Natural Products BioHUB Privacy Notice

Personal information that you supply to us will be held by NP BIOHUB, an operation funded by the UK Government through the UK Shared Prosperity Fund (UKSPF) awarded by City and County of Swansea (the Authority). UKSPF (the Funder) requires the operation to collect certain information for reporting and evaluation purposes. For data UKSPF requires, Swansea University and the Authority are data processors, and the Department for Levelling Up, Housing and Communities (DLUHC) is the data controller. For any additional personal data NP BIOHUB requires, Swansea University is the data controller.

The Data Protection Officer for Swansea University can be contacted through:

- dataprotection@swansea.ac.uk

The Data Protection Officer for the Authority can be contacted through:

- data.protection@swansea.gov.uk

- https://www.swansea.gov.uk/privacynotice

The Data Protection Officer for DLUHC can be contacted through:

- dataprotection@levellingup.gov.uk

- https://www.gov.uk/government/publications/uk-shared-prosperity-fund-privacy-notice/uk-shared-prosperity-fund-privacy-notice

NP BIOHUB at Swansea University will collect personal data that you provide to us in your interactions with the project (e.g. while participating in events, training, networking opportunities, collaboration, and other activities directly related to the project), and in response to evaluation and monitoring questions. This may include your name, address, telephone number or private email address if you have provided them, and employment costs if required as evidence of an enterprise’s financial contribution to a collaboration. Collective anonymous equal opportunities data relating to enterprise owners and managers may also be collected (e.g. gender, ethnic origin, age group, Welsh language competency, disability) if the data is requested by the Authority or Funder.

On occasion, you might supply your sensitive personal information in order to attend one of our events (e.g. accessibility or dietary needs). At our events we will usually have a photographer present taking general photographs used to promote the event. If you have a formal role at the event (e.g. a speaker), we will usually take photos of the presentation.

The purpose for collecting your personal information is:

(i) to evaluate eligibility for support from NP BIOHUB;

(ii) to provide you with a product or service as a result of your support from NP BIOHUB;

(iii) to monitor and evaluate our engagement with you;

(iv) to understand your requirements when you attend our events;

(v) in the case of photography, to illustrate the event in reporting to the Authority and on social media accounts and websites;

(vi) to keep in touch and inform you of other events, opportunities and highlights (includes “Direct marketing”, below);

(vii) to report to the Authority and through them the Regional Lead Authority and Funder

The lawful basis that applies to the processing of your personal data for purposes (i)-(vi) is Article 6 (1) (f) of UK-GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. A legitimate interests assessment has been carried out to ensure your personal data is used appropriately and in ways you would reasonably expect with minimal privacy impact.

The lawful basis that applies to purpose (vii) is Article 6 (1) (e) of UK-GDPR: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

In the interests of providing enterprises and individuals with an opportunity to benefit from NP BIOHUB by hearing about research and training activities and events, to learn from other business engagement activities across the university such as funding training programmes or graduate placements or to keep in touch with those enterprises or individuals with whom we have collaborated, the following information is collected, stored and used or otherwise processed by NP BIOHUB at Swansea University:

• Name and contact details of individuals who make enquiries via telephone, email or website and/ or who self-register for events and/or services; and
• Name and contact details of named individuals within organisations with whom we make contact by telephone, email or post where appropriate.

The lawful basis for collecting, storing and processing this data is Article 6 (1) (f) of UK-GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. A legitimate interests assessment has been carried out to ensure your personal data is used appropriately and in ways you would reasonably expect with minimal privacy impact. You have the right to object to processing for the purposes of direct marketing if you wish and will always be given the opportunity to unsubscribe to future communications.

Your personal information will be stored on our secure electronic systems and databases and will be shared with relevant colleagues within the university, including academic, technical and administrative staff and project governance boards.

Information about you will also be shared as permitted or required by law, on a considered and confidential basis, with a range of persons or organisations, including the following:

• the Authority, Regional Lead Authority and Funder
• on occasion, and where necessary, auditors
• subcontractors working with the project

You can contact NP BIOHUB at Swansea University to sign up for NP BIOHUB events. Events may also be advertised with external ticketing websites such as Eventbrite for event ticketing, which will handle your data in line with their own privacy policies.

The University will not transfer data to countries outside the UK.

We will hold the personal data you provided to us for a reasonable period of time upon the conclusion of the project to comply with regulatory audit and as long as necessary to maintain the relationship. Information held for research and archiving purposes may be kept for longer and in line with the UK-GDPR Article 89 safeguards.

Data Protection legislation requires us to keep your information secure. This means that your confidentiality will be respected, and all appropriate measures will be taken to prevent unauthorised

access and disclosure. Only members of staff who need access to relevant parts or all of your information will be authorised to do so. Information about you in electronic form will be securely stored.

You have a right to access your personal information, to object to the processing of your personal information, to rectify, to erase, to restrict and to port your personal information. If you have provided consent to NP BIOHUB at Swansea University to process any of your data, then you also have a right to withdraw that consent.

Please visit the University Data Protection webpages for further information in relation to your rights.

Any requests or objections should be made in writing to the University Data Protection Officer:

University Compliance Officer (FOI/DP)

Information Systems and Services

Swansea University

Singleton Park

Swansea SA2 8PP

Email: dataprotection@swansea.ac.uk

If you are unhappy with the way in which your personal data has been processed, you may in the first instance contact the University Data Protection Officer using the contact details above. If you remain dissatisfied, then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

www.ico.org.uk

Please advise of any changes to your name, address, contact details, and so on.

The consequences of not providing your information would mean that NP BIOHUB may not be able to interact with you in the activities undertaken by the project.

Any changes we make to our Privacy Policy will be posted on the project website or, where appropriate, you will be notified by email.