Pure Privacy Notice

This privacy notice describes how Abertay University processes personal data in Pure, the University’s Current Research Information System.

The notice also explains how we use your personal data in accordance with your rights under the UK Data Protection Act 2018 and the UK General Data Protection Regulation.

For the data we hold in Pure, Abertay University is the data controller and Elsevier, the provider of the Pure system, is the University’s data processor. Information about Elsevier’s privacy principles and privacy policy is available on their website.

The type of personal information we collect, how long it’s held, and accessed

We currently collect and process the data listed in the tables below relating to current and former staff, and Postgraduate Researchers. They also detail how long this information is kept for (retention period), and whether it is made visible to the public on the external Pure portal.

Staff personal data

DATA DESCRIPTION	DATA RETENTION PERIOD	Visibility of data on external Pure portal
DATA DESCRIPTION	DATA RETENTION PERIOD	Current staff	Former staff
First name	Permanent storage	Visible	Not visible
Last name	Permanent storage	Visible	Not visible
Publishing name (if applicable)	Permanent storage	Visible	Not visible
Former name (if applicable)	Permanent storage	Not visible	Not visible
Known as name (if applicable)	Permanent storage	Visible	Not visible
Title – (if applicable)	Permanent storage	Visible	Not visible
Username	Retention period: One year from end of employment.	Not visible	Not visible
University email address	Retention period: One year from end of employment	Visible	Not visible
Staff number	Permanent storage	Not visible	Not visible
Higher education Statistics Agency ID	Permanent storage	Not visible	Not visible
Pure Unique ID	Permanent storage	Not visible	Not visible
Job title/description	Permanent storage	Visible	Not visible
Period of employment/study	Permanent storage	Not visible	Not visible
Profile information	One year from end of employment.	Visible	Not visible
Private CVs (if applicable)	One year from end of employment..	Not visible	Not visible
Public CVs (if applicable)	One year from end of employment.	Visible	Not visible
Profile photo (if applicable)	One year from end of employment.	Visible	Not visible
Open Researcher and Contributor ID (ORCID) (if applicable)	Permanent storage	Visible	Not visible
External researcher IDs, e.g., Scopus, Publons (if applicable)	Permanent storage	Visible	Not visible
Organisational unit affiliation	Permanent storage	Visible	Not visible
FTE	Permanent storage	Not visible	Not visible
Research activities, including prizes & impacts (if applicable)	Permanent storage	Not visible	Not visible
Grant application & award data, including project costs (if applicable)	Permanent storage	Not visible	Not visible

Postgraduate research student personal data

Data description	Data retention period	Visibility of data on external Pure portal
Data description	Data retention period	Current student	Former student
First name	Permanent storage	Visible	Not visible
Last name	Permanent storage	Visible	Not visible
Publishing name (if applicable)	Permanent storage	Visible	Not visible
Former name (if applicable)	Permanent storage	Not visible	Not visible
Known as name (if applicable)	Permanent storage	Visible	Not visible
Title – (if applicable)	Permanent storage	Visible	Not visible
Username	Retention period: One year from end of employment.	Not visible	Not visible
University email address	Retention period: One year from end of employment	Visible	Not visible
Student number	Permanent storage	Not visible	Not visible
Pure Unique ID	Permanent storage	Not visible	Not visible
Degree title/ description	Permanent storage	Visible	Not visible
Period of study	Permanent storage	Not visible	Not visible
Profile information (if applicable)	One year from end of employment.	Visible	Not visible
Private CVs (if applicable)	One year from end of employment.	Not visible	Not visible
Public CVs (if applicable)	One year from end of employment.	Visible	Not visible
Profile photo (if applicable)	One year from end of employment.	Visible	Not visible
Open Researcher and Contributor ID (ORCID) (if applicable)	Permanent storage	Visible	Not visible
External researcher IDs, e.g., Scopus, Publons (if applicable)	Permanent storage	Visible	Not visible
Organisational unit affiliation	Permanent storage	Visible	Not visible
Registered degree/award	Permanent storage	Visible	Not visible
Research activities, including prizes & impacts (if applicable)	Permanent storage	Not visible	Not visible
Grant application & award data, including project costs (if applicable)	Permanent storage	Not visible	Not visible

Visitors to the external Pure portal

Data description

Data retention period

IP addresses of users downloading full text items from the external Pure portal

IP addresses are captured in Pure to allow download statistics to be calculated but the IP address is not visible in Pure – only the calculated statistics are visible. The IP addresses are transmitted to IRUS-UK (Institutional Repository Usage Statistics UK) a national aggregation service, which provides COUNTER-conformant usage statistics for all content downloaded from the external Pure Portal.

Information is retained by the Institutional Repository of Usage Statistics UK (IRUS-UK) for the current year and two previous years. IRUS-UK’s compliance with the UK General Data Protection Regulation (GDPR) is available on their on their website.

How we get your personal information and why we collect it

Most of the personal information we process is provided to us directly by you or collected from the Student Records System (SITS) and the People Services system (ITrent) along with personal data entered manually by university administrators. This collecting is done to record, administer, and manage research and research activities including the fulfilment of our public task to make our research publicly available.

We use the information that you have given us in order to:

create records of research activities undertaken by the University’s research community (staff and postgraduate research (PGR)students).
create profile pages on the external Pure portal for current research staff and PGR students. The staff profile information is also made visible externally on the staff profile pages on the external staff page for staff who have requested a staff profile on the external website.
create records of student supervision in relation to research.
assist with exercises involved with preparing for, as well as the final submission to, the Research Excellence Framework (REF).
support annual academic promotion.
record the number of downloads of items e.g., articles/datasets/ theses from the external Pure portal.
assist with reporting requirements across the University in relation to the above.

We may share this information with the Research Excellence Framework (REF) Committee for the purposes of participating in regular national research monitoring exercise run by UK REF.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

We have a contractual obligation - contract i.e., of employment or matriculation, to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

We need it to perform a public task - for the performance of the University’s stated public task in Part 2(4) of its Order of Council 2019.

Where processing falls out with the normal course of business the University may, from time to time, seek your consent to process your data for one or more specific purposes.

You can find more information about lawful basis on the ICO website.

How we store your personal information

Your information is securely stored in Pure, which is hosted online by Elsevier.

We keep various aspects of your personal information for a range of time periods set out in the tables above. We will then dispose this information by securely deleting it from the system when appropriate.

Your data protection rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact the University’s Data protection Officer dataprotectionofficer@abertay.ac.uk if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us by contacting the University’s Data Protection Officer (DPO):

Data Protection Officer

Abertay University

Kydd Building

Bell Street Dundee DD1 1HG

Scotland

Tel: 01382 308000

Email: dataprotectionofficer@abertay.ac.uk

You can also complain to the ICO if you are unhappy with how we have used your data. The ICO’s address:

Information Commissioner’s Office,

Wycliffe House Water Lane,

Wilmslow

Cheshire SK9 5AF