Who we are
CampusTV is the student TV station at the University of Bath, part of SU Bath Media. We run the booking form at campustv.co.uk/book, the crew-call pages, the team app at app.campustv.co.uk and the sports graphics at overlays.campustv.co.uk, and we decide what is done with the details they collect. This page covers all four.
The short version
- We collect only what we need to run bookings, find crew and run the society.
- No adverts, no tracking cookies, no analytics services. We do not sell your details or use them for marketing.
- Your details are stored on servers in London, behind access rules so that only the people who need them can see them.
- Booking requests are deleted automatically, 12 or 24 months after they were last needed.
- You can ask to see, correct or delete your details at any time.
If you book coverage
We ask for your name and email address, the event (its name, date, venue and the services you want) and, unless it is a personal shoot, your society or organisation. Your phone number, times, venue and notes are optional. We also keep the version of the coverage terms you accepted and when you accepted them. We do not ask for your date of birth, home address, student number, payment details or anything sensitive. Please do not put other people’s personal details in the notes box.
We use these details to reply, decide whether we can cover the event, plan the crew, and send you a receipt and updates by email. Our basis is that you asked us to cover an event and we need the details to do it (UK GDPR Article 6(1)(b)).
We keep a copy of each email we send you about your booking (and any we wrote but didn’t send), so the team can see what you have been told. These copies are deleted with your request.
Your booking has a private status link. Anyone with the link can see how the request is going, but not our notes, prices or crew. When your video is ready, the status page can play it: it loads the player from YouTube (in its privacy-enhanced mode) or Vimeo, and they can then see your connection, as they would on any website that embeds them.
If we accept your request, an event is created for the shoot. The event, its crew and the finished work stay on our records. Your contact details and status link are deleted at the time shown under “How long we keep it”.
If you offer to crew a shoot
A crew-call page asks for your name and, if you wish, a phone number and a note, so that we can fill a role. Your offer waits for the team to confirm it. Once confirmed, you are added to our crew list with the same details. Our basis is that you offered to help and we need your details to organise it (Article 6(1)(b)), and our legitimate interest in running the society (Article 6(1)(f)). The page may then show you a link to the shoot’s WhatsApp group. If you join, WhatsApp’s own privacy terms apply. The page keeps your name in your browser so you do not have to retype it (see “Cookies and your device”).
If you are on the team
Committee and crew sign in to the team app by invitation only: there is no public sign-up. We hold your email address, your password (stored only in scrambled form, so nobody can read it back) and a record of when you signed in. The same account signs you in to the sports graphics. We also hold a crew record: your name, the name you go by, your committee role, phone and email, whether you are a Students’ Union member and when we checked, your training, and notes the team has added. The app records which events and kit you are down for, kit you check out and in, the to-do items you create, and a log of changes to who has access to what. If you turn on notifications, it stores your browser’s notification address so we can send them.
Our basis is our legitimate interest in running the society and its shoots safely and fairly (Article 6(1)(f)), and your role in it. Each person is given access only to the parts of the app they need: calendar, crew, kit and so on. Only administrators can see the log of access changes.
Footage and photographs of people
When we film or photograph at an event booked by a club, society or organisation, identifiable people are personal data too. Section 4 of the coverage terms says how: clients tell the people taking part, anyone can ask to be kept out of shot, we ask to be told if under-18s or vulnerable adults will be filmed, and anyone who appears can ask us to remove or blur them by emailing ctv-manager@bath.ac.uk. We aim to reply within 14 days. Published footage is kept in our archive. Safeguarding concerns may be shared with the University or the Students’ Union where necessary.
Live sports graphics
When we cover a match, the on-screen graphics (scores, clocks, line-ups, captions) come from overlays.campustv.co.uk. For each team it holds the name, colours and crest, and a squad list: players’ names, shirt numbers and positions. During a match it keeps a log of what happened, such as goals, cards and substitutions, with the player involved where we know it and the name of the crew member who entered it. It can also hold names and roles for captions, such as commentators and guests. We get squad lists from the teams or their clubs, or type them from a team sheet.
Names entered for a match can appear on screen, so they can be in the broadcast and in any recording of it. Each match can also have a public fan link that shows the live score and its moments, with players’ names. Our basis is our legitimate interest in covering sport for the campus audience (Article 6(1)(f)). If you would rather your name were not shown, or want it taken off a squad list, email ctv-manager@bath.ac.uk.
