Key details 

For everything included in this privacy policy, unless stated otherwise, the details of the data controller are: 

British Science Association 

165 Queens Gate 

London 

SW7 5HD 

 

Our ICO registration number is: Z7505720

Policy summary

This privacy notice tells you what to expect when the British Science Association (BSA) collects personal information from you. This includes our sub-brands including the CREST Awards, British Science Week, British Science Festival, Science, Not just for scientists, Science Live, UK Science Festivals Network and Huxley Summit.

 It applies to information we collect about:

This policy outlines:

  • Your rights, including details on whether you (the data subject) are obliged to provide the personal data and what will happen if you do not provide it
  • The data we collect
  • The purposes of our collection of data, and our Lawful basis for processing the data for doing so
  • Whether we share the data with anyone else
  • Details of any transfer of your personal data to a third country
  • What to do if you have a complaint about this privacy notice, and details of the right to lodge a complaint with the supervisory authority
  • Access to personal information
  • The identity and contact details of our Data Protection Lead
  • Changes to this privacy notice

Table of Contents

Your rights

Security

Visitors to our websites

Use of cookies by the BSA

People who contact us via social media

People who email us

BSA Events

People who make a general complaint to us about any of our services

People who use our services or take part in our programmes

Communications

Newsletters and Marketing

Journalists

Financial payment record

Cultural Development

Media Fellowship

Access Labs

Science, not just for scientists website

Huxley Summit

All-Party Parliamentary Group on Diversity and Inclusion in STEM

Development and Fundraising

Affiliate membership scheme

Development and Fundraising

Education

BEIS Underrepresented Audiences Grants

CREST Award Entries

CREST Youth Panel

CREST Assessors

CREST Teacher Advisory Network

CREST Silver Impact Trial

British Science Week Poster Competition

British Science Week Event Pledges

British Science Week Kick Start Grants

Engagement

British Science Week and Festival Community Grants

British Science Festival Speakers/Organisers

British Science Festival Attendees

British Science Festival Award Lectures

UK Science Festivals Network

UK Science Festivals Network – Public Engagement Projects

Science Live

Branches

Run to the Deep and Run the Solar System

Complaints or queries

Access to personal information

What can you tell me about the data you have about me?

When will the information be provided?

How will the information be provided?

How to contact us

Changes to this privacy notice

Your rights

As a Data Subject you have the following rights. Some are dependent on our lawful basis for processing your data:

  • The right to be informed
  • The right of access
  • The right to rectification
  • Rights in relation to automated decision making and profiling.

If you would like any information or to exercise any of these rights please either visit the Information Commissioner’s website or email [email protected].

Security

To keep your personal data secure, we maintain physical, technical and administrative safeguards. We update and test our security technology on an ongoing basis. We store your data in a secure cloud-based service which requires ‘two step authentication’ to prevent unauthorised access.

We restrict access to your personal data to only those employees and contractors who need to know that information. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information.

CREST

The my.crestawards.org (run by SOON_) service is hosted within a secure private virtual network which cannot be directly accessed via the internet unless through SOON_'s public load balancer (accepting only HTTP traffic) or via a VPN account. This means the servers are protected from brute force attacks since they cannot be directly accessed. Further to this SOON_'s Database holding confidential user data also resides within the private network and also cannot be accessed over the internet, only servers within our network can connect to it. Also the database is username/password protected and only the technical team within SOON_ has direct access to the database (required for maintenance). We run a production battle tested and proven linux based operating system which is automatically patched with the latest security updates. Each server we run can only be accessed directly from the internal private network over SSH (Secure Shell) with a username and strong password, only SOON_'s development team have accounts to these servers.

Transfer of your personal information outside the European Economic Area

By the nature of the Internet it is possible that the personal information you provide to the BSA may be transferred to countries outside the European Economic Area (EEA). For example, some of our suppliers including Stripe and Mailchimp may run their operations outside the European Economic Area (EEA). We will take steps to try to ensure that they provide an adequate level of protection in accordance with the GDPR.

