Cardiff University Students' Union and our subsidiary companies Cardiff Union Services LTD & Cardiff Volunteering, collectively known in this notice as "The Students' Union", "Us" or "We" (find out more about our corporate structure), is committed to protecting the rights of our students, members & customers in line with the general data protection regulations. This page explains how your information is used, who it may be passed to and what your rights and responsibilities are. The three companies that make up our corporate structure are registered with the Information Commissioner's Office (ICO) to process personal data and you can view the registration on the ICO's website under the Data Protection Register for CUSU, Data Protection Register for CUSL, and Data Protection Register for CV.
This notice may be updated from time to time to ensure continued compliance with current legislation and to reflect best practice.
Cardiff University Students' Union is registered in Wales. Company Registration No. 07328777. Charity No. 1137163
Purposes
Current students of Cardiff University
The Students' Union will receive an up to date copy of your student record directly from Cardiff University (unless you have opted out of Students' Union membership at enrolment), from the start of your enrolment to the end of your course your information will be stored on our secure servers. You can find out more about this transference of data by viewing the University Data Sharing Agreement. The Students’ Union will notify all members when elections are running in line with Article 6 (e), for the purpose of carrying out fair elections the processing of Student data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller as is in our memorandum and Part 3 of Ordinance 13.
Past students of Cardiff University
As an alumni of Cardiff University you will be entitled to continue to use our services, your account will be automatically archived at the end of your studies for purposes of records of achievement and account transaction history management, if you wish to regain full access to the range of services at the end of your studies please send an email to us at StudentsUnion@Cardiff.ac.uk quoting “Alumni SU Account”.
General public (our customers)
The Students' Union will collect your personal data during your online application, we will continue to process your personal data so that we can manage our contractual obligations, fulfil our and your legitimate interests and satisfy our statutory responsibilities.
Your personal data will be used to
  • manage your online account - including memberships and entitlements;
  • allow you to purchase and access stored event tickets;
  • manage event entrances and guest lists;
  • notify you of changes;
  • provide services (food and drink provisions);
  • carry out legal duties (including providing information to others - see disclosures section);
  • use your data to produce anonymous demographics;
  • use your contact details for the purpose of promotion and marketing where consent is first freely given.
Personal information may be collected separately and in person or by any other means from staff of the organisation, such as our security personnel or events management for the purposes of public safety. Any information obtained will be GDPR compliant and if such an occurrence takes place an explanation of why and how the data will be used will be communicated.
Mailchimp & Our Marketing Mailing Lists
The Students' Union currently operates two Mailchimp subscriber mailing lists:
  • With our Offers & Promotions Mailing List you can sign up to if you are interested in hearing all about our current and future events, any sweet deals and offers us or our partners might be running and our September activities.
  • With our Cardiff Students Alumni Mailling List you can sign up if you are a graduate of Cardiff University and want to hear all about our Alumni events including our annual Varsity.
We will use your consent to join these mailing lists, this is captured when you fill out either of the subscriber forms, If you opt into our marketing communications via OpenTable or our App you will be consenting to joining the Offers & Promotions Mailing List.
We will never share your personal data with anyone without first getting your explicit consent to do so, we will keep you on the mailing list for two years before we will notify you to remind you that your data is still held by us for the purpose of sending you our marketing material.
You can unsubscribe from either of these lists by click unsubscribe in any email you have received or by contacting StudentsUnion@Cardiff.ac.uk.
Business to Business
The Students' Union will keep a record of business contacts that “We” have or that have provided a service to “Us” in a business capacity, this information will be kept securely and will be processed lawfully in line with our legitimate interest to do so. The Students' Union will use this information to communicate business to business services and to fulfil contractual obligations. This information will be shared to comply with statutory requirements and for the purposes of audit.
Disclosure
The Students' Union may share your relevant personal data with the following bodies where we have a lawful basis to do so:
Fulfil a contract where a contract exists with you.
In accordance with the terms of the contract.
The governing body for university sport in the United Kingdom (BUCS)
In order to confirm entry into the British Universities and Colleges Sport competitions "we" will (on request) share information to process your application (BUCS DSA)
University Hospital of Wales and/or South Wales police
Where an individual is not capable of giving consent and we have a duty to protect their vital interest.
Work placement sites or educational partners involved in joint course provision.
Where this is necessary for the delivery of your programme of study.
Potential employers or providers of education whom you have approached
To confirm your qualifications, references or development courses.
UK agencies with duties relating to the prevention and detection of crime, collection of a tax or duty or safeguarding national security
In order to allow the assessment, and payment and collection of relevant taxes i.e Council Tax, and benefits.
To aid the police, UK Visas and Immigration Agency or the Foreign and Commonwealth Office.
(This happens only as necessary and in consideration of your rights and freedoms)
Jobshop
In accordance with the University and Students' Union Data Sharing Agreement and with your consent where an application is made to use the Jobshop service (Jobshop Sharing Agreements).
Cardiff Student Letting
In accordance with the University and Students' Union; Data Sharing Agreement and with your consent or where an application is made or a contract or tenancy agreement is in place. (Download and View Cardiff Student Letting Privacy Notice)
Any other disclosures that the Students’ Union makes will be in accordance with a lawful basis defined in the UK General Data Protection Regulations and your interests will always be considered.
Website Analytics

