Privacy Notice for Imperial College London 2eMPower Project

This Privacy Notice (Notice) explains how Imperial College London (the College, we, our, us) processes your personal data when you attend its events (including public lectures, demonstrations, competitions, tours of the College’s campus and facilities, and online events such as webinars (Event)) and your rights in relation to the personal data we hold.

For the purposes of any applicable data protection laws in England and Wales, including from 25 May 2018 the EU General Data Protection Regulation 2016/679 (GDPR), the College is the data controller of your personal data. The College has appointed a Data Protection Officer, who can be contacted via email at dpo@imperial.ac.uk, via telephone on 20 7594 3502 and via post at Imperial College London, Data Protection Officer, Faculty Building Level 4, London SW7 2AZ.

For more information about the College’s data protection policies please refer to our data protection webpage.

How your personal data is collected

The College collects your personal data from the following sources:

• from you, typically when you:
  • complete forms in relation to attending or participating in an Event, including buying or registering for tickets online;
  • attend and participate in an Event;
  • interact with one of our representatives or employees during an Event (for example when you sign up to a mailing list or enter a competition);
  • complete our surveys, feedback and sign-up forms;
  • communicate with us by post, email, online chat, social media, telephone or another format;

• visit the College’s website, including when you search, register or use our online payment/ticketing portals or sign-up for an event.

What categories of personal data are collected? 

We collect the following categories of personal data:

Identification and contact details

• biographical information such as your name, title, gender and date of birth;
• your image, audio and likeness (as captured on a webinar, in photographs or on recordings we make of the Event, and on CCTV where the Event is hosted at our premises);
• your contact details including address, email address, social media account details and phone number.

Online and transactional

• details of your IP address, browser type and operating system when you visit our website;
• events that you have attended in the past or for which you are registered to attend in the future;
• records of communications sent to you by the College or received from you.

We may also collect the following special categories of personal data where it is necessary for the purposes set out in this Notice (please also see the section on Special categories of personal data for details about how we process this data):

• information concerning your health and medical conditions (e.g. disability and dietary needs);
• diversity information about your racial or ethnic origin; religion or similar beliefs; and sexual orientation.

The basis for processing your data, how we use that data and with whom we share it

We will process your personal data either in ways you have consented to, or because it is otherwise necessary for a lawful purpose. We set these out as follows:

As part of the contractual relationship between you and the College (for example in relation to a ticket you have purchased)

In this respect we use your personal data for the following purposes:

• to deliver the Event you have registered for;
• to correspond with you about the Event, including sending you pre and post-event information.

As part of this process, we will expect to share your personal data with:

• our agents, contractors and service providers where applicable and only where it is necessary for them to receive the information;
• co-organisers or partners who are involved in the delivery of an Event.

Other legitimate interests

Your personal data will also be processed because it is necessary for the College’s legitimate interests or the legitimate interests of a third party. This will always be weighed against your rights, interests and expectations. Examples of where we process data for purposes that fall under legitimate interests include:

• sharing your information with sponsors of an event (except in circumstances where it is appropriate to gain your consent);
• filming, photographing or otherwise recording Events and publishing such content on our website, social media accounts and other formats where it would not be necessary, appropriate or practicable to obtain your specific consent (for example, we may seek specific consent for prominent or impactful uses, but typically not for group shots, background inclusion or internal use);
• analysing and improving the use of our website;
• processing feedback to improve the quality of our Events and marketing activities;
• marketing the College and its News and Events by post, telephone and electronic mail (but without prejudice to your rights under the legislation that regulates the sending of marketing communications by electronic means); and

In addition to those organisations named above, we will also share your personal data with:

• our agents and contractors where they require your personal data to perform the services outlined above; and
• direct mail agencies who assist the College in the administration of marketing communications.

Where you have consented

Your personal data will also be processed by the College where we have your consent or for those under the age of 13, the consent of your parent or guardian.

Examples where consent would be sought include where the law or some other protocol requires that the College obtains your consent (for certain marketing or fundraising communications).

Where applicable, consent will always be specific and informed on your part, and the consequences of consenting or not, or of withdrawing consent, will be made clear.

Special categories of personal data

In addition to the above, College may process types of personal data that the law considers to fall into a special category (such as race, religion, health, sexual life [or criminal record]). This will be under the following circumstances:

• where you have provided your explicit consent. Examples might include where you have provided information on your dietary requirements or where you inform us of the requirement for wheelchair access;
• where it is in your vital interests to do so and you are incapable of giving consent, for example to inform your specified emergency contact, the NHS or emergency services in the event of your illness or other emergency.

International transfers of data

The College will in limited circumstances disclose personal data to third parties, or allow personal data to be stored or handled, in countries outside the European Economic Area.  For example, where attendees / speakers are based outside the EEA

In these circumstances, your personal data will only be transferred on one of the following bases:

• where the transfer is subject to one or more of the “appropriate safeguards” for international transfers prescribed by applicable law (e.g. an approved certification mechanism such as Privacy Shield); or
• there exists another situation where the transfer is permitted under applicable law (for example, where we have your explicit consent).

Your rights under the Data Protection Legislation

Prior to 25 May 2018, you have the following rights:

• to obtain access to, and copies of, the personal data we hold about you. Further information of how to make such an application can be found at http://www.imperial.ac.uk/admin-services/legal-services-office/data-protection/subject-access-requests/ ;
• to require that we cease processing your personal data if the processing is causing you damage or distress;
• to require us not to send you marketing communications.

Once GDPR comes into force, from 25 May 2018 you will also have the following additional rights:

• to request that we erase your personal data;
• to request that we restrict our data processing activities in relation to your personal data;
• to receive from us the personal data we hold about you, which you have provided to us, in a reasonable format specified by you, including for the purpose of transmitting that personal data to another data controller; and
• to require us to correct the personal data we hold about you if it is incorrect.

Please note that the above rights are not absolute, and requests may be refused where exceptions apply.

If you have any questions about these rights or how your personal data is used by us, you should contact the Data Protection Officer using the details below:

• Post – Data Protection Officer

Address – Level 4 Faculty Building, Imperial College London, South Kensington, London, SW7 2AZ

• Email – dpo@imperial.ac.uk
• Telephone – 020 7594 3502

If you are not satisfied with how your personal data is used by the College you can make a complaint to the Information Commissioner (https://ico.org.uk).

How long is my personal information retained for?

Data relating to students will be held until they reach the age of 18, whilst information pertaining to related teachers, parents etc. will be kept in the same manner

Document last updated in May 2018.