Visitors to our websites

When someone visits www.britishscienceassociation.org, www.britishsciencefestival.org, www.crestawards.org, www.huxleysummit.org, www.notjustforscientists.org,   www.sciencelive.net, www.sciencefestivals.uk, www.britishscienceweek.org and www.eventbrite.co.uk/o/british-science-association-9815087013 we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to track data, such as the number of visitors to various parts of the site. This information is processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it. See Google’s Privacy Policy here.

Use of cookies by the BSA

www.britishscienceassociation.org and all our affiliated websites use cookies.

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity.

For further information, visit www.aboutcookies.org or www.allaboutcookies.org. You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

Links to third party websites

The BSA is not responsible for the privacy notices and practices of other websites even if accessed using links from our website. We recommend that you read their privacy policies and have linked to them in this privacy information where we can.

People who email us

We encourage people who contact us via email to never share any personal data in an email. Instead, we encourage people to use password protected files and send them via a secure server like WeTransfer.

If you email us any personal data, it may also be stored on our email servers for up to one year. We make every possible effort to keep your data as safe as possible, and any data that is stored on our systems require two-factor authentication to access it. If the data is also for another programme, e.g. the CREST Awards, please see the relevant section below on how your data may be stored and processed.

Events

For the majority of the BSA's events we use website sign ups to express interest and do not use a third party. However, for ad-hoc events or events run by our Branches, we may use Eventbrite. Please see Eventbrite's privacy policy here. If you do not wish to enter your details on Eventbrite but would still like to book at ticket, please email us at [email protected]

People who make a complaint to us about any of our services

When a complaint has been made we will create a secure file containing the details of the complaint. This usually contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the necessary personal information to process the complaint through our standard complaint procedure. Our complaint procedure is used to check on the level of service we provide and make decisions to improve where possible. We do compile and publish statistics showing information like the number of complaints we receive, but not in a form which identifies anyone.

In most cases, we will disclose the identity of the complainant to the member of the staff the complaint is about or the most relevant member of staff, in case of a dispute regarding the accuracy of the complaint. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in secure files in line with our data retention policies. This means that information relating to a complaint will be retained for 2 years. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle. 

Similarly, where enquiries are submitted to us, we will only use the information supplied to deal with the enquiry and any subsequent issues, and to check on the level of service we provide.

People who use our services or take part in our programmes

This section is a composite of the privacy policies for each of our programmes. If you sign up for a programme and opt in for a newsletter, then you will need to look at both sections of this privacy information that refer to the specific programme and our general marketing. For example, if you sign up to the CREST Awards and tick that you would like to receive our Educators newsletter, then you will also be added to our marketing list and should also look at the marketing section of this notice.

Communications

Newsletters and Marketing

Lawful basis for processing the data

  • Consent

Collection purpose

  • If you have opted in for one of our newsletters (BSA, Educator, Partner or Branches) you will receive this newsletter, which will include updates on our work, special offers, details of events and details of related work from our partners.

Data held

  • We collect your name, email address and occasionally a postal address. This only applies to the data we have for our newsletters, even if you signed up for another service while explicitly opting in for the newsletter

How we collect the data

  • This data is collected via online forms and through programme opt-ins. If you sign up for our newsletter via one of our programmes, then you are agreeing for your name and email address to be transferred to our marketing lists, for the purpose you consented to.

Retention period

  • If you have signed up to a newsletter, your email address and name will be stored on Dotmailer for 2 years since your last open.
  • Your data may also be stored on our Customer Relationship Management system ThankQ for up to 2 years. ThankQ's privacy policy can be found here.
  • We do not send any of our marketing information to third parties, and the data is only shared internally if necessary and in compliance with data regulations.

Shared with a third party?

