LSE Students' Union is committed to ensuring the rights and freedoms of data subjects, and we have policies and procedures in place to aid this. Find out about our data processing, our privacy notices, and how we protect your rights as a data subject.

Privacy Notices

London School of Ecominics Students' Union (LSESU) is committed to protecting and respecting your privacy, whether you are a student, staff member, or other person engaging with Union services.

The Union adheres to LSE's policies on data protection. As part of this, LSESU adopts the LSE Information Security Policy and supporting policies including the Data Protection Policy which can be found at https://www.lse.ac.uk/lse-information/privacy-policy

This privacy notice sets out how any personal data we collect from you through your electronic and/or paper application to LSE will be processed by us. This notice also sets out the basis on which any personal data related to your application which is passed to us by individuals and by third parties is collected and processed. Please read the following carefully to understand how we collect, process and share your personal data.

What are LSESU's data protection obligations?

In accordance with the Data Protection Act (1998) and the GDPR, and any data protection legislation enacted in the UK (the "Data Protection Legislation") we are a data controller and this means that we are legally responsible for the personal data we collect and hold about you. One of our responsibilities is to tell you about the different ways in which we use your personal data – what information we collect, our legal basis for doing so, why we collect it, where we collect it from and whether and with whom we will share it with. We also need to tell you about your rights in relation to your personal data.

LSESU will use the personal data you provide, as well as personal data for which you have given consent for LSESU to receive in order to manage your Union membership, or to enable you to interact with Union services as a non-member. In addition to the information in this statement, you may be given further information about the uses of your personal data when you sign up to use specific services and facilities we offer, and in certain situations, you may be asked whether you give your consent to us processing information about you.

LSESU agrees that Personal Data shall be:

  • processed lawfully, fairly and in a transparent manner in relation to the data subject.
  • collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
  • adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.
  • accurate and, where necessary, kept up to date.
  • kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed, in accordance with LSE and LSESU data retention schedules designed for this purpose;
  • processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures
  • be able to demonstrate compliance with the above principles

Data sharing agreement

We have a Data Sharing Agreement with the London School Of Economics, which enables the sharing of our members data. This agreement details what data may be shared and for what purposes. When we (LSE Students' Union) receive this data we become a data controller.

Data Sharing Agreement

Data Protection Officer

Ben Whittaker, Chief Executive Officer

FAQs

On what basis does LSESU collect and process personal data?

Data Protection Laws require that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a "legal basis" for the processing. We take our responsibilities under Data Protection Laws extremely seriously, including meeting these conditions. The legal bases on which your personal data are collected are explained below.

Consent: We may ask you to provide us with a special category or sensitive personal data as detailed in this document, which we will agree only to process with your express consent.

Legitimate interests: The processing of your personal data may be necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or by fundamental rights and freedoms which require protection of personal data. It may be necessary for our legitimate interests to collect your personal data to enable us to manage certain operations and services of LSESU effectively.

Performance of contract: The processing of your personal data may be necessary in relation to the contract we have entered into with you to provide LSESU's services to you or because you have asked for something to be done so you can enter into such contract.

What personal data does LSESU hold?

'Personal data' means any information which identifies you as an individual. It may include your name but it may also be other information such as your date of birth, nationality and gender which when combined identify you.

After enrolment we receive the following data from LSE for current students who have not opted out of LSESU membership:

  • LSE ID
  • Full name
  • Date of birth
  • Sex
  • Email address
  • Hall of Residence
  • Contact telephone number
  • Ethnicity
  • Country of Domicile
  • Fee status
  • Department and course
  • Enrolment status
  • Mode of attendance
  • Sexual orientation
  • Disability
  • Race
  • Home postcode

Depending on your relationship to LSESU, we will collect additional information in order for us to manage membership, involvement with LSESU, or contract of employment which could include bank account details; next of kin details; visa status; and event attendance.

The data required will be covered during the on-boarding process and enrolment in a service.

Some of the personal data used for the above purposes are classed as being within 'special categories of personal data' under the Data Protection Legislation, for example, information relating to your ethnicity or any disability. This is collected to monitor our equalities responsibilities. Disability information will also be shared with relevant LSE staff in order to provide you with the best possible support for your studies. Access to, and the sharing of, this information is controlled very carefully. You will be given more details about our use of any sensitive personal data when we collect it from you.

