Protecting your privacy is important to UCLB. We are committed to protecting all Personal Data provided to UCLB, whether by individuals with whom we do business, visitors to and users of our Website or otherwise. Personal Data is information which relates to an identified or identifiable living individual.
This Policy explains what Personal Data we collect, how we may use and manage it and the rights you have in relation to your Personal Data. Before you provide us with any Personal Data or browse our Website, you should read through this Policy in full and make sure that you are comfortable with our privacy practices.
Please note that our Website may contain links to other websites, operated by third parties. These third party sites are not subject to this Policy and we recommend that you check the privacy and security policies of each website that you visit. We are only responsible for the privacy and security of the Personal Data that we collect and have no control over the actions of any third parties in relation to your Personal Data.
Please refer to the Glossary below for an explanation of the defined terms in this Policy.
Whose Personal Data do we collect?
UCLB collects Personal Data from a range of individuals in the context of its business activities, including:
- representatives of our suppliers, customers and other business contacts;
- consultants and contractors;
- users of our Website;
- individuals who contact us by any means; and
- job applicants.
How we collect your Personal Data
We obtain Personal Data which you knowingly and voluntarily disclose to us, both in an online and offline context. Other types of information may be collected automatically from your device as you interact with our Website. We collect this Personal Data by using cookies and other similar technologies.
We collect Personal Data when you:
- visit our Website and / or complete one of our web forms;
- communicate with us in any other way;
- complete surveys issued by us;
- visit our premises;
- submit an order to us via XIP;
- report issues with using XIP.
We may also collect information received by us from third party sources, for example relating to your use of other websites which we operate and from related third parties such as sub-contractors.
What Personal Data we collect
UCLB may collect a range of Personal Data from you in a business context, such as your name, gender, job title, nationality, photographic identification, email address, home address and other contact details, details of your business and other interests, communications with you (including notes from meetings) and financial and payment information.
When you use our Website, we collect certain standard information that is sent by your browser to our Website. This includes technical information, such as your IP address, browser type, operating system, language, time zone setting, access times and any referring website addresses.
Sensitive Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health or medical conditions, genetic or biometric information, sexual orientation, or criminal convictions and offences may be processed by UCLB if such processing is necessary to comply with laws and regulations or where you consent for us to do so. For example, you may opt to provide us with certain Personal Data relating to your health, ethnicity or sexuality when you submit a copy of our Equal Opportunities Classification Form.
When you apply for a job via our Website or otherwise, we will collect additional more specific Personal Data about you, such as your qualifications, career history, third party references and interview notes. We may also ask you for other information, for example your interests and the types of jobs you are interested in. There will be circumstances where we collect and process Sensitive Personal Data as part of the recruitment process. For example, with your consent, we may collect information about your race, ethnicity, health and whether you have a disability, for the purposes of conducting equal opportunities monitoring. Any Personal Data you provide to UCLB in relation to a job vacancy will be processed in accordance with our Recruitment Notice.
The purposes and lawful bases for processing your Personal Data
We have set out in the table below, a description of the purposes for which we collect and process your Personal Data and the legal bases we rely on to do so. The legal bases that apply to our processing of your personal data are:
- Performance of a contract with you;
- Our legitimate interests;
- Your consent;
- Compliance with our legal obligations.
Where we are processing your Personal Data on the basis of our legitimate interests, we have identified the relevant legitimate interests.
Note that we may process your personal data on more than one lawful basis depending on the specific purpose for which we are using your data.
|Purpose/Activity||Lawful basis for processing including basis of legitimate interest|
|To provide you with information, products and services ordered by you (including via XIP).||Performance of a contract with you.|
|To improve the products and services that we offer, and the events that we manage and host.||Necessary for our legitimate interests (to develop our products/services and grow our business).|
||Necessary for our legitimate interests (to keep our Website updated, provision of administration and IT services, network security, to study how customers use our products/services and to develop our business).|
|To play video content via third party sites.||Necessary for our legitimate interests (to provide customers with information about our business).|
|To manage our internal recruitment processes.||Necessary for us to decide whether to enter into a contract of employment with you (performance of a contract with you).
Necessary for our legitimate interests (to manage and improve our recruitment practices).
|To enable us to monitor the implementation and impact of our equal opportunities policy.||(a) Consent;
(b) Necessary for our legitimate interests (to study how customers use our services and inform our strategy in relation to corporate social responsibility).
|To comply with applicable laws and regulations.||Necessary to comply with legal obligation.|
|Other business-related purposes, including negotiating, concluding and performing contracts including licence agreements, administering payments made to us, managing accounts and records, supporting corporate social responsibility activities, legal, regulatory and internal investigations and debt administration.
|(a) Performance of a contract with you;
(b) Necessary for our legitimate interests (for running our business); and
(c) Necessary to comply with a legal obligation.
Where you have consented to us doing so, we may send you email marketing communications, including invitations to events.
If you decide that you do not want to receive marketing communications from us, you can “opt-out” from receiving such communications by clicking on the “unsubscribe” link provided at the bottom of each commercial email and updating your preferences, or by contacting us at email@example.com.
