Privacy Notice

Student Hubs Privacy Policy

v2024072401

Privacy Statement

At Student Hubs, we are committed to protecting and respecting your personal data. The data that we gather and hold is managed in accordance with the General Data Protection Regulations (GDPR) 2018, now UK GDPR 2021.  This privacy policy explains how we use any personal information that we collect about you when you engage with any of our activities or services, with effect from 25 May 2018.

1. 1. Who are we?

Student Hubs is a national charity working in universities across the UK to transform student involvement in charitable activities and social action. We are a registered charity in England and Wales (number 1122328.)

After 16 years of student social action Student Hubs is closing on 31 January 2025. Over the next six months our activities will be focused on developing toolkits, facilitating webinars and closing the organisation well. 

For the past 16 years we have supported students to develop skills and knowledge through practical volunteering, skilled placements in charities and social enterprises, and through incubation of new community projects and social ventures. Our activities have included: student-led community volunteering projects; internship and consultancy placements, conferences; training and events. 

This privacy notice outlines our ongoing commitment to collecting, storing and processing your data well. Upon closure only personal data required for legal purposes will be retained, if you have any questions about the status of your data reach out to our Data Protection Officer at sophie.payne@studenthubs.org.

1. 2. How can you contact us?

You can contact our team on info@studenthubs.org.

The Student Hubs Data Protection Officer, responsible for data protection across the network and the overall organisation, is Sophie Payne. They can be contacted on sophie.payne@studenthubs.org.

1. 3. What data do we collect from you and how do we use it?

Below, we’ve outlined the different ways in which we collect and process data from people engaging across our activities and services. Whenever we process data for these purposes we will ensure that we always keep your personal data rights in high regard and take account of these rights.

3.1 People who sign up to our Key Social Action Activities (volunteering, skilled placements and incubation) and events and training.

3.1.1 We collect information that you provide when you apply, such as your name, email address and your year of study. This  information is required in order for you to apply to take part in our activities (e.g. a volunteering project or an event). We will only process your data in the following ways where you have given us explicit consent to do so by agreeing to the terms of this privacy notice and opting in using a checkbox. The information that you provide is stored securely on our computer system.

We use a third party provider, Google, to store this information. For more information, please see Google’s privacy policy. 

We use this information to:

• Manage your involvement with an activity (e.g. processing your application, providing you with information about an event that you have signed up to attend, or contacting you to request feedback about your experience of the activity.) This may include sharing basic, specific data (e.g. name and email address) with any community partners with whom we run the specific activities to which you have applied – please see point 4 of the privacy notice for more information about this.

In addition, we use this data in an anonymised form to carry out application analysis, in order to improve how we market our opportunities and to increase the accessibility of our activities.

We also process personal data provided to us in this way for certain legitimate interest purposes, which include some or all of the following:

• Where this processing allows us to enhance, modify, personalise or otherwise improve our services / communications for the benefit of our customers
• To better understand how people interact with our websites (e.g. we might use your data to collect information about your use of our website, including your IP address, browser, how much time you spend on the site, and which pages you visit)
• We may analyse your personal information to create a profile of your interests and preferences so that we can contact you with other information relevant to you, for example we might also use this information to contact you about other similar activities internally (such as a similar volunteering project or our alumni network when you graduate.) You may opt-out of this additional communication at any time.

We will retain this information for up to 10 years in order to conduct long-term, longitudinal impact evaluation.

We use a third party provider, Google, to collect this information. For more information, please see Google’s privacy policy.

3.1.2 We collect equal opportunities data (e.g. your gender, your ethnicity and your household income) that you provide optionally when you apply to take part in our activities.

We use this data in an anonymised form for the following purposes:

• To analyse the demographics of students who engage with us, in order to improve how we market our opportunities and to increase the accessibility of our activities
• To explore how different demographics experience our outcomes. For example cross referencing our evaluation data with equal opportunities data
  
• In our annual impact report, to share our progress towards accessibility targets and to champion the issue of inclusive social action
• In some cases we also share this data with our University delivery partners for Monitoring and Evaluation purposes

We will never process this data in a way that allows you to be personally identified.

We use a third party provider, Google, to collect this information. For more information, please see Google’s privacy policy.

