Who is responsible
Operator: The responsible legal entity has not yet been confirmed.
Privacy and support contact: jaspersbusinessstuff@gmail.com
The legal entity responsible for this portal, its postal contact and its relationship with the Students’ Union must be confirmed before launch. We do not assume that the University or Students’ Union is the controller of this separate service.
01
Information we use
For an account, we use your name, student ID, Warwick email address, password hash, verification status, account status and assigned role. We also record the terms version you accept, acceptance time, your separate message-email and optional event-email preferences and when those preferences change.
Your seven-digit student ID is used to form the university mailbox address u[student ID]@live.warwick.ac.uk. The address is shown during signup and must be verified. Knowing an ID does not prove ownership, and verifying a mailbox does not establish a committee appointment. We do not request your University password or access to your academic records.
For a committee invitation, an administrator supplies your name, ID, role and department from the appointment information available to them. Authentication records include session identifiers, expiry and request metadata. Security records capture actions such as permission changes, account activity and resource downloads. If authenticator sign-in is enabled by the operator, setup adds protected authentication secrets and recovery-code records.
Shared files are stored with their title, description, folder, filename, size, uploader, creation/update times and permitted audience. Authorised team members can upload and manage their own files; administrators manage the library. Upload only information you have permission and a valid reason to share. Do not use the workspace to store unnecessary student lists or sensitive personal information.
Direct chat stores participants, encrypted message bodies, timestamps, read positions and block preferences. The member directory lets verified members browse an alphabetical list and search by name. It shows the name, role and department of active, email-verified accounts, including accounts still completing setup, without exposing email addresses or student IDs. Members can start a conversation with these accounts; the recipient must personally accept the current terms before reading or sending messages in the chat workspace, and message emails require the recipient’s current terms acceptance. Reports store an encrypted copy of the selected message and your explanation, with the reporter, reported account and review status.
02
Why we need it
Account details allow us to provide the member service you request. Roles and departments determine which team announcements and files you can access. Conversation records allow members to communicate, track unread messages and block contact; selected message reports allow administrators to investigate misuse. Authentication and security records help protect accounts, investigate misuse and maintain access controls.
The proposed lawful basis for the necessary account service is contract; for proportionate security and access administration, legitimate interests in running a safe society portal; and for optional event emails, consent. These bases and the legitimate-interests assessment require operator approval before launch. A legal obligation would be used only where a specific applicable obligation exists.
Required signup details are needed for a verified account. Optional event emails are not a condition of access. This portal does not make automated decisions with legal or similarly significant effects; committee permissions are assigned by administrators.
03
Account, message and event emails
Verification, invitation and password-reset messages support your account. They are separate from promotional event emails. In this development preview, account messages are saved in a private local outbox for testing; no external email is sent.
Message emails are enabled by default after you accept the current member terms. They include the sender’s display name and full unread message text, plus a sign-in link to the conversation. Nearby messages may be combined to limit repeated emails. Google’s Gmail service and your mailbox provider process that readable content; it can appear in inbox previews and remain in your mailbox after a conversation or account is deleted from WMS. You can turn message emails off in account settings without losing website chat access. Blocking, read status and current account eligibility are checked before sending. Do not send information that is unsuitable for the recipient’s email inbox.
Announcement emails are enabled by default after you personally accept the updated member notice. You can turn them off at signup, before accepting the notice or in account settings. They contain the full text of newly published notices available to your account. Before sending, the service checks your current account status, email verification, terms acceptance, department, role and announcement-email preference. Drafts, historical posts, later edits and republished notices do not trigger a new email campaign. You can turn these emails off in account settings without losing access to the noticeboard. Already submitted or delivered email cannot be recalled, and mailbox copies can remain after a notice is changed or deleted.
Event emails are not being sent yet. Their optional preference is separate from announcement and message emails and can also be changed in account settings. When event emails are introduced, they must honour your choice and provide an easy unsubscribe. Withdrawing consent does not affect earlier lawful use or access to your account.
We do not sell contact details or supply a member email list to sponsors for their own marketing. Deriving an email address from a student ID does not by itself give permission to send marketing.
04
Storage and access
The current preview holds account records and private files on the operator’s development computer, outside the publicly served website files and Git source history. Passwords are hashed. Uploaded resources and chat bodies are encrypted, and private reads require a fresh permission check. Chat is not end-to-end encrypted: the application server processes readable messages, and a server operator with the key can decrypt stored content.
Administrators manage accounts and permissions. Executives, department heads and analysts receive only their assigned team and role access, under the service’s configured sign-in policy. Regular members can access published member content without access to team workspaces. Someone authorised to download a file can still retain a copy, so only share material appropriate for that audience.
Administrators cannot browse other members’ direct conversations through the application. If you report a message, administrators can read that selected message and your report. Public announcements and published calendar entries are visible without signing in when the site is available; drafts and team notices are not.
Production hosting, durable storage, backup arrangements and email suppliers have not yet been provisioned. Before public launch, this notice must identify those suppliers, where information is processed and any safeguards for international transfers. Encryption of resource files alone does not describe protection of the whole database or its backups.
05
How long information stays
No automated retention schedule is active in this private preview. The operator must approve and implement periods for unverified accounts, active and former members, security records, test emails, resources and backups before live member registration. Test data should be removed when no longer needed for evaluation.
Non-administrators can delete their account in settings after confirming their password; administrators require a managed handover. This removes the sign-in account, associated membership record and direct conversations involving that account. Selected message copies already reported for moderation remain encrypted, with references to the deleted account cleared; their text may still identify someone. Account exports include your chat history and your own reports, not reports submitted by other members. Limited security records and existing local test-email files may remain and need operator review. Account deletion is not a claim that every log, file or backup is erased immediately.
Keeping the website offline is not the same as deleting its data. A future published retention policy must specify the actual periods or decision criteria, any justified exceptions, and how backup expiry is handled.
06
Cookies and external services
The portal uses first-party cookies to maintain sign-in and, where enabled, complete two-factor authentication. They contain authentication identifiers, not your readable password, and are necessary for the account service you request. Server-side sessions last up to eight hours and may be renewed during use; sign-out invalidates the current session. Two-factor challenges are short-lived.
No analytics or advertising trackers are currently enabled. External links, including Instagram, LinkedIn and WhatsApp, take you to services with their own privacy practices. Any future analytics, embedded services or optional browser storage will need a separate review and appropriate controls before activation.
07
Your choices and rights
You can export your account information and recorded activity as a JSON file from account settings. You can also request access, correction, deletion, restriction or portability where applicable. The export is a useful account tool; it does not replace your right to ask for any other personal data held about you.
You may object to processing based on legitimate interests. You may object to direct marketing at any time. You can turn message emails off and withdraw optional event-email consent in settings. Rights depend on the circumstances, and identity may need to be checked before information is disclosed or changed.
For a request or privacy complaint, contact jaspersbusinessstuff@gmail.com. You may also complain to the Information Commissioner’s Office.
08
Keeping this notice accurate
This notice will be updated when the service or its handling of information changes. Material changes should be explained through an appropriate account communication. The current draft is informed by UK data-protection guidance; it does not certify legal compliance or replace the operator’s required decisions and responsibilities.
Read the member terms for rules on account use and shared content.