Who are we and who is our representative?
The University of Plymouth is the Data Controller and is registered with the Information Commissioner’s Office under registration Z7546246. The University’s Data Protection Officer can be contacted through firstname.lastname@example.org.
Why do we collect your data?
The University needs to collect your data for the following purpose(s):
- to create a registry of ABX members to facilitate communication between members and sharing of expertise
What type of data do we collect?
The University collects a number of different types of personal data. For the purposes described above the following types of data may be required:
- Activity and expertise of your work
When and how do we collect your data?
The University will collect your information in different ways during its relationship with you. These will include:
information you provide directly to us
we may also gain your personal data from third parties, for example, from references, information from a sponsor.
How do we use your personal data?
The University will use your personal data in the following ways:
Publish publicly on the internet through the ABX webpage
Publish in a document for meetings
What is the lawful basis for the processing?
The University must have a lawful basis in order to process personal data. For the purposes above these have been identified as follows:
Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
The University may also use your data, typically in an emergency, where this is necessary to protect your vital interests, or someone else’s vital interests. In a small number of cases where other lawful bases do not apply, we will process your data on the basis of your consent. Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
In relation to more sensitive personal data (special category data) the additional legal bases for these are:
(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
(b) Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
(c) Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
(d) Vital interests: the processing is necessary to protect someone’s life or in an emergency situation.
(e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
(f) Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. The University cannot use this condition if it is processing data to perform its official tasks, eg teaching, learning or research as this is covered by its public task.
Where the University is processing your data on the basis of your consent, you can withdraw your consent at any time. We will not use your personal information to carry out any wholly automated decision-making that affects you.
How long do we keep your data?
Details of how long your personal data will be retained are available in the Records Retention Schedule .
The data will be kept on the ABX webpage for the duration of the project or until you withdraw your consent. Personal data will be kept no longer than is necessary for the purposes.
Who do we share your data with (including international transfers)?
Where there is a legitimate need or statutory obligations the University will disclose necessary personal data to third parties.
What rights do you have?
As a data subject you have a number of rights in relation to your personal data. You can:
access and obtain a copy of your data on request
require the University to amend incorrect or incomplete data
require the University to stop processing your data, for example where the data is no longer necessary for the purposes of processing
object to the processing of your data where the University is relying on its legitimate interests as the legal ground for processing
require us to erase your personal data
require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal)
receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller.
Please note that the above rights are not absolute, and the University may be entitled to refuse requests where exceptions apply.
If you wish to exercise any of these rights or if you have a complaint about the way you believe your data is being processed, in the first instance, please email: email@example.com
Changes to the Notice
This privacy notice is reviewed annually or when required to ensure compliance with data protection legislation. If significant changes are made to this notice and the way we treat your personal information we will make this clear and may seek to communicate this directly to you