Privacy Policy for Roehampton Students' Union

The event organiser, Roehampton Students' Union, has the legal responsibility to tell ticket buyers and event attendees how their personal information will be collected and used. You can find their Privacy Policy below or contact them to request it.

Roehampton Students' Union Privacy Notice for Event Ticketing

v1.1

Introduction

This privacy notice explains what personal data we may hold about you when you purchase a ticket for an RSU event, how we collect it, how we use it, and who we may share information with. We are required to give you this information under data protection law. This privacy notice should be read in conjunction with our corporate privacy notice.

Who we are

Roehampton Students' Union (RSU) is the data controller for the information you provide when purchasing a ticket. We're a registered charity (No. 1139857) and a company limited by guarantee (No. 07323081).

RSU is registered as a controller with the Information Commissioner’s Office (ICO), registration number ZA161670, and is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

To contact us about your data email rsu@roehampton.ac.uk (mark your email 'Data Protection').

What this notice covers

RSU acts as the central event ticketing platform for student-facing events at the University of Roehampton. Events may be listed by RSU, by University departments such as Colleges or Sport, or by event partners. This notice covers all ticket purchases made through our Ticket Tailor platform, regardless of which organisation is running the event.

Where we get your personal information from

We get your personal data from a number of sources. The legal basis for processing depends on how and why we receive it.

When you purchase a ticket

You provide us with your information when you buy a ticket through our platform. For higher-risk activities, we may also ask for emergency contact details and relevant medical information as a condition of participation as we cannot safely deliver these events without it. The legal basis is performance of a contract.

When other organisations share it with us

We may receive information from the University of Roehampton or our event partners about individuals who have been restricted from attending events or campus. We use this information to manage ticket sales accordingly. The legal basis is legitimate interests where RSU has a clear interest in maintaining the safety of its events and attendees.

Incident reporting

If a safety or medical incident occurs at any RSU event, whether or not we've collected your information in advance, we'll record your name, a description of what happened, any injuries, and the actions taken. You cannot ask us to delete an incident record during the retention period. The legal basis is legal obligation under health and safety law. Where a medical emergency occurs, we may share your information with emergency services under vital interests.

When we photograph or film at events

RSU and its photographers may take photographs and video at our events. These images may be used to promote RSU's events, services, and activities across our website, social media, printed materials, and other communications. We'll let you know through signage at the event. If you'd prefer not to be photographed, let a member of staff know and we'll do our best to accommodate this. If you see an image of yourself that you'd like removed, contact us and we'll take it down. The legal basis is legitimate interests.

What personal data we collect

When you purchase a ticket we collect the following personal data:

• Your name
• Your email address
• Your payment reference
• Your student number (where required, to verify membership status)
• A declaration confirming you are over the age of 18 at the time of the event (for safeguarding purposes).

Depending on the event, we may also collect:

• Emergency contact details
• Relevant medical information
• Other information specific to the event.

Where additional information is collected, we'll tell you why at the point we ask for it and whether it's required or optional.

No card data is ever stored by RSU. All payment processing is handled by PCI-DSS compliant providers.

Where we receive information about individuals restricted from attending events, this is limited to the information necessary to identify the individual and prevent ticket sales.

RSU and its photographers may also capture photographs and video of attendees at our events.

What we use your data for

We use your personal data for the purposes set out below. Not all of these will apply to you, it depends on the event and the information collected:

• Processing your ticket purchase and confirming your booking
• Verifying your membership status
• Managing event capacity and safety
• Verifying that attendees meet the age requirement for the event
• Contacting you with important information about the event
• Managing emergency contact and medical information to keep you safe
• Recording and retaining incident reports
• Managing restrictions on ticket sales where individuals have been banned from events or campus
• Meeting our financial record-keeping obligations
• Sharing attendee information with venue operators to manage admissions and meet licensing conditions
• Sending you marketing communications where you have opted in
• Promoting RSU events and activities through photography and video.

How we keep your data safe and who has access

Security measures

Our corporate privacy notice includes detailed information about the security measures we apply to all personal data we process. These apply equally to data collected through our event ticketing platform.

Who has access

Personal data collected through Ticket Tailor may be accessed by RSU employees, elected officers, and volunteers in the course of their work. Where an event is listed by a University department or event partner, relevant University employees will also have access to booking information in order to manage the event. We always control what they can see, what they are allowed to do with it, and how long they can access it.

Organisations we share your data with

We may share some or all of your personal data with the following organisations:

• Ticket Tailor: our ticketing platform, where your booking data is held
• Stripe: card payment processing, integrated with Ticket Tailor
• Campaign Monitor: if you opt in to receive marketing emails from RSU
• External venue operators: where an event is held at an external venue, for managing admissions, ensuring safety, and meeting licensing conditions
• Emergency services: in the event of a medical emergency
• University of Roehampton: where required for venue or safety purposes.

How long we keep your data

Event attendance records are kept for 3 years from the date of the event. Financial transaction records are kept for 6 years from the end of the financial year. Emergency contact and medical data is handled in line with our corporate privacy notice.

Your rights

Under data protection legislation you have the right to access, correct, or delete your data, object to how we use it, or withdraw your consent. For full details on your rights, please read our corporate privacy notice.

Data complaints

We take data protection seriously and want to resolve any concerns quickly. If you have a complaint, contact us first: rsu@roehampton.ac.uk (mark ‘Data Protection Complaint’) or write to the Chief Executive at our registered address.

Under the DUAA 2025, we’re required to acknowledge your complaint within 30 days and to respond without undue delay.

If you’re not satisfied with our response, or prefer not to contact us first, you can complain directly to the ICO at ico.org.uk/concerns, on 0303 123 1113, or by post to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

Changes to this notice

We may update this notice from time to time to reflect changes in the law, our processing activities, or best practice. When we make significant changes, we'll update the version number. Previous versions are available on request from the Data Protection Lead.

Change log