Who are UK Research and Innovation
UK Research and Innovation (“we”, “our” and “us”) brings together seven research councils, Innovate UK and Research England and is established by the Higher Education and Research Act 2017 Articles 91, 92 & 93. We are registered with the Information Commissioner’s Office with the following registration number za333592.
UK Research and Innovation is the data controller of your personal information and our registered office is: Polaris House, Swindon SN2 1FL.
Our Data Protection Officer (DPO) is:
Head of Information Governance
If you have a question or concern about how your personal information is being handled then please contact our DPO. You also have a right to raise issues with the Information Commissioner’s Office: https://ico.org.uk/concerns/
Our data protection policy
UK Research and Innovation understands the importance of protecting personal information and is committed to complying with the General Data Protection Regulation 2016/679 (GDPR). It is committed to fostering a culture of transparency and accountability by demonstrating compliance with the principles set out in the Regulation – as laid out in our Data Protection Policy (PDF, 463KB).
This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.
What kinds of personal data do we process about you?
When we ask you for personal data, we will:
- tell you why we need it
- only ask for relevant information
- look after it and make sure it is only accessible to those within UKRI who need to see it
- only keep it for as long there is a business, statutory or legal obligation (see our retention policy below)
- not to make your personal information available for commercial use without your permission.
In return, we ask you to:
- give us accurate information, and
- tell us as soon as possible if there are any changes
Across our organisation, we may collect the following types of personal information about you (this does not necessarily apply to you if taking part in research – see below for more information):
- Personal contact details
- Date of birth
- Your nationality
- Bank account information
- Equality, Diversity & Inclusion information
- Information about your career / workplace / employer / research / innovation
- Dietary and / or accessibility needs
Why we process personal information
We use the following lawful grounds for processing personal information to support our work.
When we carry out processing in pursuit of our purposes laid out in Article 93 of the Higher Education and Research Act 2017, in the most part, our lawful basis for processing your personal information falls under:
Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law, but we also make use of: contractual, legitimate and consent based processing.
Depending upon the relationship you have with us, we have outlined the purposes for which we might process your personal information.
Users of the UK Research and Innovation, and Councils’ websites
We may collect and process the following information:
- information that you provide by filling in forms or surveys
- information in correspondence that you send us
- details of your visits to our website including, but not limited to, traffic data, location data, weblogs and other communication data, and the resources that you access
We may use personal data we collect to:
- ensure that content from our website is presented in the most effective way for you
- provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes
- allow you to participate in interactive features of our service, when you choose to do so
- notify you about changes to our website or services.
Information we provide to third parties:
If you are a member of our Research and Innovation Communities
We capture and process personal information for the following reasons using public task as a lawful basis:
- To manage funding applications and awards;
- To alert you to funding opportunities;
- To operate the peer review process (including Portfolio Analysis);
- To undertake portfolio analysis and support the evaluation of our strategy and policy to investigate the effectiveness of our programmes, this may include evaluations of Equality, Diversity & Inclusion;
- To undertake Research outcomes collection, monitoring and evaluation;
- To support participation in events and workshops; this may include surveys and collecting information on dietary or accessibility requirements
- To ensure our terms and conditions of funding are met, including audit and assurance processes, research integrity and misconduct processes
- To operate our complaints policy (research conduct)
- To manage access to research services, data and facilities
- To facilitate commercialisation and technology transfer
We may share your personal information for the purposes associated with the above reasons, where we need to engage with third parties in order to carry out those public tasks.
If you are a member of the UK Research and Innovation Board, our Council or Peer review Boards and Committees
We capture and share personal information to manage our governance processes for our public task purposes.
If you are a peer reviewer
We capture and share personal information so you can participate as a peer reviewer for our public task purposes, which may also be used to report participation statistics.
