Research and Innovation Services (RIS) privacy notice

Information you need to know

Liverpool John Moores University is the Data Controller. See further information on the institution.

Our Data Protection Officer can be contacted at DPO@ljmu.ac.uk.

This privacy notice explains how we use your personal information and your rights regarding that information.

For information about how the wider university uses personal data, please see the Privacy notice section of our website.

Research and Innovation Services (RIS) supports research, innovation, knowledge exchange, research governance, ethics, research culture, impact development, research assessment, and external research funding activities across the university. RIS also works closely with external partners, businesses, funders, government organisations, higher education institutions, charities, researchers and members of the public.

As part of these activities, RIS collects and processes personal data in order to:

  • provide services
  • administer applications and awards
  • support research governance processes
  • facilitate collaborations
  • meet legal, regulatory and contractual obligations

Please note:
This notice relates to RIS operational activities and does not replace study-specific privacy information provided to research participants.
Researchers conducting individual studies may still need to provide separate participant-facing privacy information.
Where RIS activities relate to the governance or sponsorship of research studies involving participants, please refer to the Research participants privacy notice.

Information we are collecting

Depending on the service or activity involved, we may collect and process:

  • name
  • title and job role
  • organisation and department
  • contact details, including:
    • email address
    • telephone number
    • postal address
  • curriculum vitae and professional profile information
  • research expertise and interests
  • funding application information
  • project and partnership information
  • employment and academic affiliation details
  • financial information where necessary to administer:
    • grants
    • contracts
    • payments
  • equality, diversity and inclusion monitoring information
  • records of training, events and engagement activities
  • correspondence and communications relating to research and innovation activities
  • information required for due diligence, compliance, governance and audit purposes

In some circumstances, we may process special category personal data where this is required for research governance, equality monitoring, ethics review, funder requirements or other lawful purposes.

In some cases, schools may ask external speakers to complete a demographic survey for the purpose of equality monitoring. Where this is done, your identity will not be recorded, any answers will be anonymous data for reporting and analysis use only.

Source of the personal data

We usually collect personal data directly from you. We may also receive information from:

  • research funders
  • partner universities and colleges
  • government departments and public bodies
  • businesses and external organisations
  • research collaborators
  • professional bodies
  • public registers and publicly available sources
  • other LJMU departments and services
  • research participants where appropriate and lawful

Why we are collecting your data and the legal basis for this

We process personal data in accordance with UK data protection legislation and only where there is a valid lawful basis to do so.

We collect and use personal data to:

  • support applications for external research and innovation funding
  • administer and manage research projects and collaborative activities
  • facilitate knowledge exchange and business engagement activities
  • support research governance, ethics and integrity processes
  • administer research assessment and reporting activities, including the Research Excellence Framework (REF)
  • manage training, events, workshops and engagement activities
  • monitor research performance, outputs, outcomes and impact
  • fulfil contractual obligations with funders and project partners
  • comply with legal, regulatory and audit requirements
  • manage communications and stakeholder relationships
  • support institutional planning and strategic development

Depending on the activity, LJMU normally processes personal data under Article 6(1)(e) UK GDPR (public task) to support its educational and research functions, Article 6(1)(c) UK GDPR where required to meet legal or regulatory obligations, and Article 6(1)(f) UK GDPR where processing is necessary for legitimate interests. Where consent is used, this will be made clear at the point of collection.

Where special category personal data is processed, this will be undertaken in accordance with an appropriate condition under Article 9 UK GDPR and relevant provisions of the Data Protection Act 2018. This may include equality, diversity and inclusion information, health information relevant to governance or ethics processes, or other information necessary to meet legal or regulatory requirements.

Who has access to this data

Access to personal data within LJMU is restricted to staff who require it for legitimate university business.

Where necessary, information may be shared with:

  • research funders
  • government departments and public bodies
  • research collaborators and partner organisations
  • higher education institutions
  • businesses and industry partners
  • external consultants and evaluators
  • auditors and regulators
  • professional and accrediting bodies
  • suppliers acting on behalf of the university under appropriate contractual arrangements

Personal data will only be shared where there is a lawful basis to do so and appropriate safeguards are in place.

How the university protects your data

We are committed to keeping your personal data safe in line with data protection legislation and the university’s information security and data protection policies.

Electronic records are held within secure university systems with appropriate access controls.

Where paper records are retained, they are stored securely and access is restricted to authorised personnel.

Where personal data is shared with external organisations, data sharing agreements, contractual provisions or other appropriate safeguards are implemented where required.

How long the university keeps your data

Personal data will only be retained for as long as necessary to fulfil the purposes for which it was collected and to satisfy legal, regulatory, contractual and audit requirements.

Retention periods vary according to the nature of the activity, funding programme, contractual obligations and university retention schedules.

Further information about retention periods may be obtained from the relevant RIS team or the Data Protection Officer.

Your rights

As a data subject, you have a number of rights. You can:

  • access and obtain a copy of your data on request - this could be in a portable electronic format
  • request that the university changes incorrect or incomplete data if you think that it is inaccurate or out of date
  • request that the university delete or stop processing your data, for example where the data is no longer necessary or legally required for the purposes of processing

If your personal data has been provided by consent, you have a right to withdraw that consent at any time.

If you would like to exercise any of these rights, please contact the Data Protection Officer at DPO@ljmu.ac.uk.

If you do not provide data

In some circumstances, RIS requires personal data to deliver services, assess eligibility, administer funding, manage research governance processes or meet contractual and regulatory requirements.

If the required information is not provided, the university may not be able to offer services, process applications, support participation in activities, or fulfil its obligations.

Where information is provided on a voluntary basis, this will be made clear at the point of collection.

Transfers of data outside the UK

We normally keep your personal data within the UK. Some research, funding or collaboration activities may involve the transfer of personal data outside the UK.

Whenever this happens, we make sure your information stays protected. This could be through a UK “adequacy regulation” (which confirms that the other country’s data protection laws are up to UK standards) or by putting strong safeguards in place.

These safeguards might include:

  • model contractual clauses
  • formal data sharing or processing agreements
  • binding corporate rules

In short, even if your data travels abroad, it will continue to be treated with the same care and respect as it would under UK law.

Automated decision-making

We do not use computers to make decisions about you based solely on your personal data. Any decisions that affect you will always be made by a human, ensuring that you are treated fairly.

How to complain to the university

You have a right to complain to the university if you think it has not properly responded to your request for personal information or feel it has not handled your personal data responsibly.

If you are not satisfied with how your request for information or how your personal data has been handled, you should set out your complaint in writing to:

Maria Burquest
University Secretary and General Counsel
Legal and Governance Services
3rd Floor Student Life Building
Copperas Hill
Liverpool
L3 5AJ

or by email via DPO@ljmu.ac.uk.

How to complain to the Information Commissioner’s Office

You have the right to complain to The Information Commissioner if you believe that our processing of your personal data does not meet our data protection obligations. The Information Commissioner can be contacted using the following details:

  • Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK95AF.
  • Telephone: 0303 123 1113.
  • Email: contact can be made by accessing the ICO webite.