StoryFutures Audience Insight Panel

Privacy Notice

Introduction

This privacy notice relates to the information you provide to StoryFutures and StoryFutures Academy when you sign up to participate in audience insight panels through our website. The following institutions are joint data controllers for your personal data:

• Royal Holloway, University of London (“RHUL”)
• Brunel University London (“BUL”)
• The National Film and Television School (“NFTS”)
• University of the Creative Arts (“UCA”)

Royal Holloway and Bedford New College, also known as Royal Holloway, University of London, is the named controller for providing information about your personal data and will act in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 when controlling and processing your personal data.
This notice explains how we collect, use and share your personal data and your rights in relation to the processing of your data.

In this notice:

• ‘personal data’ means any data which can identify you directly or indirectly (whether by itself or when combined with other data), regardless of the format or media on which the data are stored. This includes data that can identify you when combined with other data that is held separately (pseudonymous data) but does not include data that has been manipulated so that you can no longer be identified from it (anonymous data).
• ‘processing’ means any activity relating to your personal data including collection, use, alteration, storage, disclosure and destruction.

What personal data will be collected

When you sign up to the website, you will have the option to provide the following information about yourself:

• Name
• Age
• Ethnicity
• Gender
• Country called home

We call this your profile data.

When you agree to take part in a specific study, the organiser of that study will provide you with information about how they will process any additional personal data collected from you in the course of the study. Where you have chosen to provide profile data, organisers will not receive your profile data directly but will know you meet the demographic criteria which they have set.

How and when do we collect your personal data?

We will collect your personal data when you provide it to us during the sign up to this website. You can update or remove this data at any time.

Why do we collect this data, how do we use it and what is our legal basis for doing so?

We collect your profile data for the purposes of demographic screening. This lets the organisers of projects make their questionnaires available to the audience they are trying to reach.
In circumstances where you have a genuine choice as to whether we should process your personal data, we will ask you for your consent. The method used to obtain your consent will depend on the scope and context of the processing that we propose.
You are not obliged in any way to provide us with your personal data to sign up to the website, but you may not be able to participate in certain studies if you do not.

How long will we retain your personal data?

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected and to satisfy any legal, regulatory, accounting or reporting requirements.

Specified retention periods are applied to each category of personal data that we may process about you. In setting these retention periods, the College has taken into account:

• the nature, sensitivity and volume of the personal data
• the potential risk of harm to you arising from the College’s continued retention of the personal data
• the purposes for which the College may process your personal data
• whether the College is required to retain any personal data by law or in accordance with its legitimate interests
• whether your data has been anonymised and is therefore no longer attributable to you as an individual, it may be kept indefinitely.

Sharing your personal data with third parties

Where StoryFutures uses third parties to process personal data on its behalf (acting as data processors), a written contract will be put in place to ensure that any personal data shared will be held in accordance with the requirements of data protection law and that such data processors have appropriate security measures in place in relation to your personal data.
Please note that in certain circumstances we may need to share your personal information with a regulator or to otherwise comply with the law.

International Data Transfers

Most personal data about you, including your personnel file, will be stored on servers within the UK or elsewhere within the European Economic Area (EEA).
On occasion it may be necessary for the College to transfer your personal data outside of the European Economic Area (EEA). This will only take place in circumstances where there are appropriate and adequate safeguards in place which incorporate appropriate assurances to ensure the security of the information and compliance with legislative and regulatory requirements.

How do we keep your personal data secure?

Royal Holloway has put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in any unauthorised way or altered or disclosed. In addition, Royal Holloway, on behalf of StoryFutures, limits access to your personal data to the persons and organisations, including those described above, who have a lawful and/or legitimate need to access it.
Royal Holloway has also put in place procedures to deal with any suspected personal data security breach and will notify you and any applicable regulator of a suspected breach where legally required to do so.

You and your data

You have a number of rights in relation to the processing of your personal data by StoryFutures:

• Access: You have the right to request access to and be provided with a copy of the personal data held about you together with certain information about the processing of such personal data to check that it is being processed lawfully and fairly.
• Correction: You have the right to request correction of any inaccurate or incomplete personal data held about you.
• Deletion: You have the right to request erasure of any personal data held about you where there is no good reason for us to continue processing it or where you have exercised your right to object to the processing of your personal data.
• Restriction: You have the right to request restriction of how your personal data is processed; for example, to confirm its accuracy or our reasons for holding it or as an alternative to its erasure.
• Objection: You have the right to object to the processing of any personal data which is based on legitimate interests or those of a third party based on your particular circumstances. You also have the right to object to StoryFutures processing your personal data for direct marketing purposes.
• Portability: In certain circumstances you have the right to receive or request a copy of your personal data for transfer in an electronic format .
• Complaints: You have the right to complain to the Information Commissioner’s Office (ICO) in relation to how the College processes your personal data. Our registration number with the Information Commissioner’s Office is Z7056965.

Royal Holloway may be entitled to refuse any request in certain circumstances and where this is the case, you will be notified accordingly.
Where the lawful ground relied upon to process any of your personal data is your consent, you have the right to withdraw such consent at any time without having to give any reason. However, if you do so, it may not be possible to provide you with some or all of the services you have requested.
You will not have to pay any fee to exercise any of the above rights, though Royal Holloway may charge a reasonable fee or refuse to comply with your request if any request is clearly unfounded or excessive. Where this is the case, you will be notified accordingly.
To protect the confidentiality of your personal data Royal Holloway may ask you to verify your identity before fulfilling any request in relation to your personal data.

Changes to this notice

We may update this notice at any time and may provide you with further notices on specific occasions where we collect and process personal data about you. You should check this notice regularly to take notice of any changes. Where any change affects your rights and interests, we will make sure we bring this to your attention and clearly explain what this means for you.

Questions or comments

If you have any questions or comments regarding this notice or you wish to exercise any of your rights you should contact our Data Protection Officer by email at dataprotection@royalholloway.ac.uk.
You also have the right to complain to the Information Commissioner’s Office and you can find more information on their website – www.ico.org.uk