Privacy Policy
Last updated: 15 September 2026
1. Who we are
The Heriot-Watt University Scottish Dance Society (HWUSDS, “we”, “us” or “our”) is the data controller for the personal information covered by this policy. This means that HWUSDS decides why and how that information is used.
HWUSDS is a student society affiliated with Heriot-Watt University Student Union. The Society, the Student Union, Heriot-Watt University and the operators of external services may each be responsible for information processed through their own systems.
You can contact us about privacy or exercise your data-protection rights using:
- Email: ScottishDance.Society@hw.ac.uk
- Website: https://hwusds.org/
- Postal address: HWUSDS, c/o Heriot-Watt University Student Union, Riccarton, Edinburgh, EH14 4AS
2. What this policy covers
This policy explains how HWUSDS handles personal information collected through our website, contact and joining forms, mailing list, society administration, class attendance records, communications and WhatsApp group. It also explains how information may reach us through Heriot-Watt University Student Union or Native.fm when somebody joins the Society or books an activity.
External websites and services have their own privacy notices. Their processing is not controlled by this policy.
3. Information we collect
Information you give us
Depending on how you interact with HWUSDS, we may collect:
- your name and email address;
- the information you enter in a contact or joining form;
- your communication preferences, including whether you want to receive Society emails or join our WhatsApp group;
- messages and other correspondence you send to us;
- Society membership status, class or event bookings, and attendance information;
- records showing when and how you joined or left a mailing list; and
- information you choose to share while participating in Society activities or communications.
We do not intentionally request special-category information, such as health information, through the website. If you voluntarily tell us about an accessibility, medical or safety requirement, we will use it only where reasonably necessary to accommodate you or protect somebody’s safety, and will restrict access to it.
Information collected when you use the website
Our website and hosting systems may process:
- your IP address;
- the date and time of a request;
- pages or files requested;
- browser, device and operating-system information;
- referring pages and campaign information contained in links, including UTM parameters;
- approximate location derived from an anonymised IP address; and
- your cookie and consent preferences.
Some technical information is processed automatically in server logs to operate and secure the website. Optional Matomo analytics are collected only after you consent to Statistics cookies.
Information received from other organisations
If you join HWUSDS, purchase membership or book an event through Heriot-Watt University Student Union or Native.fm, the relevant service collects information under its own privacy notice. HWUSDS may receive the limited membership, booking, contact and attendance information needed to administer the Society or activity.
HWUSDS does not normally receive or store your full payment-card details when payment is handled through those external services.
4. Why we use your information and our lawful bases
| Purpose | Typical information | Lawful basis |
|---|---|---|
| Responding to enquiries and requests | Contact details and correspondence | Our legitimate interests in communicating with members and prospective participants, or taking steps at your request before providing a service |
| Sending newsletters, announcements and optional promotional communications | Name, email address and consent records | Your consent |
| Administering membership, bookings, classes and attendance | Identity, membership, booking and attendance information | Performance of our arrangement with you and our legitimate interests in running the Society safely and effectively |
| Operating voluntary Society communication groups | WhatsApp account details and group communications | Your consent and our legitimate interests in communicating with participants who choose to join |
| Measuring and improving the website using Matomo | Consent choice and analytics information described above | Your consent |
| Operating, maintaining and securing the website and Society systems | Server logs, account, security and technical information | Our legitimate interests in providing a reliable and secure service |
| Meeting legal, financial, safeguarding or regulatory obligations | Information relevant to the particular obligation | Compliance with a legal obligation, or our legitimate interests where appropriate |
Where we rely on legitimate interests, we consider whether our use is necessary and proportionate and whether your rights and reasonable expectations override those interests.
5. Email and mailing-list communications
If you ask to join the HWUSDS mailing list, we use your contact information to send Society news, class information and event announcements. You may withdraw your consent at any time by using an unsubscribe option where one is provided or by emailing ScottishDance.Society@hw.ac.uk.
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. We may retain a minimal suppression record so that we can respect an unsubscribe request.
6. WhatsApp
Joining the HWUSDS WhatsApp group is optional. If you join, your telephone number, chosen profile information and messages may be visible to other group members. Other members may also retain messages on their own devices.
