Sign in

Privacy notice

Effective 8 May 2025

The Edinburgh University Railway Society (the "Society") provides an email newsletter service for its members. The data controller is the Society. (A data controller determines the purposes and means of processing personal data.)

The newsletter is managed and sent via Hetzner Online (a server infrastructure provider), Ghost (a blogging platform), and Mailgun (a transactional and bulk email platform). Hetzner Online and Mailgun are the data processors.

What data we collect from you

The personal data we collect from you will include:

  • email address
  • name

Your personal data is collected via the Edinburgh University Students' Association, which operates its own personal data privacy notice.

The legal basis for processing this data is legitimate interests. The Society has determined:

  • that there is legitimate interest behind the processing, namely, to deliver a newsletter that communicates Society information to its members (including notification of Annual and Emergency General Meetings, information about upcoming activities, and any other information that may be relevant to the Society's activities);
  • that the processing is necessary for the identified purpose;
  • that there is not a case in which members' interests and rights and freedoms override the legitimate interests.

In other words, we think it's beneficial that people who register as members of the Society are kept up-to-date, and members will have the opportunity to opt-out of the newsletter at any time. For more details, refer to the full legitimate interests assessment.

Why we need your data

We collect personal data in order to:

  • add you to the Society mailing list, and
  • send you the Society newsletter.

We will not:

  • sell or rent your data to third parties, or
  • share your data with third parties for marketing purposes.

We will share your data if we are required to by law — for example, by court order, or to prevent fraud or other crime.

How long we keep your data

We will keep your personal data for as long as you are a member of the Society, until the beginning of the following membership period. The membership period begins in September and ends in May.

You may at any time withdraw from receiving the newsletter without affecting your membership status. You may exercise your right to withdraw by unsubscribing at the bottom of bulk emails or via the website.

Who we share your data with

As part of delivering the Society website and newsletter, we share your personal data with Mailgun (a transactional and bulk email platform) which acts as a data processor.

Where your data is processed and secured

Your personal data is stored on IT infrastructure rented from Hetzner Online GmbH that is located in Germany. The processing and storage of your personal data within the European Economic Area is governed by General Data Protection Regulations Adequacy Decisions.

Your rights

You have the right to:

  • withdraw consent to the processing of your personal data at any time
  • request a copy of your personal data

Contact us to request a copy of your personal data. The copy we provide will be in a structured, commonly used, and machine-readable format.

You can find out more about your rights on the Information Commissioner's Office website.

Questions and complaints

Contact us if you:

  • have any questions about anything in this privacy notice;
  • think that your personal data has been misused or mishandled;
  • want to make a subject access request.

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or 0303 123 1113, or [email protected].

Changes to this notice

We may change this privacy notice. When we make changes to this notice, we will add a change note in this section. Any changes to this privacy notice will apply to you and your data immediately. If these changes affect how your personal data is processed, the Society will take reasonable steps to inform you.