Vitae-UNILUX coaching Privacy Notice

1. Introduction

The Careers Research and Advisory Centre (CRAC) Ltd is the non-profit organisation that manages the Vitae programme.  Vitae is the global leader in supporting the professional development of researchers, experienced in working with institutions as they strive for research excellence, innovation and impact.

You can find more information about CRAC and the work that we do on our website: www.crac.org.uk.

CRAC is committed to protecting the personal information of all its contacts and being clear about what information we hold about them and how we use it. This privacy notice tells you what to expect when CRAC collects personal information.

CRAC is registered as a data controller with the Information Commissioner’s Office (ICO). Our registration number is Z1030346.  You can check our registered details on the ICO’s website: https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/

2.  Data Controller and Data Protection Officer

As the party contracting this coaching programme, the University of Luxembourg is the Data Controller of any personal information collected within scope of this privacy notice.

Sandrine Munoz is the data protection officer and can be contacted via dpo@uni.lu.

Vitae is the data processor, as we are processing your personal data in order to fulfil the contract. Our location and contact details are below:

The Careers Research and Advisory Centre (CRAC) Limited

22 Signet Court

Cambridge

CB5 8LA

Tel: 01223 460277

Our Data Protection Officer (DPO, David Nightingale David.nightingale@crac.org.uk, 01223 460277) is the first point of contact for people whose information is processed.

3. How we use your personal information

We can only use your personal information where we have legitimate reasons for doing so and have told you what those reasons are.

The specific uses that will be made of your personal information in relation to this project are listed below:

  • Your contact details will be used to enable us and the coaches to deliver the programme effectively. We will not use them to contact you for any purpose outside the coaching programme.
  • Your responses to the pre-coaching survey will be used to match you to a suitable coach and to help them prepare for the coaching sessions effectively. The survey responses will only be shared with your coach, and with the Vitae project team.  
  • There will be a post-coaching survey. The responses will be used to evaluate the benefit of the programme. It will not ask about the content of the coaching sessions. A report based on this survey will be shared with the University organisers. Please note that based on the small number of participants, it may be possible to identify individual’s responses.
  • The information you share in the coaching sessions will be used by the coach to support you in achieving your intended outcomes from the programme.  This information will not be shared with anyone other than the coach, unless you give specific permission. (there are a very few exceptions to this, for example information already known to the coach in advance/separate from the session; or illegal activities; or if there is a risk of harm to the coachee or to others. Your coach will explain their approach to you if you ask).
  • Your coach may be engaged in their own professional development, as required for qualified coaches; meaning your coach may share anonymised details of the coaching session with a supervisor, or submit a log of their coaching activities including coachees’ names and email addresses so a governing body can ensure the log is accurate. Your coach will explain what professional development they are undertaking and what the obligations are. If you have any concerns, you and your coach should discuss this with Vitae in the first instance to find a resolution.
  • Vitae and the coach will store your contact details and survey responses for one year after completion of your coaching programme, which is scheduled to happen by September 2022.
  • Your coach will store information about your coaching sessions for six months after completion of your coaching sessions.
  • If we want to use your personal information for a reason other than the purposes set out above, we will tell you before we start that use.

4. Legal basis for using your personal information

Under data protection legislation, we require a legal basis to be able to process personal information for the purposes set out above. In this case, the legal basis is consent: we request your consent to process your personal data as outlined in this privacy notice, in order for us to provide the service the University has contracted us to provide.

Withdrawal of consent

Consent can be withdrawn at any point if you no longer want your responses provided to this survey to be used for the purposes outlined above.  You can withdraw consent by emailing dataprotection@vitae.ac.uk.

5. What personal information we will collect

The personal information we collect is:

  • Email Address
  • Name
  • Your discipline and possibly role/role type within the University
  • Your experience and views relevant to our delivery of coaching

The coach may collect personal information, if you provide this to them in the coaching sessions.

6. Personal information we obtain from another source

The University will provide us with contact details of the participants in the coaching programme, including name, role, email address. We do not expect to obtain any personal information from any other source. 

