Our privacy policy
Introduction
In this Privacy Notice:
references to the website means the websites and webpages found on the councilofdeans.org.uk domain;
references to we, us or our means the Council of Deans of Health (CoDH), company number 12341200 and charity number 1186780. Our address is 20 Tavistock Square, London, WC1H 9HD; and
references to you or your means the person accessing and using the website or the person to whom we supply products or services.
Data protection principles
We comply with data protection law. This says that the personal information we hold about you must be:
used lawfully, fairly and in a transparent way;
collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
relevant to the purposes we have told you about and limited only to those purposes;
accurate and kept up to date;
kept only as long as necessary for the purposes we have told you about; and
kept securely.
Purpose and scope
This Privacy Notice (together with any other documents referred to in it) sets out the basis on which we collect and use personal data about you through your use of the website and when we supply products and services to you. This Privacy Notice describes:
who is responsible for the personal data that we collect about you;
the personal data we collect about you;
how we will use it;
who we may disclose it to; and
your rights and choices in relation to your personal data.
This is to make sure you have a full picture of how we collect and use your personal data. In this Privacy Notice where we use the words personal data we use these words to describe information that is about you and which identifies you.
Who is responsible for the personal data that we collect?
We are the data controller for the purposes of data protection law, in respect of your personal data collected and used by us.
What personal data do we hold about you?
We collect and use personal data about you for the purpose of communicating with you. The personal data we hold includes information that you provide to us/we collect from you. This may include the following:
| Type of Personal Data | Examples |
|---|---|
| Member representative information | When your university applies to become a member of the Council of Deans of Health you will be asked to provide certain information relating to the persons who will act as representatives of the university. This includes: name and role professional background university address university email address university telephone number |
| Financial Data | For example, details of your financial transactions with us, and bank account and payment card details that we process in relation to payments (for example, for attending or speaking at one of our events). |
| Online activity information (to the extent that it constitutes personal data) | Marketing: this includes your email address used for our mailing lists and bulletins, or when requesting information from us or to use our services. Profile Data: this includes your username and password, your preferences, feedback and responses. Technical information, through your internet browser or electronic device: Certain information is collected by most websites or automatically through your electronic device, such as your IP address (i.e. your computer’s address on the internet), screen resolution, operating system type (Windows or Mac) and version, internet browser type and version, electronic device manufacturer and model, language, time of the visit and pages visited. Technical information, using cookies and online tracking: Cookies are pieces of information stored directly on the device you are using to access our website. Cookies allow us to recognise your device and to collect information such as IP address, internet browser type, time spent using the website and the pages visited. |
| If you supply products or services to us | If you provide products or services to us (for example speaking at one of our events) we may collect information about you, including: name and role professional background address email address telephone number social media contact details |
| Dietary and access requirements | If you attend one of our events, we may ask you whether you have any dietary or access requirements. This is classed as “special category” personal data. Our purpose for collecting this information is so that we can properly facilitate the event. |
Apart from dietary and access requirements we do not normally intend to collect any “special categories” of personal data about you (for example data about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data) unless it is for the purposes of any specific CoDH project related to these characteristics, which we will notify you about. We do not collect any information from you about criminal convictions and offences.
The information we collect may be provided:
in the course of communications between you and us (including via our website or using other systems which we provide to you, web online forms, telephone, email, paper forms or otherwise);
via our social media pages, other social media content, tools and applications;
through your completion of paper registration, order or invoice forms; and
at an event or conference we provide or deliver.
The information we collect and use may be provided from other sources, for example:
Universities UK (company number 2517018 and charity number 1001127). The Council of Deans of Health was previously a part of Universities UK before we were formed separately and became independent in August 2021. Universities UK held personal data that we use before this data was lawfully shared with us as part of our formation; and
publicly available resources (such as Companies House, university and other websites, publicly available data on professional memberships, networks and social media such as LinkedIn or Twitter, and other information or news published in printed or online form).
Information about third parties:
In the course of communicating with you, you may provide us with personal data relating to other individuals. For example, you may provide us with the personal data of a professional colleague who we may add to our mailing list.
We will use this personal data in accordance with this Privacy Notice. If you are providing personal data to us relating to any other individual, you confirm that you have the agreement of the individual to share their personal data with us and that you have made the information in this Privacy Notice available to the individual. We will also make this Privacy Notice available to them as soon as we can.
How do we use the personal data we collect about you?
