Privacy Notice — BSMS MedSoc

The controller of your data is:

• The Brighton and Sussex Medical Society (“BSMS MedSoc,” “we,” “us”)
• Website: www.bsmsmedsoc.co.uk
• Contact: comms@bsmsmedsoc.co.uk

What data we collect, and why

Website membership (registration)

When you register at www.bsmsmedsoc.co.uk/register, we collect:

• Username
• First name
• Last name
• Graduation year
• University E-mail address / personal E-mail address

Purpose: to create and manage your membership account, allowing you to participate in elections and access members-only content (meeting minutes, Member only discounts).

Legal basis: legitimate interests – running the society’s membership system and internal governance. Where any part of registration is optional, we rely on consent instead.

Elections

When you take part in an election, we additionally collect:

• University e-mail address
• First name
• Last name

Purpose: to verify eligibility and prevent duplicate voting in society elections.

Legal basis: legitimate interests – ensuring fair and verifiable elections.

Purchases (tickets, merchandise, membership fees)

When you buy anything through the website – event tickets, merchandise, or membership fees – we collect, via our WooCommerce store:

• Name and contact details (email address)
• Order details (items purchased, price, date)
• Billing details as required for payment

Payment card details are never stored on our servers. Payments are processed directly by Stripe, our payment processor. Stripe handles your card data under its own security standards (PCI-DSS compliant) and privacy policy — see stripe.com/gb/privacy.

Purpose: to process and fulfil your order, provide order confirmations, and handle any refunds or disputes.

Legal basis: performance of a contract (fulfilling your purchase). We keep basic transaction records for longer than other data, as required for accounting and tax purposes.

When personal data is collected

• When you register for a website account
• When you take part in an election
• When you purchase tickets, merchandise, or membership through the website
• If you contact us directly (e.g. by email), we’ll hold that correspondence for as long as needed to resolve the query

We do not currently operate a separate mailing list or newsletter. If this changes, this notice will be updated and your consent will be requested before you’re added to one.

Cookies

Our website uses cookies, including some required for the site and store to function (e.g. WooCommerce shopping cart/session cookies) and, where applicable, others used for analytics. Full details are in our separate Cookie Policy, and non-essential cookies will only be set with your consent via the cookie banner.

Retention of personal data

• Membership/registration data is retained until either:
  1. One year after your recorded graduation year has passed (to allow for resits), after which your account and associated data are deleted; or
  2. You delete your own account, at which point your data is deleted.
• Election data is anonymised shortly after the election concludes, then retained in anonymised form for 5 years for governance/audit purposes.
• Purchase/transaction records are retained for 6 years, in line with UK tax and accounting record-keeping requirements. Only the minimum necessary data (order details, amount, date) is kept for this purpose – not full payment card information, which we never hold.

Disclosure and transfer of personal data

We only disclose your personal data to a third party where required by law, where you’ve given specific consent, or where an appropriate data-sharing arrangement is in place, including:

• Brighton and Sussex Medical School
• Stripe, Inc. — for payment processing. Stripe may process data outside the UK/EEA (including in the United States); where this happens, Stripe relies on its own approved legal safeguards (such as Standard Contractual Clauses). See Stripe’s privacy policy for details.
• The committee member or student organising a specific event or product (e.g. a ball, social, or quiz), where you have purchased a ticket for it. In this case, we share your name, email address, and order number, solely so the organiser can manage attendance, take a register, or send event-related communications (such as a quiz link). Organisers are asked to delete this data once it is no longer needed for that purpose.
• The BSMS MedSoc committee, where you take part in an election. Your name and email are visible to relevant committee members solely to check eligibility and identify duplicate votes, before the data is anonymised as described above.
• Professional and regulatory bodies, in relation to confirmation of qualifications, professional conduct, and course accreditation
• Legal representatives, where necessary

We do not sell your personal data to anyone.

Your rights

Under UK GDPR, you have the right to:

• Rectify inaccuracies in personal data we hold about you
• Be forgotten in some circumstances — i.e. have your data erased from our systems
• Restrict how we process your personal data in certain circumstances
• Access/portability — obtain a copy of your data in a commonly used electronic format
• Withdraw consent, where consent is the legal basis for processing
• Object to certain types of processing
• Complain to the ICO (Information Commissioner’s Office) if you believe your data has been mishandled — see ico.org.uk or call 0303 123 1113. We’d appreciate the chance to resolve any concern directly first, at the contact below.

Security

We take reasonable technical and organisational steps to protect your data, including restricting admin access to the website and never storing payment card details directly. No system is perfectly secure, and in the unlikely event of a data breach affecting your personal data, we will notify affected members and, where required, the ICO, without undue delay.

How to contact us

Any questions regarding your data should be sent to comms@bsmsmedsoc.co.uk.

This policy was last updated in August 2026 and will be reviewed annually, or sooner if our data practices change (e.g. if we introduce a mailing list or change payment provider).