We use Matomo, a privacy-focused analytics platform, to understand how students and visitors interact with our website. This helps us improve content, navigation, and the overall user experience — without compromising your privacy.

We've set Matomo up to protect your privacy:

  • No Cookies – Matomo runs in cookieless mode.
  • No Personal Data – We don’t track anything that can identify you.
  • Anonymised IPs – Your IP address is anonymised and can’t be linked back to you.
  • Data Ownership – All analytics data is stored securely on our own servers in the UK and is never shared with third parties.
How long your information will be held
The Students' Union will retain your personal information for different periods of time depending on the services you have used and if you are a student, alumni or customer.
  • Your transaction history will be kept for 7 years from the date of transaction.
  • Ticket event attendance lists are kept for 2 years from the date of the event.
  • Your online account will be kept open indefinitely unless you have asked “Us” to close it or if we have taken the decision to do so.
  • As a training provider the Students’ Union will keep a student record of any studies that you have undertaken with “Us” permanently. This student record will include, name, date of birth, course attended, date of course and any grades obtained.
Security of your information
UK General Data Protection Regulations require us to keep your information secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to prevent unauthorised access and disclosure. Only members of staff who need access to relevant personal data will be authorised to do so. Information about you in electronic form will be subject to password and other security restrictions, while paper files will be stored in secure areas with controlled access.
Some processing may be undertaken on behalf of the Students’ Union by an organisation contracted for that purpose. Organisations processing personal data on behalf of the Students’ Union will be bound by an obligation to process personal data in accordance with Data Protection legislation.
Your rights
You have a right to access your personal information through the a Subject Access Request, You also have a right to object to the processing of your personal information, to rectify, to erase, to restrict and to port your personal information.  Any requests or objections should be made in writing to the Data Protection Officer using the contact details provided below.
Your responsibilities
You have a responsibility to keep your personal details up to date, as a student you can do so via SIMS, as a member of the public you can do so by either logging into your profile management on the website or by contacting StudentsUnion@Cardiff.ac.uk
How to raise a query, concern or complaint
If after reading this page you still have queries, concerns or wish to raise a complaint you should contact the Data Protection Officer in the first instance at the following:
Data Protection Officer
Cardiff University Students’ Union
University Union
Park Place
Cardiff
CF10 3QN
Tel: 029 2078 1405
If you remain dissatisfied then you have the right to apply directly to the Information Commissioner for investigation. The Information Commissioner can be contacted at:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
The Information Commissioner's Office also provides useful advice and guidance on data protection.
Relevant Links