Privacy Policy — Bristol Trading Society

1. Who we are

The Bristol Trading Society (“BTS”, “we”, “us”) is a student society at the University of Bristol, run by students for students. We are the data controller for the personal data described in this policy — meaning we decide what is collected and what it is used for.

We are affiliated with the University of Bristol Students’ Union. Where the Students’ Union or the University holds your data under their own policies, those policies apply, not this one.

2. What we collect

We keep the collection deliberately narrow. We do not collect payment or bank details, government identity documents, criminal records, or any special category data such as health or ethnicity.

If you apply to a BTS programme

First and last name
University email address, and a personal email address if you give one
Phone number
Year of study and course
LinkedIn profile URL, if you give one
Your CV, and anything contained in it
Which divisions you applied to

If you contact us or attend an event

Your name and the email address you contact us from
Anything you choose to put in your message
Attendance or sign-up details for events you register for

If you simply visit the website

Standard analytics data — see cookies and analytics below

A note on your CV. A CV often contains more than we ask for — a home address, a date of birth, a photograph, personal interests. We only ask for the information listed above, but we will hold whatever your CV contains. If there is something on it you would rather we did not hold, remove it before uploading.

3. How we collect it

We only collect personal data that you give us directly. Specifically:

Through the application form on this website
When you email us, or message us on LinkedIn or Instagram
When you sign up for an event, workshop or competition
Through sign-up sheets at fairs and society events

We do not buy contact lists, and we do not scrape or compile data about you from other sources.

4. Why we use it, and our legal basis

Under the UK GDPR we must have a lawful basis for using your data. The table below sets out what we use your data for and which basis applies.

What we do	Data used	Legal basis
Review and shortlist your application	Name, contact details, course, CV, division choices	Legitimate interests — running a competitive selection process members have asked to enter
Contact you about your application or an event	Name, email, phone	Legitimate interests
Share your CV with a sponsor	Name, contact details, course, CV	Legitimate interests — giving members access to the firms we work with is a core purpose of the society. You can object at any time; see section 5
Send you society updates and event invitations	Name, email	Consent — you can unsubscribe at any time
Understand how the website is used	Analytics data	Consent — see section 9

Where we rely on legitimate interests, we have considered whether our interest in running the society is outweighed by your rights, and we think it is not — you approached us, the data is limited, and you can object at any time.

5. The analyst CV book

Our sponsors and partner firms recruit from our membership. Some of them ask for access to a collection of member CVs — what we call the analyst CV book.

If you send us a CV, it goes into the CV book. There is no opt-in checkbox. Anyone who applies to the analyst programme, applies to be a division head, or otherwise sends us a CV should assume it is held in the CV book and may be shared with our sponsors and partner firms.

You can object at any time. Email us and we will remove you from the CV book, or delete your data entirely. It will not affect your application, and we do not tell sponsors who has asked to be removed.

What a sponsor receives

Your name, course and year of study
Your CV as you uploaded it
The email address you applied with
Which division you were selected for, where relevant

How we control it

Access is given only to sponsors and partner firms we have a current agreement with
It is shared for recruitment and career opportunities only
Sponsors are asked not to pass it on to any other organisation
We keep a record of which sponsors received the CV book and when

Email us and we will remove you from the current CV book immediately. We cannot retrieve copies a sponsor has already downloaded, but we will tell them you have objected and ask them to delete it.

6. Who we share data with

We share your personal data with the following, and no one else:

The BTS committee. Committee members handling applications, events and partnerships. Access is limited to those who need it for their role.
Sponsors and partner firms. The analyst CV book — see section 5, including how to object.
Google. We use Google Workspace, Drive, Sheets and Forms to receive and store applications. Google processes this data on our behalf, under their terms.
The University of Bristol Students’ Union. Where required for society administration, room bookings or membership records.

We do not sell your data, and we do not share it for advertising. Where a sponsor is based outside the UK, your data may be transferred outside the UK. You can object to sponsor sharing at any time; see section 5.

7. Where we keep it

Applications and CVs are stored in a Google Drive folder and a Google Sheet belonging to the society, accessible only to committee members who need it. Email correspondence sits in the society’s email account.

We take reasonable steps to protect your data — access is restricted, accounts are protected by University or Google authentication, and access is removed when a committee member leaves their role. No system is completely secure, and we cannot guarantee absolute security.

8. How long we keep it

Unsuccessful applications: kept until the end of the academic year in which you applied, then deleted.
Successful applications: kept for the duration of your involvement with the society, and for 12 months afterwards.
CV book entries: removed at the end of each academic year, or immediately on request.
General correspondence: kept for up to 12 months.

If you ask us to delete your data sooner, we will — see your rights.

9. Cookies and analytics

This website uses Google Analytics to understand how visitors use the site — which pages are read, how people arrive, and roughly where in the world they are. This sets cookies in your browser.

We do not use advertising cookies, and we do not use analytics data to identify individuals. You can block or delete cookies through your browser settings, or opt out of Google Analytics using Google’s opt-out add-on.

10. Your rights

Under UK data protection law you have the right to:

Access the personal data we hold about you
Correct anything inaccurate or incomplete
Erase your data, where we have no continuing reason to hold it
Restrict or object to how we use it
Object to your CV being shared with sponsors, and withdraw consent for society emails, at any time
Receive a copy of the data you gave us, in a portable format

To exercise any of these, email us at bristol-trading-society@bristol.ac.uk. We will respond within one month. There is no charge.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put it right first.

11. Changes to this policy

We may update this policy as the society changes. The date at the top shows when it was last revised, so check this page if you want to know where things currently stand.

We will not contact you individually about changes to this policy. If a change means you no longer want us to hold your data, or no longer want it shared with our sponsors, you can object or ask us to delete your data at any time by emailing bristol-trading-society@bristol.ac.uk. See your rights for what you can ask for.

12. How to contact us

For anything relating to this policy or your personal data, email bristol-trading-society@bristol.ac.uk, or write to us at 12 Priory Road Complex, Clifton, Bristol BS8 1TU.