UKCEH CRM Privacy Notice

1. Introduction

UK Centre for Ecology & Hydrology (UKCEH) uses a Customer Relationship Management (CRM) system to help manage relationships with customers, stakeholders, collaborators, partners, donors, event participants and other individuals who engage with our work.

This Privacy Notice explains:
•    What personal data we collect
•    How we use your personal data
•    The lawful basis for processing your personal data
•    Who we may share your information with
•    How long we keep your information
•    Your rights under data protection law

UKCEH currently uses HubSpot as its CRM platform to support relationship management, stakeholder engagement, communications, events, commercial services, partnerships and, where applicable, fundraising activities. 

For more general information about how UKCEH handles personal data, please see the main UKCEH Privacy Notice.

2. Who We Are

UKCEH is the controller of personal data processed through the CRM, except where specific programmes or partnerships require alternative arrangements which will be explained separately.

UKCEH’s registered office is at Maclean Building, Benson Lane, Crowmarsh Gifford, Wallingford, Oxfordshire, OX10 8BB, United Kingdom.

If you have any questions about this Privacy Notice or how your personal data is used, please contact:
Data Protection Officer
Email: cehdataprotection@ceh.ac.uk 

3. Information We Collect

Depending on your relationship with UKCEH, we may collect and hold:

•    Name
•    Job title
•    Organisation
•    Business address
•    Telephone number
•    Email address
•    Records of enquiries and correspondence
•    Meeting notes and engagement history
•    Information relating to projects, programmes and collaborations
•    Event registrations and attendance records
•    Communication preferences
•    Records of engagement with UKCEH communications where tracking technologies have been accepted and enabled

We aim to collect only the personal data needed for the purposes described in this notice.

4. How We Obtain Your Information

We may obtain personal data:
•    Directly from you
•    Through enquiries and requests for information
•    Through event registrations and attendance
•    Through existing professional relationships
•    Through participation in UKCEH projects, programmes or partnerships
•    From publicly available professional sources where relevant to UKCEH's charitable, scientific, commercial or partnership activities

5. Why We Use Your Information

UKCEH may use personal data to:

Commercial Activities
•    Respond to enquiries
•    Manage quotations, contracts and services
•    Maintain customer relationships
•    Provide information about relevant services and opportunities

Stakeholder Engagement
•    Manage relationships with stakeholders and partner organisations
•    Coordinate meetings, workshops and engagement activities
•    Support collaboration and communication

Research Infrastructure and Partnership Activities
•    Support collaborative projects and programmes
•    Coordinate communications between participants and partners
•    Manage engagement with research communities and stakeholders

Events and Communications
•    Administer events and webinars
•    Manage attendee communications
•    Improve engagement with UKCEH communications

Fundraising and Philanthropy
Where applicable, to:
•    Manage relationships with donors and supporters
•    Administer donations
•    Communicate fundraising opportunities and activities

Data Sharing Summary

6. Lawful Basis for Processing

UKCEH processes personal data under one or more lawful bases under UK data protection legislation, including:

Legitimate Interests
For activities such as:
•    Stakeholder engagement
•    Relationship management
•    Maintaining business records
•    Partnership and collaboration activities
•    Event administration

Contract
Where processing is necessary:
•    To provide services requested by you
•    To enter into or manage a contractual relationship

Consent
Where required, including certain marketing communications and optional engagement activities.
You may withdraw consent at any time.

Legal Obligation
Where UKCEH is required to retain or process information to meet legal, regulatory or financial obligations.
The lawful basis used will depend on the purpose of the processing and your relationship with UKCEH.

7. Who Can Access Your Information

Access to CRM information is restricted to those who need it for their role.
Only authorised UKCEH staff can access personal data where their role requires it.
Access permissions are reviewed periodically and limited to the information needed for the individual’s role.

8. Sharing Your Information

UKCEH does not sell personal data. 

We may share personal data with:

Service Providers
Approved service providers who help operate and support the CRM or related services.
These providers must:
•    Protect personal data
•    Use information only for authorised purposes
•    Apply appropriate security measures
•    Comply with applicable data protection legislation

FDRI Partners
If you are involved with the Floods and Droughts Research Infrastructure (FDRI) programme, certain information may be accessible to authorised representatives of FDRI partner organisations where needed to deliver programme activities.
This may include:
•    Contact information
•    Organisation details
•    Meeting and communication records
•    Engagement history relating to FDRI activities
•    Event participation and collaboration records
Access will be limited to authorised individuals supporting the programme.

Further information is available in the FDRI Privacy Notice. 

9. International Transfers

HubSpot and associated service providers may process or store personal data outside the United Kingdom.
Where this happens, UKCEH will ensure appropriate safeguards are in place in line with UK data protection legislation, such as adequacy regulations or approved contractual safeguards.

10. Automated Processing

•    UKCEH may use CRM tools to understand engagement with communications, websites, events and services.
•    UKCEH does not use the CRM to make solely automated decisions that have legal or similarly significant effects on individuals.

11. How Long We Keep Your Information

UKCEH keeps personal data only for as long as needed for the purposes for which it was collected and in line with:
•    UKCEH's Records Management Policy
•    Legal and regulatory requirements
•    Contractual obligations
•    Funder requirements where applicable
•    Legitimate business needs

Personal data held in the CRM is reviewed periodically and deleted, archived or anonymised when it is no longer needed.
Specific retention periods may vary depending on the type of relationship, activity or legal requirement involved.

12. Your Rights

Under UK data protection legislation, you may have the right to:
•    Access your personal data
•    Request correction of inaccurate information
•    Request deletion of personal data in certain circumstances
•    Restrict processing
•    Object to certain processing activities
•    Withdraw consent where consent is relied upon
•    Lodge a complaint with the Information Commissioner's Office (ICO)
Further information about your rights is available through the UKCEH Data Protection Officer. You can also contact the Information Commissioner’s Office.

13. Changes to this Notice

UKCEH may update this Privacy Notice from time to time to reflect changes in legislation, organisational activities, partnerships or systems.

The most recent version will be published on the relevant UKCEH website.

END OF DOCUMENT