EPSRC focus groups privacy notice 2

Privacy Policy for the EPSRC focus groups on doctoral education 2021

1.     Introduction

The Careers Research and Advisory Centre (CRAC) Ltd is the non-profit organisation that manages the Vitae programme.  Vitae is the global leader in supporting the professional development of researchers, experienced in working with institutions as they strive for research excellence, innovation and impact. You can find more information about CRAC and the work that we do on our website: www.crac.org.uk. 

CRAC is committed to protecting the personal information of all its contacts and being clear about what information we hold about them and how we use it. This privacy notice tells you what to expect when CRAC collects personal information.

CRAC is registered as a data controller with the Information Commissioner’s Office (ICO). Our registration number is Z1030346.  You can check our registered details on the ICO’s website: https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/

2.  Data Controller, Processor and Data Protection Officer

For the purposes of the EPSRC doctoral alumni survey, the EPSRC is the data controller and CRAC is the data processor. EPSRC has appointed RAND-Europe and CRAC to run this survey to inform their review of doctoral education. EPSRC has determined what categories of data are to be collected and why.

The data controller for your personal data is the UK Research and Innovation (UKRI), of which EPSRC is part. You can contact the UKRI Data Protection Officer at: dataprotection@ukri.org

3.  How we use your personal information

We can only use your personal information where we have legitimate reasons for doing so and have told you what those reasons are.

To achieve the above aims, the specific uses that will be made of your personal information are listed below: 

  • Your personal data will be used to contextualise your responses to the survey with regards to your doctoral education, your current employment and your personal characteristics.
  • Your responses and your personal data will be shared with CRAC staff involved in the delivery of this survey and EPSRC project staff involved in the review of doctoral provision.
  • EPSRC project staff will anonymise all responses and use the analysis of your responses internally to inform their review of doctoral education.
  • No individuals or institutions will be identified in any published media without explicit permission being gained.
  • If you give permission EPSRC may use your email to contact you to follow up on your responses to the survey.
  • If we want to use your personal information for a reason other than the purposes set out above, we will tell you before we start that use.

4.  Legal basis for using your personal information

Under data protection legislation, we require a legal basis to be able to process personal information for the purposes set out above. In this case, the legal basis is participant consent. Your consent will be collected via this survey if you continue.

Withdrawal of consent

Consent can be withdrawn at any point if you no longer want your responses provided to this survey to be used for the purposes outlined above. You can withdraw consent by emailing dataprotection@vitae.ac.uk.

5.     What personal information we will collect

The personal information we collect in this survey is:

  • Your email address so EPSRC can communicate with you in the context of their review of doctoral provision. You can chose not to give permission for your email to be used by EPSRC.

We also request the following personal information. You can choose not to provide this information although we ask that you do, as it is important to help us understand the profile of people responding to the survey and will enhance the value of the research.

  • Your name
  • Your gender
  • Your age bracket
  • Your ethnicity
  • Whether you consider yourself to have a disability or not

6. Personal information we obtain from another source

Within this project, we will not be seeking any personal information from any other source.

7. Who we give your personal information to

Your personal information will not be shared anyone beyond the CRAC and the EPSRC project teams. We will not routinely pass your information to any other organisation except where required to do so as part of our functions or by law.

8. Where your personal information will be stored and for how long

The collection of your personal information will take place on the SurveyMonkey software platform (which is a sub-processor, according to data protection legislation). During data collection, the data may be stored on servers residing outside the UK. SurveyMonkey adheres to the highest possible industrial standards for information security:

https://www.surveymonkey.com/mp/legal/privacy-policy/  

Your data will be downloaded from SurveyMonkey and stored securely by CRAC within the European Economic Area and will not be transferred outside that territory without you being informed about the transfer, the purpose of the disclosure, and the existence or absence of an adequacy decision by the European Commission relating to the protection of personal information in that country.

Data collected during the course of this project will be retained for up to six months after completion of the final report which is scheduled to happen in Summer 2021. It will then be deleted from SurveyMonkey, CRAC and from EPSRC.

9. How we protect your personal information

CRAC has a number of security measures in place to protect your personal information, listed below:

  • All staff are required to undertake training in data protection and information security on joining CRAC and then on an annual basis
  • Formal information security policies that must be read and understood by all staff
  • Personal information is only available to those members of staff who require access as part of their role.
  • CRAC has Cyber Essentials certification.

10. Your rights over your personal information

Once your personal information has been collected, you have certain rights in relation to that personal information that may be exercised. You have the right to: 

  1. Ask for a copy of your personal information
  2. Correct inaccurate personal information held about you
  3. Ask for your personal information to be deleted (within 30 days)
  4. Restrict processing of your personal information
  5. Ask for a copy of their information in a format that allows easy transfer (“data portability”)
  6. Object to automated decision making or profiling (if these take place)

10.  Complaints about the use of personal information

If you are unhappy with the way in which their personal information has been handled within this project, you may contact dataprotection@ukri.org and we will try to resolve your issue informally.

If we are not able to resolve the issue to your satisfaction, you can also make a complaint to the data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) and they can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Email: casework@ico.org.uk

14. Changes to this privacy notice

We keep our privacy notices under regular review. Check back here to see the latest version of the privacy notice.

This privacy notice was last updated on 12/07/2021.

Bookmark & Share