Privacy Policy - The Data Lab

Our Privacy Policy

The Data Lab is committed to preserving your privacy. This policy sets out how The Data Lab (“we”, “our” and “us”) uses and protects personal information that we collect from you when you visit or use our websites (including www.thedatalab.com and www.dataskillsforwork.com) and other services, including attending our events. This also applies when we are introduced in a business context and share contact information. This privacy policy may be supplemented by additional privacy statements, terms or notices provided to you.

As a Scottish Innovation Centre, The Data Lab is administered and hosted by the University of Edinburgh meaning that we are the same legal entity. The University of Edinburgh is a registered charity with registration number SC005336.

1. Information about you

INFORMATION WE COLLECT	REASONS FOR COLLECTING IT	LEGAL BASIS
Correspondence Information: Information you provide to us when you contact us (or third parties that carry out work on our behalf) about any of our services, are involved in a project with us or meet us in a business context: this may include your name, job title, organisation or academic institution you are associated with, contact details and address.	If you contact us to enquire about any aspect of our business or services or to apply for a job with us, we will collect your personal information in order to respond to your query appropriately.	On the basis of our and your legitimate interests. Our interests being that we would like to assist you with any queries you may have or inform you about our services or, where applicable, consider you for the role.
Contract/Application Information: Information you provide to us (or third parties that we work with e.g. ticketing platforms) when you enter (or wish to enter) a contract with us in relation to our services / funding, for example, where you apply to us for funding, enter a competition or sign up to one of our events: this may include your name, address, contact details, payment details and where you sign up to an event, your dietary requirements.	If you enter a contract with us or apply for our services, we will collect your personal information to enable us to provide those services or take steps to assess whether we can enter the contract with you. We may collect dietary requirements when you attend our events to allow us to provide you with suitable catering. This information could contain special category data, e.g. your religion.	To fulfil our obligations under the contract or to carry out necessary steps prior to determining whether we can enter the contracts. We will only collect this information on the basis of your consent.
Eligibility Information: If you are an individual applying for funding in relation to our Data Skills for Work programme, the Application Information you provide to us may also include details in relation to your eligibility which includes information relating to whether you are in receipt of Universal Credit or income related benefits, and information relating to barriers or disadvantages as defined by Scottish Government guidance (e.g. whether you have a disability).	We will collect this information to enable us to assess whether you meet the eligibility requirements for receiving funding under the Data Skills for Work programme and to ensure that we are properly spending and accountable for the funding.	We collect this information on the basis of legitimate interest and substantial public interest.
Survey Information: The Data Skills for Work Programme will conduct surveys with volunteers in relation to data skills among job seekers. This may include your contact details, recordings of your participation in focus groups and information relating to barriers or disadvantages as defined by Scottish Government guidance (e.g. whether you have a disability).	We will collect this information to help us improve our Data Skills for Work programme and ensure that it is effective in assisting individuals affected by barriers or disadvantages in the work place.	These surveys will be carried out on a voluntary basis so we will only collect this information where we have your consent to do so.
Case studies / follow up information: Where you have received Data Skills for Work funding from us, we may contact you to ask for updates as to the impacts the funding has had. This may include your current work or education.	This helps us to assess whether the Data Skills for Work programme is effective in helping individuals progress in the workplace. We may also use this for marketing purposes.	On the basis of our legitimate interests, being that we wish to ensure the use of our funding is effective and that we can market the programme. We will only identify you in the marketing material where you have consented to us doing do.
Event Statistics Information: Additional information you provide to us (or third parties that we work with e.g. ticketing platforms or associated events) where you attend our “DataFest” events, hosted by us or our event partners: this may include your gender, job title, occupation, organisation sector and industry you work in.	We collect this information to assist us in assessing who the market for our events are and to assess whether we are attracting a diverse audience. This is to allow us to ensure we meet our aims in terms of diversity and ensuring our events are relevant and helpful.	On the basis of our and your legitimate interests, our interests being that we wish to attract a diverse audience and ensure our events are relevant and useful.
Newsletter Information: Information that we collect about you when you sign up to our email newsletters, podcast series or to follow up information from events: this may include your name and contact details	We collect this information in order to send you our newsletters/marketing communications. This allows us to communicate what is going on at The Data Lab and in the wider data and technology community.	We only send you these emails where you have provided your consent and you may unsubscribe at any time by following the link in the email.
Cookies Information: Information that we collect about you by way of cookies: this includes your IP address, browser type, operating system and activity on our websites	We use these cookies to improve your experience of using our websites and to allow us to assess how visitors use our websites so we can improve these.	Other than cookies which are strictly necessary for the functioning of our website, we will use cookies only on the basis of your prior consent. Please see the cookies section below for more information.
Photographs and videos: We may capture photographs or videos of you in the following circumstances: - where you have agreed to provide video content for our online training courses or marketing materials; - where you have participated in our webinars or virtual events; and - where you have attended our events or partner events.	We may use these photographs and videos to provide training and/or to promote our services and future events	On the basis of legitimate interests, our legitimate interests being that we wish to advertise our events / services and / or provide training. We only use these images or videos of you where we (or our event partners) have informed you beforehand and given you the chance to request not to be included. If you change your mind at any time, please let us know.

