PRIVACY POLICY

Privacy Notice – IBioIC

Introduction

The Industrial Biotechnology Innovation Centre (“IBioIC”), as part of the University of Strathclyde, is committed to transparency and to complying with its responsibilities under data protection legislation. This privacy notice sets out important information regarding how we will use your information and your rights under the legislation. It is important that you read this notice prior to providing your information.

Any enquiries regarding data protection should be made to the University’s Data Protection Officer at dataprotection@strath.ac.uk.

The Legislation

The General Data Protection Regulation (GDPR) is new legislation in force from 25th May 2018, and regulates how organisations are allowed to use personal data. This notice is intended to meet the transparency requirements of GDPR, and to ensure that individuals and organisations who interact and work with IBioIC understand how their data will be processed.

The University of Strathclyde is a data controller under data protection legislation. This means that the University—as host organisation for IBioIC— is responsible for how it uses and processes your personal data, and for complying with requests from you in relation to your personal data where appropriate under the legislation.

How we use your information

We have set out below further details on where we obtain your information, how we will use it, who it is shared with, and how we retain it. For each type of processing, we are required under GDPR to identify our “lawful basis for processing.” The different lawful bases available are set out on www.strath.ac.uk/dataprotection for both personal and special categories of personal data.

Please note that in some cases you may be provided with a more detailed privacy notice in relation to the particular purpose for which data is collected. This is to increase transparency where required and any additional privacy notices supplement this central notice.

How Your Information is Collected and Used

Where an industrial or academic partner is a member of IBioIC and has signed a membership agreement or contract with IBioIC, personal data is held for the following:

• Administrative and financial management purposes.
• Collaborative research purposes.
• Database Management.
• Effective communication.

Categories of information processed by IBioIC:

• Information about your identity, including first name, last name, title, date of birth, and gender.
• Contact information, including billing address, delivery address, email address, and telephone numbers.
• Employment information, including employer, title, workplace address, education, expertise, and professional affiliations.
• Financial information of member organisations, including bank account details, payment card details, and shareholdings.
• Transaction information, including details about payments to and from you, and other details of services you have received from us.
• Technical information, including internet protocol (IP) address, your login data, passwords, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
• Profile information, including your username and password for the Members’ Area on the IBioIC website.
• Usage information, including information about how you use our website and services.
• Marketing and communications data, including your preferences in receiving marketing from us and our third parties, and your communication preferences.
• Personal information, including information about attending events and meetings.

We may also collect information:

• From publicly accessible sources.
• Directly from third parties who deliver services on our behalf.
• From third parties, with your consent.
• From consultants and other professionals we may engage in relation to our contract with you.
• From your employer or professional body.
• Via our website - we use cookies on our website.
• Via our information technology (IT) and other systems.

Purpose for Processing Information

In general terms, IBioIC collects and uses personal information about you to:

• Deliver its services and meet its legal responsibilities.
• Verify your identity, where this is required.
• Contact you by post, email, or telephone.
• Keep you up-to-date with IBioIC events and services.
• Disseminate news relevant to the IB community.
• Provide information regarding career and funding opportunities, project call details, and third party events.
• Understand your needs and how they may be met.
• Provide joined-up services to you.
• Process financial and non-financial transactions.
• Maintain our records.
• Carry out and provide research.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we are carrying out our statutory functions.
• Where we need to perform the contract we are about to enter in to, or have entered into with you: for example, providing you with funding or information, research, and analysis.
• Where we need to comply with a legal or regulatory obligation.
• For our legitimate interests.
• Where you have given us consent.
• For operational reasons, such as ensuring safe working practices, improving efficiency, training, staff assessments, and quality control.

Generally, the information we collect is only used for the purpose for which you submitted it to us, for any purpose made clear to you at the point it was collected, or here in this Privacy Notice. These purposes may include:

• When we assess your application for projects, the personal data you give us is used to process your application and to assess eligibility. This information may be shared with third parties, such as the enterprise agencies.
• When we or third parties contracted to undertake services on our behalf, including event management companies, we will use your personal data to provide you with details, tickets, and entry information and to verify your attendance.
• When providing you with reports and research information, we use your contact details.
• When we prepare research and statistical information about IB.
• When you subscribe to receive communications and other updates from us, we use your personal data to provide communications and information about topics that you have expressed an interest in.
• When you contact us through our website, email, or telephone, your information is used in order to respond to your enquiry.
• If you have a complaint, we use your personal information as part of dealing with that complaint.
• When marketing our services to you.

Sharing Information

We may have to share your personal data with the following parties for the purposes set out in this notice, or to fulfil our contractual services with you:

• External third parties including Scottish Enterprise, Skills Development Scotland, and other such agencies.
• Third party product and service providers.
• Financial and non-financial intermediaries.
• Educational institutions.
• Research organisations.
• Funding bodies, for example, the Scottish Funding Council.
• Events organisations.

How Long We Will Retain Your Information

We will not retain your personal information longer than necessary. We will hold onto the information you provide either while your account is in existence, or as needed to be able to provide services to you for as long as is necessary, as long as we have valid consent.

Your Rights

You have the right to:
• find out what personal data we process about you and obtain a copy of the data, free of charge, within one month of your request. We may make a charge for additional copies of the same information.
• ask us to correct inaccurate or incomplete data.
• withdraw consent to process your personal data at any time, if you were asked for and provided consent.

If you think we are acting unfairly or unlawfully you can:
• object to the way we are using your data.
• complain to the UK Information Commissioner’s Office.

Under certain conditions you also have the right to ask us to:
• restrict the use of your data, e.g. if you have raised issues about the accuracy or use of your personal data, until we have investigated and responded to your concerns.
• erase your information or tell us to stop using it to make decisions about you.
• comply with your wishes where you have previously agreed to us processing your data for a particular purpose and have withdrawn your consent to further processing.
• provide you with a portable electronic copy of data you’ve given us. Please contact us if you wish to exercise/enquire about any of these rights.

To find out more about data protection and your rights please see:
• The Information Commissioner’s Office website: https://ico.org.uk/
• The University’s Data Protection webpages: http://www.strath.ac.uk/dataprotection/