Cultural institute privacy notice

1. Purpose of this Notice

This Notice explains how we will collect and use your personal data.

We are the data controller for personal data that we process about you.

Throughout this Notice, "we", "our" and "us" refers to the Cultural Institute at the University of Leeds. "You" and “your” refers to those expressing an interest in collaborating or working with the University, together with those who later become a collaborator with the University.

2. Anything you are not clear about

If there is anything you are unclear about, please contact our Data Protection Officer, who shall be happy to answer any queries you may have concerning this Notice or the way in which we process your personal data.

The Data Protection Officer's contact details are provided at the end of this Notice.

3. Where does the Cultural Institute get your personal data from?

We obtain personal data about you from the following sources:

  • From you when you provide your contact details by applying to our programmes of work, contacting us directly, or registering for events.
  • From your previous interactions with the University of Leeds where you have shared your personal data for the purposes of collaborating with the University.

4. Categories of personal data being processed

We will collect and process personal data about you for the purposes described below.

We will not seek to collect “sensitive personal data” as described under the DPA and “special categories of data” as described under the GDPR. Such “sensitive personal data” or “special categories of data" will include information about your racial or ethnic origin, religious beliefs or other beliefs, physical or mental health or, in relation to DPA only, other conditions and information concerning any criminal offences or criminal proceedings.

5. The purposes for which we process your personal data and the legal basis for that processing

In general terms, we process your personal data for the administration of your engagement with the University, such as brokering meetings between University staff, use of facilities, invitation to events and notification of opportunities to work collaboratively with the University, including funding opportunities.

We set out in section 12 of this Notice the purposes for which we will process your personal data.

6. Who might we share your data with?

The Cultural Institute will occasionally share your personal data with third parties. For example we may share some of your data with third parties who are also involved in the programmes of work you are engaged in, such as decision-making panels for funding applications that have a representative from a non-University organisation.

7. Automated individual decision making, including profiling

We don’t make decisions automatically about you without human intervention.

8. Unwanted communication

We will from time to time communicate with you by email, post and telephone.

If, at any stage, you are concerned about the content of these communications, e.g. unwanted marketing information, or wish to change the method of communication that we use please unsubscribe to general email communications.

If you are unsuccessful in unsubscribing from our communications and/or remain concerned, please contact our Data Protection Officer.

9. Transfers to third party countries

Sometimes to achieve the purposes for which we are processing your personal data we may need to share your personal data with other organisations based within the European Union or if outside the European Union based in countries that have comparable levels of protection.

When it is necessary to share your data with organisations outside of the European Union, we will ensure that there are appropriate safeguards in place.

10. Retention periods

The Cultural Institute's guidelines for retention of your data:

Category
Short description
Minimum period
Maximum period
Application data
Application forms to Cultural Institute programmes and projects and interview information

12 months after cessation of relationship
Event data
Details of who attended events

12 months after event unless further contact is pursued
Inbound data
Details of queries and actions taken

12 months after cessation of relationship
Relationship to University
Details of involvement with the University as a collaborating partner

12 months after cessation of relationship
Programme participation
Details of who received support through our programmes and what that support was

Six years after participation ends
Financial data
Information relating to payment of SIPRs and other payments
Six years after end of engagement
Six years after end of engagement

11. Your rights as a data subject

We thought it would be helpful to set out your rights under GDPR. You have the right to:

  • withdraw consent where that is the legal basis of our processing
  • access your personal data that we process
  • rectify inaccuracies in personal data that we hold about you
  • be forgotten, that is your details to be removed from systems that we use to process your personal data
  • restrict the processing in certain ways
  • obtain a copy of your data in a commonly used electronic form
  • object to certain processing of your personal data by us
Please see https://ico.org.uk/ for further information on the above rights. You may also contact the Data Protection Officer for further information.

You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see https://ico.org.uk/.

12. Legal basis for processing your data under GDPR

Here is a brief explanation of the grounds for processing your data:

(Article 6(1)(a)), Consent – Direct mailing about the University of Leeds' cultural news and events programme, as well as selected cultural news about the University.

(Article 6 (1)(b)), necessary for the performance of your contractual relationship with the University – on many occasions the University will process your data to enable it to meet its commitments to you e.g. those relating to the delivery of projects you are participating in.

(Article 6 (1)(c)), necessary to comply with a legal obligation –

(Article 6 (1)(d)), for the purpose of protecting the vital interest of yourself or another – sometimes in extreme circumstances the University will have to release information to protect your interests or the interests of others e.g. in medical emergencies.

(Article 6 (1)(e)), processing necessary for the performance of a task carried in the public interest – the University is a research and educational establishment and in particular its research and educational activity is conducted in a public interest (including your interest and the interest of others).

(Article 6 (1)(f)), processing is necessary for the purposes of the legitimate interest of the University or a third party subject to overridden interests of the data subject – the University (and sometimes third parties) has a broad legitimate interest in activities that connect to the activities and education of students, researchers and third party organisations. Subject to those interests not being overridden by the interests of fundamental rights and freedoms of third party individuals and organisations, it will pursue those interests. A good example of this legitimate interest would be using personal data to manage the admission to and the administration of partner collaboration programmes, including sharing opportunities that you offer to departments and individuals within the University.

Where Article 6(1)(f) is used the “legitimate interest” is generally the interest of the Cultural Institute, yourself and third parties in providing or supporting the provision of research interests, student learning and partnership brokerage.

It is recognised that some of the above grounds will overlap and that the University could rely on multiple grounds justifying its lawful processing. The University also reserves the right to rely upon other grounds that are not referred to under table 1.

13. Concerns and contact details

If you have any concerns with regard to the way your personal data is being processed or have a query with regard to this Notice, please contact our Data Protection Officer. Our general postal address is University of Leeds, Leeds LS2 9JT, UK.

Our postal address for data protection issues is University of Leeds, Room 11.72 EC Stoner Building, Leeds, LS2 9JT.

Our telephone number is +44 (0)113 2431751.

Our data controller registration number provided by the Information Commissioner's Office is Z553814X.