GDPR

PRIVACY NOTICE FOR PARTICIPANTS OF IMPERIAL COLLEGE LONDON CENTRE FOR CONTINUING PROFESSIONAL DEVELOPMENT (CPD) PROGRAMMES

This Privacy Notice (Notice) explains how Imperial College London (the College, we, our, us) processes your personal data when you participate in its CPD programmes (including on campus or online short courses, summer schools, webinars, conferences, master modules (Programme)) and your rights in relation to the personal data we hold.

For the purposes of any applicable data protection laws in England and Wales, including from 25 May 2018 the EU General Data Protection Regulation 2016/679 (GDPR), the College is the data controller of your personal data. The College has appointed a Data Protection Officer, who can be contacted via email at dpo@imperial.ac.uk, via telephone on 20 7594 3502 and via post at Imperial College London, Data Protection Officer, Faculty Building Level 4, London SW7 2AZ.

For more information about the College's data protection policies please refer to our data protection webpage http://www.imperial.ac.uk/admin-services/legal-services-office/data-protection/.

How your personal data is collected

The College collects your personal data from the following sources:

 from you, typically when you:

  • complete forms in relation to attending or participating in a CPD Programme, including registering through our online platform;
  • attend and participate in a CPD Programme;
  • complete our surveys and feedback forms;
  • communicate with us by post, email, online chat, social media, telephone or another format;
  • visit the College's website, including when you search, register or use our online payment portals or sign-up for a CPD Programme.

 from third parties such as:

  • organisations who commissioned our Programmes and provide us your details;
  • our payment provider who will confirm details of your payment;
  • publicly available sources when researching and creating biographies of speakers and key attendees.

What categories of personal data are collected?

We collect the following categories of personal data: Identification, background and contact details

  • biographical information such as your name, title, gender and date of birth;
  • your image, audio and likeness (as captured on a webinar or live online class, in photographs or on recordings we make of the programme, and on CCTV where the programme is hosted at our premises);
  • your contact details including address, email address and phone number;
  • your qualifications, professional experience and institution or employer (where this is relevant to a Programme);
  • your other connections with the College (for example, your alumni number to register for Programme discount);
  • information about your university, degree of study, educational background, level of English proficiency, where this is relevant to selecting participants for a Programme and deciding whether you are eligible to participate in a particular Programme;
  • your mark or assessment score on the Programme where relevant;
  • your attendance registrar on the Programme;

Online and transactional

  • details of your IP address, browser type and operating system when you visit our website;
  • programmes that you have attended in the past or for which you are registered to attend in the future;
  • payment details and your financial transactions in relation to the Programme(s);
  • records of communications sent to you by the College or received from you;

We may also collect the following special categories of personal data where it is necessary for the purposes set out in this Notice (please also see the section on Special categories of personal data for details about how we process this data):

  • information concerning your health and medical conditions (e.g. disability and dietary needs);
  • membership number (for example, where membership provides you with access to (or a discount on) a programme;
  • criminal acts caught on our CCTV cameras; and
  • diversity information about your racial or ethnic origin; religion or similar beliefs; and sexual orientation.

The basis for processing your data, how we use that data and with whom we share it

We will process your personal data either in ways you have consented to, or because it is otherwise necessary for a lawful purpose. We set these out as follows:

As part of the contractual relationship between you and the College (where you have enrolled on an open programme) or because it is necessary for the College's legitimate interests or the legitimate interests of a third party (where a third party such as an employer has arranged for you to participate in a programme)

In this respect we use your personal data for the following purposes:

  • to deliver the Programme you have registered for;
  • to correspond with you about the Programme, including sending you pre and post-Programme information and project marks (if applicable).

As part of this process, we will expect to share your personal data with:

  • our agents, contractors and service providers (including providers of accommodation, catering, IT, webinar and other support services) where applicable and where it is necessary for them to receive the information;
  • co-organisers or partners who are involved in the delivery of a Programme;
  • relevant professional bodies or institutions where membership or affiliation affects your entitlement to attend (or results in a discount on) a Programme.