Some of this information may also be collected to allow us to manage any ongoing case with LSESU advice Service. Details of what is information is collected will be discussed with you during registration with the Advice Service. Further details about how the Advice Service may use your information can be viewed in the separate Advice Service data protection statement.

How does LSESU collect data?

The bulk of student data is received directly and securely from LSE, and is provided only where a student has opted-in and consented to this data being provided to the LSESU.

We work closely with other third parties including, for example event organisers, who may receive information about you from them if you have provided specific consent to this sharing of your personal data in your agreements with those third parties. If you have provided such consent, we may receive and process any of the information from third parties in relation to you.

Both your image and voice may be recorded during our attendance at LSESU events.

How does LSESU use and process personal data?

We process information we hold about you for the following purposes

  • to facilitate and manage your LSESU membership
  • to provide the services you request or initiate with LSESU
  • to manage your involvement in the democratic process such as standing for election and voting
  • to administer the financial aspects of your relationship with us – ie payroll, reimbursement of payment requests
  • to manage your membership and participation for Student activities and events
  • to manage your interest and involvement in volunteering opportunities facilitated by the Union
  • to manage access to Union systems such as the website
  • to enable effective communications with you in relation to Union activities and updates
  • to support your training, health, safety and welfare requirements including registering and using the Advice service
  • to produce statistics and research for internal and statutory reporting purposes
  • to monitor our responsibilities under equalities legislation

Access to your personal information is limited to staff who have a legitimate need to see it for the purpose of carrying out their job at the Union in furtherance of the objectives outlined above.

Data processors

n all cases, LSESU endeavours to share the least possible amount of personal data with other agencies. However, in some cases the services of LSESU require data sharing, and/or you may otherwise consent to more data being shared for other purposes.

As part of a student's Union membership, your personal data may be disclosed to other organisations as required by law, for crime prevention, investigation or detection purposes. We may also share it in emergency situations whereit is in your vital interests for us to do so.

We also use third party services ("processors") to facilitate our operations. Where we engage with such third parties, we insist upon strict contractual requirements to be adhered to by in order to protect the personal data. Current processors currently include:

How long does LSESU keep personal data?

Your data will be retained in accordance with the Union's Data Retention Schedule. After you leave LSE or cease to be a member of the Union, certain parts of your data may be retained as a permanent archival record for research purposes and to confirm your award and period of study. At this point, all identifiable fields will be 'pseudonymised' to ensure it cannot be identified as you.

How do I access my data?

You have the right to access information held about you. For LSE, details are set out on the University's Data Protection policy. Your right of access can also be exercised at any time by contacting us at: su.dataprotection@lse.ac.uk.

How do I change or delete the data LSESU hold about me?

The Data Protection Laws require us to take reasonable steps to ensure that any personal data we process is accurate and up-to-date. For other data changes or deletions, contact su.dataprotection@lse.ac.uk.

Who regulates the use of my personal data?

The Union is registered on the Information Commissioners' Register of Data Controllers. The Union's registration number is ZA106815 and sets out, in very general terms, the full range of purposes for which we use student, staff and all other personal information. See the Information Commissioners Office website for details.

Freedom of information

Freedom of information requests do not apply to LSESU as we are a registered charity, not a public authority according to the legislation. However, you are welcome to ask us directly for this data. We will try to support any legitimate requests with a response. This can be done via emailing su.dataprotection@lse.ac.uk.

Data retention schedule

Record Statutory retention period Statutory authority
accident books, accident records/reports 3 years after the date of the last entry (see below for accidents involving chemicals or asbestos) The Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 1995 (RIDDOR)(SI 1995/3163) as amended
accounting records 3 years for private companies, 6 years for public limited companies Section 221 of the Companies Act 1985 as modified by the Companies Acts 1989 and 2006
income tax and NI returns, income tax records and correspondence with the Inland Revenue not less than 3 years after the end of the financial year to which they relate

The Income Tax (Employments) Regulations 1993

(SI 1993/744) as amended, for example by The Income Tax (Employments) (Amendment No. 6) Regulations 1996 (SI 1996/2631)
medical records and details of biological tests under the Control of Lead at Work Regulations 40 years from the date of the last entry

