Key details 

For everything included in this privacy policy, unless stated otherwise, the details of the data controller are: 

British Science Association 

165 Queens Gate 

London 

SW7 5HD 

 

Our ICO registration number is: Z7505720

Policy summary

This privacy notice tells you what to expect when the British Science Association (BSA) collects personal information from you. This includes our sub-brands including the CREST Awards, British Science Week, British Science Festival, Science, Not just for scientists, Science Live, UK Science Festivals Network, For Thought Summit and The Ideas Fund.

 It applies to information we collect about:

This policy outlines:

  • Your rights, including details on whether you (the data subject) are obliged to provide the personal data and what will happen if you do not provide it
  • The data we collect
  • The purposes of our collection of data, and our Lawful basis for processing the data for doing so
  • Whether we share the data with anyone else
  • Details of any transfer of your personal data to a third country
  • What to do if you have a complaint about this privacy notice, and details of the right to lodge a complaint with the supervisory authority
  • Access to personal information
  • The identity and contact details of our Data Protection Lead
  • Changes to this privacy notice

Table of Contents

Your rights

Security

Visitors to our websites

Use of cookies by the BSA

People who contact us via social media

People who email us

BSA Events

People who make a general complaint to us about any of our services

People who use our services or take part in our programmes

Communications

Newsletters and Marketing

Journalists

Financial payment record

Policy, Partnerships and Impact

Media Fellowship

Access Labs

Science, not just for scientists website

For Thought Summit

All-Party Parliamentary Group on Diversity and Inclusion in STEM

Affiliate membership scheme

Development and Fundraising

Education

Underrepresented Audiences Grants

CREST Award Entries

CREST Youth Panel

CREST Assessors

CREST Teacher Advisory Network

British Science Week Poster Competition

British Science Week Event Pledges

British Science Week Kick Start Grants

British Science Week Event Evaluation  

Engagement

British Science Week and Festival Community Grants

Highlands and Islands Climate Change Community Grants

British Science Festival Speakers/Organisers

British Science Festival Attendees

British Science Festival Award Lectures

UK Science Festivals Network

UK Science Festivals Network – Public Engagement Projects

UK Science Festivals Network – Public Engagement Projects - feedback

Community Leaders Programme

Community Buddies Programme

Community Engagement Network

Community Engagement Network - Public Engagement Projects

Community Engagement Network - Public Engagement Projects - feedback

Science Live

The Ideas Fund

Registration of interest – directly online and via Development Coordinators

Pre-application workshops registration and participation

Applications for Funding

Requests for help completing eligibility quiz

Complaints or queries

Access to personal information

What can you tell me about the data you have about me?

When will the information be provided?

How will the information be provided?

How to contact us

Changes to this privacy notice

Your rights

As a Data Subject you have the following rights. Some are dependent on our lawful basis for processing your data:

  • The right to be informed
  • The right of access
  • The right to rectification
  • Rights in relation to automated decision making and profiling.

If you would like any information or to exercise any of these rights please either visit the Information Commissioner’s website or email [email protected].

Security

To keep your personal data secure, we maintain physical, technical and administrative safeguards. We update and test our security technology on an ongoing basis. We store your data in a secure cloud-based service which requires ‘two step authentication’ to prevent unauthorised access.

We restrict access to your personal data to only those employees and contractors who need to know that information. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information.

CREST

The my.crestawards.org (run by SOON_) service is hosted within a secure private virtual network which cannot be directly accessed via the internet unless through SOON_'s public load balancer (accepting only HTTP traffic) or via a VPN account. This means the servers are protected from brute force attacks since they cannot be directly accessed. Further to this SOON_'s Database holding confidential user data also resides within the private network and also cannot be accessed over the internet, only servers within our network can connect to it. Also the database is username/password protected and only the technical team within SOON_ has direct access to the database (required for maintenance). We run a production battle tested and proven linux based operating system which is automatically patched with the latest security updates. Each server we run can only be accessed directly from the internal private network over SSH (Secure Shell) with a username and strong password, only SOON_'s development team have accounts to these servers.

Transfer of your personal information outside the European Economic Area

By the nature of the Internet it is possible that the personal information you provide to the BSA may be transferred to countries outside the European Economic Area (EEA). For example, some of our suppliers including Stripe and Mailchimp may run their operations outside the European Economic Area (EEA). We will take steps to try to ensure that they provide an adequate level of protection in accordance with the GDPR.

Visitors to our websites

When someone visits www.britishscienceassociation.org, www.britishsciencefestival.org, www.crestawards.org, www.forthought.uk, www.notjustforscientists.org,   www.sciencelive.net, www.sciencefestivals.uk, www.britishscienceweek.org and www.eventbrite.co.uk/o/british-science-association-9815087013 we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to track data, such as the number of visitors to various parts of the site. This information is processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it. See Google’s Privacy Policy here.

Use of cookies by the BSA

www.britishscienceassociation.org and all our affiliated websites use cookies.

Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information. This information is used to track visitor use of the website and to compile statistical reports on website activity.

For further information, visit www.aboutcookies.org or www.allaboutcookies.org. You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

Links to third party websites

The BSA is not responsible for the privacy notices and practices of other websites even if accessed using links from our website. We recommend that you read their privacy policies and have linked to them in this privacy information where we can.

People who email us

We encourage people who contact us via email to never share any personal data in an email. Instead, we encourage people to use password protected files and send them via a secure server like WeTransfer.

If you email us any personal data, it may also be stored on our email servers for up to one year. We make every possible effort to keep your data as safe as possible, and any data that is stored on our systems require two-factor authentication to access it. If the data is also for another programme, e.g. the CREST Awards, please see the relevant section below on how your data may be stored and processed.

Events

For the majority of the BSA's events we use website sign ups to express interest and do not use a third party. However, for ad-hoc events or events run by our Branches, we may use Eventbrite. Please see Eventbrite's privacy policy here. If you do not wish to enter your details on Eventbrite but would still like to book at ticket, please email us at [email protected]

People who make a complaint to us about any of our services

When a complaint has been made we will create a secure file containing the details of the complaint. This usually contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the necessary personal information to process the complaint through our standard complaint procedure. Our complaint procedure is used to check on the level of service we provide and make decisions to improve where possible. We do compile and publish statistics showing information like the number of complaints we receive, but not in a form which identifies anyone.

In most cases, we will disclose the identity of the complainant to the member of the staff the complaint is about or the most relevant member of staff, in case of a dispute regarding the accuracy of the complaint. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in secure files in line with our data retention policies. This means that information relating to a complaint will be retained for 2 years. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle. 

Similarly, where enquiries are submitted to us, we will only use the information supplied to deal with the enquiry and any subsequent issues, and to check on the level of service we provide.

People who use our services or take part in our programmes

This section is a composite of the privacy policies for each of our programmes. If you sign up for a programme and opt in for a newsletter, then you will need to look at both sections of this privacy information that refer to the specific programme and our general marketing. For example, if you sign up to the CREST Awards and tick that you would like to receive our Education newsletter, then you will also be added to our marketing list and should also look at the marketing section of this notice.

Communications

Newsletters and Marketing

Lawful basis for processing the data

  • Consent

Collection purpose

  • If you have opted in for one of our newsletters (BSA, Education or Partner) you will receive this newsletter, which will include updates on our work, special offers, details of events and details of related work from our partners.

Data held

  • We collect your name, email address and occasionally a postal address. This only applies to the data we have for our newsletters, even if you signed up for another service while explicitly opting in for the newsletter

How we collect the data

  • This data is collected via online forms and through programme opt-ins. If you sign up for our newsletter via one of our programmes, then you are agreeing for your name and email address to be transferred to our marketing lists, for the purpose you consented to.

Retention period

  • If you have signed up to a newsletter, your email address and name will be stored on Dotmailer for 2 years since your last open.
  • Your data may also be stored on our Customer Relationship Management system ThankQ for up to 2 years. ThankQ's privacy policy can be found here.
  • We do not send any of our marketing information to third parties, and the data is only shared internally if necessary and in compliance with data regulations.

Shared with a third party?

  • We use a third-party provider, Dotdigital, to deliver our monthly e-newsletters. We gather statistics about email opening and clicks using industry standard technologies, including clear gifs to help us monitor and improve our e-newsletter. For more information, please see Dotdigital privacy policy.
  • We may also store information on Salesforce. Salesforce's privacy policy can be found here.

Journalists

Lawful basis for processing the data 

  • Legitimate interests and consent.

Collection purpose

  • We collect this data to maintain a relationship with the media, and ensure our work is given as high of a profile as possible.

Retention purpose 

  • We retain the contact details to maintain relationships for future relevant work.

Data held 

  • Name, contact details, place of work, previous work experience, social media

How we collect the data 

  • We do not retain a lot of data on our servers, instead using a third-party service, Gorkana, to collect contact details. In this case we are the data processor, as we only use the data for the agreed purpose.
  • Some data is received either via contact with journalists who get in touch with us, or sometimes through an online search. We only collect the data of and contact people who would reasonably expect this as part of their professional role.

Retention period 

  • Three years for the data we have on our servers.

Shared with a Third Party?

  • We share data with the university hosting the British Science Festival and the PR agency that we work with throughout the year on various projects

 

Finance

Financial payment record

Lawful basis for processing the data

  • Legitimate interests, consent and legal obligation

Collection purpose

  • We collect financial data for many of our programmes, including the CREST Awards and our Grant schemes. These details are used to either take or make payments to or from our

Data held

  • Name, email, postal address, banking details, phone number

How we collect the data

  • Online, emails, and hard paper copies

Retention period

  • Paper records are kept for 1.5 years in the office.
  • Archived paper data is held for 6 years in line with HMRC requirements
  • Some financial data is kept on our Customer Relationship Management system ThankQ for 6 years or for as long as your membership or direct debit lasts. If we have received Gift Aid from you, we are required to keep the data for up to 6 years.

