Vitae member key contact privacy policy

Vitae Membership Key Contact Privacy Notice

1.  Introduction

The Careers Research and Advisory Centre (CRAC) Ltd is the non-profit organisation that manages the Vitae programme.  Vitae is the global leader in supporting the professional development of researchers, experienced in working with institutions as they strive for research excellence, innovation and impact.

You can find more information about CRAC and the work that we do on our website: www.crac.org.uk.

CRAC is committed to protecting the personal information of all its contacts and being clear about what information we hold about them and how we use it. This privacy notice tells you what to expect when CRAC collects personal information. 

CRAC is registered as a data controller with the Information Commissioner’s Office (ICO). Our registration number is Z1030346.  You can check our registered details on the ICO’s website: https://ico.org.uk/about-the-ico/what-we-do/register-of-data-controllers/

2.  Data Controller and Data Protection Officer

CRAC is the Data Controller of any personal information collected within scope of this privacy notice. Our location and contact details are below:

The Careers Research and Advisory Centre (CRAC) Limited
22 Signet Court
Cambridge
CB5 8LA
Tel: 01223 460277
Email: dataprotection@crac.org.uk

Our Data Protection Officer (DPO) is the first point of contact for people whose information is processed. Contact details for our DPO are as follows:

David Nightingale
IT Manager
The Careers Research and Advisory Centre (CRAC) Limited
22 Signet Court
Cambridge
CB5 8LA
Email: dataprotection@crac.org.uk
Tel: 01223 460277

3.  How we use Key Contact information

We can only use Key Contact personal information where we have legitimate reasons for doing so and have told the Key Contact what those reasons are.

To achieve the above aims, the specific uses that will be made of Key Contact personal information are listed below:

  • Use of an organisation’s nominated Senior Key Contact is limited to communications that fulfil the purpose of strategic engagement
  • Use of an organisation’s nominated Key Contact 1 and Key Contact 2 is limited to communications that fulfil the purpose of operational engagement
  • Key Contact email address and telephone number may be shared with other contacts at the Key Contact's organisation

If we want to use a Key Contact’s personal information for a reason other than those purposes set out above, we will tell the Key Contact before we start that use and provide further information about the new purpose(s).

4.  Legal basis for using Vitae Key Contact personal information

Under data protection legislation, we require a legal basis to be able to process personal information for the purposes set out above.

In this case, the legal basis is:

  • Legitimate interest

We have a legitimate commercial interest to use Key Contact personal information to administer and improve the quality of the membership services that we provide to the Key Contact’s organisation.  Vitae Key Contacts are nominated by their organisations on the Vitae Membership Application Form.  Key Contacts can email us at dataprotection@crac.org.uk if they are no longer performing this role for their organisation.  Key Contacts also have the rights described in section 10 of this document in respect of their personal information.

5.     What personal information we will collect

The personal information we will collect and use for Key Contacts is set out below: 

  • Title
  • Name
  • Job Title
  • Telephone
  • Email Address
  • Postal Address
  • Vitae region

6. Personal information we obtain from another source

Other than the personal information collected from the Key Contacts directly, we also obtain personal information about them from other sources, listed below:

  • None

Purpose of obtaining personal information from other source(s)

  • None

Legal basis for obtaining personal information from other source(s)

  • None

7. Who we give Key Contact personal information to

We will not routinely pass Key Contact information to any other organisation except where required to do so as part of our functions or by law.

8. Where Key Contact personal information will be stored

Key Contact personal information is normally stored on Microsoft Office 365 business service within the European Economic Area (EEA), and will not normally be transferred outside the EEA by us. Microsoft will have access to Key Contact personal information for the purposes of providing the business services to us. For more information about how Microsoft may process Key Contact personal information please see the information in the Microsoft Trust Centre:
www.microsoft.com/en-us/trustcenter/privacy
There may be occasions where Microsoft may transfer Key Contact personal information outside the EEA, as set out in the Microsoft Privacy Statements linked to above. If the Key Contact resides outside Europe, they should understand and agree that their personal information may be transferred to, and stored at, a destination outside the country in which they reside, and that it may also be processed by staff operating outside that country for the purposes set out in this Privacy Policy. 

9. How do we protect Key Contact personal information

CRAC has a number of security measures in place to protect Key Contact personal information, listed below:

  • All staff are required to undertake training in data protection and information security on joining CRAC and then on an annual basis
  • All Vitae regional representatives are required to undertake training in data protection and information security before engaging with Vitae Key Contacts
  • Formal information security policies that must be read and understood by all staff
  • Personal information is only available to those members of staff who require access as part of their role.

10. Key Contact rights over their personal information

Once a Key Contact’s personal information has been collected, they have certain rights in relation to that personal information that may be exercised. They have the right to:

  • Ask for a copy of their personal information
  • Correct inaccurate personal information held about them
  • Ask for their personal information to be deleted (within 30 days)
  • Restrict processing of their personal information
  • Ask for a copy of their information in a format that allows easy transfer (“data portability”)
  • Object to automated decision making or profiling (if these take place)

Further information can be found about these rights and our processes for handling such requests at: https://www.vitae.ac.uk/policies/privacy-policy

11. How long we will hold Key Contact personal information

We are only able to retain a copy of Key Contact personal information as long as it is still needed for the purpose(s) for which it was collected. Key Contact personal information will be kept until the termination of the Vitae membership contract.

13.  Complaints about the use of Key Contact personal information

If a Key Contact is unhappy with the way in which their personal information has been handled by CRAC, they may contact us at: dataprotection@crac.org.uk or via our Data Protection Officer (details in section 2) and we will try to resolve their issue informally.

If we are not able to resolve the issue to their satisfaction, they can also make a complaint to the data protection supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO) and they can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Email: casework@ico.org.uk

14. Changes to this privacy notice

We keep our privacy notices under regular review and we will inform you of any changes to this notice by sending an update by email.

This privacy notice was last updated on 10/01/18.

Bookmark & Share