³ÉÈËÊÓƵ

This privacy notice gives you some general information about what we will do with your personal information when it is collected by a researcher (staff or student) at UCLan. Where you participate in a study, you will be given a ‘Participant Information Sheet’ by the researcher; this notice is in addition to the specific information included in that sheet.

Personal information (or personal data) is any information which relates to and identifies you. Data protection legislation (the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA)) sets out how we should handle your personal information.

³ÉÈËÊÓƵ Higher Education Corporation is the data controller for the personal information we process, unless otherwise stated. We are registered with the Information Commissioner’s Office and our registration number is Z5512420.

The Participant Information Sheet will include contact details for the researcher or research team carrying out the study in which you are participating, and this is who you should contact in the first instance.

You can also contact the University by phone, email, social media and post. 

UCLan’s Information Governance Manager & Data Protection Officer can be contacted on DPFOIA@uclan.ac.uk. Further information and contact details can be found on our Data Protection web page.

The information we use will depend on the nature of the research in which you are participating. In many cases, it will be clear what information we are using because you will have provided it to us directly – for example, by completing a survey or answering questions in an interview. In other cases, the information may be obtained by observation (e.g. a video or audio recording), or by a third party who collected it for another purpose (e.g. the NHS).

In some cases, we will collect information considered to be particularly sensitive under the GDPR, known as Special Category Data. This is information about your race, ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data used for ID purposes, health, sex life or sexual orientation. As above, it will usually be clear when we are collecting this information because we will have asked you for it.

Please see the Participant Information Sheet for further information about what personal data we will be using in the particular study in which you are participating.

As a university, we use personal information to conduct research into a range of different topics with the aim of providing positive social, environmental and economic impacts locally, nationally and internationally. We ensure that any use of personal data for these purposes is in the public interest.

Exactly how we use this data will depend on what is necessary for the specific programme of research in which you are participating. We need to manage your information in specific ways in order for our research to be reliable and accurate. As such, your rights to access, change or move your information are limited, and if you withdraw from a study it is likely that we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum amount of personal information possible.

Please see the Participant Information Sheet for further information about how and why we use your personal data, and what will happen if you withdraw from a study.

The University relies on the following legal bases from the GDPR and the DPA to process information about you for the purposes set out in this notice:

GDPR Article 6(1)(e), which allows us to process personal data where it is necessary to perform a task in the public interest. As a Higher Education institution, one of our tasks (set out in Section 123A of the Education Reform Act 1988) is carrying out and publishing research.

GDPR Article 9(2)(j), which allows us to process special category data for archiving, scientific or historical research purposes or statistical purposes, where there is a basis to do so in law. The law which allows us to rely on this basis is section 10 of the DPA by virtue of Schedule 1(4).

In certain circumstances, we may rely on your consent to process your information. In these cases, Article 6(1)(a) applies, and Article 9(2)(a) applies where the information is Special Category Data (see above). It will be clear where we are relying on your consent to collect and use your information because we will explicitly request it. However, please be aware that consent to participate in research is not the same as consent to use your data. Even where we have asked for your consent to participate, any processing of your personal data is usually carried out as part of our ‘public task’ (described above), meaning you will have the right to withdraw from further participation in the study, but your right to stop us using any of your data we have already obtained for our research purposes may be limited.

In the cases where we do need your consent to process your information, we will explain (in the Participant Information Sheet) why we are asking for the information and how we will use it if you choose to provide it. Your consent can be withdrawn at any time and we will explain how you can do this in each individual case.

We sometimes share your information with external organisations and bodies which process data on our behalf, such as transcription services and hosting providers. We have contracts in place with our data processors which ensure that they hold your data securely, only retain it for as long as we instruct, and cannot do anything with it unless we have instructed them to do so.

We may also share your personal data with our research partners who are working with us on all or part of the piece of research.

Please see the Participant Information Sheet for specific information about who your data will be shared with.

Occasionally we may need to send your personal information outside the EEA (e.g. if we are working with partner institutions in other countries). All transfers are carried out with appropriate safeguards in place to protect your information and ensure it remains secure.

Please see the Participant Information Sheet for further information about whether your data will be transferred internationally, and what safeguards are in place in such cases.

Research data could be retained for any length of time, depending on the requirements of the research, and in many cases may be retained indefinitely. The Participant Information Sheet will advise you in each specific case how long we intend to retain your data.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information. Further information about each of these rights can be found on the .

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. For further information or to make a request, please see our Data Protection web page.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing

You have the right to object to any processing we carry out, if we carry it out on the basis that it forms part of our public task or is in our legitimate interests. You also have the right to object to your personal information being used for direct marketing purposes.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information because we have your consent or because you have a contract with us and it is necessary for the performance of that contract, and the processing is automated.

We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact the Information Governance Manager & Data Protection Officer, and we will respond.

If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Information Commissioner’s Office, which is the UK supervisory authority for data protection. Further information can be found on our Data Protection webpage.