2. Cookie Notice

We also collect some personal information, such as the IP address of your computer, through the use of website cookies. You can set your preferences for these cookies through our cookie banner.

What is a cookie?

A cookie is a small data file that certain websites write to your hard drive when you visit them. The only personal information a cookie can obtain is information a user supplies him or herself. A cookie cannot read data from your hard disk or read cookie files created by other sites. Cookies, however, enhance our website performance in a number of ways, including providing a secure way for us to verify your identity during your visit to our website and personalising your experience on our website, making it more convenient for you.

What types of cookies do we use?

Strictly Necessary Cookies

These cookies are essential to enable you to move around the website and use its features. Without these cookies, we cannot provide some of the basic functionalities of our website.

Performance Cookies

These cookies generally collect information about how visitors use our website, for instance which pages visitors go to most often, and the pages that they do not. This helps us to understand and improve the site, so it is easy to use and includes helpful content. They also allow us to fix bugs or glitches on the website. These cookies do not collect information that identifies visitors, so we cannot identify you individually. We use Google Analytics to track usage of our websites and interaction with our newsletters. For example, to see what content you click on, so we can analyse what content is of most interest to our audience.

Functionality Cookies

These cookies allow our website to remember the choices you make as you browse the site. They provide more enhanced and personal features. The information collected is anonymised and they cannot track your browsing activity on other sites once you leave our site.

How to block cookies

You can restrict or block cookies which are set during your use of the website by changing your browser’s settings. Some pages may not work if you completely disable cookies, but many third party cookies can be safely blocked.

Check information in your browser’s help section for specific instructions on how to manage cookies. Alternatively, websites such as “All About Cookies” provide comprehensive guidance.

Guide to managing cookies

3. Sharing tools and Links to Third Party Websites

This website uses sharing tools. Sharing tools allow you to share content through social networks such as Facebook, LinkedIn or Twitter. When you click on a sharing button, the social networking site may place a cookie on your computer. This would be a third-party cookie set by the social networking site. If you have any questions about the use of these third-party cookies, you should check the relevant social networking site’s cookie policy. As we want your experience of our website to be as informative and useful as possible, we provide a number of links to websites operated by third parties.

Please be aware that we do not have any control over third party websites and that such third party websites may send their own cookies to users, or otherwise collect data or solicit personal information.

We cannot be responsible for the protection and privacy of any information which you provide whilst visiting such third party websites and so these are not governed by this privacy policy. We encourage you to review each third party website’s privacy policy before browsing and interacting with the website in question.

4. Retention of your information

We will retain your personal information for as long as we reasonably require in light of the purpose(s) for which we are holding it and all relevant legal, commercial and operational considerations.

