Privacy Policy

PRIVACY NOTICE – Birmingham City University’s Ecrofit Services

How we will use your data

Introduction

 

The Ecrofit project delivered by Birmingham City University (‘BCU’) provides access to BCU Business Specialists, Analysts and Advisors who will work with users to identify opportunities to innovate on low carbon and building energy efficiency projects.  It also offers information and advice through training workshops as non-credit bearing continuous professional development.  In order to provide the services BCU sometimes needs to collect information about individuals.

By using the Ecrofit website to enquire and apply for services or register for training, users agree that BCU may process personal data that we collect for the purpose of providing the services. Additional consent may be provided by users for the purpose of gaining access to updates, news, information about additional services offered and BCU events.

This privacy notice explains how BCU collects, uses and shares personal data collected by the Ecrofit project and explains individuals’ rights in relation to the personal data we hold.

Unless otherwise stated on individual services BCU is the data controller for personal data collected by the Ecrofit project and is subject to the Data Protection Act 1998 (‘DPA’) (and, once in force in May 2018, to the General Data Protection Regulation (the ‘GDPR’)).

This privacy notice explains the following:

  1. How we collect your information
  2. The types of information we collect
  3. How we use your personal data
  4. Who we share personal data with
  5. Will you be contacted for marketing purposes?
  6. Where we store your data
  7. How we keep your data safe
  8. How long is your information kept?
  9. How we keep your information up to date and Communication preferences
  10. Your rights
  11. How to exercise your data rights?
  12. How to ask questions or raise concerns?
  13. Changes to this privacy notice

1. How we collect your information

 

BCU may collect your personal data in a number of ways, for example from the information you provide to us when you interact with BCU, if you provide BCU with your contact details to us by:

  • Email
  • Telephone
  • Post
  • Social media
  • In person
  • Register for an event
  • Respond to a questionnaire
  • Make an enquiry via BCU Advantage and or BCU website enquiry forms such as the Ecrofit project enquiry or application forms
  • Entering into a contractual relationship with BCU (such as the Ecrofit research collaboration)

2. The types of information we collect

 

We may collect the following types of personal data about you:

  • Title
  • First Name
  • Last Name
  • Email address
  • Phone number
  • Job title
  • Business name and address
  • Social media
  • Reasons for contacting BCU and or using business diagnostic tools and services offered
  • Information required for specific project services, such as required on the application form
  • Consents and or specified contract preferences

Your IP address, browser settings and location

3. How we use your personal data

 

Your contact details, your reason for contacting BCU and a record of any services provided to you will be stored on our Customer Relationship Management database (‘CRM’).

We will use your information to keep a record of your relationship with the University, to provide business diagnostic and or growth services to you and where requested to inform you of a range of business support activities and opportunities. This includes:

  • Contacting you about enquires made via telephone, email, websites, post or social media
  • To provide business diagnostic services to you and offer you BCU business growth services based on your results
  • To create Personalised Business Analysis Reports
  • To record anticipated and actual achievement dates of outputs and milestones
  • To enable individual project and overall Programme performance to be monitored
  • Gathering anonymous regional SME insight data
  • Providing links to or copies of publications from BCU
  • Sending E-newsletters with BCU news and updates that we believe to be of interest to you
  • Communications about events that we believe to be of interest to you
  • Communications about products and services that we believe to be of interest to you
  • For administrative purposes to maintain a secure CRM database of your details, including updating any preference changes received from you and to keep records of communications, engagement history
  • To undertake analytics, analysis and research so that we may improve the services offered by BCU
  • Using information in aggregate so that no individuals can be identified for strategic development
  • We may use records of your interactions with BCU to help us personalise our service to you and direct resources appropriately
  • We may track email communications including views, opens and clicks, to help us improve our email communications and identify individuals engaging with our communications. We may add this data to your individual record and use it to personalise the communications we send to you

4. Who we share personal data with

 

We may share your data with other departments and faculties within BCU only where necessary for BCU Business Specialists, Analysts, Advisors and BCU academic research groups to deliver the Ecrofit Project, BCU Advantage and or business diagnostic, growth services and BCU academic research activities.

For the purposes referred to in the privacy notice, we may share your personal data with certain third parties for the purposes of delivering the BCU Advantage and or business diagnostic or growth services. This will be in accordance with your preferences provided when applicable. We will not share your personal data with third parties except:

  • Our employees, agents and contractors for the sole purpose of providing you with any requested diagnostic, growth services and or BCU academic research activities;
  • We may use a third party provider to deliver our email communications and or to distribute postal services. They are only allowed to use this information to send out the communications specified by BCU and are required to securely delete the information once communications have been sent;
  • BCU works closely with GBSLEP Growth Hub and its partners for the purpose of SME growth within the GBSLEP region. If BCU is unable to offer you the business support you require, the Growth Hub partners may be able to. We would only share your contact details and enquiry with Growth Hub partners once you have given us express permission to do so.
  • Where we are running an event in partnership with a third party, it may be necessary to share your personal data. If this is the case, we will always make this clear during the registration process and provide the name of the third party;
  • Should you be involved with a funded project at BCU, BCU may be required to share details with partners and or funding organisations for governance and audit compliance requirements;
  • We may share information, if legally required with regulatory bodies and auditors, for example if records had to be lawfully inspected by a regulator such as the Information Commissioners Office or auditor of a European funding provider;

If we use or share information with a third party as detailed above, we will always ensure that appropriate controls are in place to ensure data is safe, it is only used for the allowed purpose and it is permanently deleted after the task has been completed.

