Interim privacy notice
Who we are
Royal College of Art Students’ Union (RCASU) is the controller of the personal information described in this notice. RCASU is a registered charity (charity number 1204514) based at the Royal College of Art, Kensington Gore, London SW7 2EU.
Contact: students.union@rca.ac.uk
RCASU is reviewing how it collects, uses, stores, shares and deletes personal information. This interim notice explains our current approach while that review is completed. It should be read with any privacy information shown at the point where information is collected. Where older wording conflicts with this notice, this notice is intended to be the current statement.
Information we may collect
-
Information supplied by the Royal College of Art or through our website about membership and eligibility.
-
Identity and contact details, including name, email address, telephone number, programme, year of study and membership status.
-
Information provided through forms, emails, meetings, telephone calls and other correspondence.
-
Details connected with applications, bookings, purchases, payments, reimbursements and other financial transactions.
-
Information about societies, representatives, elections, events, volunteering and employment.
-
Information needed to provide advice or support, or to handle complaints, conduct matters, safeguarding concerns and investigations.
-
Supporting documents and relevant information supplied by other people or organisations.
-
Account, log-in, cookie, device and service-usage information where our systems collect it.
Some services may involve special category information, such as information about health, disability, ethnicity, religious or philosophical beliefs, sexual orientation, political opinions or trade-union membership. We may also receive information about alleged misconduct or criminal offences. We will only collect and use this information where it is necessary and we have identified an appropriate legal condition.
How we use information
-
To provide services, advice, representation and support.
-
To respond to enquiries and administer applications, complaints and other cases.
-
To manage membership, democratic representation, elections, societies, events and commercial services.
-
To administer bookings, purchases, payments, reimbursements, volunteering and employment.
-
To protect people, manage conduct and safeguarding concerns, investigate incidents and reduce risk.
-
To send service messages and, where permitted, optional communications.
-
To meet legal, regulatory, financial, employment, charity-governance and audit obligations.
-
To operate, secure, monitor and improve our systems and services.
Our lawful bases
Depending on the activity, we may rely on one or more of the following lawful bases:
-
Legitimate interests, where using the information is necessary for RCASU or another person’s legitimate interests and those interests are not overridden by the individual’s rights and interests.
-
Contract, where processing is necessary to enter into or perform a contract.
-
Legal obligation, where processing is necessary to comply with the law.
-
Vital interests, in a genuine emergency where processing is necessary to protect someone’s life.
-
Consent, for genuinely optional uses where consent is appropriate and can be withdrawn.
Where special category or criminal-offence information is used, RCASU will also identify and document the additional legal condition that applies. A form-specific notice should state the confirmed lawful basis rather than asking for consent by default.
Who can access information and when we share it
Access is limited to people who need the information for their role. This may include authorised RCASU staff, officers and trustees; suppliers acting for RCASU; the Royal College of Art; people involved in a complaint, investigation or decision; professional advisers, insurers, auditors and regulators; and emergency services or law-enforcement bodies where necessary and lawful.
We share only what is reasonably necessary for the relevant purpose and take account of confidentiality, fairness, safeguarding and legal obligations. RCASU does not sell personal information.
International transfers
Some technology suppliers may store or access information outside the United Kingdom. Where this happens, RCASU will require an appropriate lawful transfer mechanism and safeguards. Supplier and transfer details will be confirmed through the audit and made available in the final notice or on request.
How long we keep information
We keep personal information only for as long as it is needed for the relevant service or purpose, and for any additional period required for complaints, legal claims, safeguarding, financial records, audit, employment or governance. We then securely delete or anonymise it. Each form should state a specific period or clear retention rule once confirmed through the audit.
Your rights
Depending on the circumstances, you may have rights to access your information, correct it, have it erased, restrict its use, receive it in a portable format, or object to its use. If processing is based on consent, you may withdraw that consent at any time; withdrawal does not affect processing already carried out lawfully.
If we rely on legitimate interests, you may object to the processing. We will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
If a service uses solely automated decision-making that produces legal or similarly significant effects, the form-specific notice will explain this and the safeguards available.
Questions and complaints
To ask a question, exercise a right or make a data-protection complaint, email students.union@rca.ac.uk and use the subject line “Data protection complaint” where relevant.
We will acknowledge a complaint within 30 days, investigate it fairly, keep you informed if it takes longer, and provide an outcome without undue delay. You may also complain to the Information Commissioner’s Office (ICO).