Effective: 1st May, 2020
The following policy describes what data is collected and how it is used by the United Nations Association York (“us”, “we”), when you use the YorkMUN website and apply for YorkMUN.
1. What information do we collect?
In order for us to deliver our services effectively we must process the information we collect about you. The way we process your data will be entirely dependent on how you use our services.
The information you provide to us
When you join our online mailing list, you provide us with an email address that we can use to contact you. When using our services and applying to our events, you may also submit application forms will collect personal information pertaining to the event you have applied for. The aforementioned forms may include your name, age, gender, nationality, email, university institution and what you study at this institution, such as your degree or course.
We are also partnered with the United Kingdoms United Nations Association, as well as other United Nations societies in the United Kingdom and abroad. A full list of our partner institutions can be found on our website. We only share data with our partners if you have chosen to opt-in, and in no circumstances do we share information with any external institution without your express permission and an agreed purpose for the sharing of such data.
2. How do we use your information?
The data you share with us allows us to personalise our event experience, and provide a high quality service.
Communicating with you
When you share data with us, this is usually to express interest in or a confirmation of attendance to our events. For example, you may choose to apply to attend YorkMUN, and provide us with personal information upon submitting your application. For us to confirm your attendance, verify your details, or ensure the experience you provide is tailored to your specific needs, we will need to communicate with you. Our primary method of communication will be email, however in emergency circumstances we may choose to contact you via telephone.
Personalised Experience
By sharing your information with us, we can tailor your experience to fit your needs. For example, we often provide food and drink to our attendants, and therefore must be made aware of any dietary or nutritional needs. The information you provide can help us achieve this goal, and we will contact you via email and gain your express consent to use this data for such purposes.
3. How do we share your data publicly?
In under no circumstances do we share your data publicly unless with your express consent. If your express consent is given, we may share your data in the following ways.
Public Information and Advertising
If you take a significant public facing role in the organisation of our events, we make publicise some information about you. This may include a short biography and photograph on our website or social media pages. Alternatively, our photographers with express permission may take pictures of you during our events and publicise them on our website and social media pages.
Shared with third-parties
Although we are partnered with a number of University United Nations societies in the United Kingdom and abroad, in no instance will we share your data with a third party actor without express consent.
As a University of York Student Union (YUSU) ratified society however, we may share information with our parent entity. YUSU acts as our Data Controller, and we may therefore share information including your name, age, gender, nationality, institution and association with this institution.
4. What is our legal basis for collecting your data?
Consent
The collection of our data is entirely dependent on your express consent, and you may choose to opt-out from our data collection services by opting out of our service.
Legitimate Interests
In order to deliver our services effectively, we store data which allows us to deliver a tailored and high quality experience. We therefore only store relevant data, and never ask for data which is not absolutely necessary for achieving this aim.
5. How can you exercise your rights under GDPR?
Under the General Data Protection Regulation coming into force on May 25th 2018, EU citizens have a number of rights in relation to the process, storage and use of their data. These include:
- Right of Access
- Right of Information
- Right of Rectification
- Right of Erasure
- Right to Object
- Right to Avoid Profiling
- Right to Data Portability
- Right to Restrict Processing
For more information concerning your rights under GDPR, refer to: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
You can exercise these rights by contacting our Secretary-General at secretary.general@yorkmun.com
6. Data and Retention and Deletion
We only collect data that is firstly relevant and necessary to providing our service, and only store this data for as long as it is needed for this purpose. Primarily, we collect data in the lead up to our events, and will no longer store data after an event is over unless stated otherwise. The handling of our data is often done on a case-by-case basis however, and we will notify you and seek your express consent before we store data for any time that is not necessary.
If you sign up for our mailing list, your email address will be stored for the duration of the lead-up to the event, and will be removed from the mailing list afterwards unless you give us express consent to remain on the mailing list for the next iteration of YorkMUN.
7. Where we store, and how we protect your data
The data we store will typically be stored in the United States, as we store our data on web services provided by Google, such as Google Drive. Our parent organisation, and Data Controller, The University of York Student Union (YUSU), is responsible for securing and protecting the data that all student societies store at the University of York. YUSU protects digital records through a number of methods, including:
- Use storage on the University network, @yusu.org Google Drive or other approved platforms;
- Password protection on all files containing personal data;
- Use of the Union’s secure platforms for processing data;
- Up to date antivirus and malware systems;
- Adequate firewalls;
- Secure destruction of IT equipment.
The YorkMUN mailing list is operated through MailChimp (https://mailchimp.com/about/). The only information collected on you for the mailing list is your email address and this information is stored safely by MailChimp and will not be used for any other purposes or passed on to third parties.
8. How we’ll notify you of changes to our Data Policy
Should we change our data policy, we will notify you by email to provide you with the option to opt-out of our services if you desire.
9. How to contact us with questions?
Any questions concerning our data policy should be directed to our Secretary-General at secretary.general@yorkmun.com
10. Rights to complain:
If you are unhappy with the way in which we have handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, see www.ico.org.uk/concerns.