1. Introduction

This Privacy Policy explains how London Student Network Ltd ("LSN", "we", "us", "our") collects, uses, shares, and protects your personal data when you use our platform and attend our events.

If you have any questions or concerns about how we handle your data, please contact us at hello@londonstudentnetwork.com. Data protection matters will be escalated internally to our privacy lead (CEO, Josh Robinson) as needed - please subject your email as DATA ISSUE.

2. What Data We Collect

We collect the following categories of information:

• Account & Ticketing Information: name, email, university, course, event interests, ticket purchases, and internal/external university status.
• Usage Data: privacy-preserving, cookie-free platform analytics on page visits and use.
• Special Event Data (occasional): For certain events (e.g. speed dating), we may collect relationship preferences. This constitutes special category data, is processed only with your explicit consent under Article 9(2)(a) of UK GDPR, and can be withdrawn before or after the event. This data is automatically deleted within seven days, and a record of the consent is retained for up to 30 days for audit purposes, unless you withdraw it sooner.
• Photography & Media: Photos and videos may be taken at events for promotional purposes. You will always be informed beforehand and may opt out (see section 7).

We do not collect phone numbers, dietary information, or financial details beyond those needed for legally-required transactions.

We may use your event interests to recommend relevant events; you can change or delete these anytime in your account.

3. How We Use Your Data

We process your data for the following purposes, under the lawful bases set out in UK GDPR:

• Contract (Art. 6(1)(b)): To register you for events, issue tickets, manage your account, and send essential pre‑event communications or updates.
• Legitimate Interests (Art. 6(1)(f)): To maintain safe and efficient operations, provide attendee lists to reception, analyse platform use, support event logistics, and promote events via general photos and videos. We have carried out Legitimate Interest Assessments to ensure necessity and a fair balance with your privacy rights. You have the right to object at any time and we will respect your request.
• Consent (Art. 6(1)(a)): For email marketing, close-up or featured event media, processing special category data for events, and optional communications such as newsletters. All marketing checkboxes are unticked by default, and you may withdraw consent at any time.
• Legal Obligation (Art. 6(1)(c)): To comply with legal duties including tax, finance, and student safety.

Where more than one lawful basis could apply, we will always rely on the most appropriate basis in context.

4. Sharing Your Data

With Students' Unions & Venues: We share only essential details (event, name, ticket reference, internal/external status) for event admission and safety.

If you choose not to share this information, the venue may not be able to verify your ticket on arrival.

We require hosting partners to delete admission lists within 14 days of the event unless required for safety or incident reporting. Until formal Data Sharing Agreements (DSAs) are signed, sharing is carried out under documented interim terms ensuring confidentiality, necessity, and secure transfer.

With Service Providers: We use trusted providers in the UK and EEA (including AWS Frankfurt and Neon DB, subject to UK adequacy decisions). Where third-party processors are used, they act strictly under our instructions, contractually bound to safeguard your data. Vercel acts as our analytics processor for aggregated usage data only.

International Transfers: If third-party tools outside the UK/EEA are engaged, transfers rely on the UK-US Data Bridge or UK International Data Transfer Addendum.

No Sale of Data: We never sell or rent your personal data.

5. Retention

We keep personal data only as long as necessary, in line with a live retention matrix:

• Inactive accounts: deleted after 24 months.
• Event interest preferences: deleted after 12 months of inactivity.
• Marketing consent records: reviewed every 24 months.
• Financial records (when generated): kept for 6 years (HMRC compliance).
• Special event data: deleted within 7 days of the event; consent records held for up to 30 days.
• Promotional photos and videos: kept for up to 3 years, then archived or deleted.

All retention periods are actively reviewed; data is securely erased or anonymised once no longer required except where the law requires otherwise.

6. Marketing

We only send marketing if you explicitly opt in.

• All boxes are unticked by default.
• You can withdraw consent or unsubscribe at any time.
• We maintain a suppression list on a legitimate interests basis to ensure you are not contacted again if you unsubscribe, retained indefinitely until you reverse your opt-out.

For "similar events" you have attended or purchased, we rely on the soft opt-in exception (PECR Regulation 22). Every email provides an easy opt-out.

7. Photography & Media

At events:

• We may take general crowd photos or videos for promotional use. These rely on legitimate interests where individuals are not specifically identified.
• You will always be notified in pre-event communications and by signage at the event.
• Anyone preferring not to be photographed may request a "no-photo" indicator at the event.
• For close-up or featured media, your specific consent is always sought prior to use.
• All media is stored securely and reviewed before reuse or publication.

8. Your Rights

You have the right to:

• Access your data
• Request correction
• Request deletion
• Request restriction of processing (e.g., while accuracy concerns are investigated)
• Object to processing (including marketing and photography)
• Request data portability

You can exercise these rights by contacting hello@londonstudentnetwork.com.

We will respond within one month wherever possible.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): www.ico.org.uk.

Rights are provided under UK GDPR and the Data Protection Act 2018.

9. Security

We protect your data with industry-standard measures, including:

• Encryption in transit and at rest
• Multi-factor authentication (MFA)
• Role-based, least-privilege access
• Regular reviews of access and audit logs

Systems and controls are tested regularly, and we maintain a documented breach response plan.

10. Breaches

If we ever suffer a data breach likely to result in a risk to your rights and freedoms, we will:

• Notify the UK Information Commissioner's Office within 72 hours, unless risk is unlikely
• Notify you promptly via the email address linked to your account, including guidance on steps to protect yourself

11. Updates to This Policy

We may update this policy from time to time. The latest version will always be available on our website.

If we make significant changes, we will notify you by email and/or in-platform message. Previous versions are available on request for transparency.

12. Company Information

Company Name: London Student Network Ltd
Company Registration Number: 15849720
Registered Office Address: 87 Egginton Road, Etwall, Derby, DE65 6NP
ICO Registration Number: ZB808699

For all privacy-related enquiries, please contact: hello@londonstudentnetwork.com