This Impact Privacy Notice explains what personal information the University holds about you, detailing why we hold this information, what we do with it, how long we keep it for and if we share it with third parties. This Privacy Notice is relevant to the following groups of individuals: Individuals who are not employed by the University of Edinburgh but who have provided testimonials or other information regarding impact of the University’s research (see Table 1). Individuals who are not employed by the University but who have carried out some or all of the research that underpins an impact that the University is looking to promote (See Table 2). The legal basis for collecting and storing personal information is “the University’s legitimate interest”. We collect and use your personal information for the purpose of disseminating an impact narrative either internally or externally including as part of future UK research assessment exercises, and being able to verify the narrative as true and accurate, in the event of a query. “Personal information” means any piece of information which can identify you, that is, the information would make it clear to others that the information is about you. It can be a single piece of information - for example, your name - or it can be separate pieces of information which, when combined, would help others identify you. The tables below describe the information we hold and what we need it for. We receive information from you, University documents, or from third parties including research users. We will keep your personal data for as long as required for the purpose; at the longest this will be until the next UK Research Assessment Exercise is complete. We will keep categories of your personal data in a password protected database or OneDrive folder linked to University of Edinburgh institutional accounts, to which only teams directly involved in creating impact narratives have access. Other third parties we share your data with are also listed below. In these circumstances, we will only share your data if we are required to do so by law, you ask us to do so, or we are contractually obliged to do so. Table 1: Personal data of Testimonial/Information Providers for impact The information the University holds What the University needs it for Organisation Data required by the authors of an impact narrative to create an engaging narrative and to verify its accuracy in the event of query or audit. Where an individual has provided data or a testimonial (including data) to corroborate key claims made by the University in an impact narrative, data may be mentioned as part of the narrative. Position (where appropriate) Data required by the authors of an impact narrative to create an engaging narrative and to verify its accuracy in the event of query or audit. Where an individual has provided data or a testimonial (including data) to corroborate key claims made by the University in an impact narrative, data may be mentioned as part of the narrative. If required, data will be removed or redacted before the impact narrative is published. Name Data required by the authors of an impact narrative to create an engaging narrative and to verify its accuracy in the event of query or audit. Where an individual has provided data or a testimonial (including data) to corroborate key claims made by the College in an impact narrative, data may be mentioned as part of the narrative. If required, data will be redacted before the impact narrative is published. Contact details Data required by the University to contact the individual for any follow-up queries or audit purposes. Data will not be published. Table 2: Personal data of staff who have carried out research underpinning an impact narrative The information the University holds What the University needs it for Staff reference code (academic visitor number, where available) Data required by the authors of an impact narrative to verify the right of the University to refer to the research as “our” or “College’s” or “University’s”, in the event of a query or an audit. Data will not be published. Name (initials and surname) Data required by the authors of an impact narrative to create an engaging narrative and to verify its accuracy in the event of query or audit. Employing organisation Data required by the authors of an impact narrative to create an engaging narrative and to verify its accuracy in the event of query or audit. Position/job title Data required by the authors of an impact narrative to create an engaging narrative and to verify its accuracy in the event of query or audit. Period(s) employed by the University or periods associated with it. Data required by the authors of an impact narrative to verify the right of the University to refer to the research as “our” or “College’s” or “University’s”, in the event of a query. Data will not be published. Details of any teams/groups/collaborators that the individual has/is a member of at the University Data required by the authors of an impact narrative to verify the right of the University to refer to the research as “our” or “College’s” or “University’s”, in the event of a query or an audit. Funding (including: details of grants held during the assessment period) Data required by the authors of an impact narrative to verify the right of the University to refer to the research as “our” or “College’s” or “University’s”, in the event of a query or an audit. Publication of data Impact narratives may be disseminated via various digital and non-digital means, including but not limited to: social media platforms, internal newsletters or email campaigns, promotional materials, University of Edinburgh webpages, posters displayed at University buildings or events attended by University staff and internal and external funding applications, Personal data that may feature will be strictly limited and will only include: Testimonial/Information Providers for impact: organisations, job titles and names may appear in the narrative alongside the information provided. For former or formerly eligible staff: names and job titles (when employed by the University) may appear in the narrative alongside the information provided. We do not use automated decision-making processes. General information about the University’s approach to data protection and to your rights Records Management | The University of Edinburgh Data Protection | The University of Edinburgh Data will be stored in line with the University of Edinburgh’s Information Security Policy Information Security Policy | The University of Edinburgh Further information about GDPR and Data Protection GDPR.org Data protection - GOV.UK (www.gov.uk) Guide to the UK General Data Protection Regulation (UK GDPR) | ICO This article was published on 2024-01-24
