Data Protection Privacy Notice: DG Cities Research Participants
As a research company and provider of research insights, we take privacy and data security very seriously, and believe that everyone’s personal data should be handled responsibly and ethically.
If you’d like help understanding this privacy notice please contact us at [email protected].
What this notice covers
This notice describes:
● The personal data we may collect from you;
● How and why we use your personal data;
● The rights and choices you have when it comes to your personal data.
DG Cities is the controller of your personal data. This means we choose why and how that data is processed. We are based at 1st Floor Incubation, Ravensbourne University London, 6 Penrose Way, Greenwich Peninsula, London, SE10 0EW.
Personal data that we collect
Data that we collect from you
When you join participate in our research you will share with us different types of data, for example:
● When you participate in a research survey we collect contact details, such as your name, email and postcode, demographic data, such as your age, gender, and ethnicity.
● When you participate in an online or face-to-face focus group or interview we collect your opinions on the research topic. We may also record these interviews with you, but in such cases you will be given full information about the research project and the opportunity to opt out.
Special categories of personal data
Data protection law describes some data as ‘sensitive’, or ‘special categories of personal data’, such as your racial or ethnic origin or information concerning your health or sexual orientation. We use this information in the same way we use all the other information we collect, but we need your permission to do so. You can opt not to provide this information to us.
How long we’ll keep your data
We will only retain your personal data for as long as we need to in order to fulfil the needs of the project which are described to you when you agree to participate, or until you ask us to delete your data.
This means that we’ll keep most of your personal data for the length of the project, and will keep anonymised data for up to 3 years. We will, however, delete some types of data after a much shorter time. For example, if you participate in any recorded interviews, we will delete any video footage as soon as it is no longer needed by our researchers to complete the project and will only store anonymised transcribed data sets.
How and why we use your personal data
We use the data that you share with us for our research projects, which can be for government projects, academic partners or clients we are working with. We process your personal data on the grounds that our processing is necessary for legitimate interests we pursue as a business, namely that our business relies on our ability to develop research insights from the participants that we work with.
The exceptions to legitimate interests being the grounds for processing are:
● Consent: We will always ask for your consent when –
○ Using special categories of data (as described above);
○ Sharing personal data with our clients or partners; and
○ Collecting specific types of data from you (and we would always make clear at the time we ask for consent which data are involved and the purposes those data would be used for).
● Processing is necessary for the performance of a contract.
We use personal data to:
● Produce aggregated and anonymised research reports: We use research data to write articles that may be published on our website, or included in news articles on third-party websites. We will never reveal your identity in these publications without your consent.
● Improve our research methods: we use research data to make sure our research methods work and engage diverse groups of people.
When we work with other companies to collect data, such as survey providers, we always put in place a data processing agreement to ensure your data is protected.
How we store and protect your personal data
We do everything we can to protect your personal data. We do this by:
● Hosting data on protected Google Cloud servers
● Ensuring no attributable (e.g. named) data is saved for analysis
● Regularly deleting data which has identifiers in it (such as names)
● Ensuring our team understands how to protect your data.
● Working with our data processor partners to ensure we follow the best quality standards in managing your data.
Your rights
Your rights over the data we store about you are designed to give you more control over your data:
● The right to request access to personal data: you can request confirmation that we are processing your personal data, and a copy of the data we hold about you. If your data has been anonymised we are not able to do this.
● The right to rectify errors in your personal data: you can ask us to correct any inaccuracies in the data we store about you.
● The right to request your personal data be destroyed: you can ask us to delete any personal data about you. We cannot do this once your data has been anonymised and aggregated into a larger data set.
● The right to withdraw consent: you can change your mind at any time about participating in our research and withdraw your consent.
● The right to request how we process your personal data: you can request that we restrict our use of your personal data to storage only, that we stop using it for all other purposes, or that we retain data that was due for deletion.
● The right to object to the processing of personal data: you can object to certain types of processing of your personal data in certain specific circumstances.
● The right of data portability: when you give your consent for us to use your personal data you have the right to receive a copy of your personal data.
Exercising your rights
You can exercise your rights by getting in touch with us on the contact details below. We may contact you to request further information to authenticate your identity (because we want to make sure it is actually you requesting your data) or to help us to respond to your request. Except in rare cases, we will respond to you within 1 month of receiving this information or, where no such information is required, after we have received full details of your request.
You can contact us on the information at the bottom of this page.
Lodging a complaint with a regulator
You have the right to lodge a complaint with a data protection regulator in Europe, in particular in a country you work or live, where your legal rights have been infringed or where your personal information has or is being used in a way that you believe does not comply with data laws. The Information Commissioner’s Office (“ICO”), the UK’s independent regulatory body that upholds information rights includes information about how to raise a complaint on their website: www.ico.org.uk .
How to contact us
If you have questions about this notice, or about how we collect, store and use personal data, you can contact us on:
Email: [email protected]
Mail: 1st Floor Incubation, Ravensbourne University London, 6 Penrose Way, Greenwich Peninsula, London, SE10 0EW.
Updates to this notice
This notice was last updated on 29/07/2021. While we reserve the right to change this notice at any time, if any material changes are made we will let you know via email or any other appropriate means to give you the opportunity to review the changes before they become effective.