We use your personal data for a variety of different purposes during the course of us carrying out membership services and other activities. The purposes for which we use your personal data are set out below. Under data protection law, we can only use your personal data if we have a legal basis to do so. Examples of where we have a legal basis to process your personal data, includes when:
we have your consent;
it is necessary to enter into or perform a contract we have with you (or to take steps at your request prior to entering into that contract);
it is necessary to comply with a legal obligation; or
it is in our legitimate interests to process your personal data.We have set out our reasons for using your personal data in the table below under the heading Legal Bases.
| Purpose | Legal Bases |
|---|---|
| Setting up and managing your membership account | Contract Legitimate interests |
| Communicating with you about our products, services and events | Contract Legitimate interests |
| Providing our bulletins, newsletters, and sector updates as well as any other publications | Legitimate interests |
| Survey participation | Consent Legitimate interests |
| Publicity | Consent Legitimate interests |
| To comply with any legal or regulatory obligations (including in connection with a court order | Legal obligation |
| To enforce or apply any agreements concerning you (including agreements between you and us). | Contract Legitimate interests |
| To manage any issues, complaints, feedback and enquiries. | Consent Contract Legitimate interests |
Automated processing
We do not use your personal data to make any automated decisions that might affect you.
Who may we disclose your personal data to?
We may share your personal data with the categories of recipients set out in Schedule 1, including our service providers named in Schedule 2, for the purposes set out above (How do we use the personal data we collect about you).
We require all recipients with whom we share your personal data to respect the security of your personal data and to treat it in accordance with the law. We do not give permission for our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. We may share your personal information with third parties when required by law.
Where will we transfer your personal data?
If we transfer personal data outside the UK, we will implement appropriate and suitable safeguards to ensure that such personal data will be protected as required by data protection law.
How long will we keep your personal data?
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for your personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Your rights
You have certain rights with respect to your personal data. The rights will only apply in certain circumstances and are subject to certain exemptions. Please see the table below for a summary of your rights. Details of who to contact to exercise these rights can be found below (How to contact us).
| Your right | Summary |
|---|---|
| Right of access to your personal data | You have the right to receive a copy of your personal data that we hold about you and information about how we use it, subject to certain exemptions. |
| Right to rectify your personal data | You have the right to ask us to correct your personal data that we hold where it is incorrect or incomplete. |
| Right to erasure of your personal data | You have the right to ask that your personal data be deleted in certain circumstances. For example: where your personal data is no longer necessary in relation to the purposes for which it was collected or otherwise used. For example, you may no longer wish to act as your university’s representative; if you withdraw your consent and there is no other legal ground for which we rely on for the continued use of your personal data; if you object to the use of your personal data (as set out below); if we have used your personal data unlawfully; or if your personal data needs to be erased to comply with a legal obligation. |
| Right to restrict the use of your personal data | You have the right to suspend our use of your personal data in certain circumstances. For example: where you think your personal data is inaccurate but only for so long as is required for us to verify the accuracy of your personal data; the use of your personal data is unlawful and you oppose the erasure of your personal data and request that it is suspended instead; we no longer need your personal data, but your personal data is required by you for the establishment, exercise or defence of legal claims; or you have objected to the use of your personal data and we are verifying whether our grounds for the use of your personal data override your objection. |
| Right to data portability | You have the right to obtain your personal data in a structured, commonly used and machine-readable format and for it to be transferred to another organisation, where it is technically feasible. The right only applies to personal data you provided to us; where we rely on the following legal bases: consent; or for the performance of a contract; and when the use of your personal data is carried out by automated (i.e. electronic) means. |
| Right to object to the use of your personal data | You have the right to object to the use of your personal data in certain circumstances and subject to certain exemptions. For example: where you have grounds relating to your particular situation and we use your personal data for our legitimate interests (or those of a third party); if you object to the use of your personal data for direct marketing purposes; and where we use your personal data to take a decision which is based solely on automated processing where that decision produces a legal effect or otherwise significantly affects you. |
| Right to withdraw consent | You have the right to withdraw your consent at any time in the limited circumstances where we rely on consent to use your personal data. |
| Right to complain to the relevant data protection authority | You have the right to complain to the relevant data protection authority, the Information Commissioner’s Office (ICO), where you think we have not used your personal data in accordance with data protection law. The ICO’s contact details are: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF |
Third party links
Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for how they handle your personal data. When you leave our website, we encourage you to read the privacy notice of every website you visit.
Cookies
When you visit our website, we may store some information on your computer. This information will be in the form of a ‘cookie’ or similar file and can help us in many ways. For example, cookies allow us to tailor a website to better match your interests and preferences. With most internet browsers you can erase cookies from your computer hard drive, block all cookies or receive a warning before a cookie is stored.
This website uses:
The web statistics package we use on our site, Google Analytics, sets cookies to help us accurately estimate the number of visitors to the website and volumes of usage. This is to ensure that the service is available when you want it and fast.
For further details on the cookies set by Google Analytics, please refer to the Google Analytics documentation
Updates to our privacy Notice
We reserve the right to update this Privacy Notice at any time, and we will refer you to an updated notice when we make any substantial updates. The updated Privacy Notice will take effect as soon as it has been updated or otherwise communicated to you.
How to contact us
The DPO is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below:
Ed Hughes, CEO
Data Protection Officer
20 Tavistock Square, London, WC1H 9HD
ed.hughes@cod-health.ac.uk