If you are a current or past employee, visiting worker, student or third party agency worker
We capture and process personal information for the following reasons using contractual, legal obligation and legitimate interest as lawful bases:
- Equality and diversity
- Personnel files
- Rewards and Benefits
- Training and development
- Management Information
- Pension Scheme Administration
- Accidents, incidents and general health and safety at work
- Occupational Health
- Non-pay staff benefits
- Information Systems Management & Delivery
- Legal casework – grievances, disciplinary, and dismissal
We may share your personal information for the above purposes with:
- Other governmental departments and regulatory bodies as a statutory requirement, such as:
- Information Commissioner’s Office
- Business partners, such as:
- financial services
- UK SBS
- Security checks
- Recruitment Agencies
- Administration of non-pay staff benefits by the provider
If you are a member of the Public (see further below if you are taking part in Research)
We capture and process personal information for the following reasons using public task and/or consent as a lawful basis:
- Communications and public engagement activities: Surveys, Events, newsletters, communications, websites and social media
- Queries and complaints
- Evaluation and recording
We may share your personal information for the following purposes:
- To send you information about our work
- To manage your attendance at meetings outside of our own sites
If you are a supplier
We capture and process personal information for the following reasons using contractual and legitimate interest as a lawful basis:
- Site management (building access, car parking)
- Health and Safety
- Dietary and accessibility requirements
- Equality reporting
- Service provision and management
If you are taking part in Research
This general information supplements the specific information you have already seen if you are taking part in research studies managed by Research Council Institutes.
UKRI researchers capture and process personal information for the purposes of scientific research using public task as a lawful basis. Where researchers are using special categories of personal data (this includes data about your health, ethnicity, political opinions, religious beliefs, etc), the added condition of ‘necessary for scientific research in accordance with safeguards’ is used.
The research team undertaking the project will provide you with information on the types of personal data used in the study.
It is common for personal data for research to be kept for a long time with periodical reviews for the need to keep it, and the law allows for this. It is also common for research to be undertaken jointly with other research organisations. Data may be shared with other credible research teams in universities, commercial companies, health or social service providers, etc, in the UK and abroad. Most of the time the data will be depersonalised so you won’t be identified. If it is personal, there are security, legal and ethical safeguards in place to protect your interests.
If you have any questions about the particular research study you are participating in, please use any contact details that have already been provided.
Children and Young People
We may collect personal information about children and young people (such as name, school, age, and characteristics including dietary and/or disability details) to enable us to carry out the aspects of our statutory role relating to education, promotion and public engagement. We may also use that data to inform decisions about funding, future programmes and monitoring and reporting of our activities. Such activities are all considered by UKRI to be in the substantial public interest and further to its statutory foundations using public task or consent as our lawful basis. Where it is appropriate to do so, UKRI will request the consent of the child or young person or a responsible adult.
How long do we keep your personal information?
We may retain your personal information based upon business requirements, legal obligation, statutory or regulatory obligations and transactional purposes. If you want to know how long we keep your information, please write to our Data Protection Officer.
Sharing personal information outside of the UK
We are based in the UK, but we also have international representation across the globe. Where we share personal information outside of the UK, we’ll make sure we put in place suitable safeguards to ensure compliance with the GDPR, such as: technical measures, contractual agreements or data sharing agreements.
Media and images
We process images and recordings for the purposes of CCTV, security, communication and broadcast, general public engagement and health & safety in accordance with the Information Commissioner’s Code of Practice.
What are your rights as a data subject?
Under data protection law, you can exercise your rights according to the lawful basis used for processing. All individuals have the right to:
- To be Informed about how your information is being processed
- Access a copy of your personal information
- Rectification if your personal information is inaccurate or changes
And then the following rights are determined by the lawful basis:
- Restrict processing
- Object to
- Not be subject to a decision based on automated processing, including profiling.
When you contact us to exercise your right, we will:
- Respond to acknowledge your request has been received
- If your request is not applicable, we will write to tell you of this whilst providing the reasons why.
- We will provide / have acted on your request within the time period as per the current data protection law
- Should we need to extend the period of time required to respond due to the complexity, we will write to inform you of this
- There are exemptions to most of these rights in research, depending on the circumstances. These will be discussed with you upon making contact. The law does not allow any research exemption to your right to be informed or your right to restrict processing.
How and when can you withdraw consent?
Where consent has been used as the lawful basis for processing your information, you have the right to withdraw said consent. You can do this, by contacting our Data Protection Officer using the details given above.
When you have provided consent to take part in research, it is unlikely to be the lawful basis for processing personal data, but this consent can still be withdrawn or amended. If you wish to do so, you need to contact the study team directly.
Do we make use of automated decision making, or profiling?
Changes to this privacy notice
We may change this privacy notice and we encourage you to check this privacy notice from time to time.
- Current version: 1.2
- Published on: 28 June 2018
- Last revision: 1.0 published on 18 May 2018