Market Research and Insight Privacy Notice

Source: https://warwick.ac.uk/services/legalandcomplianceservices/dataprotection/otherprivacynotices/marketresearch/ Parent: https://warwick.ac.uk/services/legalandcomplianceservices/dataprotection/otherprivacynotices/

• About this notice
• Why we collect your personal data
• Processing of your personal data
• How we collect your personal data
• Sharing of your personal data
• Keeping your personal data secure
• Retention of your personal data
• Data subject rights
• Who to contact and complaints
• Changes to this Privacy Notice

About this Notice

The University of Warwick, a royal charter company with registered number RC000678.

The University of Warwick’s Market Research and Insight (MR&I) team is committed to undertaking market research to the highest standards of integrity, in line with the Market Research Society (MRS) Code of Conduct and in compliance with the relevant data protection legislation: the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018 (DPA).

This privacy notice sets out, who the University’s MR&I team are, how and why we collect, store, use and share personal data, when we delete or anonymise your data and your rights in relation to your personal data and on how to contact us and supervisory authorities if you have a query or complaint.

Under UK GDPR, personal data is defined as any information relating to an identified or identifiable natural person (also known as a data subject), an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier. Personal data identifiers can include basic identity information e.g. name, email address, personal address, date of birth, ID numbers, web data such as location, IP address, and Cookie tags. Under the UK GDPR there are “special categories” of more sensitive personal data which require a higher level of protection e.g. ethnicity, sexual orientation, data concerning health and other more sensitive personal data.

In the UK the Information Commissioner's Office (ICO) is an independent authority which upholds the UK legislation relating to Data Protection and other public information rights.

Why we collect your personal data

The University’s MR&I team generate insight into our stakeholders, to better support decision-making, and to improve the experience of our key audiences, whether this be students, staff, or the general public. We also undertake market research and analysis to inform the University’s understanding of market demand and competition, for student recruitment but also for businesses which operate within the University.

The legal basis under which we will process your personal data for market research is called Article 6 (1.f) ‘Legitimate interests’: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. We may also process your personal data where it concerns your image e.g. video or photographs with your consent (Article 6 (1.a)).

Processing your personal data

With regards to the processing of your data, in most cases The University of Warwick will be classified as the ‘Data Controller’. This means that we will be responsible for deciding how your personal information is collected, used, processed, shared, archived, anonymised and deleted.

How we collect your personal data

All market research activity at The University of Warwick is undertaken voluntarily. When you take part in a market research project, for example, a survey, focus group or as part of our Student or Staff Insight panels, you will provide your data to us as part of that exercise. In some instances we may send you a personal link which can also pass your ID and demographic information. This data is only used for the purpose of ensuring that we understand the experiences of our different stakeholders, in order to improve the University’s offer and ensure that equal opportunities are available to all.

Sharing of your personal data

The University will use your information only for the purposes of market research and we will not use your information or contact you for any purpose other than research unless you have agreed to this. We do not sell or rent your information to third parties. We do not share your information with third parties for marketing purposes.

The privacy of your personal data is extremely important to the MR&I team, we operate within the MRS Code of Conduct, and undertake regular training. Your responses are treated anonymously and you will not be reported on individually at any stage, your name will never appear on any reports. However, if your responses give us reason to be concerned about your wellbeing, or if there is a safeguarding concern, we may contact you to provide sign posting for support services. This would be treated confidentially and would not affect you, your results or your course in any way.

The University may sometimes use products or services provided by third parties in order to collect your data. For example, Qualtrics (a survey tool), Qualzy (a qualitative research platform). In these instances we have Data Processing agreements in place, and we have undertaken rigorous checks that they operate to the highest standards of data security. In these situations, the University, as the Data Controller, remains responsible for your personal information.

Keeping your personal data secure

The University has robust physical and technical procedures in place to protect your data. The MR&I team also have in place policies and procedures that tell our staff how to collect and use your information safely and provide training to ensure our staff understand the importance of data protection.

Where we engage a third party to process personal data, we will take every available action to ensure that they have appropriate security measures – both technical and physical, in place.

Retention of your personal data

The UK GDPR and DPA 2018 requires that personal data should be kept for no longer than is necessary for the purposes for which the personal data are processed.

The MR&I team will not keep your information for longer than is necessary for the purposes of the project and all personal data will be anonymised, by removing identifying information where possible. It will not normally be possible to withdraw your data after this point.

Data subject rights

Under the UK General Data Protection Regulation (UK GDPR) you have a number of rights regarding your personal data. The following information identifies each of these rights and how The University of Warwick’s MR&I team apply these rights to your personal data.

You have the right to:

• Be informed of how we collect and use your personal data.
• This privacy notice sets out how the MR&I team do that.
• Access your personal data (also known as a subject access request).
• The MR&I team will provide your data through the University’s established processes.
• Require us to correct any mistakes in the data we hold about you.
• Where you tell us that the information we hold on our records about you is incorrect, we will update the data as quickly as possible, and no longer than one month after you have let us know.
• Require the erasure of personal data concerning you in certain situations.
• Where you request that we remove your personal data from MR&I records we will do that as quickly as possible. Where data has already been anonymised, it will not be possible to remove your data after that point.
• Restrict our processing of your personal data in certain circumstances.
• The MR&I team will automatically restrict the processing whilst we consider the accuracy of the data or the legitimate grounds for processing the personal data in question.
• The right to data portability – i.e. to receive your personal data in a way that makes it easy to move.
• This right only applies when the lawful basis for processing personal data is consent or for the performance of a contract. As the MR&I team use legitimate interest as our lawful basis, this right does not apply.
• Object to processing of your personal data for direct marketing.
• The MR&I team do not use any personal data for direct marketing purposes.
• Object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you.
• The MR&I team do not take any decisions by automated means, including profiling as part of automated decision making.

Who to contact and complaints

We hope that this document sets out how the MR&I team use your data. However, if you have any queries, concerns or complaints the University’s Data Protection Officer (DPO) can be contacted via email at infocompliance@warwick.ac.uk or write to: The Data Protection Officer, University of Warwick, University House, Kirby Corner Road CV4 8UW.

The UK GDPR and DPA 2018 also gives you the right to lodge a complaint with the Information Commissioner who may be contacted at https://ico.org.uk/concerns

Changes to this Privacy Notice

This privacy notice was published on 12 July 2023