EPSRC focus groups privacy notice

Privacy Policy for the EPSRC focus groups on doctoral education 2021

1.     Introduction

The Careers Research and Advisory Centre (CRAC) Ltd is the non-profit organisation that manages the Vitae programme.  Vitae is the global leader in supporting the professional development of researchers, experienced in working with institutions as they strive for research excellence, innovation and impact.

You can find more information about CRAC and the work that we do on our website: www.crac.org.uk. 

CRAC is committed to protecting the personal information of all its contacts and being clear about what information we hold about them and how we use it. This privacy notice tells you what to expect when CRAC collects personal information.

CRAC is registered as a data controller with the Information Commissioner’s Office (ICO). Our registration number is Z1030346.  You can check our registered details on the ICO’s website: https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/

2.  Data Controller, Processor and Data Protection Officer

For the purposes of the EPSRC focus groups, the EPSRC is the data controller and CRAC is the data processor. EPSRC has appointed CRAC to design and deliver these focus groups in order to inform their review of doctoral education. EPSRC has determined what categories of data are to be collected and why.

The data controller for your personal data is the UK Research and Innovation (UKRI), of which EPSRC is part. You can contact the UKRI Data Protection Officer at: Email: dataprotection@ukri.org

3.  How we use your personal information

We can only use your personal information where we have legitimate reasons for doing so and have told you what those reasons are.

To achieve the above aims, the specific uses that will be made of your personal information are listed below: 

  • Your data will be used to:
    • Ensure that the participants of the focus groups (and as a result, the findings of the focus groups) are, where possible, representative of the range of researchers represented in the EPSRC doctoral programmes
    • Communicate with you about the focus groups
  • Your responses will be kept confidential and your personal data will not be shared with any third parties other than those CRAC staff involved in the delivery of this research project.
  • A report will be drafted based on the aggregated, anonymised responses and shared with EPSRC and RAND Europe.
  • No individuals or institutions will be identified in the report.
  • It is EPSRC’s intention to publish the final report.
  • If we want to use your personal information for a reason other than the purposes set out above, we will tell you before we start that use.

4.  Legal basis for using your personal information

Under data protection legislation, we require a legal basis to be able to process personal information for the purposes set out above. In this case, the legal basis is participant consent. Your consent will be collected via this application if you continue.

Withdrawal of consent

Consent can be withdrawn at any point if you no longer want your responses provided to this application to be used for the purposes outlined above. You can withdraw consent by emailing dataprotection@vitae.ac.uk.

5.     What personal information we will collect

The personal information we collect in this application is:

  • Your email address (so we can communicate with you about the focus groups – therefore this must be provided for you to be part of the project)

We also request the following personal information. You can choose not to provide this information although we ask that you do, as it is important to help us ensure representative participation as this will enhance the value of the research.

  • Your name
  • Your gender
  • Your age bracket
  • Your ethnicity
  • Whether you consider yourself to have a disability or not

6. Personal information we obtain from another source

Within this project, we will not be seeking any personal information from any other source.

7. Who we give your personal information to

Your personal information will not be shared anyone beyond the CRAC project team. We will not routinely pass your information to any other organisation except where required to do so as part of our functions or by law.

8. Where your personal information will be stored and for how long

The collection of your personal information will take place on the SurveyMonkey software platform (which is a sub-processor, according to data protection legislation). During data collection, the data may be stored on servers residing outside the UK. SurveyMonkey adheres to the highest possible industrial standards for information security:

https://www.surveymonkey.com/mp/legal/privacy-policy/  

Your data will be downloaded from SurveyMonkey and stored securely by CRAC within the European Economic Area and will not be transferred outside that territory without you being informed about the transfer, the purpose of the disclosure, and the existence or absence of an adequacy decision by the European Commission relating to the protection of personal information in that country.

The invitations to the focus groups will be sent via Mailchimp (which is a sub-processor according to data protection legislation). the only personal data that will be uploaded to Mailchimp is your email address and name and it will not be used for any other purpose. Mailchimp is based in the USA. You can find out more about how Mailchimp complies with GDPR here:

General Data Protection Regulation (GDPR) Compliance: Get GDPR Consent for Marketing (mailchimp.com)

Data collected during the course of this project will be retained for up to six months after completion of the final report which is scheduled to happen in Summer 2021. It will then be deleted from SurveyMonkey, Mailchimp and from CRAC.

9. How we protect your personal information

CRAC has a number of security measures in place to protect your personal information, listed below:

  • All staff are required to undertake training in data protection and information security on joining CRAC and then on an annual basis
  • Formal information security policies that must be read and understood by all staff
  • Personal information is only available to those members of staff who require access as part of their role.
  • CRAC has Cyber Essentials certification.

10. Your rights over your personal information

Once your personal information has been collected, you have certain rights in relation to that personal information that may be exercised. You have the right to: 

  1. Ask for a copy of your personal information
  2. Correct inaccurate personal information held about you
  3. Ask for your personal information to be deleted (within 30 days)
  4. Restrict processing of your personal information
  5. Ask for a copy of their information in a format that allows easy transfer (“data portability”)
  6. Object to automated decision making or profiling (if these take place)

10.  Complaints about the use of personal information

If you are unhappy with the way in which their personal information has been handled within this project, you may contact dataprotection@ukri.org and we will try to resolve your issue informally.

If we are not able to resolve the issue to your satisfaction, you can also make a complaint to the data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) and they can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Email: casework@ico.org.uk

14. Changes to this privacy notice

We keep our privacy notices under regular review. Check back here to see the latest version of the privacy notice.

This privacy notice was last updated on 19/05/2021.

Bookmark & Share