Privacy Notice

Privacy Notice

Who we are

Scotland’s Centre of Expertise for Waters (“CREW”, “we”, “us” or “our”), is a Scottish Government funded consortium between the James Hutton Institute (“Hutton”), Scottish Higher Education Institutes and Research Institutes (together ‘CREW’).

Hutton primarily manages CREW’s daily operations and is the Data Controller over any personal data processed about you for the purposes relating to the operation of this website, or as otherwise stated in this privacy notice. 

However, in some cases, Hutton requires to share your personal data with other consortium members (e.g. if relevant to a project application) and where this is the case, such members shall also be Data Controllers over your data for the purposes of their processing.

This privacy notice outlines what personal data CREW collects and processes about you in various situations, which we have explained below.  In short, such situations may be when you submit any project application to us,  interact with our website www.crew.ac.uk or its sub-domains (the “websites”), submit a webform to join the Register of Expertise, when we send you information about CREW related events and projects and any other interaction you have with us and during which we process your personal data. Please note that, through submitting a project application form or webform to join the Register of Expertise, accessing our website(s) and/or submitting an enquiry through the website(s), you are consenting to the collection, retention and use of your personal information in accordance with the terms of this privacy notice.

Please read through the privacy notice to understand how CREW uses and processes the information obtained from you and held about you. If you have any concerns about CREW’s processing of your personal data or you have a general enquiry in relation to data protection, please contact our Data Protection Officer at DPO@hutton.ac.uk.

Data protection principles

CREW is committed to protecting your personal data and adheres to the principles of the UK General Data Protection Regulation (GDPR) when processing your personal data.  This says that the personal data we hold about you must be:

1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.

What is personal data?

Personal Data: means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Special Category of Data: means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

When we use the term ‘personal data’ we mean both personal data and special category of data. The above definitions do not include anonymised data.

What personal data is CREW processing?

• Personal details (such as your name and e-mail address) which you provide by clicking on the enquiries@crew.ac.uk e-mail address or equivalent on the Contact Us page of the website(s).
• How you use the website and any other information you post, e-mail or otherwise send to us.
• IP addresses - we may collect information where available about your IP (internet protocol) address, operating system and browser type.  This data provides us with information about users’ browsing actions and patterns.  It is used to inform improvements to the website and for internal system administration.
• Personal data such as name, telephone number, job title and company email address in order for us to carry out business to business marketing of our services, ideals, or aims to your organisation, including sending to you our e-newsletter. 
• Personal data you have provided to us when submitting a project application.  This includes name, position, email address, telephone number of Principal Investigator/ Lead Applicant, Project Manager, Contract Manager, Finance Contract Details, Sub-Contractor (if applicable), CV including education/training and career history, details of your proposal.  We will also collect information about topic expertise on staff members proposed to be involved in the project as well as references.
• In addition to information we hold from the project application stage on lead applicants and participants on an application, once an application has been successful, we collect additional information for the ongoing management of your awarded project and related contract.
• Personal data you provide to us when you submit a webform for joining the Register of Expertise. This may include your name, position, email address, geographical region, telephone number, education/training/career history, topic expertise and skills and any communications relating to your Register membership .

Where did CREW obtain my personal data from?

We will obtain your personal data (see above) from you when you engage with us (e.g. when you submit an enquiry/project application/webform to join the Register of Expertise) or sign up for our newsletter or otherwise use our website(s).  

We may also obtain personal data from external referees (relative to a project application form) or from another person who has included your details in a project application form. 

Does CREW use Cookiesⁱ?

Cookies are small text files that are stored on your computer or mobile device when you visit CREW’s website.  They do not cause your computer any harm nor do they identify you personally, they only identify the computer being used to access the site.  The cookies obtain information in relation to your use of the website. CREW uses this information to help us monitor the use of our website and be able to then provide you with a better user experience by remembering how you like things displayed, measuring how you use the website, ensuring the website works properly and improving navigation.  Further information on how CREW uses cookies is available in Hutton’s Cookies Policy.

Where will CREW keep my data?

Your personal data will be stored on a secure server at Hutton located in the UK.

Why is CREW processing my personal data?

1. When you are submitting a project application, CREW is processing your personal data for the purposes of:

• Assessing your eligibility and suitability for CREW funding, reviewing and processing proposals and project applications and corresponding with you to advise on your submitted applications.
• Administering our funding management system.
• Monitoring and reporting e.g. on application trends. Where appropriate, we invite you to provide feedback on your experience of applying for a CREW project, how we may improve on how we do things etc.

