Coventry University Higher Education Corporation

Privacy Notice for Coventry Digital

Users and the General Public

Who are we?

In this Privacy Notice, the terms "we", "our", and "us" refer to Coventry University Higher Education Corporation, Priory Street, Coventry, United Kingdom, CV1 5FB (ICO registration number Z6939585).

As a controller of your personal data we are responsible for looking after it, and we will use it fairly, lawfully, and in a transparent manner.

Purpose

We are committed to protecting your privacy. This notice will help you understand how we look after, use, store and share your personal data, and how we meet our obligations under the General Data Protection Regulation 2016 and the Data Protection Act 2018 (Data Protection Laws). It supplements any other notices or statements we may provide to you.

What personal data do we collect?

"Personal data" is any information from which you can be identified, e.g. name, date of birth, contact details, identification numbers, photographs, and expressions of opinion about you.

Where do we get your personal data from?

We may collect your personal data directly from you when you make a public user account with us (“User Data”) and we may also collect your personal data through digital assets uploaded by our partners to the Archive (“Archival Data”).

Why do we need personal data and how do we use it?

Users will be required to provide their name, email address, age, gender, ethnic background and occupation in order to set up a user account to access the Coventry Digital.

Photographs and oral recordings are needed to be held within the Archive under the University’s Public duty as an education and research institution and for corporate social responsibility, monitoring and academic purposes. This resource will also be used as a public resource for historic, educational and public policy purposes.

Basis for using your personal data

We need a legal basis for any processing of personal data. This means that our processing must be for one of a limited number of reasons set out in the data protection laws.

The legal basis that we rely on in this instance for processing data is:

Public Task

We will collect the data provided by users and partners for the creation and maintenance of an academic archive to be used for academic and research purposes. This aligns to the University’s public duty as an education and research institution.

Special Category Data

The University may collect special category data through recognition software used on photographs and audio recordings. Photographs may reveal political or trade union membership of individuals, which would also be considered to be special category data. In addition to having a legal basis for any processing of personal data, where special category data is being processed an additional condition must be met under data protection laws. The special category condition that we rely on in this instance is:

Processing necessary for archiving purposes in the public interest

This purpose of this archive is to ensure there is a record of local history and to consider and explore aspects of our digital future. It is in the public interest to ensure a historical record is maintained for historic, educational and public policy purposes. The record will be vital for the monitoring and evaluation of the years around city of culture and for the heritage sector of Coventry more generally.

Processing of your personal data

"Processing" means doing anything with the personal data, such as collecting, recording, organising, structuring, storing, adapting or altering, retrieving, accessing, consulting, disclosing, disseminating, aligning or combining, restricting, erasing or destroying or using the data in any way.

We will process your personal data for the purposes set out above, or as we otherwise notify you.

The personal data you provide will be subject to security measures and procedures to minimise the risk of unauthorised access, loss, theft or disclosure.

Your personal data will not be used for the purposes of automated decision making.

How long do we keep your personal data for?

Your personal data may be held indefinitely as it is being held for archiving purposes to ensure there remains a record of local history around Coventry.

Who do we share your personal data with?

Personal data used to create a User Account will not be disclosed to any third parties. Archival data can be accessed by the public, however only where individuals have created User Accounts.

Keeping your personal data secure

We are committed to the protection and security of your personal data. We will ensure that appropriate measures are taken against its unlawful or unauthorised processing, and against its accidental loss or damage. We are certified to Cyber Essentials.

How you may contact us

In the event of any queries relating the information you provide, please contact Director of the City of Culture Coventry Digital Dr. Ben Kyneswood at ac4693@coventry.ac.uk.

Your Data Protection Rights

You have the right to:

Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data that we hold about you, and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data that we hold about you corrected, although we may need to verify the accuracy of the new personal data.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data if:

• there is no good reason for us continue processing it;
• you have successfully exercised your right to object to processing (see below);
• you believe we may have processed your personal data unlawfully; or
• we are required to erase your personal data to comply with the law.

Please note that we may not be able to comply with your request for specific legal reasons which, if applicable, will be notified to you.

Object to processing of your personal data when we are relying on public task or a legitimate interest (or those of a third party), and you feel that this processing impacts on your fundamental rights and freedoms. However, these may be overridden by the public interest or our legitimate interest grounds.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

• if you want us to establish the accuracy of the data;
• where our use of the data is unlawful but you do not want us to erase it;
• where you need us to hold the data even if we no longer require it (for example if you need it to establish, exercise or defend legal claims); or
• If you have objected to our use of your data, but we need to verify whether we have overriding public interest or legitimate interest grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated data that you initially provided consent for us to use, or where we used the data to perform a contract with you.

Withdraw consent at any time when we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent.

Exercising your rights

If you wish to exercise any of your above rights, please send a written request to the Information Governance Unit, Coventry University, Priory Street, Coventry, CV1 5FB or email dsar@coventry.ac.uk.

You will not have to pay a fee to exercise any of your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.  Alternatively, we may refuse to comply with your request in these circumstances.

We may need to confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information, in order to speed up our response.

We try to respond to all legitimate requests within one month, although it may take us longer if your request is particularly complex, or if you have made a number of requests. In this case, we will notify you and keep you updated.

Complaints and questions

We have appointed a Data Protection Officer to oversee compliance with this Privacy Notice. If you have any concerns of complaints about it, please contact the Data Protection Officer at the Information Governance Unit, Coventry University, Priory Street, Coventry CV1 5FB or email dpo@coventry.ac.uk.

If you are not satisfied with the proposed resolution of your complaint, you have the right to contact the Information Commissioner’s Office. Further information can be found on the Information Commissioner’s website at www.ico.org.uk or via their helpline on 0303 123 1113.

We reserve the right to update this Privacy Notice at any time.  Any updated versions will be made available on our website.

Feedback

If you have feedback for us about this privacy notice, please let us know by emailing enquiry.igu@coventry.ac.uk.