Privacy Policy

Biorenewables Development Centre Privacy Notice

This privacy notice is for BDC clients, potential clients and visitors to the BDC. It sets out the ways in which BDC gathers, uses, stores and shares your personal data. It also sets out how long we keep your data and what rights you have in relation to your data under the General Data Protection Regulation (GDPR). Access to this notice is given to anyone visiting our facilities by a public display.

Where do we get your data from?

We collect the Personal Information you knowingly provide when you engage with us or use our services. Much of the data we hold on you comes when you engage with us as a potential customer or supplier or use any of the services offered by our organisation. Additional information may also have been provided by you as part of your interactions with us at events or conferences provided by us or in which we are involved by sharing your details with our staff. Information relating to you may also have been provided to us by third parties e.g. your contacts or colleagues.

What data do we have?

We may collect, use, store and transfer different kinds of personal data about you, including your name, job title, business name, address and postcode, your position, telephone number, e-mail address. We only collect special categories of personal data about you where we are required to do so in connection with any funding which may be used to benefit you or your organisation (this may include details about your race or ethnic origin and information about your health and/​or any disability).

What is our legal basis for processing your data?

BDC needs to collect and retain certain types of data, in various formats, about its contacts, customers and partners to fulfil its functions as a research and business development organisation.

Typically, data will be processed:

• Because you have given us your consent;
• To fulfil our legitimate interests of bioeconomy business development as required by our funders.

How do we use your data?

BDC may process your personal data for the following purposes:

1. To provide services to you or the organisation you work for;
2. For marketing purposes and market research
3. To help us to improve our website, services and communications to you including providing you with information relating to BDC services and events, funding and/or collaboration opportunities
4. To issue invoices and reminder notices, to raise queries in relation to invoicing and other matters, and to manage accounts, records and collection of payments and debts
5. To verify eligibility for project funding
6. For disclosures to our funders and auditors and otherwise demonstrating the impact of our organisation’s receipt of public funding;

In addition, please note:

On certain occasions such as project press release or events, you may be captured in photographs or video footage as part of a wider group shot. These images/recordings may be used by BDC for promotional purposes e.g. in marketing BDC facilities or services. If you have concerns about the use of your image please contact BDC for more information, biorenewables@york.ac.uk

Who do we share your data with?

BDC may share your data with:

• Employees of BDC and the University of York
• Third parties that process data on behalf of BDC to support it in fulfilling its obligations and responsibilities to and relationship with you (e.g. software and system providers);
• Third party providers or employers involved in facilitation or delivery of BDC events or meetings;
• Government departments/agencies to whom we have a statutory obligation to release information (including ERDF and Research England);
• Law enforcement agencies such as the police or relevant authorities dealing with emergency situations (only as required or appropriate in line with Data Protection legislation).

BDC may also disclose your data to other 3rd parties not listed above on a case-by-case basis. Disclosures will be made in full accordance with the data protection legislation and only where necessary. Consent will be sought with you where appropriate and you will be told about such disclosures unless exceptional circumstances apply.

How do we keep your data secure?

BDC takes information security extremely seriously and has implemented appropriate technical and organisational measures to protect personal data. Access to information is restricted on a need-to-know basis and security arrangements are regularly reviewed to ensure their continued suitability. For further information see https://www.york.ac.uk/it-services/security/.

How do we transfer your data safely internationally?

In certain circumstances, it is necessary to transfer your Personal Data (including Special Category Data) outside the European Economic Area. In respect of such transfers, the BDC will comply with our obligations under Data Protection Law and ensure an adequate level of protection for all transferred data.

How long will we keep your data?

BDC will retain your data in line with legal requirements or where there is a business need. Retention timeframes will be determined in line with the University of York’s Records Retention Schedule.

What rights do you have in relation to your data?

Under the General Data Protection Regulation, you have a right of access to your data, a right to rectification, erasure (in certain circumstances), restriction, objection or portability (in certain circumstances). You also have a right to withdraw consent. You can verify or correct information in your record at any time by contacting the BDC Administrator at biorenewables@york.ac.uk or writing to the Biorenewables Development Centre at 1 Hassacarr Close, Chessingham Park, Dunnington, York, YO19 5SN. We will promptly correct any information found to be incorrect.

Questions or concerns

If you have any questions about this privacy notice or concerns about how your data is being processed, please contact biorenewables@york.ac.uk. The University of York’s Data Protection Officer can also be contacted at dataprotection@york.ac.uk.

Right to complain

If you are unhappy with the way in which BDC has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, see www.ico.org.uk/concerns