This notice (“Notice”) relates to all individuals whose personal data is processed in line with the requirements of the Regulation (EU) of 27th April 2016 (the General Data Protection Regulation) “GDPR” and the UK Data Protection Act 2018. For purposes of this Notice, such individuals are called “Data Subjects”. Under the EU’s General Data Protection Regulation (GDPR) personal data is defined as:
“any information relating to an identified or identifiable natural person (the ‘Data Subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
2. Privacy Notice
2.1 Who we are
The Hearing Medicines Discovery Syndicate (“Syndicate”) brings together UK expertise and infrastructure in hearing research to support academic researchers and companies (“Third Parties”) to develop the hearing therapeutics of the future. The Hearing Medicines Discovery Syndicate is focused on accelerating the development of hearing therapeutics to bring new treatments to people with hearing disorders, faster.
Anchored by a partnership between the charity RNID and Medicines Discovery Catapult (MDC) the Syndicate also includes the following organisations with expertise in hearing research as strategic partners:
- Cell and Gene Therapy Catapult;
- National Institute of Health Research (NIHR) through its Biomedical Research Centres (BRC) with hearing research themes:
Collectively, RNID, MDC and the above listed organisations are the “Syndicate Partners”.
2.1 MDC, RNID and the Syndicate Partners are bound to specific obligations in relation to data protection under the Syndicate Partners Agreement, for the duration of the relevant data processing as joint data controllers.
2.2 A key activity of the Syndicate will involve connecting Third Parties to the Syndicate Partners to engage on research opportunities leading to access to and exchange of knowledge and expertise and collaborative projects.
2.3 MDC and RNID are the Syndicate managing partners and will facilitate Third Parties introductions to the Syndicate Partners.
2.4 MDC, RNID and the Syndicate Partners will comply with applicable legislation, including the GDPR and the UK Data Protection Act 2018.
2.5 For enquiries, you can contact the following Data Protection Representatives via phone, email, and post:
MDC Data Protection Representative
Phone number: 01625 238734
Compliance email address: email@example.com
Medicines Discovery Catapult
Block 35, Mereside,
RNID Data Protection Officer
Phone number: 020 7359 4442
1-3 Highbury Station Road
2.6 Please note that for the purpose of maintaining this Notice up to date, the MDC Data Protection Representative is the owner of this document.
3.1 The Data Protection Representatives are responsible for ensuring that this Notice is made available to Data Subjects prior to MDC, RNID and the Syndicate Partners collecting/processing their personal data.
3.2 All employees/staff of MDC and RNID, acting as the managing partners of the Syndicate, who interact with Data Subjects are responsible for ensuring that this Notice is drawn to the Data Subject’s attention and, where applicable, their consent to the processing of their data is secured prior to any processing.
3.3 The Data Protection Representatives will ensure that all employees/staff of MDC and RNID will receive adequate training to make them aware of appropriate data processing behaviours, to ensure compliance with the law and with this Notice.
3.4 MDC, RNID and the Syndicate Partners expects any Third Parties engaging with the Syndicate to also abide by the law in regards to the personal data being shared in common across any projects initiated through the Syndicate.
4. What we do with your data
This Notice tells you how we, MDC and RNID, will collect and use your personal data for the purpose of introductions to the Syndicate Partners, and supporting the project management for collaborative projects initiated through the Syndicate.
4.1 In order for us to provide this service we need to collect personal data for correspondence purposes, understanding the scope of a project to make relevant introductions, and other related administrative tasks. In any event, we are committed to ensuring that the information we collect, and use is appropriate for this purpose and does not constitute an invasion of your privacy.
4.2 When engaging with MDC and RNID, Third Parties will have the opportunity to request for only anonymised information to be sent to the Syndicate Partners. In this case, only anonymised information will be shared and if a Syndicate Partner wishes to engage with the Third Party, MDC and RNID will let the Third Party know and facilitate an introduction between the Third Party and the relevant Syndicate Partner(s).
4.3 Our aim is not to be intrusive, and we undertake not to ask irrelevant or unnecessary questions. Moreover, the information you provide will be subject to rigorous measures and procedures to minimise the risk of unauthorised processing, retention, access or disclosure.
4.4 Marketing. In terms of being contacted for marketing purposes, other than advising you of the Syndicate’s workshops and events, where we do not already have a legitimate reason to do so, we would ensure we contact you appropriately for additional consent to do this.
4.5 Processing. The personal data we will collect from/process on you are:
Personal data type
(where MDC and/or RNID obtained the personal data from if it has not been collected directly from you, the Data Subject. Note: this may include personal data accessed from publicly accessible sources, such as published research, social media, or Companies House)
Name (first name, surname) of representatives/employees of Third Parties engaging with the Syndicate
Syndicate enquiry form, email signature or footer, industry body or public directory listings, published research, programme-related reports and other documentation, patent databases, university published directories or website listings, institution contact pages, Companies House
Business address of representatives/employees of Third Parties engaging with the Syndicate
Syndicate enquiry form, email signature or footer, industry body or public directory listings, published research, patent databases
Qualifications, educational training details and status, membership of societies or organisations related to field of work or study, skills, professional expertise, career history, academic records.