NOTE: We are relying on research as a task which we carry out in the public interest when processing your personal data for purposes pertaining to the submission, evaluation and management of project applications. 

2. When you are a CREW grant holder or participant on an awarded grant, we use your information for:

• Administering and managing your awarded project and related contracts.
• Notifying you about changes to our funding schemes, conditions, policies or privacy terms.
• Monitoring the progress of your awarded project.
• Managing our project management system.
• Keeping in touch with you about your awarded project. This includes sending you update emails and inviting you to attend meetings or other events run by CREW and its partners which are of relevance to your awarded project.
• Contacting you for feedback and suggestions for improvements on how we do things.
• Publishing information on CREW projects on our website or social media. This may include name of grant holder researcher and project research team and their organisation, project title and summary, project outputs. We will only publish the names of individuals where we have their consent to do so.
• Metrics, evaluation, learning and reporting purposes, e.g. on how CREW funds or reach and impact of CREW projects etc.

NOTE: We are relying on research as a task which we carry out in the public interest when processing your personal data for purposes pertaining to ongoing management of funding and awarded projects.

3.  When you are submitting a webform to join the Register of Expertise, we use your personal data for the purposes of:

• Enabling your registration in the Register and providing you with a relevant online account.
• Knowing who the experts/ members of the water community willing to engage with CREW are as well as their area of expertise, skills, role and geographical area, based on their self-defined textual sources of evidence.
• Contacting the members of the Register about CREW projects and activities and informing them about CREW and the wider water community updates.
• Managing the Register as a knowledge asset for the water community by sharing it online (as an expert-finding and expert-recommendation interface with the public) and allowing both the public to search for the members of the register and the members of the register to be found.

NOTE: Our lawful basis for processing your personal data for the above purposes is your consent, except for contacting you about CREW projects and activities (second bullet point) when we will rely on legitimate interests.

You can remove your data from the register of expertise at any time by logging in and deleting or suspending your profile.

No contextual/secondary information will be collected. The searchability of the experts on the register will be relying solely on matches to the information submitted by the experts at the time of registration.

4. Other purposes:

• Responding to your enquiries submitted by post, telephone, online via our website, social media or email. By sending these communications to us you are consenting to us processing your personal data to process and respond to your enquiry.
• Sending you information about CREW that we think you may be interested in including sending you our newsletter, communications about events, and activities or projects CREW is running or otherwise supporting.  We are relying on your consent for this. You can opt-out of this at any time by sending an email to enquiries@crew.ac.uk and requesting to be removed from the mailing list or clicking the opt-out link in your emails.
• In relation to IP addresses, we use this to inform improvements to the website and for internal system administration. By using the CREW website and providing your personal data via the enquiry page or otherwise through the website you are consenting to CREW processing your personal data for these purposes.

Is CREW processing particularly sensitive information?

"Special category" or particularly sensitive personal information (see section “What is Personal Data?”) that we hold about you require higher levels of protection under data protection law. We need to have further justification for collecting, storing and using this type of personal information.

Where possible, “special category” data collected via diversity monitoring surveys will be collected on an anonymous basis.

Where we need to collect “special category” data (such as information about your ethnicity, race and disability) on a named basis for diversity monitoring purposes, we will do this with your explicit consent,  which can be withdrawn at any time by emailing enquiries@crew.ac.uk.

If we require   to process any further special category data from you or for another purpose we will provide you with full details of the information that we need and our reason for processing it to allow you to carefully consider whether you wish to provide us with your explicit consent to do so You should be aware that it is not a condition of your contract with us and you are under no obligation to provide us with your explicit consent.

Will my personal data be shared with any other organisation/third parties and if so, why?

We would share your personal data externally where we are required to do so in accordance with law or any regulatory requirement to which CREW is subject or where we are undergoing a corporate restructure.

Also, as noted above, where you are the lead applicant or a participant on the CREW project application, Hutton may need to share your personal data with other consortium members  forming part of CREW or  our funding partners, such as RESAS.  We may also need to share some personal data with external reviewers, advisors and referees in order to evaluate/validate  your application . 

Also, we may need to share your data with partner organisations with whom CREW holds events, e.g. when registering you for CREW events.

The personal data you submit during the registration process for the Register of Expertise will be publicly available to allow your expertise to be found.