3.1.3 We collect evaluation data that you provide optionally when you complete our end of programme evaluation forms, participate in a case study or give feedback through a different avenue. 

We use this data for the following purposes:

• To improve our programmes according to your feedback
• In our annual impact report and funding reports, to demonstrate the impact we have had
• In funding applications, to demonstrate the impact we could make 

We will retain this information for up to 10 years in order to conduct long-term, longitudinal impact evaluation. Once anonymised and analysed, it will be retained indefinitely. 

We use a third party provider, Google, to collect this information. For more information, please see Google’s privacy policy.

3.2 People who register to hear from us via our newsletters

We collect your name, email address and year of graduation for the following purposes:

• To provide you with information that you have requested (e.g. a newsletter)
• To contact you about other relevant activities internally (such as a similar volunteering project or our alumni network.)

We refresh consent for this kind of marketing every 3 years.

We use a third party provider, Mailchimp, to deliver our newsletters. We gather statistics around email opening and clicks using industry standard technologies, to help us monitor and improve our newsletter. For more information, please see Mailchimp’s privacy notice.

3.3 Visitors to our websites

By using our websites, you’re agreeing to be bound by the terms of this privacy notice.

3.3.1 We collect log data about you whenever you visit our websites. We will only use this data in order to troubleshoot problems with your use of the website (for example, if a page will not load) and never to do any individual profiling of you for marketing purposes. The information that we collect includes: originating IP addresses, internet service providers, the files viewed on our site (e.g. HTML pages, graphics, etc.), operating system versions, device type and timestamps.

3.3.2 We use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this in order to:

• Find out things such as the number of visitors to the various parts of the site
• Make improvements to the ways in which we market our opportunities and how people interact with our websites

This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

3.3.3 Cookies

We use third party tracking services that employ cookies and page tags (also known as web beacons) to collect data about visitors to our websites. This data includes usage and user statistics.

3.3.4 Forms on our website

We have several forms on our website for users to download brochures. We use Gravity Forms to create these forms and information collected is shared with relevant members of the staff team. By completing a form on our website you consent to being contacted under legitimate interests, in relation to the brochure you downloaded. For example if you download our advertising brochure we may reach out over email to discuss advertising opportunities. 

3.4 People who email us

To encrypt and protect email traffic we use Transport Layer Security (TLS) by default, but when a secure connection isn’t available (both sender and recipient need to use TLS to create a secure connection), messages will be delivered over non-secure connections. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit.

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

3.5 General partners

Student Hubs uses a third party provider called Salesforce to manage information about fundraising. For more information, please see Salesforce’s privacy notice.

3.6 Job applicants, current and former Student Hubs employees

3.6.1 What information do we ask for, and why?

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it might affect your application if you don’t. Information that we collect might include:

• Your personal details including name and contact details
• Your previous experience, education, referees and answers to questions relevant to the role you have applied for
• Written tests or interview notes generated at assessment or interview days
• Pre-employment checks (such as proof of your identity and your right to work in the UK)
• An enhanced Criminal Record check via the Disclosure and Barring Service
• A questionnaire about your health. This is to establish your fitness to work and to ensure that we can provide any support or reasonable adjustments required by you

• Bank details – to process salary payments
• Emergency contact details – so we know who to contact in case you have an emergency at work
• We might also contact your referees, using the details you provide in your application, directly to obtain references

3.6.2 How long is the information retained for?

If you are unsuccessful following assessment for the position you have applied for, we may ask if you would like your details to be retained in our talent pool for a period of six months. If you say yes, we would proactively contact you should any further suitable vacancies arise.

If you are successful, the information you provide during the application process will be retained by us as part of your employee file for the duration of your employment plus 2 years following the end of your employment. This includes your criminal records declaration, fitness to work, records of any security checks and references.

If you are unsuccessful at any stage of the process, the information you have provided until that point will be retained for 1 year from the closure of the campaign.

Information generated throughout the assessment process, for example interview notes, is retained by us for 12 months following the closure of the campaign.

3.7 Community Participants

When our activities involve direct community participants (e.g. residents of a local care home who take part in befriending with Student Hubs student volunteers, or young people who are referred to take part in activity days run by Student Hubs student volunteers), we may collect personal data about those community participants in order to manage their involvement with the specific activity, and to ensure that the activities we are providing are safe, efficient and positively impactful.

