Privacy statement

On what basis will you process my data?

Under the General Data Protection Regulation (GDPR), the University has to identify a legal basis for processing personal data and, where appropriate, an additional condition for processing special category data.

In line with our charter which states that we advance learning and knowledge by teaching and research, the University processes personal data for research purposes under Article 6 (1) (e) of the GDPR:

Processing is necessary for the performance of a task carried out in the public interest

Special category data is processed under Article 9 (2) (j):

Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes

Research will only be undertaken where ethical approval has been obtained, where there is a clear public interest and where appropriate safeguards have been put in place to protect data.

In line with ethical expectations and in order to comply with common law duty of confidentiality, we will seek your consent to participate where appropriate. This consent will not, however, be our legal basis for processing your data under the GDPR.

How will you use my data?

Data will be processed for the purposes outlined in this notice.

Will you share my data with 3rd parties?

Yes. The following third parties will have access to your data for the following purposes: Glitch and/or Amazon Web Services will host the system, which is where user email addresses will be stored in order to ensure the functioning of the interface.

Anonymised data may be reused by the research team or other third parties for secondary research purposes.

If you divulge that you are using the system (e.g., by posting about it on social media, or sharing a search with friends/family), then your anonymity is compromised. You are able to do this if you wish; we are making you aware of the situation.

How will you keep my data secure?

The University will put in place appropriate technical and organisational measures to protect your personal data and/or special category data. For the purposes of this project we will be using password-protected accounts to access user data. If you are partaking in a user or artist interview as part of this project, you participation is on an anonymous basis. That said, if an artist joins the service via this route, their artist name and biography will then be searchable in our system.

Information will be treated confidentiality and shared on a need-to-know basis only. The University is committed to the principle of data protection by design and default and will collect the minimum amount of data necessary for the project. In addition, we will anonymise or pseudonymise data wherever possible.

Will you transfer my data internationally?

Possibly. The hosting solutions mentioned above means that data can be located at any of the companies’ globally spread data centres.

Will I be identified in any research outputs?

No.

How long will you keep my data?

Data will be retained in line with legal requirements or where there is a business need. Retention timeframes will be determined in line with the University’s Records Retention Schedule.

What rights do I have in relation to my data?

Under the GDPR, you have a general right of access to your data, a right to rectification, erasure, restriction, objection or portability. You also have a right to withdrawal. Please note, not all rights apply where data is processed purely for research purposes. For further information see the University’s GDPR record management page.

Questions or concerns

If you have any questions about this participant information sheet or concerns about how your data is being processed, please contact Jonathan Finch, Chair of the Arts and Humanities Ethics Committee in the first instance. If you are still dissatisfied, please contact the University’s Acting Data Protection Officer.

Right to complain

If you are unhappy with the way in which the University has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office.