This statement describes how Advance HE collects and uses personal information about you when you consent to be a participant in a research project. For the purpose of data protection legislation the Data Protection Act 2018 (“DPA”)) Advance HE is the “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this statement.
1 Who we are
Advance HE is a company limited by guarantee incorporated in England and Wales under company number 4931031, and registered as a charity in England under charity number 1101607 and in Scotland under charity number SC043946, with its registered office at Innovation Way, York Science Park, York YO10 5BR. We can also be contacted at research@advance-he.ac.uk or 01904 717500.
2 Information we may collect from you
We may collect and process the following data about you:
- Information that you provide when submitting your form consenting to be a research participant;
- If you contact us, we may keep a record of that correspondence;
- Contact details;
- We may ask for the following information dependent on the type of research you will be participating in:
- life information;
- age;
- genetics;
- biometrics;
- race;
- ethnic origin;
- politics;
- religion;
- health;
- sex life or orientation;
3 What we may use your data for
The situations in which we will process your personal information are listed below:
- For communicating with you about your participation in a research project;
- Transfer of information to the research team;
- Evaluating and analysing your participation in a research project;
- Publishing findings of the research including anonymous information concerning your participation in a research project;
- Generating reports for internal use by us (including our staff) in relation to statistical information to support the research findings.
- Appointing Researchers to review the outcomes from your participation;
- Using third party systems to collect and analysis the data gained from your participation;
- Where we wish to use data for other purposes, we may anonymise your information so that it cannot be linked to you. In that case, it will cease to be personal data and we may use the anonymised data for any purpose.
Our lawful basis for the above activities is our legitimate interest in conducting research for the benefit of the higher education sector and in pursuance of our charitable aims. Where we collect ‘special category’ data our additional condition for processing such data is that it is in the ‘substantial public interest’, particularly in relation to equality of opportunity and treatment.
4 How we will protect your personal information
We are committed to securely holding your personal information provided in this form.
Where personal information is held electronically, it is held on a computer system that is owned and controlled by Advance HE or such other third party appointed by Advance HE.
Each third party contract ensures on-going security protocols for collecting and sharing personal and special category data with auditing measures in place. Upon expiry of a third party contract, the contractor is obliged to cease processing the data, to destroy or return any copies of data they hold on our behalf, and we block further access to our systems.
Cloud service providers used to store, process and protect AHE data will provide the relevant certification, security and encryption to support the organisation. Any cloud service provider cannot under any contractual arrangement use, process or store any AHE personal information without the express permission of AHE. Breach notification obligations and protocols will be included in any data arrangements with cloud providers and notifications on any data breach reported to AHE immediately. In the case of any data breach, AHE will work with the cloud provider to ensure data is secured and relevant parties informed of the data breach immediately. Any cloud provider chosen by AHE will demonstrate compliance through data protection impact assessments and by being ISP 27001 and ISO 27018 compliant.
To effectively process research outcomes, Advance HE stores details in electronic format.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
5 How long we will retain your data for
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for (see “3. What we may use your data for”).
To determine the appropriate retention period for personal data, we consider:
- the amount, nature, and sensitivity of the personal data;
- the potential risk of harm from unauthorised use or disclosure of your personal data; and
- the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Advance HE will ensure that our suppliers and selected third parties with whom we share your personal information in accordance with this statement will delete your personal information when they no longer require it.
Please see Advance HE’s Retention and Erasure policy for specific details of retention periods for Research.
6 Who else we may pass on your information to
We may pass your information on to the following third parties and/or internal teams or departments at Advance HE and for the following purposes:
- Our suppliers who provide services on our behalf such as IT providers who own, manage or provide support for our computers or systems we use and our suppliers who provide the VLE, e-learning, diagnostic tools or other software;
- Our staff or individuals that we appoint to review your participation.
We may sometimes be obliged to disclose your personal information by law such as by a regulator with appropriate power, or court order. In addition, information held by or for public bodies can be subject to freedom of information requests.
7 Your duty to inform us of changes
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.
8 Your rights in connection with personal information
Under certain circumstances, by law you have the right to:
- Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Data Protection Team in writing at data.protection@advance-he.ac.uk.
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
You have the right to complain to the Information Commissioner (http://www.ico.gov.uk/) if you have any concerns in respect of the handling of your personal information by Advance HE.