  • We use a third-party provider, Dotmailer, to deliver our monthly e-newsletters. We gather statistics about email opening and clicks using industry standard technologies, including clear gifs to help us monitor and improve our e-newsletter. For more information, please see Dotmailer’s privacy policy.
  • We may also store information on ThankQ. ThankQ's privacy policy can be found here.

 

Journalists

Lawful basis for processing the data 

  • Legitimate interests and consent.

Collection purpose

  • We collect this data to maintain a relationship with the media, and ensure our work is given as high of a profile as possible.

Retention purpose 

  • We retain the contact details to maintain relationships for future relevant work.

Data held 

  • Name, contact details, place of work, previous work experience, social media

How we collect the data 

  • We do not retain a lot of data on our servers, instead using a third-party service, Gorkana, to collect contact details. In this case we are the data processor, as we only use the data for the agreed purpose.
  • Some data is received either via contact with journalists who get in touch with us, or sometimes through an online search. We only collect the data of and contact people who would reasonably expect this as part of their professional role.

Retention period 

  • Three years for the data we have on our servers.

Shared with a Third Party?

  • We share data with the university hosting the British Science Festival and the PR agency that we work with throughout the year on various projects

 

Finance

Financial payment record

Lawful basis for processing the data

  • Legitimate interests, consent and legal obligation

Collection purpose

  • We collect financial data for many of our programmes, including the CREST Awards and our Grant schemes. These details are used to either take or make payments to or from our

Data held

  • Name, email, postal address, banking details, phone number

How we collect the data

  • Online, emails, and hard paper copies

Retention period

  • Paper records are kept for 1.5 years in the office.
  • Archived paper data is held for 6 years in line with HMRC requirements
  • Some financial data is kept on our Customer Relationship Management system ThankQ for 6 years or for as long as your membership or direct debit lasts. If we have received Gift Aid from you, we are required to keep the data for up to 6 years.

Shared with a Third Party?

  • Accountant and auditor (access via Sage and cloud-based service only
  • Archive provider
  • ThankQ's privacy policy can be found here.

 

Cultural Development

Media Fellowship

Lawful basis for processing the data

  • Consent (and explicit consent where required)

Collection purpose

  • We collect data to enable us to select Fellows and communicate with successful applicants. We collect nationality and age for recruitment purposes
  • We collect sensitive data (race/ethnicity) for monitoring and evaluating the application process to improve it in the future, but this is only analysed anonymously.

Retention purpose

  • Demographic data is required for reporting purposes as part of grant funding. Any data used for reporting will be anonymised.
  • We hold personal contact details to maintain relationships with Media Fellow alumni. Alumni can opt out of this communication if they wish

Data held

  • Unsuccessful applicants - name, email, postal address, telephone, age range, ethnicity, gender
  • Successful applicants - name, email, postal address, telephone,, ethnicity, gender

How we collect the data

  • Microsoft forms

Retention period

  • Successful applicants - five years for name and contact details. We renew this consent for contact on a regular basis to ensure that people would still like to hear from us.
  • Unsuccessful applicants – six months
  • Anonymous diversity data of all applicants is retained for six

Shared with a Third Party?

  • We do not provide any personal information to third parties, except anonymised data for reporting purposes.
  • We source our Media Fellows through an open call via universities and societies. The data of shortlisted candidates is provided to us by universities and societies, including anonymised diversity data.

 

Access Labs

Lawful basis for processing the data

  • Consent

Collection purpose

  • Administering and evaluating the programme

Data held

  • Applicants name, email address, employer, town of residence
  • Anonymous diversity data: age range, gender, ethnicity, disability status

How we collect the data

  • Microsoft Forms

Retention period

  • Unsuccessful and successful applicants’ data will be held until 31 March 2019 or the duration of involvement in the project (max. 12 months)

Shared with a Third Party?