5. Will you be contacted for marketing purposes?

 

BCU will only send you marketing emails or contact you via your selected preference selections where you have expressly agreed to this. We may personalise the message content based upon information you have provided. You can update your preferences at any time see section 8 below.

6. Where we store your data

The CRM used to store your data is kept on a secure cloud network with data centers within the in the European Economic Area (“EEA”). However, some of the personal data we process about you may be transferred to, and stored at, a destination outside the EEA, for example where it is processed by staff operating outside the EEA who work for us or for one of our suppliers, or where personal data is processed by one of our suppliers who is based outside the EEA or who uses storage facilities outside the EEA.

In these circumstances, your personal data will only be transferred on one of the following bases:

  • where the transfer is subject to one or more of the “appropriate safeguards” for international transfers prescribed by applicable law (e.g. standard data protection clauses adopted by the European Commission);
  • a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of protection; or
  • there exists another situation where the transfer is permitted under applicable law (e.g. where we have your explicit consent).

7.  How we keep your data safe

 

BCU is committed to safeguarding your personal data. Whenever you provide such information, we are legally obliged to use your information in line with all applicable laws concerning the protection of personal information, including the Data Protection Act 1998 and from May 2018 the General Data Protection Regulation. In relation to all our Ecrofit Project and BCU Advantage services records these are held within a dedicated and secure CRM system and or our secure network with access limited on a need to know basis. A range of administrative, technical, physical security controls are used to ensure a robust approach to protecting data held on BCU IT systems, and when approved transfers between third parties are undertaken. For more information a copy of BCU’s overarching Data Protection Policy is available on the policies page of the BCU website. Policies and Procedures – Privacy Notices

8.  How long is your information kept?

 

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Where you have indicated that you no longer wish to receive any services your information will be retained only in line with project audit requirements and after that securely and permanently destroyed in accordance with the BCU retention and destruction policy.

Where a record has not been used and or there is no active engagement (for example there has been no response to required correspondence), BCU may class the record as dormant or may delete the record in accordance with the BCU retention and destruction policy. When appropriate BCU will email you to confirm your preferences and to notify you of any intention to delete your records if no response is received.

9. How we keep your information up to date and Communication preferences

 

BCU wants to ensure that we keep the details we hold about you up to date and communicate with you fully in accordance with your wishes. You should also get in touch with us if any of your personal details change. You can update your details and your communication preferences at any time by:

Email: bcuadvantage@bcu.ac.uk

By Post:
BCU Advantage
University House
15 Bartholomew Row
Birmingham
B5 5JU

10.  Your rights

 

Under the Data Protection Laws, you have the following rights:

  • to obtain access to, and copies of, the personal data that we hold about you;
  • to request that we cease processing your personal data if the processing is causing you damage or distress;
  • to require us not to send you marketing communications.
  • to request us to correct the personal data we hold about you if it is incorrect;

Under GDPR, you have the following additional rights:

  • to request us to erase your personal data;
  • to request us to restrict our data processing activities;
  • where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal;
  • to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller;
  • to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

11. How to exercise your data rights?

 

If you wish to exercise any of your rights, please contact our Data Protection Officer using the following contact details:

By email to: informationmanagement@bcu.ac.uk

By telephone on: +44 (0) 121 331 5288

By post to:
Data Protection Officer
Information Management Team
Joseph Priestly Building / 3rd Floor
6 Cardigan Street
Birmingham
B4 7BD

12. How to ask questions or raise concerns?

 

If you have any questions, comments or concerns about how we use or handle your personal data please contact the Data Protection Officer using the contact details in section 10 above.

If you are not content with how we handle your information we would ask you to contact our Data Protection Officer to help you. However, you do also have the right to complain directly to the Information Commissioner at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Information about the Information Commissioner is available at: https://ico.org.uk.

13. Changes to this privacy notice

 

This privacy notice may be updated from time to time so you may wish to check it each time you submit personal information to BCU. The date of the most recent versions will appear on this page (see version control). We encourage you to check our privacy notice from time to time to ensure you understand how your data will be used and to see any minor updates. If material changes are made to the privacy notice, for instance how we would like to use your personal data, we will provide a more prominent notice (including, for certain services, email notification or correspondence of privacy notice changes).