Who we share your Personal Data with
UCLB may share your Personal Data with people within the company who have a “need to know” that data for business or legal reasons, for example, in order to carry out an administrative function such as processing an invoice, or to direct a query that you have submitted to the relevant department within UCLB.
We may disclose your Personal Data to third parties including: (i) public and government authorities; (ii) courts or regulators; (iii) UCLB’s professional advisors, such as lawyers, auditors and insurers; (iv) suppliers of IT services; and (v) third parties engaged by UCLB or with whom it otherwise has a business relationship, for the purposes of: (a) providing services requested by you; (b) enabling you to view third party video content; (c) protecting any intellectual property rights in any materials displayed on or otherwise available from UCLB’s Website; (d) seeking legal or other professional advice; (d) responding to a legal request or comply with a legal obligation; (e) enforcing UCLB’s Rules of Website Use; and (f) as may otherwise be necessary in connection with the processing purposes identified in this Policy.
We may disclose your Personal Data to third parties in the event that we sell, buy or merge any business or assets, including to the prospective seller or buyer of such business or assets.
We may share the Personal Data you submit to us with any entity within the UCL group. These entities are required to maintain the confidentiality of your data and are restricted from using it for any purpose other than the purposes set out in this Policy.
We may decide to allow our website users to share comments, posting, testimonials, or other information. If you choose to submit such information to us, the information that you submit may be available generally to the public. Information that you provide in these areas may be read, collected, and used by others who access it.
Finally, we may share non-Personal Data with other third parties that are not described above. When we do so we may aggregate or de-identify the information so that a third party would not be likely to link data to you, your computer, or your device. Aggregation means that we combine the non-Personal Data of numerous people together so that the data does not relate to any one person. De-identify means that we attempt to remove or change certain pieces of information that might be used to link data to a particular person.
Transfers of Personal Data
Please note that UCLB may transfer your Personal Data and/or store it outside the UK in order to operate our business, services or the Website.
Whenever we transfer Personal Data across borders, we take legally required steps to ensure that adequate safeguards are in place to protect your Personal Data and to make sure it is treated in accordance with this Policy. Where Personal Data is transferred outside of the UK, you can request a copy of the appropriate safeguards which we have put in place to protect your Personal Data and privacy rights in these circumstances, using the contact details set out in the ‘Questions and complaints’ section below.
UCLB takes all reasonable technical and organisational security measures to protect Personal Data from accidental or unlawful destruction, accidental loss and unauthorised access, destruction, misuse, modification or disclosure. We do our best to protect your Personal Data but unfortunately the transmission of information over the internet is not completely secure. We cannot guarantee the security of your Personal Data and any transmission of your data to UCLB is at your own risk.
In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions and are subject to a duty of confidentiality.
If we have given you (or where you have chosen) a password which enables you to access certain parts of our Website, you are responsible for keeping this password confidential. We ask you not to share this password with anyone. If you fail to keep your password confidential and this leads to a breach of security, we cannot be held accountable for the loss or other compromising of any Personal Data belonging to you.
Your Personal Data is not kept for longer than is necessary for the purposes for which it is collected. This means that data and records (including Personal Data) are destroyed or erased from our systems when no longer required. The amount of time that records are kept for varies depending upon the type of Personal Data they contain.
Applicable data privacy laws give rights to individuals in respect of Personal Data that organisations hold about them. If you wish to:
- request access to or a copy of the Personal Data that we hold about you; or
- request that we rectify or delete your Personal Data; object to / restrict the processing of your Personal Data; or request portability of your Personal Data,
- withdraw consent at any time where we are relying on consent to process your Personal Data (this will not affect the lawfulness of any processing we conducted prior to your withdrawal),
please submit your written request to our Data Protection Representative via firstname.lastname@example.org. We ask that you always inform us of changes to your Personal Data so that we can keep it up to date.
Questions and complaints
If you have a concern or complaint about this Policy or how UCLB has used your Personal Data, as a first step, you should raise this in writing with UCLB via:
Director of Legal Affairs
UCL Business Ltd
University College London
If you are not satisfied with the handling of your concern or complaint by UCLB, you can escalate this to the Information Commissioner’s Office (ICO).
Changes to this Policy
We reserve the right to modify or amend this Policy at any time by posting the revised Policy on our Website. It is your responsibility to review the Policy every time you submit information to us or place an order through XIP.
|Controller||A party that determines the purposes and means of data processing.|
|Personal Data||Information which relates to an identified or identifiable individual (i.e. data about UCLB employees, contractors, applicants, employees of vendors and suppliers, contractors, customers and individuals who use our Website or service centres). It includes names, addresses, email addresses, job applications, user account information, and correspondence. Personal Data can also include web browsing information (e.g. data associated with a particular cookie) and IP addresses, when such information can be linked to an individual.|
|Processing||Doing anything with Personal Data; this includes collecting it, storing it, accessing it, combining it with other data, sharing it with a third party, or even deleting it.|
Last updated: 17.05.2023