  • Shared with project partners (Natural Environment Research Council and FoAM) subject to a data processing agreement

 

Science, not just for scientists website

Lawful basis for processing the data

  • Consent

Collection purpose

  • Crowdsourcing ideas from the public about how science can belong to all of us
  • We use email addresses to contact individuals for idea submissions
  • Other details are used to provide further information for visitors to the website

Retention purpose

  • To consider the ideas and get in touch if they are successful.

Data held

  • Name, email
  • For successful ideas – name, institution, image

How we collect the data

  • Online web forms

Retention period

  • Four years

Shared with a Third Party?

  • No

 

Huxley Summit

Lawful basis for processing the data

  • Legitimate interests and consent

Collection purpose

  • A public search is used to find suitable contacts from organisations who would be interested in attending. Only people who would reasonably expect to be contacted in this regard are approached.
  • We collect address and email information to post and email invitations to the Summit.

Retention purpose

  • Communications regarding the event they signed up for.

Data held

  • Name, email, postal address, telephone, organisation and job title

How we collect the data

  • Online sign ups via the Huxley Summit website
  • Online via email

Retention period

  • Four years

Shared with a Third Party?

  • Name, organisation and job title of attendees are included in the programme delegate list which is shared with attendees.

 

All-Party Parliamentary Group on Diversity and Inclusion in STEM

Lawful basis for processing the data

  • Consent

Collection purpose

  • For sensitive data such as political views, our Lawful basis for processing the data is that it relates to personal data which are manifestly made public by the data subject. (E.g. politicians)
  • We collect contact details from our members, sponsors, advisory group members, and people who sign up to the mailing list, so they can be informed of future APPG meetings and updates

Retention purpose

  • Retained to send updates for those who have signed up to the mailing list,
  • Retained to maintain details and contact of those on our advisory panel, and those who are members of the APPG.

Data held

  • We collect the name and email of sponsors, newsletter sign ups, members of the advisory group and MPs. We also have the political affiliation of the MPs who are members.

How we collect the data

  • We collect the data through sign ups via the British Science Association website, networking, referrals and through some public searches (e.g. to get in touch with an MP.)

Retention period

  • Five years

Shared with a Third Party?

  •  Names and organisations of attendees will be shared with attendees.

 

Development and Fundraising

Affiliate membership scheme

Lawful basis for processing the data

  • Consent

Collection purpose

  • We gather financial information to collect membership fees
  • To become an Affiliate organisation, the organisation will provide contact data to receive the BSA newsletter.

Retention purpose

  • To maintain relationships with existing Affiliates

Data held

  • Name, email, postal address, telephone, financial

How we collect the data

  • We no longer collect data for this programme.

Retention period

  • Three years
  • Financial data is deleted after six months but may be retained by our finance team for longer due to legal reasons. See the financial section of this privacy notice.

Shared with a Third Party?

  • No

 

Partnerships and Fundraising

Lawful basis for processing the data

  • Legitimate interests and consent

Collection purpose

  • We collect data to build partnerships with organisations which have similar goals to the British Science Association. Personal data is collected to ensure we contact the most relevant person at these organisations.
  • We may collect financial information to collect payments

Retention purpose

  • To contact previous partners for fundraising and networking purposes

Data held

  • Name, email, postal address, telephone, some financial data

How we collect the data

  • Data is collected through networking, where consent is provided through verbal agreement and the subject sharing their email address.
  • Contacts may also be passed on through email networking, but only where someone would reasonably expect this.
  • Our development team may search online for appropriate companies and contacts to get in touch with. This is a tailored and considered approach, and only people who would expect to be contacted and would have a reasonable interest in our work will be contacted.

Retention period

  • Three years from last contact
  • Financial data is deleted after six months but may be retained by our finance team for longer due to legal reasons.. See the financial section of this privacy notice.

Shared with a Third Party?

  • No

 

Education

BEIS Underrepresented Audiences Grants

Lawful basis for processing the data

  • Consent

Collection purpose

  • Email and phone details are collected for communication purposes and for contact during the application process
  • We collect financial details to make grant payments to successful applicants

Retention purpose

  • To keep in touch with teachers until their CREST projects have been completed and they have finished the evaluation.