Shared with a Third Party?

  • Accountant and auditor (access via Sage and cloud-based service only
  • Archive provider
  • ThankQ's privacy policy can be found here.

 

Policy, Partnerships and Impact

Media Fellowship

Lawful basis for processing the data

  • Legitimate interests 
  • Substantial public interest (where relevant) 
  • Equality monitoring (where relevant)

Collection purpose

  • We collect data to enable us to select Fellows and communicate with successful applicants. We collect nationality and age for recruitment purposes
  • We collect sensitive data (race/ethnicity) for monitoring and evaluating the application process to improve it in the future, but this is only analysed anonymously.

Retention purpose

  • Demographic data is required for reporting purposes as part of grant funding. Any data used for reporting will be anonymised.
  • We hold personal contact details to maintain relationships with Media Fellow alumni. Alumni can opt out of this communication if they wish

Data held

  • Unsuccessful applicants - name, email, postal address, telephone, age range, ethnicity, gender
  • Successful applicants - name, email, postal address, telephone,, ethnicity, gender

How we collect the data

  • Microsoft forms

Retention period

  • Successful applicants - five years for name and contact details. We renew this consent for contact on a regular basis to ensure that people would still like to hear from us.
  • Unsuccessful applicants – six months
  • Anonymous diversity data of all applicants is retained for six

Shared with a Third Party?

  • We do not provide any personal information to third parties, except anonymised data for reporting purposes.
  • We source our Media Fellows through an open call via universities and societies. The data of shortlisted candidates is provided to us by universities and societies, including anonymised diversity data.

 

Access Labs

Lawful basis for processing the data

  • Consent

Collection purpose

  • Administering and evaluating the programme

Data held

  • Applicants name, email address, employer, town of residence
  • Anonymous diversity data: age range, gender, ethnicity, disability status

How we collect the data

  • Microsoft Forms

Retention period

  • Unsuccessful and successful applicants’ data will be held until 31 March 2019 or the duration of involvement in the project (max. 12 months)

Shared with a Third Party?

  • Shared with project partners (Natural Environment Research Council and FoAM) subject to a data processing agreement

 

Science, not just for scientists website

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • Crowdsourcing ideas from the public about how science can belong to all of us
  • We use email addresses to contact individuals for idea submissions
  • Other details are used to provide further information for visitors to the website

Retention purpose

  • To consider the ideas and get in touch if they are successful.

Data held

  • Name, email
  • For successful ideas – name, institution, image

How we collect the data

  • Online web forms

Retention period

  • Four years

Shared with a Third Party?

  • No

 

For Thought Summit

Lawful basis for processing the data

  • Legitimate interests and consent

Collection purpose

  • A public search is used to find suitable contacts from organisations who would be interested in attending. Only people who would reasonably expect to be contacted in this regard are approached.
  • We collect address and email information to post and email invitations to the Summit.

Retention purpose

  • Communications regarding the event they signed up for.

Data held

  • Name, email, postal address, telephone, organisation and job title

How we collect the data

  • Online sign ups via the Huxley Summit website
  • Online via email

Retention period

  • Four years

Shared with a Third Party?

  • Name, organisation and job title of attendees are included in the programme delegate list which is shared with attendees.

 

All-Party Parliamentary Group on Diversity and Inclusion in STEM

Lawful basis for processing the data

  • Consent and legitimate interests

Collection purpose

  • For sensitive data such as political views, our Lawful basis for processing the data is that it relates to personal data which are manifestly made public by the data subject. (E.g. politicians)
  • We collect contact details from our members, sponsors, advisory group members, and people who sign up to the mailing list, so they can be informed of future APPG meetings and updates

Retention purpose

  • Retained to send updates for those who have signed up to the mailing list,
  • Retained to maintain details and contact of those on our advisory panel, and those who are members of the APPG.

Data held

  • We collect the name and email of sponsors, newsletter sign ups, members of the advisory group and MPs. We also have the political affiliation of the MPs who are members.

How we collect the data

  • We collect the data through sign ups via the British Science Association website, networking, referrals and through some public searches (e.g. to get in touch with an MP.)

Retention period

  • Five years

Shared with a Third Party?

  •  Names and organisations of attendees will be shared with attendees.

 

Affiliate membership scheme

Lawful basis for processing the data

  • Consent

Collection purpose

  • We gather financial information to collect membership fees
  • To become an Affiliate organisation, the organisation will provide contact data to receive the BSA newsletter.

Retention purpose

  • To maintain relationships with existing Affiliates

Data held

  • Name, email, postal address, telephone, financial

How we collect the data

  • We no longer collect data for this programme.

Retention period

  • Three years
  • Financial data is deleted after six months but may be retained by our finance team for longer due to legal reasons. See the financial section of this privacy notice.

