Pure REF2021 Privacy Notice

This privacy notice describes how Abertay University processed personal data in Pure for the purposes of recording, administering, and managing research and research activities in preparation for the University’s submission to the REF2021 assessment exercise. The notice also explains how we use your personal data in accordance with your rights under the UK Data Protection Act 2018 and the UK General Data Protection Regulation.

Pure is the University’s Current Research Information System. For the data we hold in Pure, Abertay University is the data controller and Elsevier, the provider of the Pure system, is the University’s data processor. Information about Elsevier’s privacy principles and privacy policy are available on their website.

Table 1: Personal data of current staff required for the REF2021 exercise

DATA DESCRIPTION	DATA RETENTION PERIOD
First name	Permanent storage
Last name	Permanent storage
Publishing name (if applicable)	Permanent storage
Former name (if applicable)	Permanent storage
Known as name (if applicable)	Permanent storage
Higher education Statistics Agency ID	Permanent storage
Open Researcher and Contributor ID (ORCID) (if applicable)	Permanent storage
Pure Unique ID	Permanent storage
Date of Birth	Permanent storage
Email address	Permanent Storage
Division	Permanent storage
Start date	Permanent storage
Eligibility for inclusion in REF (Eligible or Not Eligible)	Permanent storage
Fixed term contract (If yes dates included)	Permanent storage
FTE	Permanent storage
Whether on secondment and contracted to return within 2 years form the start of the secondment. (If yes dates included).	Permanent storage
Whether on leave of absence and contracted to return within 2 years form the start of the period of absence (If yes dates included).	Permanent storage
Information about internal and external assessment of output.	Permanent storage
If Early Career Researcher (ECR,) date of commencement of ECR status.	Permanent storage
Whether staff based in a discrete unit outside the UK. (if yes details of the connection between the individual's research activity and the submitted unit in the UK.)	Permanent storage

The type of personal information we collect, how long it’s held

We collected and processed the data listed in the tables 1 and 2 relating to current and former staff as the data were required for the REF2021 exercise. Eligibility criteria and the census date for defining current and former staff are as stated in the REF2021 Submission Guidance.

Table 2: Personal data of former Eligible/submitted staff required for the REF 2021 exercise

DATA DESCRIPTION	DATA RETENTION PERIOD
First name	Permanent storage
Last name	Permanent storage
Publishing name (if applicable)	Permanent storage
Higher education Statistics Agency ID	Permanent storage
Open Researcher and Contributor ID (ORCID) (if applicable)	Permanent storage
Pure Unique ID	Permanent storage
Former Job titles with dates	Permanent storage
Date of Birth	Permanent storage
Division	Permanent storage
Eligibility for inclusion in REF (Eligible / Not Eligible)	Permanent storage
Fixed term contract (If yes, dates included)	Permanent storage
FTE for each eligible contracts with dates	Permanent storage
End date at institution	Permanent storage
Information about internal and external assessment of output	Permanent storage

How we get your personal information and why we collect it

Most of the personal information we hold was collected from the People Services system (ITrent) along with personal data entered manually by university administrators. The data were collected to record, administer, and manage research and research activities including the fulfilment of our public task to provide information required for the REF2021 assessment exercise.

We may share this information with the following third parties:

Higher Education Statistics Agency (HESA) Collection notice available: https://www.hesa.ac.uk/about/regulation/data-protection/notices

Research Council, and other prospective actual funders of research.

Government bodies that run Research Excellence Framework (REF 2021), including the UK higher education funding bodies such as the Scottish Funding Council. The REF have published their own Privacy Notice for users of REF Submission and Assessment Systems: https://www.ref.ac.uk/submission-system/privacy-notice/

Under Article 6 of the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

We have a contractual obligation - contract i.e. of employment or matriculation, to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
We need it to perform a public task - for the performance of the University’s stated public task in Part 2(4) of its Order of Council 2019.

Where processing falls out with the normal course of business the University may, from time to time, seek your consent to process your data for one or more specific purposes. You can find more information about lawful basis on the ICO website.

How we store your personal information

Your information is securely stored in Pure in a specific REF2021 module, which is hosted online by Elsevier. We keep various aspects of your personal information for a range of time periods set out in tables 1 and 2. We will dispose this information by securely deleting it from the system when appropriate.

Your data protection rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.