WhatsApp is provided by Meta and processes information under its own terms and privacy notice. You can stop participating by leaving the group. You may also ask HWUSDS to remove you, although we cannot erase information held independently by Meta or copied by other group participants.
7. Website analytics and cookies
We use a self-hosted installation of Matomo Analytics to understand how consenting visitors find and use the HWUSDS website. This helps us assess our outreach and improve the way we present classes, events and Society information.
Matomo is hosted within our website environment rather than Matomo Cloud. IP anonymisation is enabled. Matomo analytics do not run until you consent to Statistics cookies. You can refuse analytics without losing access to the website and can change your choice later through the website’s cookie-preference control.
For details of the cookies used and how to manage them, see our Cookie Policy.
8. Who we share information with
We do not sell personal information. We may disclose limited information where necessary to:
- Green Trail Hosting, LLC, which provides website hosting and technical administration;
- Heriot-Watt University and Microsoft 365, which provide the Society’s shared email facilities;
- Heriot-Watt University Student Union and Native.fm, where necessary to administer membership, bookings, tickets or events;
- Meta/WhatsApp, when you choose to participate in the Society’s WhatsApp group;
- authorised members of the HWUSDS committee who need access for a Society role;
- professional advisers, insurers, regulators, law-enforcement bodies or other recipients where disclosure is required or permitted by law; and
- a successor Society committee, so that essential records and active consents can be administered responsibly after committee handover.
External booking, membership and messaging services may act as independent data controllers for their own processing. Their privacy notices apply when you use their services.
9. International transfers
Some of our service providers may process information in, or permit access from, countries outside the United Kingdom. Where HWUSDS makes a restricted transfer of personal information, we will only do so where a lawful transfer mechanism applies, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by UK data-protection law.
You may contact us for further information about the safeguards relevant to your information.
10. How long we keep information
We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, including any legal, accounting, safeguarding or dispute-resolution requirement. Our normal retention periods are:
- Contact enquiries: up to 12 months after the enquiry is resolved.
- Mailing-list records: until you unsubscribe or the mailing list closes, with the list reviewed at least once each academic year. A minimal suppression record may be kept for as long as necessary to honour an unsubscribe request.
- Membership, booking and ordinary attendance records: until 12 months after the end of the relevant academic year, unless a longer period is required for finance, insurance, safeguarding or a legal claim.
- Matomo raw visit data: up to 90 days.
- Aggregated Matomo reports: up to 24 months.
- Routine server and security logs: up to 30 days, unless a record must be retained longer to investigate a security incident or protect legal rights.
- Cookie-consent choices: up to six months before we ask you to choose again, unless an earlier refresh is needed because our use of cookies changes.
- WhatsApp participation: while you remain in the group. Messages or account information may remain in other participants’ devices or Meta’s systems in accordance with WhatsApp’s operation and policies.
Information stored in backups may remain until the relevant backup is securely overwritten. We may retain information for longer where required by law or where necessary to establish, exercise or defend legal claims.
11. How we protect information
We use proportionate technical and organisational measures intended to protect personal information from unauthorised access, alteration, disclosure, loss or destruction. Access is limited to committee members and service providers who need it for their role. No internet service can be guaranteed completely secure, but we review access and transfer information responsibly during committee handovers.
12. Your data-protection rights
Depending on the circumstances, UK data-protection law may give you the right to:
- ask for access to your personal information;
- have inaccurate or incomplete information corrected;
- ask for information to be erased;
- ask us to restrict how information is used;
- object to processing based on legitimate interests;
- receive certain information in a portable format;
- withdraw consent at any time where consent is our lawful basis; and
- object at any time to direct-marketing communications.
To exercise a right, contact ScottishDance.Society@hw.ac.uk. We may need enough information to confirm your identity and understand your request. We will respond within the period required by law.
You also have the right to complain to the UK Information Commissioner’s Office (ICO). Information about making a complaint is available at https://ico.org.uk/make-a-complaint/. We would appreciate the opportunity to address your concern first.
13. Automated decision-making
HWUSDS does not use the personal information covered by this policy to make solely automated decisions that have legal or similarly significant effects on individuals.
14. Changes to this policy
We may update this policy when our activities, services or legal obligations change. The latest version will be published on this website with an updated date. If a change materially affects how we use information collected with consent, we will request fresh consent where required.