Shared with a Third Party?

  • No

 

Partnerships and Fundraising

Lawful basis for processing the data

  • Legitimate interests and consent

Collection purpose

  • We collect data to build partnerships with organisations which have similar goals to the British Science Association. Personal data is collected to ensure we contact the most relevant person at these organisations.
  • We may collect financial information to collect payments

Retention purpose

  • To contact previous partners for fundraising and networking purposes

Data held

  • Name, email, postal address, telephone, some financial data

How we collect the data

  • Data is collected through networking, where consent is provided through verbal agreement and the subject sharing their email address.
  • Contacts may also be passed on through email networking, but only where someone would reasonably expect this.
  • Our development team may search online for appropriate companies and contacts to get in touch with. This is a tailored and considered approach, and only people who would expect to be contacted and would have a reasonable interest in our work will be contacted.

Retention period

  • Three years from last contact
  • Financial data is deleted after six months but may be retained by our finance team for longer due to legal reasons.. See the financial section of this privacy notice.

Shared with a Third Party?

  • No

 

Education

Underrepresented Audiences Grants

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • Email and phone details are collected for communication purposes and for contact during the application process
  • We collect financial details for all applicants so that we can make grant payments to successful applicants

Retention purpose

  • To keep in touch with teachers until their CREST projects have been completed and they have finished the evaluation.
  • For those who opt-in, we will retain emails to contact them about further relevant grant opportunities.

Data held

  • Teacher name, email, school/organisation’s postal address, telephone, financial

How we collect the data

  • Via FormAssembly and Salesforce Cloud. You can view FormAssembly's privacy policy here, and Salesforce's privacy policy here.

Retention period

  • Three years from application
  • Financial data is deleted after a year but may be retained by our finance team for longer due to legal reasons. See the financial section of this privacy notice.

Shared with a Third Party?

  • FormAssembly and Salesforce Cloud. You can view FormAssembly's privacy policy here, and Salesforce's privacy policy here.

 

CREST Award Entries

Lawful basis for processing the data

  • Legitimate interests 
  • We have previously relied on other lawful bases – if you think one of these may apply to you and you have questions, please get in touch using the email at the bottom of the page.

Collection purpose

  • Account owner names and email addresses are collected for operational communications. Account owners are teachers and students.
  • Student ethnicity, gender, disability, free school meal and age range data are collected separately to the overall project and are processed anonymously. In cases where an individual student is submitted it may be more possible to identify student data, however this information is stored and processed separately. There is an option ‘prefer not to say’ for all diversity data where people are not happy to provide this.
  • Student names are used for certificate printing to record the student’s achievement of the Award

Retention purpose

  • To keep in touch with and maintain a record of teachers and students who have taken part in the Awards, so we can verify the date of the award if asked by the student in the future.
  • For future reporting purposes, e.g. a CREST impact report may be based on ~9 years of historical data
  • We ask for sensitive data such as ethnicity and disability for diversity monitoring purposes and collect and analyse this data anonymously. There is a prefer not to say option. For data collected not-anonymously in the past, this data has been brought in line with our current data collection standards and is now also stored anonymously.

Data held

  • Data on teachers who have submitted students for Discovery and Bronze awards – name, email, role, certificate delivery address
  • Data on teachers who have submitted students for Star, SuperStar, Silver and Gold awards – name, email, certificate delivery address
  • Data on students submitted for Discovery and Bronze awards – name, school
  • Data on students submitted for Silver and Gold awards – name, email, school, certificate delivery address
  • Anonymous diversity data held on students (when ‘Prefer not to say’ is not chosen) -gender, age range, ethnicity, disability, free school meal data
  • For Star, SuperStar, Silver and Gold Awards on the Survey Monkey Apply platform, Survey Monkey collects geolocation data such as IP address. Survey Monkey is the controller for this data. View their privacy policy.

How we collect the data

  • A teacher or student (expected to be over 13) signs up as a project owner to enter students for CREST Awards via the CREST website
  • For Discovery and Bronze: on line via My.CREST - a bespoke platform owned by the BSA
  • For Star, SuperStar, Silver and Gold: online via Survey Monkey Apply – a platform owned by SurveyMonkey

Retention period

  • Student and teacher data is stored for 5 years
  • Some financial data will be stored for up to 6 years, including name, email address and bank details. This will be retained due to legal requirements. See also the financial section of this privacy notice.

Shared with a Third Party?

  • Users submit data online via CREST website. This is accessible to the website developer for My.crest and Survey Monkey (who own Survey Monkey Apply). View Survey Monkey's privacy policy here. 
  • Student names and certificate delivery address for Discovery, Bronze, Silver and Gold is sent to our printer to print CREST certificates. We have a Data Processing Agreement in place with them.
  • We use Xero to manage the CREST Award finances. Some data is transferred to Xero for the purposes of administering the CREST Awards. You can find Xero's privacy policy here. 
  • We use a Stripe integration to allow card payments for the CREST Awards. You can find Stripe privacy policy here.
  • We use Mailchimp to send functional emails to MyCREST users. You can find their privacy policy here.