Data held

  • Teacher name, email, school/organisation’s postal address, telephone, financial

How we collect the data

  • Through an online on Google forms. See Google’s Privacy Policy here.

Retention period

  • Three years from application
  • Financial data is deleted after six months but may be retained by our finance team for longer due to legal reasons. See the financial section of this privacy notice.

Shared with a Third Party?

  • No

 

CREST Award Entries

Lawful basis for processing the data

  • Consent and explicit consent (where needed).

Collection purpose

  • Account owner names and email addresses are collected for operational communications. Account owners are teachers and students (students are expected to be over 16). Address is collected to deliver certificates.
  • Student ethnicity, gender, disability and age data are held (when provided) and used for anonymised diversity analysis
  • Student names are used for certificate printing to record the student’s achievement of the Award

Retention purpose

  • To keep in touch with and maintain a record of teachers and students who have taken part in the Awards, so we can verify the date of the award if asked by the student in the future.
  • For future reporting purposes, e.g. a CREST impact report may be based on ~9 years of historical data
  • We ask for sensitive data such as ethnicity and disability for diversity monitoring purposes and analyse this data anonymously. Educators are not required to submit this information if they would prefer not to. We are working on revising the website to allow educators to submit this data in such a way that it is separated from student names.

Data held

  • Data on teachers who have submitted students for Discovery and Bronze awards – name, email, role, certificate delivery address
  • Data on teachers who have submitted students for Star, SuperStar, Silver and Gold awards – name, email, certificate delivery address
  • Data on students submitted for Discovery and Bronze awards – name, gender. ethnicity, disability, date of birth, school, 
  • Data on students submitted for Silver and Gold awards – name, email, age, gender, ethnicity, school, certificate delivery address, certificate delivery address

How we collect the data

  • A teacher or student (expected to be over 16) signs up as a project owner to enter students for CREST Awards via the CREST website
  • For Discovery and Bronze - on line via My.CREST - a bespoke platform owned by the BSA
  • For Star, SuperStar, Silver and Gold - on line via Fluid Review – a platform owned by SurveyMonkey. View Survey Monkey's privacy policy here. 

Retention period

  • Student data is nine years and teacher data is five years.
  • Data on students who did CREST awards (and their teachers) prior to September 2017 is stored on our legacy database, which is held within a secure office and only accessible by a small number of BSA staff. Data which is beyond the retention periods is not processed but may be stored until we disable the database in late 2018.
  • Some financial data will be stored for up to 6 years, including name, email address and bank details. This will only be retained due to legal requirements. See also the financial section of this privacy notice. 

Shared with a Third Party?

  • Users submit data online via CREST website. This is accessible to the website developer for my.crest and Survey Monkey (who own FluidReview). View Survey Monkey's privacy policy here. 
  • Student names and certificate delivery address for Discovery, Bronze, Silver and Gold is sent to our printer to print CREST certificates.
  • We use Xero to manage the CREST Award finances. Some data is transferred to Xero for the purposes of administering the CREST Awards. You can find Xero's privacy policy here. 
  • We use a Stripe integration to allow card payments for the CREST Awards. You can find Stripe privacy policy here.

 

CREST Youth Panel

Lawful basis for processing the data

  • Consent

Collection purpose

  • We collect the data to assess if someone is suitable to join the panel, and to ensure we have parental consent for them to join.
  • We collect gender and geography (postcode) to monitor and develop the diversity of the Youth Panel and to understand if it represents to makeup of CREST students more widely.

Retention purpose

  • To maintain communications with the Youth Panel members

Data held

  • Parent name and contact details, student name, email, date of birth, postcode and gender

How we collect the data

  • Through application forms emailed to the BSA staff member responsible for the panel

Retention period

  • Two years after leaving the panel.
  • Unsuccessful applicant data is securely destroyed immediately

Shared with a Third Party?