Syndicate enquiry form, email signature or footer, industry body or public directory listings, published research, patent databases, university website
Syndicate enquiry form, direct email correspondence, social media or industry body directory listings, published research
Contact details (personal or business landline or mobile phone number or email addresses) for representatives/employees of Third Parties engaging with the Syndicate
Syndicate enquiry form, direct email correspondence, social media or industry body directory listings, published research, programme-related reports and other documentation, patent databases, university published directories or website listings, institution contact pages, Companies House
4.6 Types of processing and lawful bases.
The personal data we collect will be used for the following purposes:
- to review enquiries from Third Parties and determine whether an enquiry is in scope for further engagement with the Syndicate Partners;
- to inform the Syndicate Partners of an enquiry that may be of interest;
- to fulfil our obligations, as the Management Team, around assessing enquiries and engaging the Syndicate Partners in the enquiry review, in accordance with the aims of the Syndicate;
- to follow up with Third Parties to facilitate an introduction to the relevant Syndicate Partner/s.
Our legal basis for processing some or all of the personal data is:
- contract: processing is necessary for the performance of a contract to which the Data Subject(s) will be party, or in order to take steps at the request of the Data Subject prior to entering into a contract purpose;
- legitimate Interests: processing may be necessary for the purpose of the legitimate interests pursued by MDC, RNID and the Syndicate, with the assurance that such interests will not override the fundamental rights and freedoms of the Data Subject(s) concerned.
4.7 We do not envisage processing special category data in any non-anonymised or non-aggregated manner that could identify Data Subjects, but in the instance where any processing of special category personal data is necessary, processing will be proportionate to the aim pursued, and carried out with all appropriately suitable technical and organisational measures and safeguards to respect the fundamental rights and interests of the Data Subject(s).
5. Data sharing and disclosure
5.1 We will pass your personal data on to the relevant Syndicate Partners, in the course of dealing with you for your enquiry. The Syndicate Partners are listed in the below table, and you should view their own individual privacy notices to understand how they will process your personal data once we have shared it with them.
5.2 The Syndicate Partners we share your data with are obliged to process your personal data lawfully, keep your details securely, and to use them only to fulfil the outlined purpose, in accordance with the relevant data sharing and protection clauses within the Syndicate Partners Agreement. When they no longer need your data, they will dispose of the details in line with either the procedure we have set out for them or their own retention schedules, per their listed privacy notice/policy.
5.3 The following organisations will receive your personal data for the following purpose(s) as part of usual processing activities:
Safeguards that we will have in place to protect your personal data before data is shared
MDC and Medicines Discovery Catapult Limited
Syndicate Partners Agreement
Syndicate Partners Agreement
Cell and Gene Therapy Catapult
Syndicate Partners Agreement
NIHR Manchester BRC
Syndicate Partners Agreement
NIHR Manchester BRC Privacy Statement
NIHR Nottingham BRC
Syndicate Partners Agreement
NIHR UCLH BRC
Syndicate Partners Agreement
Microsoft Inc. Office 365 software is used widely within the Hearing Medicines Discovery Syndicate (e.g. Word, Excel, Outlook etc.)
A Software licence agreement for the applications is in place
Microsoft’s Trust Center webpage has details of their approach to Privacy and the GDPR
MDC use HubSpot as a database to process applicant accounts, invoices and financial transactions
A Service Agreement is in place for the provision of the CRM
6. Retention period
6.1 MDC and RNID will process personal data for as long as required for the purpose of our role and function of Management Team within the Syndicate.
6.2 We are required to retain some personal information in accordance with the law, such as information needed for tax and audit purposes. How long certain kinds of personal data should be kept may also be governed by specific business-sector requirements and agreed practices. Personal data will be held in addition to these periods depending on individual business needs and only where an appropriate lawful basis exists to do so.
6.3 Should you wish a copy of our ‘Retention Schedule’, please use the contact details in section 2.5 of this Privacy Notice. For the retention policies and schedules of the Syndicate Partners you should review their own individual privacy notices to understand how they will retain and delete your personal data.
7. Your rights as a Data Subject
7.1 At any point while we are in possession of, or processing, your personal data for the purpose of the Syndicate project, you (the Data Subject) have the following rights:
- Right of access – you have the right to request a copy of the information that we hold about you.
- Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
- Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.
- Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
- Right of portability – in some circumstances you have the right to have the data we hold about you transferred to another organisation.
- Right to object – you have the right to object to certain types of processing such as direct marketing.
- Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.
- Right to judicial review – in the event that MDC or RNID refuse your request under ‘right of access’, we will provide you with a reason why we have refused some or all of your request. You have the right to complain as outlined in section 8 below.
7.2 As applicable, any of the above requests that we receive will be forwarded on should there be a Syndicate Partner or any other service provider acting as a Data Controller involved (as stated in section 5 above) in the processing of your Records.
In the event that you wish to make a complaint about how your personal data is being processed by MDC and RNID (or third parties as described in 5 above), or how a complaint you have made to us in relation to this processing has been handled, you have the right to lodge a complaint directly with the supervisory authority and where applicable, MDC’s and RNID’s Data Protection Representatives as outlined in section 2.5 above.
The details for the relevant supervisory authority are:
Information Commissioner’s Office
Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number
Fax: 01625 524 510
9. Subject Access Requests
At your request, MDC and RNID can confirm what information we hold about you and how it is processed. We treat our responsibilities for data privacy very seriously and will ensure we take all reasonable steps to correctly identify anyone submitting a subject access request to our business, per our Data Subject Access Request Procedure. Should you wish a copy of this Procedure please contact the Data Protection Representatives using the details in section 2.3 above.