Privacy Policy

King’s College London Legal Tech Society Privacy Policy

1. Who we are. KCL Legal Tech (the King’s College London Legal Tech Society) is a student society affiliated to King’s College London Students’ Union (KCLSU), Bush House, South East Wing, 300 Strand, London WC2R 1AE. KCLSU is legally responsible for all society activities and is the data controller for the personal data described in this policy; KCL Legal Tech processes it on KCLSU’s behalf and follows KCLSU’s data protection policies. KCLSU’s privacy notice is at https://www.kclsu.org/resources/kclsu/Student-Data-Privacy-Notice/ . Contact our Data Protection Lead (Raphy Craigie) at kcllegaltech@gmail.com, or KCLSU at data@kclsu.org.

2. What we collect, why, and our lawful basis.

(a) Membership: name, email, student status — to administer membership — contract (Art. 6(1)(b)).

(b) Event registration: name, email, course/year — to run events — legitimate interests (Art. 6(1)(f)), or contract for paid tickets.

(d) Newsletter — promotional emails — consent (Art. 6(1)(a) and PECR).

(e) Sharing with a named sponsor — recruitment/networking — consent (Art. 6(1)(a)).

(f) Photographs and recordings — event records and promotion — consent for identifiable promotional images; legitimate interests for general crowd images, with an opt-out.

(g) Speakers and business contacts — arranging events and sponsorship — legitimate interests.

(h) Legal Tech Review contributors — publishing — contract.

(i) Committee records — governance — contract and legitimate interests.

(j) Financial records — accounting — legal obligation.

(k) Elections — legitimate interests.

(l) Website: see our Cookies Notice.

3. Who we share data with. Our service providers (Google Workspace, Luma, Squarespace, which process data on our instructions; KCLSU and the University where required by their rules or the law; sponsors only where you have specifically consented, naming that sponsor. We never sell your data. Speakers do not receive attendee lists.

4. International transfers. Some providers may process data outside the UK; where they do, appropriate safeguards (such as UK adequacy regulations or the International Data Transfer Agreement/Addendum) apply.

5. How long we keep it. Membership: membership year plus 12 months. Event registrations: 3 months after the event. Dietary/access data: 30 days after the event. Newsletter: until you unsubscribe (we keep a suppression list so we don’t contact you again). Data shared with sponsors: our copy deleted within 3 months; the sponsor’s retention is governed by its own privacy notice. Business contacts: relationship plus 2 years. Speakers: 6 months after the event unless you agree otherwise. Photographs: up to 3 years or until consent is withdrawn. Review contributors: published works archived; correspondence 12 months. Committee records: end of the academic year following the member’s term. Financial records: 6 years. Election ballots: 1 month.

6. Your rights. You have the right to be informed; to access your data; to rectification; to erasure; to restriction; to data portability; to object to processing based on legitimate interests and to direct marketing at any time; and to withdraw consent at any time without affecting earlier processing. Contact kcllegaltech@gmail.com; we respond within one month. You may complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.

7. Security. We store data only on official Society accounts, with restricted access, and our committee members are bound by data protection obligations in their Committee Member Contract.

8. Changes. We review this policy each year and will post updates here.