CoSTAR National Lab Privacy Policy

The CoSTAR National Lab (“CoSTAR”) is Royal Holloway, University of London (“Royal Holloway”), The University of Surrey ("University of Surrey"), Abertay University ("Abertay University"), the National Film and Television School ("NFTS") and Disguise Technologies Limited (“Disguise”). 

This privacy notice relates to the information you provide to The CoSTAR National Lab (“CoSTAR”). CoSTAR is committed to being transparent about how we collect and use your personal data and to meeting our obligations under data-protection law. 

We, Royal Holloway, University of London, Egham Hill, Egham, TW20 0EX, telephone number 01784 434455, University of Surrey, Stag Hill, University Campus, Guildford GU2 7XH, Abertay University, Bell Street, Dundee, Scotland, DD1 1HG, National School of Film and Television, Beaconsfield Studios, Station Road, Beaconsfield, Bucks HP9 1LG and Disguise Technologies limited, 88-89 Blackfriars Road, London, SE1 8HA are the data controllers for personal data relating to you that we process. 

Where do we get your personal data from? 

We process personal data supplied to us by our website and its associated forms, including, but not limited to, Zoho, Airtable, Mailchimp, Eventbrite registrations, Microsoft Teams Webinar registrations and SurveyMonkey surveys administered to participants in our activities and events. 

What personal data about you might we hold? 

Information held about you may include: 

• your name; 

• your email address; 

• your telephone number; and 

• your company name. 

• your role/job title 

• Which CoSTAR Network events, webinar or programmes you have taken part in

Why do we process your personal data? 

We only process your personal data for specified purposes and if it is justified in accordance with data-protection law. The table below lists the various purposes for which we process personal data and the corresponding justification for it. 

Who can access your personal data? 

All CoSTAR National Lab members who administer this project and our partners in the CoSTAR National Lab programme will be able to access your personal data. We will not share your personal data with any other third parties or use it for marketing purposes other than as detailed above. 

We use Google Forms, Zoho, Mailchimp and SurveyMonkey to collect and store some of your personal data. Some of these organisations are based outside of the EU.  

Please refer to their privacy policies for more information on how they handle your data. 

Google’s Privacy Policy can be found here: https://policies.google.com/privacy?hl=en.  

Zoho's privacy policy can be found here: https://www.zoho.com/privacy.html.  

Survey Monkey's Privacy Policy can be found here: https://www.surveymonkey.com/mp/legal/privacy-policy/ 

Microsoft's Privacy Policy can be found here: https://www.microsoft.com/en-gb/privacy/privacystatement 

Airtable’s Privacy Policy can be found here: https://www.airtable.com/company/privacy 

Mailchimp’s Privacy Policy can be found here: https://mailchimp.com/legal/prior-privacy-policy/ 

How long do we keep your personal data? 

We will normally keep your data which you have supplied to us for the purposes of expressing your interest in the CoSTAR Network for the minimum duration of the CoSTAR Network programme, which we expect to last until March 2029.   

If the programme continues past that date, we will contact you to ask if you consent to us keeping your data. 

If you go on to take part in a CoSTAR Network project, we will continue to retain your personal data for the purposes of facilitating your participation in the project, informing you for opportunities and activities, and for analysis and evaluation of CoSTAR for up to ten years past the point that the project came to a close. There will be a separate privacy notice, covering these issues at the point of your involvement in the project.

What are your rights? 

You have the following rights in relation to your personal data processed by us: 

• to gain access to your personal data;

• to rectify inaccuracies or where appropriate, given the purposes for which your data is processed, the right to have incomplete data completed;

• to have your personal data erased. This is a limited right which applies, among other circumstances, when the data is no longer required or the processing has no legal justification. There are exceptions to this right, such as when the processing is required by law or in the public interest;

• to object to the processing of your personal data for marketing purposes. If you ask us to delete your personal data, we will continue to maintain a core set of personal data comprising very brief information to ensure that we do not inadvertently contact you in future;

• to object to the processing of your personal data when such processing is based on the public interest or other legitimate interests, unless we have compelling legitimate grounds to continue with the processing;

• to restrict the processing of your personal data. This is a limited right which will apply in specific circumstances and for a limited period;

• to ask for the transfer of your data electronically to a third party; and

• where the legal basis for us processing your personal data is your consent, to withdraw that consent at any time.
  
  

You may exercise your rights against each of the members of the CoSTAR National Lab. 

Exercising your rights, queries and complaints 

For more information on your rights, if you wish to exercise any right or for any queries or complaints you may have, please contact a Data Protection Officer: 

Royal Holloway’s Data Protection Officer: Data Protection Officer FE029 – Founders East, Royal Holloway, University of London, Egham Hill, Egham, TW20 0EX, +44 (0)1784 414477 

dataprotection@royalholloway.ac.uk 

NFTS’s Data Protection Officer: Data Protection Officer, NFTS, Beaconsfield Studios, Station Road, Beaconsfield, Bucks HP9 1LG 

dataprotection@nfts.co.uk 

University of Surrey’s Data Protection Officer: Data Protection Officer, University of Surrey, Guildford, Surrey, GU2 7XH 

dataprotection@surrey.ac.uk 

Abertay’s Data Protection Officer: Data Protection Officer, Abertay University, Kydd Building, Bell Street, Dundee, DD1 1HG 

dataprotectionofficer@abertay.ac.uk 

You also have a right to complain to the Information Commissioner’s Office (ICO) about the way in which we process your personal data. You can make a complaint on the ICO’s website https://ico.org.uk/. 

Revisions to this privacy notice 

We may revise this privacy notice at any time in response to changes in the law or other factors. We encourage you to periodically visit our website to review the most current notice, or obtain a copy by contacting us directly.