  • No

 

CREST Assessors

Lawful basis for processing the data

  • Legitimate interests, consent, and necessity due to contractual obligations.

Collection purpose

  • Name, email and phone details are collected for communication purposes and for contact during the assessing process.
  • We also collect details of experience that relates to the role the applicant is applying for. This may include previous or current jobs.
  • We collect gender for diversity monitoring

Retention purpose

  • We need to communicate with assessors we contract to deliver a service

Data held

  • Name, email, gender, experience, financial data (for successful applicants).
  • Name, email, gender, experience (for unsuccessful applicants)

How we collect the data

  • Online via SurveyMonkey. View their privacy policy here. 

Retention period

  • One year after termination of contract or unsuccessful application

Shared with a Third Party?

  • Assessors are asked to sign up to a third-party website, Thinkific, for training. Thinkific's privacy policy can be found here. 
  • Assessors are paid using Xero, meaning some data is stored on their website. You can find Xero's privacy policy here. 

 

CREST Teacher Advisory Network

Lawful basis for processing the data

  • Consent

Collection purpose

  • Administration of the Teacher Advisory Network

Retention purpose

  • For communications relating to the advisory network.
  • We retain school postcode data to monitor and expand the diversity of the network.

Data held

  • Name, email, school name, school postcode

How we collect the data

  • Email and Microsoft forms

Retention period

  • Six months after leaving Network

Shared with a Third Party?

  • No

 

CREST Silver Impact Trial

Lawful basis for processing the data

  • Consent and legitimate interests

Collection purpose

  • Email and phone details of teachers are collected for communication purposes and for contact during the application process, and well as for future contact with NatCen Social Research.

Retention purpose

  • To perform the randomised trial study looking at effect of completing CREST Silver Awards on GCSE results
  • Administration of the project – communicating with teachers
  • The BSA doesn’t hold any student data

Data Held

  • Teachers - name, email, telephone, school
  • Nat Cen Social Research also collect personal data of students, however this is not held by, controlled by or sent to the BSA.

How we collect the data

  • The BSA is no longer collecting this data

Retention period

  • Five years

Shared with a Third Party?

  • This data was passed on to NatCen Social Research (with consent). NatCen’s privacy policy can be found here.

 

British Science Week Poster Competition

Lawful basis for processing the data

  • Consent

Collection purpose

  • To contact successful participants
  • To publish the winners

Retention purpose

  • Retained for judging and to contact successful participants.

Data held

  • Teachers - name, email, telephone and school.
  • Students – name, age, school

How we collect the data

  • Online via Microsoft forms, and through physical posted entries

Retention period

  • One year

Shared with a Third Party?

  • Student’s first names only are posted on social media for a public voting round.

 

British Science Week Event Pledges

Lawful basis for processing the data

  • Consent

Collection purpose

  • To encourage members of the public and schools to pledge to run events in British Science Week

Retention purpose

  • To maintain a map of pledges for British Science Week

Data held

  • Pledger name, email address, School/Organisation name, Postcode

How we collect the data

  • Through an online sign up on the British Science Week website

Retention period

  • Six months

Shared with a Third Party?

  • No

 

British Science Week Kick Start Grants

Lawful basis for processing the data

  • Consent

Collection purpose

  • Email and phone details are collected for communication purposes
  • Financial details are collected to make payments to selected schools

Retention purpose

  • To allow us to review historical applications for current grants and see which schools were unsuccessful in the past.

Data Held

  • Applicants – name, address, email, telephone, financial

How we collect the data

  • Online application through the British Science Week website or Survey Monkey. View their privacy policy here. 

Retention period

  • Three years
  • Financial data is deleted after one year but may be retained by our finance team for longer due to legal reasons. See the financial section of this privacy notice.
  • Website accounts (name and email) are kept for 5 years since last login

Shared with a Third Party?

