Healthcare Professional Academic Group – Personal Data

How we process your personal data

Data controller and this notice:

Imperial College of Science, Technology and Medicine (the “College” or “Imperial” or “we”) is a "data controller" and therefore responsible for deciding how we hold and use personal information about you. This notice does not form part of any contract to provide services and we may update this notice at any time.

Categories of personal data being processed:

We may collect, store, and use the following categories of personal information about you: personal contact details such as name and email address; tracking technologies such as device, operating system information and IP address. We do not expect to collect, store or use any "special categories" of more sensitive personal information.

Where we get your personal data from:

1. We collect personal information about you via this form. 

The legal basis for processing your personal data:

1. We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
2. Where it is either necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests or is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us as a university.
3. Where you have given us consent to process the information.
4. Where we need to comply with a legal obligation.
5. Where we need to protect your vital interests (or someone else's interests) e.g. in medical emergencies.
6. Where we need to perform the contract we have entered into with you or in order to take steps at your request prior to the entry into a contract.

The purposes for which we process your personal data:

The situations in which we will process your personal information are:

1. To provide you with the information and services you request from us;
2. To contact you by email in relation to key events and useful information about courses and related activities at Healthcare Professional Academic Group (HPAG);
3. For monitoring and evaluation purposes, internal reporting purposes and for statistical analysis on group level.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
We will only use your personal information for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How we share your personal data and transfers to third-party countries:

Sharing your information with third parties:

1. We may share your personal information with third parties where required by law, where it is necessary to administer our relationship with you or where we have another legitimate interest in doing so. 
2. We may also share your personal information with other third parties, for example in the context of the possible sale or restructuring of the business and operations of the College. We may also need to share your personal information with a regulator or to otherwise comply with the law.
3. All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal information in line with data protection laws. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
4. Some third parties may process your personal information outside the EU. Where this is the case, you can expect a similar degree of protection in respect of your personal information.
5. The following third-party service providers process personal information about you for the following purposes: MailChimp (whose legal name is The Rocket Science Group LLC) who provide MailChimp and its group companies for the purposes of them providing an email service, automation and marketing platform and other related services (which also includes reporting and analytics functionality). We share the information submitted through this form with MailChimp for these purposes. MailChimp processes personal data in accordance with the MailChimp Privacy Policy and Data Protection Laws. It also employs tracking technologies as described in the MailChimp Cookie Statement. 
6. MailChimp’s servers and offices are located in the United States, so your information may be transferred to, stored, or processed in the United States. MailChimp participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework and, on this basis, we can lawfully transfer personal information to them for the purposes of MailChimp providing their services to us. 
7. In future, we may change the provider of third-party services to support or enhance this system. In such circumstances, we will always ensure that appropriate protections are in place to safeguard your data in line with applicable laws.

Security:

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

How long we retain your personal information for:

You can unsubscribe from this mailing list at any time by clicking on the unsubscribe option available at the foot of every email we send you.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different records the College holds are available in our retention policy which is available on the Archives and Corporate Records Unit website.

Your rights as a data subject: You have the right to:

1. withdraw consent where that is the legal basis of our processing;
2. access your personal data that we process;
3. rectify inaccuracies in personal data that we hold about you;
4. be forgotten, that is your details to be removed from systems that we use to process your personal data;
5. restrict the processing in certain ways;
6. obtain a copy of your data in a commonly used electronic form; and
7. object to certain processing of your personal data by us.

Please see https://ico.org.uk/ for further information on the above rights. You may also contact our Data Protection Officer for further information at dpo@imperial.ac.uk.

You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see https://ico.org.uk/.

Questions and contact details:

If you have any concerns with regard to the way your personal data is being processed or have a query with regard to this information, please contact our Data Protection Officer at:

Imperial College London
Data Protection Officer
Exhibition Road
Faculty Building Level 4
London SW7 2AZ
email: dpo@imperial.ac.uk