Visit counting and abuse limits
We count visits to the booking page so we can tell whether a poster or QR code worked. A visit records the page, the website you came from (the host only), a source tag such as a poster name, and whether you used a phone, tablet or computer. Your visit is stored as a scrambled code made from your connection and browser together with a secret that changes every day. It cannot be turned back into your address or linked from one day to the next. We hold the secret, so the code still counts as personal data.
To stop the form being misused, we keep a record of your connection and the email address you entered for about a day, so we can limit how many requests and receipts one connection or address can generate. The connection record is scrambled before it is stored. Our basis for both is our legitimate interest in running the service and protecting it from misuse (Article 6(1)(f)).
Cookies and your device
The public site sets no cookies and has no advertising, tracking or analytics scripts. It uses two small pieces of storage in your browser, only to work as you would expect: after you send a booking, a summary of what you sent is kept in the tab so the thank-you page can show it (it disappears when you close the tab), and the crew-call page remembers the name you typed, on this device, for next time. You can clear both in your browser settings.
The team app sets one sign-in cookie, only when you sign in, to keep you signed in for up to 400 days on that device. It also keeps recently viewed screens so the app works with a poor signal, and your display and Board settings. Signing out clears the saved screens. The sports graphics set their own sign-in cookie, for up to 60 days, and the device running them remembers the last few names typed into captions and any score changes not yet sent, so a lost connection does not lose a goal. These are needed for the apps to work, so there is no cookie banner. On a shared computer, sign out when you finish.
Who can see it, and who helps us run it
Within CampusTV, only team members who have been given access to the relevant part of the app. We use a small number of providers who handle data only to provide these services for us:
- Oracle Cloud, London region: the website, the database, uploaded photos and encrypted backups.
- Cloudflare: runs our domain name records, sits in front of the team app and the sports graphics to protect them, and forwards email sent to campustv.co.uk addresses to the team’s shared mailbox, which is a Google mailbox.
- Resend: sends our emails (receipts, updates and sign-in codes).
- YouTube and Vimeo: only if you open a status page that plays your video (above).
- Browser notification services (Apple, Google, Microsoft or Mozilla), only if you turn on notifications.
Resend and Cloudflare may handle data outside the UK. Their data processing terms cover this and the safeguards UK law requires. We do not sell your details.
How we keep it safe
- Every connection is encrypted. The database cannot be reached from the internet: only our own servers can talk to it.
- Access rules in the database itself decide who can see each record, so a mistake in the app cannot show people what they should not see. We test these rules automatically.
- Accounts are by invitation only, and every one has a password, stored in scrambled form. People are given access to only the parts of the app they need, and changes to access are logged.
- Backups are encrypted, and the key is not kept on the server that holds them.
- Security updates to the servers are applied automatically.
No system is perfectly safe. If something goes wrong that puts your details at risk, we will tell the Information Commissioner’s Office within 72 hours where the law requires it, and tell you without undue delay if it is likely to affect you seriously.
How long we keep it
- Requests we declined, that were withdrawn, or that never got a reply: deleted 12 months after the last change.
- Requests we accepted: contact details and status link deleted 24 months after the event date.
- Copies of the emails we sent you: deleted with the request they were about.
- Visit records: deleted after about 13 months.
- Abuse-limit records: deleted after about a day.
- Crew-call offers and team records (accounts and crew records): kept while you are involved with CampusTV. An administrator removes them when you leave or ask us to. We do not yet delete these automatically.
- Sports squads, caption names and match logs: kept while the team or match is in use, and removed by an administrator on request. We do not yet delete these automatically.
- Published footage: kept in our archive, subject to removal requests (see above).
- Backups: deleted after 8 weeks at most, so a deletion reaches the backups within that time.
Your rights
You can ask to see the details we hold about you, correct them, or have them deleted, ask us to limit how we use them, and object to how we use them. Where you gave us details to arrange something, you can also ask for a copy in a form you can reuse. Email ctv-manager@bath.ac.uk and we will reply within 1 month. If you are not happy with how we handled something, you can complain to the Information Commissioner’s Office at ico.org.uk. Footage and photographs are also covered by clause 4.4 of the coverage terms.
Changes
If we change what we collect or who we share it with, we will update this page and the date at the top. This is the current version.