  • No

 

Engagement

British Science Week and British Science Festival Community Grants  

Lawful basis for processing the data

  • Consent

Collection purpose

  • We collect the data from those who apply for a grant. This data is used to establish the eligibility for the grant.
  • Financial data is collected to pay successful applicants

Retention purpose 

  • The data must be kept for the period of the grant and its use. Contact details are required throughout the grant process to contact applicants.

Data held 

  • Applicants – name, address, email, telephone, financial

How we collect the data 

  • Online, via the British Science Week website

Retention period 

  • Personal details are retained three years after completion of grant process
  • Financial data is deleted after a year but may be retained by our finance team for longer due to legal reasons.. See the financial section of this privacy notice.
  • Website accounts (name and email) are kept for 5 years since last login

Shared with a Third Party?

  • No

 

British Science Festival Speakers/Organisers

Lawful basis for processing the data 

  • Consent and explicit consent

Collection purpose

  • Data is collected for communication and logistical purposes
  • To assess proposals and decide who was successful

Retention purpose 

  • Data is retained for future communication to inform applicants and speakers about other opportunities. This will only be in the capacity that the speaker would reasonably expect and will not include marketing.

Data held 

  • Unsuccessful applicants – email, name, address, job title, organisation, social media, telephone, gender,
  • Successful applicants - email, name, address, job title, organisation, social media, telephone, gender, disability, ethnicity

How we collect the data 

  • Via Google Forms. See Google’s Privacy Policy here

Retention period 

  • Five years after last consent for name and email.
  • We keep unsuccessful applicant data for three years.
  • Diversity data such as disability etc are kept for six months and then anonymised.

Shared with a Third Party?

  • No

 

British Science Festival Attendees

Lawful basis for processing the data 

  • Consent and legitimate interests

Collection purpose

  • So thatparticipants can be provided with event information.
  • Some attendees are invited due to their professional position, and the data has been obtained because they would reasonably expect it through an online search.

Retention purpose 

  • So that previous Festival attendees can remain a user on the booking site

Data held 

  • Name, Email address, accessibility requirements

How we collect the data 

  • Online
  • Through an online search, only where the subject would reasonably expect this.

Retention period 

  • Five years for most data. And five years since last accessed the website.

Shared with a Third Party?

  • Some data may be shared with a festival partner, such as the university we work with. This will only be data for select events where the attendees are being invited due to their professional position, and the data has been obtained because they would reasonably expect it through an online search.

 

British Science Festival Award Lectures 

Lawful basis for processing the data

  • Consent and legitimate interests

Collection purpose

  • To assess the eligibility of applicants
  • For award lecturers outside of the retention period we may use our legitimate interests to obtain a professional email address to get in touch about specific legacy related news/information.

Retention purpose 

  • Communications and logistics
  • To hold a record of who applied, who was an Award Lecturer and to get in touch if any similar opportunities arise that they would be interested in.

Data held 

  • Successful applicants - name, address, workplace name, email, telephone, age, gender
  • Unsuccessful applicants - name, address, workplace name, email, telephone, age, gender

How we collect the data 

  • Online, via Google Forms. See Google’s Privacy Policy here.

Retention period 

  • Award lecturer and nominator email addresses are kept for five years. We often renew the consent to keep this data.
  • Names of award lecturers and nominators are kept indefinitely on an opt out basis as part of a legacy record.
  • Diversity data such as gender etc is kept for six months and then anonymised.

Shared with a Third Party?

  • Award lecturer names are listed on our website.

 

UK Science Festivals Network

Lawful basis for processing the data 

  • Consent

Collection purpose

  • For event notifications and network communications

Retention purpose 

  • To organise regular meet-ups and for communications purposes

Data held 

  • Name, email, telephone number, organisation

How we collect the data 

  • Online via a Google form. See Google’s Privacy Policy here.

Retention period 

  • Membership is renewed annually.
  • If membership is not renewed, then we keep the data for three years from membership expiry date.