 

CREST Assessors

Lawful basis for processing the data

  • Legitimate interests, and necessity due to contractual obligations.

Collection purpose

  • Name, email and phone details are collected for communication purposes and for contact during the assessing process.
  • We also collect details of experience that relates to the role the applicant is applying for. This may include previous or current jobs.
  • We collect gender for diversity monitoring

Retention purpose

  • We need to communicate with assessors we contract to deliver a service

Data held

  • Name, email, gender, experience, financial data (for successful applicants).
  • Name, email, gender, experience (for unsuccessful applicants)

How we collect the data

  • Online via SurveyMonkey. View their privacy policy here. 

Retention period

  • One year after termination of contract or unsuccessful application

Shared with a Third Party?

  • Assessors are asked to sign up to a third-party website, Thinkific, for training. Thinkific's privacy policy can be found here. 
  • Assessors are paid using Xero, meaning some data is stored on their website. You can find Xero's privacy policy here. 

 

CREST Teacher Advisory Network

Lawful basis for processing the data

  • Consent

Collection purpose

  • Administration of the Teacher Advisory Network

Retention purpose

  • For communications relating to the advisory network.
  • We retain school postcode data to monitor and expand the diversity of the network.

Data held

  • Name, email, school name, school postcode

How we collect the data

  • Email and Microsoft forms

Retention period

  • Six months after leaving Network

Shared with a Third Party?

  • No

British Science Week Poster Competition

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • To contact successful participants
  • To publish the winners

Retention purpose

  • Retained for judging and to contact successful participants.

Data held

  • Teachers - name, email, telephone and school.
  • Students – name, age, school

How we collect the data

  • Online via Microsoft forms, and through physical posted entries

Retention period

  • One year

Shared with a Third Party?

  • Student’s first names only are posted on social media for a public voting round.

British Science Week Kick Start Grants

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • Email and phone details are collected for communication purposes
  • Financial details are collected to make payments to selected schools

Retention purpose

  • To allow us to review historical applications for current grants and see which schools were unsuccessful in the past.
  • For those who opt-in, we will retain emails to contact them about further relevant grant opportunities.

Data Held

  • Applicants – name, address, email, telephone, financial details

How we collect the data

  • Via FormAssembly and Salesforce Cloud. You can view FormAssembly's privacy policy here, and Salesforce's privacy policy here.

Retention period

  • Three years
  • Financial data is deleted after one year but may be retained by our finance team for longer due to legal reasons. See the financial section of this privacy notice.
  • Website accounts (name and email) are kept for 5 years since last login

Shared with a Third Party?

  • FormAssembly and Salesforce Cloud. You can view FormAssembly's privacy policy here, and Salesforce's privacy policy here.

 

British Science Week Event Evaluation  

Lawful basis for processing the data 

  • Legitimate interests 
  • Substantial public interest (where relevant) 
  • Equality monitoring (where relevant) 

Collection purpose 

  • Evaluating British Science Week events 

Retention purpose 

  • Retained for analysis and processing 

Data Held 

  • Full home postcode, gender, ethnicity, disability, age range 

How we collect the data 

  • Via paper surveys at events, completed by the individual 

Retention period 

  • 3 years 

Shared with a third party? 

  • The data may be shared with the Audience Agency or Eurodata. View the Audience Agency's privacy notice here.

Engagement

British Science Week and British Science Festival Community Grants  

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • We collect the data from those who apply for a grant. This data is used to establish the eligibility for the grant.
  • Financial data is collected for all applicants so we can pay successful applicants

Retention purpose 

  • The data must be kept for the period of the grant and its use. Contact details are required throughout the grant process to contact applicants.

Data held 

  • Applicants - name, organisation name, role, organisation address, email, telephone, financial details

How we collect the data

  • Via FormAssembly and Salesforce Cloud. You can view FormAssembly's privacy policy here, and Salesforce's privacy policy here.

Retention period 

  • Personal details are retained three years after completion of grant process
  • Financial data is deleted after a year but may be retained by our finance team for longer due to legal reasons. See the financial section of this privacy notice.
  • Website accounts (name and email) are kept for 5 years since last login

Shared with a Third Party?

  • FormAssembly and Salesforce Cloud. You can view FormAssembly's privacy policy here, and Salesforce's privacy policy here.

 

Highlands & Islands Climate Change Community Grants

Lawful basis for processing the data

  • Online sign ups via an expression of interest form – Consent
  • Via the Highland and Island Climate Change Community Grant coordinator – legitimate interests

Collection purpose

  • To hold data on individuals interested in hearing about the Highland and Islands Climate Change Community Grant and contact them about the grant
  • To communicate with interested individuals and organisations and support them with applications
  • We collect the data from those who apply for a grant. This data is used to establish the eligibility for the grant.
  • Financial data is collected for all applicants so we can pay successful applicants

Retention purpose 

  • The data must be kept for the period of the grant and its use. Contact details are required throughout the grant process to contact applicants.

