Privacy Policy

CES Quorum is an internal scheduling tool run by the UAL Creative Entrepreneurs Society, a student society of University of the Arts London (“CES”, “we”, “us”). CES is the data controller for the personal data described here.

Access is invitation only. Only people already on the CES committee directory can sign in; the tool is not open to the public and is not used to contact students outside the committee.

For anything in this policy, email contact@ualces.com.

We only collect what the tool needs to find a time when the right people are free.

• Directory details — your full name, contact email address, access level (member, project lead or admin), account status, time zone, and the hours you’re willing to take calls, including any per-day custom hours you set.
• Membership details — the departments, wings and roles you hold, the projects and events you’re on, and whether you lead any of them.
• Calendar availability — if you choose to connect a Google or Microsoft calendar, we read busy/free time blocks only. We do not receive or store event titles, descriptions, locations, attachments or guest lists. We store the list of calendars you chose to include, and the credentials needed to keep reading your busy times, which are held encrypted.
• Scheduling activity — searches you run, the participants you selected, the suggested time slots produced, and calls you book (title, time, participants, and any meeting link or note you add).
• Admin activity log — a record of who changed a directory record or setting, and when, so committee changes are traceable.
• Sign-in data — your email address and sign-in timestamps, handled by our authentication provider. We never see or store your Google, Microsoft or email password.

We do not run advertising, we do not sell or share data with third parties for their own purposes, and we do not track individual members with analytics or profiling tools.

Under UK GDPR we rely on:

• Legitimate interests — running the society: keeping an accurate committee directory, organising meetings, and keeping a record of who changed what.
• Consent — for connecting a personal calendar. This is entirely optional. You can withdraw it at any time by disconnecting the calendar in your profile, and nothing else about your account changes.

• Other signed-in committee members can see your directory entry: name, contact email, roles, wings, departments and projects.
• When you’re included in a scheduling search, other members see only whether a time slot is free, busy, outside your preferred hours or unknown. They never see what is in your calendar.
• Society admins can view and edit directory records, change access levels, deactivate accounts, and read the activity log.
• Nobody outside the CES committee has access to the tool.

• Lovable Cloud — hosting, database and authentication for the app.
• Google and Microsoft — calendar availability and, when you book a call from your own account, sending the calendar invitation. These are only involved if you connect a calendar.

These providers may process data outside the UK, including in the United States. Where that happens it is covered by the providers’ standard data-protection safeguards for international transfers.

• Your directory and scheduling data is kept while your committee account is active.
• If you disconnect a calendar, the stored credentials and cached busy-time data for it are removed straight away.
• If your account is deactivated or you leave the committee, your personal data is kept for 12 months and then deleted.
• Records of past calls may be kept beyond that for society history, with personal details removed.

You can ask us to:

• give you a copy of the data we hold about you;
• correct anything that’s wrong;
• delete your data;
• stop using it in a particular way, or object to our legitimate-interests use;
• withdraw calendar consent (you can also just disconnect it yourself in your profile).

You can edit your own name, time zone, call hours and calendar connections at any time from your profile. For anything else email contact@ualces.com and we’ll respond within one month.

If you’re unhappy with how we’ve handled your data you can complain to the UK Information Commissioner’s Office at ico.org.uk.

• Calendar credentials are encrypted before they are stored.
• Database access rules mean each account can only reach the records it is entitled to; admin actions are logged.
• Sign-in is invitation only, using a one-time email link or your Google account.

CES Quorum is for committee members of a university society, who are normally 18 or over. If you are under 18 and on the committee, a parent or guardian can contact us on your behalf about any of the rights above.

If we change how the tool handles data we’ll update this page and change the date at the top. Material changes will also be announced to the committee.

See also our Terms of Service.