7. Who we give your personal information to

We will share your contact details and responses to the initial survey with your coach. We will not routinely pass your information to any other individual or organisation except where required to do so as part of our functions or by law. 

8. Where your personal information will be stored

Your personal information is stored by CRAC on Microsoft Azure and Microsoft Office 365 business services.  Microsoft will have access to your personal information for the purposes of providing the business services to us. For more information about how Microsoft may process your personal information please see the information in the Microsoft Trust Centre: www.microsoft.com/en-us/trustcenter/privacy. 

The coach may use Zoom or a similar platform to deliver the coaching sessions; and may use Gmail or an equivalent email platform or online filing system. We recommend that if you have any concerns, you review the privacy information of the platform they propose using to ensure you are satisfied with it.

Zoom complies with GDPR. For more information, please visit Zoom’s website (https://zoom.us/gdpr). As with other online tools, the use of Zoom generates data that may allow conclusions to be drawn about people. This data is treated confidentially and is neither passed on nor sold to third parties by Vitae or by Zoom, according to their privacy policy (https://zoom.us/privacy#_Toc44414842). Like many other webinar technology providers, Zoom is a US-based service provider. Like others, "Zoom" is certified under the EU-U.S. Privacy Shield, so that the legal requirements for an adequate level of data protection are met.

Vitae uses Surveymonkey to distribute surveys and collect responses.  Any personal information that you share with Vitae through Surveymonkey will only be used to facilitate the delivery and evaluation of the event and programme as described in this policy. Your personal information will not be shared with any other party or for any purpose not referenced in this privacy notice and will not be used for marketing purposes. For more information on how Surveymonkey handles data, please visit Privacy Notice | Momentive (surveymonkey.com) Like many other webinar technology providers, Surveymonkey is a US-based service provider. Like others, it is certified under the EU-U.S. Privacy Shield, so that the legal requirements for an adequate level of data protection are met.

We do everything possible to protect your and our data and to ensure transparency. However, it is up to you to decide whether you want to use Surveymonkey. With your participation in a surveymonkey survey you accept our data privacy policy and agree to the processing of the data necessary for the execution of the programme.

You should understand and agree that your personal information may be transferred to, and stored at, a destination outside the country and economic area in which you reside, and that it may also be processed by staff operating outside that country for the purposes set out in this Privacy Policy. 

9. How do we protect your personal information

CRAC has a number of security measures in place to protect your personal information, listed below:

  1. All staff are required to undertake training in data protection and information security on joining CRAC and then on an annual basis
  2. Formal information security policies that must be read and understood by all staff
  3. Personal information is only available to those members of staff who require access as part of their role.
  4. CRAC implements information security controls based on recommendations from the UK National Cyber Security Centre, the International Organisation for Standardisation, the Payments Security Standards Council and the UK Information Commissioner’s Office. We regularly review the risks to our systems and mitigating security controls.
  5. CRAC has current Cyber Essentials certification.
  6. CRAC holds ISO27001 accreditation.

10. Your rights over your personal information

Once your personal information has been collected, you have certain rights in relation to that personal information that may be exercised. You have the right to:

  1. Ask for a copy of your personal information
  2. Correct inaccurate personal information held about you
  3. Ask for your personal information to be deleted (within 30 days)
  4. Restrict processing of your personal information
  5. Ask for a copy of their information in a format that allows easy transfer (“data portability”)
  6. Object to automated decision making or profiling (if these take place)

11.  Complaints about the use of your personal information

If you are unhappy with the way in which your personal information has been handled by CRAC, you may contact us at: dataprotection@crac.org.uk and we will try to resolve your issue informally.

If we are not able to resolve the issue to your satisfaction, you can also make a complaint to the data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) and they can be contacted at:

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 0303 123 1113

Email: casework@ico.org.uk

12. Changes to this privacy notice

We keep our privacy notices under regular review and we will inform you of any changes to this notice by email.

This privacy notice was last updated on 28 January 2022.

 

Bookmark & Share