Privacy policy

Who we are

"We” are ‘The Global Open Finance Centre of Excellence’ which are part of the University of Edinburgh which is a charitable body, registered in Scotland, with registration number SC005336, VAT Registration Number GB 592 9507. We are based in Bayes centre, 47 Potterrow, Edinburgh, EH8 9BT. The University of Edinburgh are registered with the Information Commissioner's Office (ICO); our registration number is Z6426984 and our Data Protection Officer (DPO) is Rena Gertz.

What personal data do we collect and how do we use it?

Our role
Data controller Direct from individual Name and job title; Company or organization; Contact information, including email address and telephone number(s); Demographic information such as postcode To communicate with you during business operations or reply to your enquiry Legitimate interest We use Pipedrive and Microsoft Office 365 as a assured processors, to communicate with business contacts 1 year with records routinely cleansed and aligned to data subject right
Data controller Direct from individual Name and job title; Company or organization; Contact information, including email address and telephone number(s); Demographic information such as postcode or preferences While running our organization and fulfilling contractual obligations, or on an ad hoc basis Contract We use Microsoft Office 365 and Monday.com as assured processors to operate our business 1 year with records routinely cleansed and aligned to data subject rights
Data controller Direct from individual Rich media: identifiable images or video content On our external communication platforms, such as our websites Legitimate interests Our website is built in WordPress and hosted on WP Engine 1 year with records routinely cleansed and aligned to data subject rights
Data controller Direct from individual Name, contact and professional information (within CVs) We limit processing to relevant vacancies, we do no hold CVs on file speculatively Legitimate interests We use Microsoft Office 365 to securely store files and communicate with prospective employees and contractors 2 years after vacancy closing date See University HR Retention Schedule
Independent data controller Indirectly, from Data providers De-identified financial data which has been adequately anonymized We use adequately anonymized data for research Legitimate interests The EPCC are our Data Processor; the EPCC are an accredited Data Processor under the Digital Economy Act 2017. The EPCC’s secure infrastructure is securely hosted in the UK. In alignment with the Data Sharing Agreement termination period, and no longer than 1 year

Cookies

Cookies are small text files that are placed on your computer by websites that you visit.; they are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. Necessary cookies enable core functionality such as security, network management, and accessibility. You may disable these by changing your browser settings, but this may affect how the website functions. 

We would like to set Google Analytics cookies to help us to improve our website by collecting and reporting information on how you use it. The cookies collect information in a way that does not directly identify anyoneCookies we use:

Cookie
Google Universal Analytics _ga, _gali, _gat, _gid These cookies are used to collect information about how visitors use our website. We use the information to compile insight reports and to help us improve the website. The cookies collect information in a way that does not directly identify anyone. Read more from Google (https://policies.google.com/technologies/cookies)
CloudFlare __cfduid These cookies are associated with sites using CloudFlare, used to speed up page load times. It does not contain any user identification information. Read more from Cloudflare (https://www.cloudflare.com/en-gb/privacypolicy/)

Your Privacy and Security, by Design

We will always protect and respect your privacy, and we are committed to security when it comes to your information. We promise that when we collect, process, store and share personal data we will do so safely and securely and on the basis of a Privacy by Design-driven approach. If we ever share your data with third parties, such as with government bodies for the purposes of research, we will anonymize data

Retention and storage

We only store your data for as long as is necessary for the purposes of processing that are set out in this policy and according to our retention schedules, after which it is deleted according to our data management processes. We have taken appropriate safeguards to require that the personal information we process will remain protected in accordance with this Privacy Notice when transferred internationally, including when processed internationally by our third-party service providers and partners.

Your rights

You have certain rights in relation to personal information we hold about you; details of these rights and how to exercise them are set out below. We will require evidence of your identity before we are able to act on your request.

· Right of Access: You have the right at any time to ask us for a copy of the Information about you that we hold, and to confirm the nature of the Information and how it is used

· Right of Correction or Completion: If Information we hold about you is not accurate, or is out of date or incomplete, and requires amendment or correction you have a right to have the data rectified, updated or completed

  • Right of Erasure In certain circumstances, you have the right to request that Information we hold about you is erased e.g. if the Information is no longer necessary for the purposes for which it was collected or processed or our processing of the Information is based on your consent and there are no other legal grounds on which we may process the Information
  • Right to Object to or Restrict Processing:. In certain circumstances, you have the right to object to our processing of your Information by contacting us at the address or email address set out below. For example, if we are processing your Information on the basis of our legitimate interests and there are no compelling legitimate grounds for our processing which override your rights and interests. You also have the right to object to use of your Information for direct marketing purposes.
  • Right of Data Portability: In certain instances, you have a right to receive any Information that we hold about you in a structured, commonly used and machine-readable format.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), who are the UK’s supervisory authority; their address is: Wycliffe House, Water Lane, Wilmslow SK9 5AF. Helpline number: 0303 123 1113. ICO website: https://www.ico.org.uk

We are also unable to comply with requests that relate to Information of others without their consent. You can exercise any of the above rights by contacting us at the address or email address set out below. Most of the above rights are subject to limitations and exceptions; we will provide reasons if we are unable to comply with any request for the exercise of your rights.

How to get in touch

If you want to know what information we collect and hold about you, or to exercise any of your rights as set out in section, please write to us at our company address or via email at [email protected] (please mark your correspondence ‘For the Attention Of’ FAO the Privacy team).

05/01/2021