in the way that we treat your personal information, we will make this clear on our website or by contacting you directly.

If you have any questions, comments, or suggestions, please let us know by contacting dpo@bruceandbutler.com.

Last updated: January 2026