In addition, we may need to share your data with third-party service providers where we use them to perform services on our behalf. This may include but is not limited to our IT and communications systems providers, email marketing and communications providers for the distribution of emails/newsletter on our behalf, third party survey providers, event registration system providers, event venue operators, travel security partners and travel management/transportation providers. We may also share your data with institutions we use for the purpose of facilitating the collection and sharing of research outcomes/outputs data e.g. via Researchfish.

We do not allow our third-party service providers to use your personal data for their own purposes. We do not sell your personal data to third parties under any circumstances or permit third parties to sell on the data we have shared with them. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

Will my personal data be shared outside of the UK?

We will share your information with individuals and organisations outside CREW who are connected to or provide services on behalf of CREW, some of whom may be based outside of the UK. Where personal data is required to be shared outside the UK, CREW will adhere to the requirements of data protection legislation (i.e. ensure that adequate technical and organisational controls are in place.) CREW will ensure that appropriate agreements with regard to data sharing are in place with parties outside the UK. 

Two of the most common jurisdictions we may transfer data to are the EU and the US.  The EU is deemed adequate by the UK in terms of providing adequate levels of security for your personal data.  The US is not viewed in the same way therefore we typically put in place Standard Contractual Clauses (or an International Data Sharing Agreement) when transferring to the US with a view to ensuring that your personal data is protected adequately.  This may change over time however we will ensure that appropriate transfer mechanisms are in place.

The personal data you submit during the registration process for the Register of Expertise will be publicly available to allow your expertise to be found and as such will be accessible globally.

Is my personal data safe?

CREW works hard to protect your personal data and have adopted appropriate technical and organisational measures to keep it safe from unauthorised disclosure, alteration or destruction.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted to CREW via the internet; any transmission is at your own risk.

 How can I stop CREW using my personal data for marketing purposes if I no longer wish to receive communications from CREW?

If you no longer wish to receive communication from CREW and would like your personal data removed from our database, please e-mail our Administrator on enquiries@crew.ac.uk.

How long will CREW retain my personal data?

CREW will keep your personal data for no longer than is necessary for the purpose we obtained it for or until such time that you withdraw your consent and/or exercise your right to request that CREW stops processing your personal data.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

 Does CREW make any automated decisions about me or profile my personal data?

CREW does not make automated decisions about you and also does not profile your personal data.

 What are my rights in relation to the personal data CREW holds about me?

We have summarised your rights below.  Please contact our Data Protection Officer at DPO@hutton.ac.uk to exercise these.  Please note that some of these rights are not absolute rights and there are instances where we can refuse to comply with your request.  Each request will be reviewed on a case-by-case basis.

• If we are relying on your consent, you can withdraw your consent at any time, at which point we shall stop processing your personal data in that way.  Please note this does not affect the legality of our processing up to the date of your withdrawal of consent.
• You can seek to restrict our processing of your personal data, ask us to rectify any personal data we hold about you or (where we process your data for marketing purposes) object to us processing your personal data for the purposes stated above. 
• You have the right to lodge a complaint with the Information Commissioners Office (ICO) if you think that we have infringed your rights. You can find more information about reporting a matter on the ICO’s website.
• You have the right to access personal data held by us about you.
• In certain circumstances you have the right to ask us to provide you with your personal data in a structured, commonly used and machine-readable format to allow you (or us on your behalf) to transmit this information to another party.  More information can be found on the ICO's website.
• In certain circumstances you have the right to ask us to erase the personal data we hold about you. Such circumstances include (a) where we no longer need your personal data for the purposes set out above; (b) if you withdraw your consent to our processing; (c) if you object to our processing based on our legitimate interest and we have no overriding legitimate grounds to continue processing your personal data; (d) if we process the data unlawfully; or (e) where the personal data has to be erased to comply with legal obligation to which we are subject.  We will consider any such request in line with GDPR.  Please note this is not an absolute right and there may be circumstances where we choose not to delete all of the personal data which we hold about you.  More information about your right of erasure can be found on the  ICO's website.

Third Party Links

CREW’s website may, from time to time, contain links to and from the websites of third parties. If you follow a link to any of these websites, please note that these websites and any services that may be accessible through them have their own privacy notices and that we do not accept any responsibility or liability for these notices or for any personal data that may be collected through these websites or services, such as contact and location data. Please check these notices before you submit any personal data to these websites or use these services.

 Changes to Privacy Notice

We reserve the right to amend this privacy notice. However any changes we may make to our privacy notice in the future will be communicated to you in some manner.

 Contact

Questions, comments and requests regarding this privacy notice are welcomed and should be addressed to: DPO@hutton.ac.uk

Last updated March 2023