Other legitimate interests

Your personal data will also be processed because it is necessary for the College's legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

  • creating biographies of attendees or a delegate or speaker list and distributing the biography/list to speakers and attendees (except in circumstances where it is appropriate to gain your consent);
  • sharing your information with sponsors of a Programme (except in circumstances where it is appropriate to gain your consent);
  • filming, photographing or otherwise recording Programmes and publishing such content on our website, social media accounts and other formats where it would not be necessary, appropriate or practicable to obtain your specific consent (for example, we may seek specific consent for prominent or impactful uses);
  • analysing and improving the use of our website;
  • using digital tools to monitor the impact of our marketing communications (such as using email tracking to record when an email we send you has been opened);
  • analysing who is attending our Programmes, including so that we can monitor the success of our programs and understand trends in participation (for example, by monitoring participation by industry sectors, job titles, academic backgrounds);
  • processing feedback to improve the quality of our Programmes and marketing activities;
  • marketing the College’s CPD Programmes by post, telephone, social media and electronic mail (but without prejudice to your rights under the legislation that regulates the sending of marketing communications by electronic means);

In addition to those organisations named above, we will also share your personal data with:

  • our agents and contractors where they require your personal data to perform the services outlined above.

Legal obligations

Your personal data will be processed for compliance with the College's legal obligations. For example:

  • for the detection and prevention of crime and to assist the police and other competent authorities with investigations;
  • to comply with tax legislation, safeguarding duties and subject access requests of others.

In this respect, as well as the organisations mentioned above, we may in specific circumstances need to share your personal data with third parties who have made legitimate requests under data protection or freedom of information law; the police and other law enforcement agencies; HMRC and the College’s external auditors.

Where you have consented

Your personal data will also be processed by the College where we have your consent.

Examples where consent would be sought include where the law or some other protocol requires that the College obtains your consent (for certain marketing communications) or where, having balanced the College’s legitimate interests against your rights, interests and expectations, we feel it is appropriate to obtain your consent for our processing, rather than rely on the legitimate interests basis.

Where applicable, consent will always be specific and informed on your part, and the consequences of consenting or not, or of withdrawing consent, will be made clear.

Special categories of personal data

In addition to the above, College may process types of personal data that the law considers to fall into a special category (such as race, religion, health, sexual life or criminal record). This will be under the following circumstances:

  • where you have provided your explicit consent. Examples might include where you have provided information on your dietary requirements, allergies or where you inform us of the requirement for wheelchair access;
  • where such processing is necessary for the establishment, exercise or defence of legal claims (including sharing with the College's insurers and legal advisers) or the prevention or detection of crime (for example, detecting criminal actions through the use of CCTV or reporting allegations to the police);
  • where it is in your vital interests to do so and you are incapable of giving consent, for example to inform your specified emergency contact, the NHS or emergency services in the event of your illness or other emergency.

International transfers of data

The College will in limited circumstances disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside the European Economic Area. For example, we will transfer data to IT and sign-up platform providers based overseas (such as MailChimp, Google and EventBrite) and share information with international co-organisers of a Programme.

In these circumstances, your personal data will only be transferred where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law, such as:

  • an approved certification mechanism such as Privacy Shield;
  • where the College has entered into contractual clauses approved by the European Commission that provide appropriate safeguards; or
  • there exists another situation where the transfer is permitted under applicable law (for example, where we have your explicit consent).

Profiling

We may use personal characteristics such as age, role, your expressed interests, your previous interactions with the College or geographical location to target our communications, and advertising and promotions so that they are relevant to you. We may also use your personal characteristics (such as those contained within your LinkedIn profile) to assist us in identifying and targeting new audiences for our Programmes, including through online behavioural advertising (for example, through tools such as LinkedIn).

Rights of access, correction, erasure, and restriction

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

  • Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
  • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
  • Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
  • Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
  • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the College’s Data Protection Officer in writing.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the College’s Data Protection Officer. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Please note that the above rights are not absolute, and requests may be refused where exceptions apply.

If you have any questions about these rights or how your personal data is used by us, you should contact the Data Protection Officer using the details below:

  • Post – Data Protection Officer
  • Address - Level 4 Faculty Building, Imperial College London, South Kensington, London, SW7 2AZ
  • Email – dpo@imperial.ac.uk
  • Telephone – 020 7594 3502

If you are not satisfied with how your personal data is used by the College you can make a complaint to the Information Commissioner (www.ico.org.uk).

How long is my personal information retained for?

Your data is held in accordance with the College’s Retention Schedule available at http://www.imperial.ac.uk/media/imperial-college/administration-and-support-services/records-and-archives/public/RetentionSchedule.pdf.

In addition, we hold information on attending participants for up to five years after a Programme unless we have a legitimate reason for retaining your information for longer and the signed list of attendance register on Programmes permanently.  In addition, where you have requested to receive further information from us and to keep you informed about future Programmes your data will be retained for the entirety of your relationship with the College.

Document last updated on 19 June 2020