Coventry University
Research Participants Privacy Notice
Who are we?
In this Privacy Notice, the terms “we”, “our”, and “us” refer to Coventry University Higher Education Corporation, Priory Street, Coventry, United Kingdom, CV1 5FB (ICO registration number Z6939585).
As a controller of your personal data we are responsible for looking after it, and we will use it fairly, lawfully, and in a transparent manner.
Purpose
We are committed to protecting your privacy. This notice will help you understand how we look after, use, store and share your personal data, and how we meet our obligations under the General Data Protection Regulation 2016 and the Data Protection Act 2018 (Data Protection Laws). It supplements any other notices or statements we may provide to you.
This notice should be read together with the Participant Information Sheet/Page, which will be provided to you as part of your introduction to the research.
What personal data do we collect?
“Personal data” is any information from which you can be identified. The type of personal data we collect, and how we process it, can vary depending on the nature of the research in which you are taking part. Please see the Participant Information Sheet/Page for information about what personal data we collect.
Special Category Data
We may process your ‘special category data’ such as:
· racial or ethnic origin;
· religion;
· political views;
· trade union membership;
· genetics and biometrics (where used for ID purposes);
· health and disabilities; and
· sex life and sexual orientation.
Depending on the nature of the research, we may also process your criminal convictions and offences data.
Please see the Participant Information Sheet/Page for information about what special category data we collect.
Where do we get your personal data from?
Please see the Participant Information Sheet/Page for information about what where we obtain your personal data from.
Why do we need personal data and how do we use it?
Please see the Participant Information Sheet/Page for information about why we need your personal data and what we do with it.
Legal Claims
Personal data (including special category data) may be processed for the purpose of establishing, exercising or defending a legal claim.
Basis for using your personal data
We need a lawful basis for any processing of personal data. This means that our processing must be for one of a limited number of reasons set out in the data protection laws. These lawful legal bases are:
a) The processing is necessary for the entry into or performance of a contract
b) Compliance with a legal obligation
c) Pursuant to a public task
d) Legitimate interests
e) Vital interests
f) Consent
We are most likely to rely on the ‘public task’ or ‘consent’ lawful basis to process your personal data for research purposes. For more information on this please see the Participant Information Sheet/Page.
Processing of your personal data
“Processing” means doing anything with the personal data, such as collecting, recording, organising, structuring, storing, adapting or altering, retrieving, accessing, consulting, disclosing, disseminating, aligning or combining, restricting, erasing or destroying or using the data in any way.
We will process your personal data for the purposes set out in the Participant Information Sheet/Page, or as we otherwise notify you.
The personal data you provide will be subject to security measures and procedures to minimise the risk of unauthorised access, loss, theft or disclosure.
How long do we keep your personal data for?
We will only keep your personal data for as long as we need to in order to fulfil the purposes for collecting it. However, on some occasions we may retain your personal data indefinitely for archiving or research purposes, although these will be subject to appropriate safeguards to protect the data.
Please see the Participant Information Sheet/Page for more information on how long we will retain your personal data for the specific research.
Who do we share your personal data with?
Please see the Participant Information Sheet/Page for information on who we share your personal data with.
Your personal data will not be shared with any individual or organisation unless stated in the Participant Information Sheet/Page, or unless we are under a legal duty to do so; or in order to enforce any agreements that we may have entered into with you.
We require that all third parties with whom we share your personal data to treat it in accordance with the Data Protection Laws, and this will be supported by a formal agreement.
Keeping your personal data secure
We are committed to the protection and security of your personal data. We will ensure that appropriate measures are taken against its unlawful or unauthorised processing, and against its accidental loss or damage. We are certified to Cyber Essentials.
Other countries your personal data will be sent to and why
Please see the Participant Information Sheet/Page for information on which countries your personal data is sent to and why. It will only be shared across international borders where this is necessary for the purpose of the research and will be subject to the requirement to treat it in accordance with the Data Protection Laws, underpinned by a formal agreement. We only transfer your personal data:
· to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission; or
· to service providers who have agreed to contractual terms approved by the European Commission, which give personal data equivalent protection as in the UK and European Union.
How we may contact you
Please note that we may contact you in connection with the purposes set out in the Participant Information Sheet/Page, by post or by electronic means (including telephone, text messages, email, social media messaging, or any other suitable electronic method).
Your Data Protection Rights
You have the right to:
1. Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data that we hold about you, and to check that we are lawfully processing it.
2. Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data that we hold about you corrected, although we may need to verify the accuracy of the new personal data.
3. Request erasure of your personal data. This enables you to ask us to delete or remove personal data if:
· there is no good reason for us continue processing it;
· you have successfully exercised your right to object to processing (see below);
· you believe we may have processed your personal data unlawfully; or
· we are required to erase your personal data to comply with the law.
4. Object to processing of your personal data when we are relying on public task or a legitimate interest (or those of a third party), and you feel that this processing impacts on your fundamental rights and freedoms. However, these may be overridden by the public interest or our legitimate interest grounds.
5. Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
· if you want us to establish the accuracy of the data;
· where our use of the data is unlawful but you do not want us to erase it;
· where you need us to hold the data even if we no longer require it (for example if you need it to establish, exercise or defend legal claims); or
· If you have objected to our use of your data, but we need to verify whether we have overriding public interest or legitimate interest grounds to use it.
6. Request the transfer of your personal data to you or to a third party. We will provide your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated data that you initially provided consent for us to use, or where we used the data to perform a contract with you.
7. Withdraw consent at any time when we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent.
Please note that there may be exemptions to your data protection rights with respect to research and archiving. Where these apply, you will advised on making an application to exercise these rights.
Exercising your rights
Unless otherwise stated in the Participant Information Sheet/Page, if you wish to exercise any of your above rights, please send a written request to the Information Governance Unit, Coventry University, Portal House, 163 New Union Street, Coventry, CV1 2PL, or email dsar@coventry.ac.uk.
You will not have to pay a fee to exercise any of your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information, in order to speed up our response.
We try to respond to all legitimate requests within one month, although it may take us longer if your request is particularly complex, or if you have made a number of requests. In this case, we will notify you and keep you updated.
Complaints and questions
We have appointed a Data Protection Officer to oversee compliance with this Privacy Notice. If you have any concerns of complaints about it, please contact the Data Protection Officer at Coventry University, Priory Street, Coventry CV1 5FB or email dpo@coventry.ac.uk.