National Composites Centre (NCC) Privacy Notice for Communications and Marketing
The NCC complies with the Data Protection Act 2018 and UKGDPR. We are registered with the Information Commissioner's Office (ICO) as a Data Controller.
This Privacy Notice is for Communications and Marketing and explains what personal data is collected, how it is processed and who it will be shared with.
Why we collect personal data about you
We collect and hold personal data relating to your contact with our department.
Dependent on your reason for communicating with the department we use this information to:
- Contact you, following your enquiry.
- Respond to your enquiry.
- Make available our products and services to you.
- Process your orders.
- Processing payment from you or give you a refund if you hire our facilities.
- For statistical analysis.
- Get feedback from you about our products, websites, mobile apps, and other services and activities.
- Contact you about products and services you consume (with your consent).
- Provide you with online advertising and promotions (with your consent).
Our Lawful Basis for Processing
Depending on your reason for visiting or making use of our services, our lawful basis may differ:
- Receiving news & events updates – our lawful basis is Consent. The data subject has given consent to the processing of their personal data for one or more specific purposes.
- Onsite visits and events: our lawful basis is Legal Obligation, where we need certain information under H&S for visiting our facility. Processing is necessary for compliance with a legal obligation to which the NCC is subject.
What personal information we collect
- Your name and your contact details.
- Nationality (Visits and Events).
- Survey responses.
- Records of conversations regarding your enquiry.
- Dietary requirements (Visits and Events).
- Access requirements (Visits and Events).
Who we share your information with
Depending on the nature of our engagement with you, we may share data with:
- High Value Manufacturing Catapult, of which we are part of – when we undertake joint events, press releases and for support on enquiries.
- University of Bristol, who we are a subsidiary of – when we undertake joint events, press releases and for support on enquiries.
- Company Caterers – event organisers contact details are shared when catering is booked through us for an event.
We all use the following sub-processors:
- Mailchimp – for processing your data to receive news & events updates.
- Mentor Digital – who provide a platform that we use to process news & events information.
How long we keep your information for
We will only keep your information for as long as we need to unless we need to keep it for legal reasons. For the purposes of this processing, we will keep your data for:
- With your consent, to be contacted about offers, news, products – 3 years (before confirming with you that we can retain your information for future contact).
- For events – 12 months after the event has completed.
- For records of correspondence – for 12 months after the purpose of the correspondence is completed.
Your rights
You have the right to:
- Ask to see the information we hold about you.
- Ask us to change information we hold about you if it is wrong.
- Ask us to delete the information we hold about you.
- Ask us to limit the way we use your information.
- Withdraw your consent (see below).
- Ask for human intervention regarding decisions made about you by a computer.
- Complain to the Information Commissioner’s Office.
Withdrawal of consent
Where personal data is processed on the lawful basis of consent, you will have the right to withdraw that consent. However, dependent on the purposes that we are processing your data, withdrawal of consent may affect our ability to provide certain services to you.
Data Protection Officer Contact Details
Under the GDPR, the NCC is required to appoint a Data Protection Officer (DPO). The Data Protection Officer is required to monitor compliance with the GDPR and Data Protection Act 2018, to advise and inform the NCC on its data protection obligations and how to meet them, and to be a point of contact for data subjects and the ICO. The NCC's Data Protection Officer is Sharon Lock, Information Governance Manager & Data Protection Officer – email [email protected]
Complaints
If you are unhappy with the way your request was handled or you disagree with a decision made by the NCC regarding your data, you have the right to submit a complaint by contacting the Data Protection Officer (DPO) who will review your complaint via email: [email protected]
If you are not happy with the outcome from the DPO you may wish to contact the Information Commissioner’s Office (ICO) at:
The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.