Shared with a Third Party?

  • No

 

UK Science Festivals Network – Public Engagement Projects

Lawful basis for processing the data

  • Consent

Collection purpose

  • Festivals apply for grants to carry out public engagement projects. Data is collected to assess eligibility of applicants

Retention purpose 

  • To keep a record of previous grant recipients (both successful and unsuccessful) and track how the grants are being used.
  • We use financial data to pay the grant.

Data held 

  • Unsuccessful applicants - Name, email, telephone
  • Successful applicants - Name, email, telephone and financial data

How we collect the data 

  • Applications collected via Google forms. See Google’s Privacy Policy here.

Retention period 

  • One year for name and email address of successful applicants
  • Financial data is deleted after six months but may be retained by our finance team for longer due to legal reasons.. See the financial section of this privacy notice.

Shared with a Third Party?

    • No

 

Science Live

Lawful basis for processing the data

  • Consent

Collection purpose

  • The data is collected so that people can be contacted about relevant events if they have consented to receive these updates.

Retention purpose 

  • Users can make accounts on the website, so they can log in and access information.

Data held 

  • Name, email, professional information

How we collect the data 

  • Online via Science Live website

Retention period 

  • After two years of inactivity, accounts are deleted

Shared with a Third Party?

  • Name and professional experience are publicly visible due to the nature of the site.

Branches

Lawful basis for processing the data 

  • Consent

Collection purpose

  • For volunteers: to pass on data to relevant branch, so volunteers can join branches and get involved with activities
  • For event attendees: to be provided with details about events they signed up for.

Retention purpose 

  • To provide communications and logistics about events.
  • Paying expenses.
  • Those who opt in are added to Dotmailer to receive our Branches newsletter. Please see the marketing section of our privacy notice for more details.

Data held 

  • Branch volunteers - name, email, address, telephone, age, gender, financial data
  • Event attendees – name and email

How we collect the data 

  • Online, via Typeform. View Typeform's privacy policy here.

Retention period 

  • Branch volunteers: three years from last branch activity
  • Financial data is deleted after six months but may be retained by our finance team for longer due to legal reasons.. See the financial section of this privacy notice.

Shared with a Third Party?

  • No

 

Run to the Deep and Run the Solar System Race downloads

This data is owned by the app developers, Six to Start. You can view their privacy policy here. If you sign up for a live race you will also have submitted your data to Eventbrite. See the relevant section of this notice here.

Complaints or queries about this privacy information

The BSA tries to meet the highest standards when collecting and using personal information and we take any complaints we receive about this very seriously. 

You can make a complaint if you think our collection or use of information is inaccurate, unfair or misleading. 

We also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of BSA’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

[email protected]

Access to your personal information

What can you tell me about the data you have about me?

On receipt of evidence of your identity, we can provide:

  • confirmation that your data is being processed;
  • access to your personal data; and
  • any other supplementary information 

In some cases, what will be provided may be limited if in sharing the data we would also be providing data on another individual. In these cases, we may have to ask for consent to contact the other individual for consent, edit out some of the data relating to the individual, or not share a portion of the data. If this is the case, we will communicate this with you as soon as possible and explain the reasoning behind this. 

When will the information be provided?

Information will be provided within one month of receipt. However, we may extend the period of compliance by a further two months where requests are complex or numerous. If this is the case, we will inform the you within one month of the receipt of the request and explain why the extension is necessary.

How will the information be provided?

We will verify the identity of the person making the request, using ‘reasonable means’. If the request is made electronically, we will provide the information in a commonly used secure electronic format.

How to contact us

If you have any queries or concerns, please contact our Data Protection team:

Email: [email protected]

Tel: 02070194946

Changes to this privacy notice        

This Policy was last updated on 25/05/2018

This BSA Privacy Policy may change from time to time so you may wish to check it whenever you visit our website. If we make material changes, we will make this clear on our website or contact you directly.