The Control of Lead at Work Regulations 1998

(SI 1998/543) as amended by the Control of Lead at Work Regulations 2002 (SI 2002/2676)
medical records as specified by the Control of Substances Hazardous to Health Regulations (COSHH) 40 years from the date of the last entry The Control of Substances Hazardous to Health Regulations 1999 and 2002 (COSHH) (SIs 1999/437 and 2002/2677)

medical records under the Control of Asbestos at Work Regulations

  • medical records containing details of employees exposed to asbestos
  • medical examination certificates

40 years from the date of the last entry

4 years from the date of issue

The Control of Asbestos at Work Regulations 2002 (SI 2002/ 2675). Also see the Control of Asbestos Regulations 2006 (SI 2006/. 2739)
medical records under the Ionising Radiations Regulations 1999 until the person reaches 75 years of age, but in any event for at least 50 years

The Ionising Radiations Regulations 1999

(SI 1999/3232)
records of tests and examinations of control systems and protective equipment under the Control of Substances Hazardous to Health Regulations (COSHH) 5 years from the date on which the tests were carried out The Control of Substances Hazardous to Health Regulations 1999 and 2002 (COSHH) (SIs 1999/437 and 2002/2677)
records relating to children until the child reaches the age of 21 Limitation Act 1980
records relating to events notifiable under the Retirement Benefits Schemes (Information Powers) Regulations 1995, records concerning decisions to allow retirement due to incapacity, pension accounts and associated documents 6 years from the end of the scheme year in which the event took place, or the date upon which the accounts/reports were signed/completed.

The Retirement Benefits Schemes (Information Powers) Regulations 1995

(SI 1995/3103)
Statutory Maternity Pay records, calculations, certificates (Mat B1s) or other medical evidence 3 years after the end of the tax year in which the maternity period ends

The Statutory Maternity Pay (General) Regulations 1986

(SI 1986/1960) as amended
Statutory Sick Pay records, calculations, certificates, self-certificates 3 years after the end of the tax year to which they relate

The Statutory Sick Pay (General) Regulations 1982

(SI 1982/894) as amended
wage/salary records (also overtime, bonuses, expenses) 6 years Taxes Management Act 1970

Recommended retention periods

(ie where no statutory retention periods exist)

For many types of personnel records, there is no definitive retention period: it is up to the employer to decide how long to keep these records and it’s a question of judgment rather than there being any definitive right and wrong. An employer needs to consider what would be a necessary retention period, depending on the type of record. The advice in this factsheet is based on the time limits for potential tribunal or civil claims and aims to draw sensible conclusions as to how long keeping the records will protect an employer.

Where the recommended retention period given is 6 years, this is based on the 6-year time limit within which legal proceedings must be commenced as laid down under the Limitation Act 1980. Thus, where documents may be relevant to a contractual claim, it is recommended that these be retained for at least the corresponding 6-year limitation period.

Record Recommended retention period
actuarial valuation reports permanently
application forms and interview notes (for unsuccessful candidates) 6 months to a year. (Because of the time limits in the various discrimination Acts, for example the Disability Discrimination Act 1995, minimum retention periods for records relating to advertising of vacancies and job applications should be at least 6 months. Successful job applicants documents will be transferred to the personnel file in any event.)
assessments under Health and Safety Regulations and records of consultations with safety representatives and committees permanently
Inland Revenue approvals permanently
money purchase details 6 years after transfer or value taken
parental leave 5 years from birth/adoption of the child or 18 years if the child receives a disability allowance
pension scheme investment policies 12 years from the ending of any benefit payable under the policy
pensioners' records 12 years after benefit ceases
personnel files and training records (including disciplinary records and working time records) 6 years after employment ceases
redundancy details, calculations of payments, refunds, notification to the Secretary of State 6 years from the date of redundancy
senior executives' records (that is, those on a senior management team or their equivalents) permanently for historical purposes
time cards 2 years after audit
trade union agreements 10 years after ceasing to be effective
trust deeds and rules permanently
trustees' minute books permanently
works council minutes permanently

Site design by Elliot Parker.