Data held 

  • Applicants – name, organisation name, role, organisation address, email, telephone, financial details or expression of interest that may be shared with the Highland and Island Climate Change Community Grant coordinator

How we collect the data

  • Directly via the Highland and Island Climate Change Community Grant coordinator
  • Via FormAssembly and Salesforce Cloud. You can view FormAssembly's privacy policy here, and Salesforce's privacy policy here.

Retention period 

  • Personal details are retained three years after completion of grant process
  • Financial data is deleted after a year but may be retained by our finance team for longer due to legal reasons. See the financial section of this privacy notice.
  • Website accounts (name and email) are kept for 5 years since last login

Shared with a Third Party?

  • Highland and Island Climate Change Community Grant coordinator is a third party and acts as Data Processor on the BSA’s behalf.
  • FormAssembly and Salesforce Cloud. You can view FormAssembly's privacy policy here, and Salesforce's privacy policy here.

British Science Festival Speakers/Organisers

Lawful basis for processing the data 

  • Legitimate interests

Collection purpose

  • Data is collected for communication and logistical purposes
  • To assess proposals and decide who was successful

Retention purpose 

  • Data is retained for future communication to inform applicants and speakers about other opportunities. This will only be in the capacity that the speaker would reasonably expect and will not include marketing.

Data held 

  • Unsuccessful applicants – email, name, address, job title, organisation, social media, telephone, gender,
  • Successful applicants - email, name, address, job title, organisation, social media, telephone, gender, disability, ethnicity, sexuality

How we collect the data 

  • Via Microsoft Forms.

Retention period 

  • Five years after last consent for email. Name is kept indefinitely for legacy purposes.
  • We keep unsuccessful applicant data for three years.
  • Diversity data such as disability etc are kept for six months and then anonymised.

Shared with a Third Party?

  • No

 

British Science Festival Attendees

Lawful basis for processing the data 

  • Legitimate interests
  • Substantial public interest (where relevant)
  • Equality monitoring (where relevant)
  • Explicit consent

Collection purpose

  • So that participants can be provided with event information.
  • Some attendees are invited due to their professional position, and the data has been obtained because they would reasonably expect it through an online search.
  • To assess the diversity and reach of the festival

Retention purpose 

  • So that previous Festival attendees can remain a user on the booking site
  • Analysis of feedback.

Data held 

  • (Event attendees) Title, forename, surname, email address, postal address, phone number, accessibility information
  • (People who fill out the feedback form) Age range, gender, disability, ethnicity, full home postcode

How we collect the data 

  • Online
  • Through paper surveys
  • Through an online search, only where the subject would reasonably expect this.

Retention period 

  • Five years for most data. And five years since last accessed the website.
  • One year for postcode from feedback form.

Shared with a Third Party?

  • Some data may be shared with a festival partner, such as the university we work with. This will only be data for select events where the attendees are being invited due to their professional position, and the data has been obtained because they would reasonably expect it through an online search.
  • Diversity data is shared with the Audience Agency. You can view their privacy policy here.
  • Tickets are sold via See Tickets. Please view their data protection policy here

British Science Festival Award Lectures 

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • To assess the eligibility of applicants
  • For award lecturers outside of the retention period we may use our legitimate interests to obtain a professional email address to get in touch about specific legacy related news/information.

Retention purpose 

  • Communications and logistics
  • To hold a record of who applied, who was an Award Lecturer and to get in touch if any similar opportunities arise that they would be interested in.

Data held 

  • Name, address, workplace name, email, telephone, age, gende

How we collect the data 

  • Online, via Google Forms. See Google’s Privacy Policy here.

Retention period 

  • Award lecturer and nominator email addresses are kept for five years. We often renew the consent to keep this data.
  • Names of award lecturers and nominators are kept indefinitely on an opt out basis as part of a legacy record.
  • Diversity data such as gender etc is kept for six months and then anonymised.

Shared with a Third Party?

  • Award lecturer names are listed on our website.

 

UK Science Festivals Network

Lawful basis for processing the data 

  • Legitimate interests

Collection purpose

  • For event notifications and network communications
  • To collect event attendee information

Retention purpose 

  • To organise regular meet-ups and for communications purposes
  • To run events for those who sign up to them, including members and non-members

Data held 

  • Members: Name, email, telephone number, organisation
  • Event attendees: Name, email

How we collect the data 

  • Members: Online via Microsoft Forms.
  • Events: Online via Hopin

Retention period 

  • Membership is renewed annually.
  • If membership is not renewed, then we keep the data for three years from membership expiry date.
  • For events we hold the data for 1 year

Shared with a Third Party?

  • Event data is collected via Hopin. You can view their privacy policy here.

