Data Protection Privacy and Cookies Notice for the Archives for Education project
What is this privacy notice about?
This privacy notice explains how the Archives for Education project ("we", "our", "us") collects, uses and shares your personal data (information) and your rights in relation to this data. The notice relates to our processing of personal data of website visitors, enquirers, applicants and others ("you", "your") who visit, contact or submit information to Archives for Education project and its website.
This privacy notice answers the following questions:
· What is the role of the Archives for Education project?
· How do we collect your information?
· What types of information do we collect about you?
· How will we use your information?
· What legal basis do we have for processing your information?
· Who will we share your information with?
· For how long do we keep your information?
· Who can you contact about your information?
Because the Archives for Education project is a research activity run by Kingston University the University is the data controller of your personal data and is subject to the General Data Protection Regulation (the "GDPR") and the UK Data Protection Act 2018. As such, we are listed on the Information Commissioner’s Office (ICO) register of fee payers.
You can find a copy of the University’s Data Protection Policy online along with copies of our other relevant information regulations.
We may update this privacy notice periodically and if we do we will publish this on the Archives for Education project website.
What is the role of the Archives for Education project?
The Archives for Education project makes available documentaries from the BFI National Archive and BBC Archive for creative reuse by student filmmakers on course-related projects in universities across the UK through educational licensing agreements with the BFI and BBC. The project is led by Dr Shane O’Sullivan, a senior lecturer in filmmaking at Kingston University, London and nine universities are currently signed up to the scheme, including Bournemouth University, Kingston University, Roehampton University, Screenology (Bristol), Sheffield Hallam, University College Cork, University of Lincoln, London Southbank University and Southampton Solent University.
[Shane – you should describe your project briefly here including the relationship with Kingston University as well as the BFI, BBC and other universities.]
How do we collect your information?
Information provided by you
We do not actively seek information from our website visitors. However, we may hold some of your personal data if you have previously expressed an interest in the project or you use the contact details available on our website to make an enquiry.
The cookies we use
Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.
The project website is hosted by Squarespace, which uses necessary and functional cookies, which are needed to run the site. These are automatically applied but under the UK’s Privacy and Electronic Communications Regulations it is not necessary to obtain consent to use them.
The website also uses analytical and performance cookies that collect information on how you use the site. We use this information, for example, to understand traffic sources and numbers of unique visitors. Under the regulations it is necessary to obtain consent to use these types of cookies. To comply, these cookies will be restricted until you accept the confirmation message on our cookie banner. There is no impact on you user experience if you choose not to accept these cookies. [WD1]
A full list of both sets of cookies is provided at the end of this policy.
What types of information do we collect about you?
We may collect the following types of personal data about you:
· your name, contact details and any other personal information that you might provide in correspondence between us and you;
· details about your website page visits including date, time, IP address, referrer, browser version and operating system only if you accept the analytical and performance cookies.
How will we use your information?
Your data will be used for the following purposes:
· to correspond with you;
· to measure the performance of our website.
What legal basis do we have for processing your information?
There are a number of legal bases for processing personal data but for processing your personal data we rely upon consent.
Who will we share your information with?
Your personal data will not be shared with anyone else without your consent. Any personal data you might share with us will be stored and accessed using equipment managed by Kingston University.
For how long do we keep your information?
We will store your information in line with Kingston University’s Retention Policy for the duration of the project.[WD2]
Cookie data will be stored for the length of time set out in the tables at the end of this policy.
How do you make sure my information remains accurate?
It is important that the personal information we hold about you remains accurate. Please tell us as soon as possible about any changes to the information we hold about you. This is particularly important for your contact details.
What are your rights?
Under the GDPR and the DPA 2018, you have the following rights:
· to access from us the personal data we hold about you;
· to require us to correct the personal data we hold about you if it is incorrect;
· to require us to erase your personal data;
· to require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
· to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format and the right to transmit that data to another controller;
· to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights;
· to not be subject to a decision based solely on automated processing, including profiling, which has a legal effect on you.
Please note that the above rights are not absolute and we may be entitled to refuse requests where exceptions apply.
If you have given your consent and you wish to withdraw it, please contact Shane O’Sullivan at s.osullivan@kingston.ac.uk. Alternatively you can contact Kingston University’s Data Protection Officer using the contact details set out below.
Who can you contact about your information?
If you wish to request access to the personal data we hold about you please use the Subject Access Request Form available online. For any other queries about this privacy notice or how we process your personal data you can contact our Data Protection Officer by email: DPO@kingston.ac.uk or by post: Data Protection Officer, Vice Chancellor’s Office, River House, 53–57 High Street, Kingston upon Thames, Surrey KT1 1LQ.
If you are not satisfied with how we are processing your personal data, you can make a complaint to the Information Commissioner.
You can find out more about your rights under data protection legislation from the Information Commissioner's Office website.
Cookies
Below is a full list of all the cookies that may be used on the website.[WD3]
Necessary and functional cookies
Cookie Name
Duration
Purpose
Crumb
Session
Prevents cross-site request forgery (CSRF). CSRF is an attack vector that tricks a browserinto taking unwanted action in an application when someone’s logged in.
RecentRedirect
30 minutes
Prevents redirect loops if a site has custom URL redirects. Redirect loops are bad for SEO.
CART
2 weeks
Shows when a visitor adds a product to their cart
hasCart
2 weeks
Tells Squarespace that the visitor has a cart
Locked
Session
Prevents the password-protected screen from displaying if a visitor enters the correct site-wide password.
SiteUserInfo
3 years
Identifies a visitor who logs into a customer account
SiteUserSecureAuthToken
3 years
Authenticates a visitor who logs into a customer account
Commerce-checkout-state
Session
Stores state of checkout while the visitor is completing their order in PayPal
squarespace-popup-overlay
Persistent
Prevents the Promotional Pop-Up from displaying if a visitor dismisses it
squarespace-announcement-bar
Persistent
Prevents the Announcement Bar from displaying if a visitor dismisses it
Test
Session
Investigates if the browser supports cookies and prevents errors.
Analytical and performance cookies
Cookie Name
Duration
Purpose
ss_cid
2 years
Identifies unique visitors and tracks a visitor’s sessions on a site
ss_cvr
2 years
Identifies unique visitors and tracks a visitor’s sessions on a site
ss_cvisit
30 minutes
Identifies unique visitors and tracks a visitor’s sessions on a site
ss_cvt
30 minutes
Identifies unique visitors and tracks a visitor’s sessions on a site
ss_cpvisit
2 years
Identifies unique visitors and tracks a visitor’s sessions on a site
ss_cookieAllowed
30 days
Remembers if a visitor agreed to placing Analytics cookies on their browser if a site is restricting the placement of cookies
[WD1]This was one of the options we discussed briefly in our email exchange. It is the approach I would recommend as the option is there. If you choose another option this should be amended accordingly.
[WD2]KU does not yet have a fixed retention period for email, which is what I assume any personal data you hold will be. So deletion will have to be manual. You can select any reasonable period and so I have gone for the duration of the project. You can amend.
[WD3]Clearly not all these cookies will be placed on your website. It depends on the functionality you deploy. So you may want to remove some once the site is running and you know the exact cookies being used.