Your use of this website is subject to the following terms of use.
Who are MRC PPU Reagents and Services (MRC PPU R&S)
MRC PPU R&S (‘we’, ‘our’ and ‘us’) brings together the seven research councils, Innovate UK and Research England and was established by the Higher Education and Research Act 2017 Articles 91, 92 and 93. Further information about our work in funding research and innovation and supporting a thriving and inclusive research system can be found across our websites, including our about us pages.
We are registered with the Information Commissioner’s Office with the registration number za333592. UKRI is the data controller for the personal information we process, unless otherwise stated. Our registered office is: Polaris House, Swindon SN2 1FL.
Our Data Protection Officer (DPO) is:
David Hyett
Head of Information Governance
Polaris House
Swindon
SN2 1FL
Email: dataprotection@ukri.org
If you have a question or concern about how personal information is handled then please contact our DPO. You also have a right to raise issues with the Information Commissioner’s Office.
Close allsections
Our data protection policy
UKRI understands the importance of protecting personal information and we are committed to complying with UK data protection legislation, including the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
We are committed to fostering a culture of transparency and accountability by demonstrating compliance with the principles set out in the legislation as laid out in our data protection policy (PDF, 190KB).
This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you. It applies across UKRI, to our councils, Innovate UK and Research England and to our research centres, units and institutes.
On some of our websites this notice is supplemented with additional privacy policies or transparency information.
Our partners
We work with third parties who provide services and with partners across the research and innovation system.
Where we use third parties as data processors to deliver, services agreements are in place which address how personal data is managed. Examples of third party data processors include UK Shared Business Services Limited (UK SBS), who provide our:
- Web hosting services.
Partners across the research and innovation system include:
- other research funding bodies, in the UK and internationally
- higher education institutions and institutes
- innovative businesses
- investors
- not-for-profit organisations
- policy makers.
We will not share personal information with partners and third parties other than to:
- comply with any legal obligation
- enforce or apply our terms of use and other agreements
- protect the rights, property, or safety of MRC PPU R&S or others.
What personal data we process and why
When we ask you for personal data, we will:
- tell you why we need it
- only ask for relevant information
- look after it and make sure it is only accessible to those who need to see it
- only keep it for as long there is a business, statutory or legal obligation (see our retention policy below)
- not to make your personal information available for commercial use without your permission.
In return, we ask you to:
- give us accurate information
- tell us as soon as possible if there are any changes.
The types of personal data processed and the lawful basis for processing depends upon the relationship you have with us. In the sections that follow we have outlined the purposes for which we process personal information and the type of personal information for our different relationships.
When we carry out processing in pursuit of our purposes laid out in Article 93 of the Higher Education and Research Act 2017, in the most part, our lawful basis for processing your personal information falls under ‘public task’.
The processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law. We also make use of contractual, legitimate and consent based processing.
Other lawful bases likely to be used include:
- performance of a contract
- legitimate interests
- legal obligation.
Users of the MRC PPU R&S website
We may collect and process personal information using public task, legitimate interest, performance of a contract, or consent as the lawful basis:
- information that you provide by filling in forms or surveys
- information in correspondence that you send us
- information you provide in accessing products or services, including payment, contact and delivery information
- details of your visits to our websites including, but not limited to, traffic data, location data, weblogs and other communication data, and the resources that you access.
We may use personal data we collect to:
- ensure that content from our website is presented in the most effective way for you
- provide you with information, products or services that you request from us or which we feel may interest you, where you have consented to be contacted for such purposes
- provide you with a means to access or purchase products and services
- allow you to participate in interactive features of our services, when you choose to do so
- notify you about changes to our websites or services.
We do not generally provide any personal information about users of our website to third parties or other users. Personal information may be shared with partners and other third parties to provide services or if we are under a duty to disclose or share information as discussed above.
Suppliers
We collect and process personal information for the following reasons using public task, contractual and legitimate interest as a lawful basis:
- service provision and management
We may share personal information with third parties for the reasons identified above and earlier in this Privacy Notice.
Children and young people
We do not collect and process personal information about children and young people.
How long we keep your personal information
We may retain personal information based upon business requirements, legal obligation, statutory or regulatory obligations and transactional purposes.
If you want to know how long we keep personal information, please contact our data protection officer.
Email: dataprotection@ukri.org
Your rights as a data subject
Under data protection law, you can exercise your rights according to the lawful basis used for processing. All individuals have the right to:
- to be informed about how your information is being processed
- access a copy of your personal information
- rectification if your personal information is inaccurate or changes.
And then the following rights are determined by the lawful basis:
- erasure
- restrict processing
- object to
- portability
- not be subject to a decision based on automated processing, including profiling.
When you contact us to exercise your right, we will:
- respond to acknowledge your request has been received
- write to tell you if your request is not applicable and give the reasons why
- act on your request within the time period as per the current data protection law
- write to inform you if we need to extend the period of time required to respond due to the complexity
- discuss with you the exemptions to most of these rights in research, depending on the circumstances. The law does not allow any exemption to your rights to be informed or to restrict processing.
How and when you can withdraw consent
Where consent has been used as the lawful basis for processing your information, you have the right to withdraw said consent.
You can do this, by contacting our data protection officer.
Email: dataprotection@ukri.org
When you have provided consent to take part in research, it is unlikely to be the lawful basis for processing personal data, but this consent can still be withdrawn or amended.
If you wish to do so, you need to contact the study team directly.
Changes to this privacy notice
Changes to the Privacy Notice will be listed below, starting with the most recent.
29 November 2022
Created