- This is the privacy notice for the student recruitment website (the System) in use by The Institute of Cancer Research (the ICR).
- It explains how the ICR will collect, use, and share personal information relating to two types of external users (the Users): applicants for student places at the ICR and the referees for these applicants.
- This personal information is made available to appropriate employees, workers and other contractors (the Staff) of the ICR. Certain information, such as sensitive personal data, is further restricted to selected administrative staff (Administrators), who have access to all information in the System.
Collecting personal information
Personal information regarding each applicant is collected by the System from three sources:
- the applicant themselves;
- referees named by the applicant; and
- our Staff.
Personal information regarding each referee is collected by the System from two groups of users:
- any applicant who names the referee; and
- the referee themselves.
Personal information collected
- The personal information includes personally identifiable data (such as name and address). For applicants, it may also include sensitive personal data (such as ethnicity, sexual orientation, and religious belief).
- The personal information is collected at each applicant’s request in order for us to process an application for a student place.
- Sensitive personal data is collected so we can monitor student recruitment statistics. Where sensitive personal information is requested, a ‘prefer not to say’ option is available.
- Basic information is also collected about the devices used to access this System. This includes, but is not limited to, IP address, operating system, and web browser.
Storing personal information
- Personal information collected by the System is hosted on ICR-controlled servers within the EEA, which may include those supplied by third parties.
- For successful applicants, basic personal information (such as name, address, and date of birth) stored in this system will be transferred to other systems under the control of the ICR, for the purposes of creating a preliminary student record. Incoming students are able to review and amend this information at the point of registration.
- The ICR takes all appropriate technical and organisational security measures to protect personal data from loss or misuse.
Using personal information
- Personal information will be used to process your application; this includes consideration of your application by relevant ICR staff and communicating with you about your application, and to monitor recruitment statistics.
- Sensitive personal data will only be visible to Administrators, and will form no part of assessing an applicant’s suitability for a studentship. This data will be anonymised before it is presented to our academic staff.
- Personal information may be cross-referenced with publicly available records, or information already held by the ICR, in order to confirm its accuracy. We may also request applicants’ permission to verify information such as qualifications attained.
- The System does not make automated decisions about applications.
- We may also contact those applicants who opt-in to surveys, to ask about their experience of the recruitment process.
- The contact information of referees will be used for the purposes of requesting references only.
- echnical information about the devices used to access the system (including IP address) are used for the purposes of technical support, and to prevent and investigate the misuse of our servers.
- Personal information is retained in the System for up to five years after each call for applications (the Records Retention Period).
- Within this period, we may destroy all identifiers, and may then keep this anonymised data for longer. We would do this, for example, to allow us to conduct longitudinal equality monitoring.
- Servers at the ICR are backed up frequently. The server used to store personal information for this System may also store information that has a records retention period. Where we have to restore these backups, we will delete any personal information where the Records Retention Period has elapsed.
- For successful applicants, personal information transferred to our other student systems will instead be subject to the records retention periods for our student records.
Disclosure of information to third parties
- We will not sell, trade or rent personal information to any organisation.
- Where the ICR offers one or more student places in collaboration with another organisation, personal information may also be made available to appropriate employees, workers and other contractors of the partner institution. We may also cross-reference the information provided by Users with data already held by the partner institution.
- From time to time, we may engage third parties to assist with the functioning of the System or our student recruitment process – and these third parties may consequently have access to personal information stored by the system. Such contractors are acting on behalf of the ICR, and are always engaged under a duty of confidentiality.
- We may from time to time supply fully anonymised data in bulk to other organisations for statistical purposes. For example, we might do this as part of sector-wide projects to analyse the fairness of higher education recruitment processes.
- We may at times need to disclose information collected by the System to relevant authorities, to prevent or investigate crime.
- Referees should be aware that UK data protection law permits applicants to request a copy of any references provided.
- For those people who opt in to surveys, we may transfer your contact details to the Bristol Online Survey – a polling tool operated for the UK university sector. The ICR has performed due diligence on the security of personal data held by the Bristol Online Survey.
- For successful applicants, we may need to pass personal information to our funding bodies, for the purposes of funding the applicant’s studentship.
- To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, please visit http://www.allaboutcookies.org/.
Right of access
- You may amend the information that you enter into the system up until the point where you mark your application as complete. From this point onward, you will be able to view the information that you have submitted, but you will not be able to alter it through the System.
- You have the right to ask for a copy of the information that we hold about you under UK data protection legislation. Further information is available on our website.
- Our Registry team may be contacted by replying to any email that the System has sent. They will be able to amend or delete information about a User, where necessary.
- The data controller for the System is The Institute of Cancer Research: Royal Cancer Hospital, which is a company limited by guarantee (registered in England and Wales with company number 534147), and a charity (exempt from registration with the Charity Commission).