Cultural institute privacy notice
1. Purpose of this Notice
This Notice explains how we will collect and use your personal data.
We are the data controller for personal data that we process about you.
Throughout this Notice, "we", "our" and "us" refers to the Cultural Institute at the University of Leeds. "You" and “your” refers to those expressing an interest in collaborating or working with the University, together with those who later become a collaborator with the University.
2. Anything you are not clear about
If there is anything you are unclear about, please contact our Data Protection Officer, who shall be happy to answer any queries you may have concerning this Notice or the way in which we process your personal data.
The Data Protection Officer's contact details are provided at the end of this Notice.
3. Where does the Cultural Institute get your personal data from?
We obtain personal data about you from the following sources:
- From you when you provide your contact details by applying to our programmes of work, contacting us directly, or registering for events.
- From your previous interactions with the University of Leeds where you have shared your personal data for the purposes of collaborating with the University.
4. Categories of personal data being processed
We will collect and process personal data about you for the purposes described below.
We will not seek to collect “sensitive personal data” as described under the DPA and “special categories of data” as described under the GDPR. Such “sensitive personal data” or “special categories of data" will include information about your racial or ethnic origin, religious beliefs or other beliefs, physical or mental health or, in relation to DPA only, other conditions and information concerning any criminal offences or criminal proceedings.
5. The purposes for which we process your personal data and the legal basis for that processing
In general terms, we process your personal data for the administration of your engagement with the University, such as brokering meetings between University staff, use of facilities, invitation to events and notification of opportunities to work collaboratively with the University, including funding opportunities.
We set out in section 12 of this Notice the purposes for which we will process your personal data.
6. Who might we share your data with?
The Cultural Institute will occasionally share your personal data with third parties. For example we may share some of your data with third parties who are also involved in the programmes of work you are engaged in, such as decision-making panels for funding applications that have a representative from a non-University organisation.
7. Automated individual decision making, including profiling
We don’t make decisions automatically about you without human intervention.
8. Unwanted communication
We will from time to time communicate with you by email, post and telephone.
If, at any stage, you are concerned about the content of these communications, e.g. unwanted marketing information, or wish to change the method of communication that we use please unsubscribe to general email communications.
If you are unsuccessful in unsubscribing from our communications and/or remain concerned, please contact our Data Protection Officer.
9. Transfers to third party countries
Sometimes to achieve the purposes for which we are processing your personal data we may need to share your personal data with other organisations based within the European Union or if outside the European Union based in countries that have comparable levels of protection.
When it is necessary to share your data with organisations outside of the European Union, we will ensure that there are appropriate safeguards in place.
10. Retention periods
The Cultural Institute's guidelines for retention of your data:
| Category |
Short description |
Minimum period |
Maximum period |
|---|---|---|---|
| Application data |
Application forms to Cultural Institute programmes and projects and interview information |
|
12 months after cessation of relationship |
| Event data |
Details of who attended events |
|
12 months after event unless further contact is pursued |
| Inbound data |
Details of queries and actions taken |
|
12 months after cessation of relationship |
| Relationship to University |
Details of involvement with the University as a collaborating partner |
|
12 months after cessation of relationship |
| Programme participation |
Details of who received support through our programmes and what that support was |
|
Six years after participation ends |
| Financial data |
Information relating to payment of SIPRs and other payments |
Six years after end of engagement |
Six years after end of engagement |
11. Your rights as a data subject
We thought it would be helpful to set out your rights under GDPR. You have the right to:
- withdraw consent where that is the legal basis of our processing
- access your personal data that we process
- rectify inaccuracies in personal data that we hold about you
- be forgotten, that is your details to be removed from systems that we use to process your personal data
- restrict the processing in certain ways
- obtain a copy of your data in a commonly used electronic form
- object to certain processing of your personal data by us
You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see https://ico.org.uk/.
12. Legal basis for processing your data under GDPR
Here is a brief explanation of the grounds for processing your data:
(Article 6(1)(a)), Consent – Direct mailing about the University of Leeds' cultural news and events programme, as well as selected cultural news about the University.
(Article 6 (1)(b)), necessary for the performance of your contractual relationship with the University – on many occasions the University will process your data to enable it to meet its commitments to you e.g. those relating to the delivery of projects you are participating in.
(Article 6 (1)(c)), necessary to comply with a legal obligation –
(Article 6 (1)(d)), for the purpose of protecting the vital interest of yourself or another – sometimes in extreme circumstances the University will have to release information to protect your interests or the interests of others e.g. in medical emergencies.
(Article 6 (1)(e)), processing necessary for the performance of a task carried in the public interest – the University is a research and educational establishment and in particular its research and educational activity is conducted in a public interest (including your interest and the interest of others).
(Article 6 (1)(f)), processing is necessary for the purposes of the legitimate interest of the University or a third party subject to overridden interests of the data subject – the University (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students, researchers and third party organisations. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of third party individuals and organisations, it will pursue those interests. A good example of this legitimate interest would be using personal data to manage the admission to and the administration of partner collaboration programmes, including sharing opportunities that you offer to departments and individuals within the University.
Where Article 6(1)(f) is used the “legitimate interest” is generally the interest of the Cultural Institute, yourself and third parties in providing or supporting the provision of research interests, student learning and partnership brokerage.
It is recognised that some of the above grounds will overlap and that the University could rely on multiple grounds justifying its lawful processing. The University also reserves the right to rely upon other grounds that are not referred to under table 1.
13. Concerns and contact details
If you have any concerns with regard to the way your personal data is being processed or have a query with regard to this Notice, please contact our Data Protection Officer. Our general postal address is University of Leeds, Leeds LS2 9JT, UK.
Our postal address for data protection issues is University of Leeds, Room 11.72 EC Stoner Building, Leeds, LS2 9JT.
Our telephone number is +44 (0)113 2431751.
Our data controller registration number provided by the Information Commissioner's Office is Z553814X.