 

UK Science Festivals Network – Public Engagement Projects

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • Festivals apply for grants to carry out public engagement projects. Data is collected to assess eligibility of applicants

Retention purpose 

  • To keep a record of previous grant recipients (both successful and unsuccessful) and track how the grants are being used.
  • We collect financial data for all applicants so that we can pay the grant to those who are successful.

Data held 

  • Name, email, telephone and financial data

How we collect the data 

  • Online via Microsoft Forms.

Retention period 

  • One year for name and email address of successful applicants
  • Financial data is deleted after six months but may be retained by our finance team for longer due to legal reasons.. See the financial section of this privacy notice.

Shared with a Third Party?

    • No

 

UK Science Festivals Network – Public Engagement Projects feedback 

Lawful basis for processing the data 

  • Legitimate interests 
  • Substantial public interest (where relevant) 
  • Equality monitoring (where relevant) 

Collection purpose 

  • To evaluate the diversity and accessibility of the programme 

Retention purpose  

  • Diversity analysis 

Data Held  

  • Age range, gender, disability, ethnicity, full home postcode 

How we collect the data  

  • Paper surveys 

Retention period  

  • 1 year 

Shared with a third party? 

  • The data is shared with the Audience Agency who analyse the data. View their privacy policy here. 

Community Engagement Network

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • Administration of the network

Retention purpose 

  • Administration of the network and to provide opportunities and information to members.

Data held 

  • Lead contact's name, email address and phone number.
  • Name and address of organisation.

How we collect the data 

  • Online via the British Science Week and British Science Festival websites.
  • Ad-hoc sign ups.

Retention period 

  • Information will be held on an opt-out basis.

Shared with a Third Party?

  • Email addresses will be shared between members where relevant, as part of the purpose of the network.

Community Engagement Network – Community Engagement Projects

  • Lawful basis for processing the data
    • Legitimate interests
  • Collection purpose
    • Organisations apply for grants to carry out community engagement projects. Data is collected to assess eligibility of applicants
  • Retention purpose
    • To keep a record of previous grant recipients (both successful and unsuccessful) and track how the grants are being used.
    • We use financial data to pay the grant.
  • Data held 
    • Unsuccessful applicants - Name, email, telephone
    • Successful applicants - Name, email, telephone and financial data
  • How we collect the data 
    • Applications collected via Google forms. See Google’s Privacy Policy here.
  • Retention period 
    • Two years for name and email address of successful applicants
    • Financial data are deleted after one year but may be retained by our finance team for longer due to legal reasons.. See the financial section of this privacy notice.
  • Shared with a Third Party?
    • No

 

Community Engagement Network – Community Engagement Projects feedback

  • Lawful basis for processing the data 
    • Legitimate interests 
    • Substantial public interest (where relevant) 
    • Equality monitoring (where relevant) 
  • Collection purpose 
    • To evaluate the diversity and accessibility of the programme 
  • Retention purpose  
    • Diversity analysis
  • Data Held  
    • Age range, gender, disability, ethnicity, full home postcode 
  • How we collect the data
    • Paper surveys
  • Retention period
    • 1 year
  • Shared with a third party?
    • The data is shared with the Audience Agency who analyse the data. View their privacy policy here. 

Community Leaders Programme

  • Lawful basis for processing the data 
    • Legitimate interests
    • Substantial public interest (where relevant) 
    • Equality monitoring (where relevant)
  • Collection purpose 
    • For the administration of the programme and related grants
  • Retention purpose  
    • For ongoing communication with the Leaders
  • Data Held  
    • All applicants - Name, organisation, email address, phone number Grant applicants - financial information
    • Project participants - Full home postcode, gender, ethnicity, disability, age range
  • How we collect the data
    • Via Microsoft Forms
    • Some paper forms at grant events
  • Retention period
    • Unsuccessful applicants - Email and phone number - 1 year, Name and organisation - 3 years
    • Successful applicants (members) when they leave the network they will be removed after a year
    • Project participants - Full home postcode, gender, ethnicity, disability, age range
  • Shared with a third party?
    • No

Community Buddies Programme

  • Lawful basis for processing the data 
    • Legitimate interests
    • Substantial public interest (where relevant) 
    • Equality monitoring (where relevant)
  • Collection purpose 
    • For the administration of the programme and related grants
  • Retention purpose  
    • For ongoing communication with members, diversity monitoring of people who attend events
    • Administration of grants
  • Data Held  
    • Members - Name, organisation, email address, phone number, Grant awardees - financial information
    • Project participants - Full home postcode, gender, ethnicity, disability, age range
  • How we collect the data
    • Via Microsoft Forms
    • Some paper forms at grant events
  • Retention period
    • Unsuccessful applicants - Email and phone number - 1 year, Name and organisation - 3 years
    • Successful applicants (members) when they leave the network they will be removed after a year
    • Event attendees - 1 year
  • Shared with a third party?
    • No

Science Live

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • The data is collected so that people can be contacted about relevant events if they have consented to receive these updates.

