Version 1 25/03/2025
This notice explains how we will collect and use your data.
We are the data controller for personal data that we process about you.
Throughout this notice, ‘University’ refers to the University of Leeds, ‘EDI Hub+’, ‘we’, ‘our’, and ‘us’ refers to the EDI Hub+ at the University of Leeds. ‘You’ and ‘your’ refers to those who register for and attend our events, those who apply to our Flexible Fund, and those who nominate themselves as reviewers for our Flexible Fund.
Changes in the law
We shall process your personal data in accordance with the General Data Protection Regulations (or ‘GDPR’ for short).
This notice complies with requirements under GDPR.
Changes to this notice
We reserve the right to make changes to this notice. We shall inform you of any changes to this notice using the appropriate medium of communication (e.g., where our main contact with us is by email, we will email you).
Anything you are not clear about
If there is anything you are unclear about, please contact the EDI Hub+ in the first instance and we will be happy to answer any queries you may have concerning this notice of the way in which we process your personal data.
Where the EDI Hub+ gets your personal data from
We obtain personal data about you from the following sources:
- From you, when you register for our events;
- From you, when you contact us via email, phone or post;
- From you, when to nominate yourself as a reviewer for the Flexible Fund;
- From you, when you apply to the Flexible Fund;
- From you, when you complete our monitoring forms;
- From you, when you complete an end of award report.
Categories of personal data being processed
We will collect and process personal data about you. Personal data may contain “sensitive personal data” as described under the DPA and “special categories of data” as described under UK GDPR.
Such “sensitive personal data” or “special categories of data” is information about your racial or ethnic origin, religious beliefs or other beliefs, physical or mental health or, in relation to DPA only, other conditions and information concerning any criminal offences or criminal proceedings.
The data we may process includes:
- name
- job title or role
- contact information, such as email address and your phone number
- organisations that you are, or have been, affiliated with
- career history including employment history and publication record
- salary
- skills and areas of expertise
- conflicts of interest, some of the information you provide relating to conflicts may also relate to other people, for example family members
- caring responsibilities
- equality, diversity and inclusion information, such as:
- religion
- ethnic group
- sex
- gender identity
- sexual orientation
When you review an application for the Flexible Fund, we collect information from you relating to the individual merit of an application against agreed criteria, this may include:
- feedback, against specified criteria
- scores, against a specified scale
- views or expert opinion
- comments
Where this information includes opinions and references to others these may be considered as both your personal information and the personal information of the subject of your opinion.
The purposes for which we process your personal data
We need this information so that we can:
- inform you of upcoming events and opportunities
- receive and process applications for funding from you
- ensure that information can be passed to and from you securely
- make decisions regarding which proposals we fund
- evaluate and analyse the inclusion and accessibility of our funding
- prevent and detect fraud
- administer and manage your funding award, if successful
The legal basis for processing your data
- (Article 6 (1)(a)), Consent – on specific occasions the EDI Hub+ will only process certain data if you consent e.g. when completing our monitoring forms, you only need to provide certain ‘special categories of data’ if you agree to do so.
- (Article 6 (1)(b)), Contract – on specific occasions it will be necessary for a contract we have with you, e.g., if you are awarded EDI Hub+ funding.
- (Article 6 (1)(c)), Legal obligation – we are contractually obliged to provide data to our funder, the Engineering & Physical Sciences Research Council.
- (Article 6 (1)(e)), Public task – sometimes it will be necessary for us to process your data to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. The EDI Hub+ is publicly funded and its activity is conducted in a public interest (including your interest and the interest of others).
Who we might share your data with
We may need to share your information for a number of reasons, including:
- managing your application and awards
- carrying out evaluation and analysis of our activities
- fulfilling our contractual or legal obligations
Only the minimum amount of personal information required to support the specific purpose will be shared in each case.
Your personal data may be shared with:
- our funder (the Engineering & Physical Sciences Research Council) to enable them to carry out their statutory functions as applicable
- reviewers, assessors and panel members
If your application is successful, a limited set of your information will be made publicly available.
Retention period
Minimum period: none
Maximum period: six years after the end of the EDI Hub+ (31 October 2028 + six years).
Your rights as a data subject
Under GDPR, you have the right to:
- withdraw consent where that is the legal basis of our processing;
- access your personal data that we process;
- rectify inaccuracies in personal data that we hold about you;
- be forgotten, that is your details to be removed from systems that we use to process your personal data;
- restrict the processing in certain ways;
- obtain a copy of your data in a commonly used electronic form; and
- object to certain processing of your personal data by us.
Please see the International Commissioner’s Office (ICO) website for further information on the above rights. You may also contact the Data Protection Officer for further information.
You have a right to complain to the Information Commissioner’s Office about the way in which we process your personal data. Please see the ICO website.
Concerns and contact details
If you have any concerns with regard to the way your personal data is being processed, or have a query with regard to this notice, please contact the EDI Hub+ in the first instance. Our contact details are as follows:
Email: EDIHubPlus@leeds.ac.uk
Alternatively, you can email the University’s Data Protection Officer, Adrian Slater, at a.j.slater@adm.leeds.ac.uk.
The University’s data controller registration number provided by the Information Commissioner’s Office is Z553814X.