As a Scottish Innovation Centre, we may have to comply with statutory retention periods as required by our funders.

5. Disclosure of your information

We will never sell or trade your personal information to others.

We use third party service providers and suppliers to deliver certain services. We put contractual arrangements in place with these third parties to ensure they are obliged to protect your personal information.

We only share your personal information where it is reasonably necessary to properly administer our business and/or to comply with law / regulations.

The following third parties may have access to your personal information:

Software providers – we use various software providers to enable us to administer our business, these providers include the providers of our email system, automated email mailing list system, content management system and the host of our website.
Event organisers – where we hold events we may need to share some of your personal information with third party organisers of the event, for example to put in place a guest list of ticket holders.
Regulators, government departments, law enforcement authorities, tax authorities, accountants, insurance companies, professional advisers, dispute resolution bodies or the courts – where necessary to comply with law or enforce or rights; and
Scottish Funding Council, Scottish Government, Scottish Enterprise and/or Highlands and Islands Enterprise – as a Scottish Innovation Centre we have certain reporting duties to our funders.
Consultants – we use third party consultants where we require specialist assistance to deliver our services and where these are required on a short term or ad hoc basis, this includes specialist training providers, marketing / technology specialists and recruitment specialists;

Some of these entities may also be data controllers but please contact us in the first instance if you have any questions.

6. European Economic Area

The information we collect from you may be stored inside the UK, the European Economic Area (“EEA”) or outside the EEA.

If you live or work outside of the EEA, we may need to transfer your personal information outside of the EEA to correspond with you. Where this applies, we will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with this privacy notice.

We may transfer personal information outside the EEA where our service providers host, process, or store personal information outside the EEA. Where this is the case we use contractual arrangements and safeguards to protect this personal information, these safeguards include:

The country to which the personal information will be transferred has been deemed to provide an adequate level of protection for personal information by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.
Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal information the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to non-EU countries.
Where we use providers based in the US, we may transfer personal information to them if they are part of the Privacy Shield which requires them to provide similar protection to personal information shared between the Europe and the US. For further details, see European Commission: EU-US Privacy Shield

Please contact us if you want further information on the specific mechanism used by us when transferring your personal information out of the EEA.

7. Your rights under data protection laws

All individuals have a number of rights under data protection laws. However, they do not apply in all circumstances.

If you wish to exercise any of them, please email us (details provided below) and we will explain at that time if they are applicable or not.

We will inform you in writing following receipt of your written request and if necessary, seek additional information from you about your request, including proof of identity.

The right to request access to your personal information, be informed about the processing of your personal information and receive a copy of the personal information we hold about you. We are obliged to respond to any such request within one month of receiving a request, subject to limited exceptions.
The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed.
The right to object to processing of your personal information.
The right to restrict processing of your personal information.
The right to have your personal information erased (the “right to be forgotten”).
The right to move, copy or transfer your personal information (“data portability”).
The right to withdraw your consent to processing (if consent is relied upon by us to process the personal data).
Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you.
At all times, you have the right to complain to the Information Commissioner’s Office which enforces data protection laws: https://ico.org.uk/.

8. Security

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted online or through the website. Any transmission is at your own risk. Once we have received your information, we use strict procedures and security features to try to prevent unauthorised access.

9. Changes to our Privacy Policy

This Privacy Policy was updated in November 2020 to include our new Data Skills for Work Programme.

We may further amend this Privacy Policy from time to time to take account of changes to our processing and regulatory changes. We encourage you to review it from time to time. If we make any substantial changes we will notify you by posting a prominent notice on our website.

10. Contact Details

Please help us keep our records updated by informing us of any changes to your e-mail address and other contact details.

If you have any questions about this privacy policy, including if you wish to exercise any of your rights, please contact us at info@thedatalab.com with the subject line “privacy policy”.

This privacy policy was last updated in April 2020.