Research and innovation services privacy notice

We hold and process personal data about staff, research students and research related collaborators and visitors.

The personal data we hold about you consists of:

• Name
• Contact details
• Identifiers such as
  • Staff ID
  • ORCID ID
• We also keep information relating to research performance such as:
  • Research grant information
  • Bibliometric information
  • Output and impact ratings.

We receive this data from you when you respond to emails, complete an intention to bid form or output review form (or other internal research related form), enter information onto a database or complete a grant proposal (internal and external).

We also receive data such as names, contact details, research grant information rating and bibliometric information from third parties. These third parties include:

• External reviewers: Output and impact ratings
• Subscription services: e.g. Scopus, Web of Science, SciVal
• Funding bodies.

We collect special category data relating to health from individual staff members and from Robens for staff circumstance processing as part of submission to national research assessment exercises.

The University collects only the data we need and we keep the data up to date and only for as long as it is needed. In the research context, we collect your personal data in order to:

• Identify potential research collaborations and opportunities
• Support research strategy and planning
• Support you in bid development
• Assist you with commercialisation and/or consultancy opportunities arising from your research
• Create internal reports
• Assess research performance, including its quantity and impact
• Support the University’s submissions to national research assessment exercises.

We use the data listed above in analysis of individual’s performance related to research assessment exercises, such as the REF.

We take our obligations for data handling very seriously and it is therefore important for you to know the lawful bases under which we process your information:

Where we are supporting your bids and supporting research strategy and planning and identifying potential research collaborations and opportunities, processing is necessary for the public interest as these activities are integral to the undertaking of research.

Where we are using your personal data in the assessment of research performance, or to assist you with commercialisation and consultancy opportunities, or to create internal reports (e.g. for management information) or support the University’s submission to national research assessment exercises, processing is necessary for the purposes of the legitimate interests of the University of Surrey.

Where, in a limited number of cases, the University has to collect special category (health) data to support the University’s submission to national research assessment exercises, this data is only processed with the explicit consent of the individual.

These purposes will never override your personal interests, fundamental rights and freedoms which require protection of your personal data.

Your personal information may be shared internally with members of:

• The VPRI portfolio
• Heads of department
• Centre, school and faculty senior management
• Finance
• IT
• Advancements if access to the data is necessary for performance of their roles.

We also combine your data with data received from the third parties listed above in order to assess performance; identify opportunities for collaboration and support research strategy and planning.

Access to, and the sharing of, your special category data are controlled very carefully. You will be given further details about our need for collecting such data when we ask you to share it with us, including any consequences for you of not providing it.

We keep your personal data in accordance with the University’s retention schedules. This means that your data is kept for a maximum of 10 years and then destroyed/passed to the University’s historical archive for permanent preservation.

Special category data, where collected for the purpose of a research assessment exercise will be kept for a year after submission. Please see the record retention schedules for more information.

Internally, we share your personal data with:

• Colleagues within the VPRI portfolio and Advancements to help them support your bids and strategic research and to facilitate events and training
• Colleagues in Finance to help support research projects once they have been awarded
• Strategic planning to enable them to produce internal reports, and contribute to submissions to national research assessment exercises and research performance analysis
• Heads of Department, Centre, School and Faculty Management to enable them to manage research effectively and strategically
• IT who host the data for our online systems.

Externally we share your personal data with:

• Research England as a requirement of national research assessment exercises. We do this to comply with a legal obligation
• Research funders as part of the bidding process for external research funding. We do this in the University’s legitimate interests.
• Appointed external auditors for the auditing of funded projects. We do this to comply with a legal obligation.

As an individual whose data we process (a data subject), you have certain rights in relation to the processing. Find detailed information about your rights as a data subject.

You have the right to:

• Withdraw your consent for us to process your personal data where we have relied on that consent as our basis for processing your data.
• Ask us to confirm that your personal data is being processed and to access (i.e. have a copy) of that data as well as to be provided with supplemental information about the processing.
• Request that we rectify any inaccuracies where the data we hold on you is inaccurate or incomplete.
• Have your data erased by us, although in certain circumstances we may not be able to do this. The circumstances where this applies can be found in the guide to data subject rights information.
• Restrict the processing of your personal data in certain ways.
• Obtain your personal data for reuse.
• Object to certain processing of your personal data.

If you would like to exercise any of your rights please visit our make a privacy request section.

Details on university-wide measures surrounding IT security can be found in Our Data Policy Statement (PDF) (incorporating Information Security Policy).

Make a complaint

If you have any concerns about the way that we have handled your personal data please email the Data Protection team as we would like to have the opportunity to resolve your concerns.

If you’re still unhappy, you have the right to complain to the Information Commissioner’s Office (an independent body set up to advise on information rights for the UK) about the way in which we process your personal data.