What information do we collect from you?
USSU holds and processes personal data about students, staff and guests:
- Tixtu ticket information – name, URN, D.O.B., event attendance;
- Rubix guest list information – name;
- Rubix night club disciplinary information – name, incident details, resulting action;
- Medical incident reports – name and relevant medical information;
- CCTV information – CCTV Footage.
How this data is collected:
- Tixtu ticket information – collected from you electronically via Tixtu website;
- Rubix guest list information – voluntary email from you;
- Rubix night club disciplinary information – staff email;
- Medical incident reports – collected by staff/contractor paper form;
- CCTV information – CCTV System (recording).
Why do we collect this information?
USSU collects only the data we need, and we keep the data up to date and only for as long as it is needed.
We collect your personal data in order to:
- Tixtu ticket information – process tickets and contact students about events they have signed up to where relevant;
- Rubix guest list information – to inform staff of guest list for club entry;
- Rubix night club disciplinary information – to facilitate necessary disciplinaries and inform staff for relevant safety purposes;
- Medical incident reports – to meet our legal obligations surrounding reporting accidents;
- CCTV information – to deter and detect crime, and for health and safety reasons under the Health and Safety at Work Act 1974
We take our obligations for data handling very seriously and it is therefore important for you to know the lawful basis for us processing your information (as below):
- Tixtu ticket information
- Rubix guest list information
- Rubix night club disciplinary information
We process the above stated data in our legitimate interests to facilitate the events our customers may attend and any incidents that may follow because of their attendance. These legitimate interests are determined through an assessment made by weighing our requirements against the impact of the processing on you. Our legitimate interests will never override your right to privacy and the freedoms that require the protection of your personal data. If you are interested in learning more about this legitimate interest assessment, please contact dataprotection@surrey.ac.uk.
- Medical incident reports
- CCTV information
We process the above stated data to comply with our legal obligations under the Health and Safety at Work Act 1974 and Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013.
What do we do with your information?
- Tixtu ticket information – validate ticket purchase
- Rubix Guest List information – provide to relevant staff to facilitate guest list entry to events
- Rubix night club disciplinary information – information used in any necessary disciplinary proceedings
- Medicial incident reports – anonymously analysed for trends and stored for insurance purposes (i.e. potential claims)
- CCTV information – in accordance with our CCTV policy.
How long do we keep your information?
- Tixtu ticket information – end of relationship with customer
- Rubix Guest List information – event day only
- Rubix night club disciplinary information – end of relationship with student
- Medical incident reports – keep for 3 years due to insurance liability reasoning
- CCTV Footage – 21 days (CCTV policy)
Who do we share your information with?
- Tixtu ticket information – n/a
- Rubix guest list – n/a
- Rubix night club disciplinary information – UOS under certain circumstances
- Medical incident reports – Insurer where necessary, University safety officer
- CCTV information – UOS on valid necessary request