Retention purpose 

  • Users can make accounts on the website, so they can log in and access information.

Data held 

  • Name, email, professional information

How we collect the data 

  • Online via Science Live website

Retention period 

  • After two years of inactivity, accounts are deleted

Shared with a Third Party?

  • Name and professional experience are publicly visible due to the nature of the site.

The Ideas Fund

Registration of interest – directly online and via Development Coordinators

Lawful basis for processing the data

  • Online sign ups – Consent
  • Via our regional Development Coordinators – legitimate interests

Collection purpose

  • To hold data on individuals interested in hearing about the Ideas Fund and contact them about the fund
  • To communicate with interested individuals and organisations and support them with applications

Retention purpose

  • So we can contact individuals who have registered their interest in learning more about the Ideas Fund

Data held

  • Name, email, region, phone number, other details relevant to application that may be shared with Development Coordinators

How we collect the data

  • Directly via our regional Development Coordinators
  • Online via Form Assembly, using an online form.
  • We also hold data in Salesforce

Retention period

  • Two years 

Shared with a Third Party?

  • Our Development Coordinators are third parties that act as Data Processors on the BSA’s behalf.
  • Data submitted via the form is collected via a third part, Form Assembly. You can view their privacy policy
  • Data submitted is stored in our Salesforce database. View their privacy policy

 

Pre-application workshops registration and participation

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • So interested individuals or groups can attend workshops to learn more about the application process and how to apply

Retention purpose

  • To keep a record of who has attended the workshops

Data held

  • Name, email address, region

How we collect the data

  • Via Form Assembly and Salesforce.

Retention period

  • Two years

Shared with a Third Party?

  • You can view Salesforce's privacy policy here.
  • Workshop organiser/s Science Ceilidh and Development Coordinators

 

Applications for Funding

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • To process applications for the Ideas Fund, and to hold a record of grantholders.

Retention purpose

  • To keep a record of who has previously applied and to hold a record of grantholders

Data held

  • Unsuccessful applicants – name, email address, phone number, employer/organisation, address
  • Successful applicants - name, email address, phone number, employer/organisation, address, bank name, bank account number and sort code.

How we collect the data

  • Via an online form on Form Assembly and Salesforce.

Retention period

  • Successful applicants - 3 years after the end of the grant. Financial data may be retained by our finance team for longer due to legal reasons. See the financial sectionof this privacy notice.
  • Unsuccessful applicants – Two years

Shared with a Third Party?

  • Data submitted via the form is collected via a third party, Form Assembly. You can view their privacy policy
  • Data submitted is stored in our Salesforce database. View their privacy policy
  • Data may also be submitted via our regional Development Coordinators. They are third parties that act as Data Processors on the BSA’s behalf.

 

Requests for help completing eligibility quiz

Lawful basis for processing the data

  • Legitimate interests

Collection purpose

  • To provide support to individuals with the online eligibility quiz

Retention purpose

  • To keep a record of requests for support

Data held

  • Name, email address, phone number

How we collect the data

  • Via an online form on Form Assembly and Salesforce

Retention period

  • 1 year

Shared with a Third Party?

  • Data submitted via the form is collected via a third party, Form Assembly. You can view their privacy policy
  • Data submitted is stored in our Salesforce database. View their privacy policy
  • Data may also be submitted via our regional Development Coordinators. They are third parties that act as Data Processors on the BSA’s behalf.

Complaints or queries about this privacy information

The BSA tries to meet the highest standards when collecting and using personal information and we take any complaints we receive about this very seriously. 

You can make a complaint if you think our collection or use of information is inaccurate, unfair or misleading. 

We also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of BSA’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

[email protected]

Access to your personal information

What can you tell me about the data you have about me?

On receipt of evidence of your identity, we can provide:

  • confirmation that your data is being processed;
  • access to your personal data; and
  • any other supplementary information 

In some cases, what will be provided may be limited if in sharing the data we would also be providing data on another individual. In these cases, we may have to ask for consent to contact the other individual for consent, edit out some of the data relating to the individual, or not share a portion of the data. If this is the case, we will communicate this with you as soon as possible and explain the reasoning behind this. 

When will the information be provided?

Information will be provided within one month of receipt. However, we may extend the period of compliance by a further two months where requests are complex or numerous. If this is the case, we will inform the you within one month of the receipt of the request and explain why the extension is necessary.

How will the information be provided?

We will verify the identity of the person making the request, using ‘reasonable means’. If the request is made electronically, we will provide the information in a commonly used secure electronic format.

How to contact us

If you have any queries or concerns, please contact our Data Protection team:

Email: [email protected]

Tel: 02070194946

Changes to this privacy notice        

This Policy was last updated on 26/01/2021

This BSA Privacy Policy may change from time to time so you may wish to check it whenever you visit our website. If we make material changes, we will make this clear on our website or contact you directly.