Where this information is collected by us directly (e.g. through one of our forms sent to the community participant to complete), we will always ensure that we collect informed consent from the community participant (or their parent/guardian if they are under 13) in order to process this data.

Where this information is shared with us by the intermediary community partner (e.g. a school or care home), we will always ensure that we have a data sharing agreement in place with that community partner, that states the legal basis for processing this personal data.

We will destroy the majority of data from community participants 1 year after the end of their engagement with us. Records of concern will be destroyed 6 years after the record has been made and feedback will be retained for 10 years, and after that anonymised and retained indefinitely. 

1. 4. How do we share and transfer your personal data to other organisations?

We will never sell, rent, or trade your personal data. We may disclose your data to service provides who render services to us or on your behalf (e.g. Mailchimp or Google), all of which are

obliged to operate in accordance with applicable laws, including GDPR.

Individual Hubs may also share specific data with affiliated organisations (e.g. partner universities or community partners with whom we run activities), as part of a contractual agreement which includes a data sharing agreement, in place to ensure that any data shared is done so securely and inline with GDPR. For example, basic data collected from students who apply to take part in our activities (3.1.1) may be shared with community partners with whom we work to provide those specific activities to which the student has applied. This is in order to run those specific activities and includes data such as name and email address, so that the community partner can send volunteers details about their volunteering activity. Or we may share information with your university about your engagement with us so that we can learn more about you – ultimately to improve our programmes, and prove the value of the work we are doing

If you have questions about your local Hub’s affiliated organisations and how we share data, please get in touch using the contact details provided at the start of this privacy notice.

We may disclose your information if required by law or to enforce our legal rights. We may also disclose data overriding consent to safeguard where the individual, or others, may be at risk.

Some of our service providers lie outside of the EEA (e.g. Mailchimp and Google.) Therefore, sometimes we transfer your data outside of the EEA. If we do, we ensure your data is processed only in countries that provide an adequate level of protection for your data or where the recipient provides appropriate safeguards.

You can read more about how our service providers comply with GDPR here:

Mailchimp

Google

Gravity Forms

1. 5. What rights do you have?

You are not required to provide any personal data to us. However, your failure to do so may affect our ability to provide you with the services that you request. For example, we are unable to contact you with information about an activity if you do not provide your email address.

We respect your privacy rights and provide you with reasonable access to the Personal Data that you may have provided us. If you wish to access or amend any Personal Data we hold about you, or to request that we delete any information about you, you may contact us at: info@www.studenthubs.org. You will not be required to pay any charge for exercising your rights and we will respond to you within one month.

Please note that while any changes you make will be reflected in our active user databases instantly or within a reasonable time period, we may retain all information you submit for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so

At any time, you may object to the processing of your Personal Data by contacting the above email address, on legitimate grounds, except if otherwise permitted by applicable law.

You also have the right to data portability. You can ask us that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances. 

If you believe your right to privacy granted by applicable data protection laws has been infringed upon, please contact Student Hub’s Data Protection Officer at sophie.payne@www.studenthubs.org. You also have a right to lodge a complaint with the Information Commissioner’s Office (ICO) using the contact details below.

Postal address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

1. 6. How do we retain your personal data and how do we keep it secure?

Internally, your data is shared with staff members responsible for managing the activities with which you are involved. As we are a student-led organisation, your data may also be shared with selected individuals who have been selected as student leaders in accordance with our recruitment policy, and who have signed a data sharing agreement. Data is only shared with individuals who require access in order to provide the services or activities to which you have signed up.

We review our retention periods for personal information on a regular basis. We will hold your personal information on our systems for as long as is necessary for the relevant activity. Please see section 2 above for more information on how long we hold your information for.

We use reasonable organisational, technical and administrative measures to keep any information collected and/or transmitted to us secure. This includes the use of HTTPS with TLS (Transport Layer Security), which encrypts transmitted data, however, no data transmission or storage system can be guaranteed to be 100% secure.

1. 7. How often is this policy reviewed and updated?

We keep our privacy policy under regular review and we will place any updates on this web page. This privacy policy was last updated on 24/07/2024.

v2024072401

v2023090601