This privacy notice tells you what to expect us to do with your personal information when you interact with Campus Sexual and Repro Health (CSRH), whether as a member of staff, volunteer, research participant, event attendee, or visitor to our website.
Contact details
Email: compliance@csrh.uk
What information we collect, use, and why
Staff recruitment, administration and management
We collect or use the following personal information for staff and volunteer recruitment, administration and management:
- Contact details (name, address, telephone number or personal email address)
- Date of birth
- National Insurance number
- Gender
- Copies of passports or other photo ID
- Copies of proof of address documents
- Next of kin or emergency contact details
- Employment history (job application, references, secondary employment)
- Education history and qualifications
- Right to work information
- Details of any criminal convictions (e.g. DBS checks)
- Performance records (reviews, disciplinary records, complaints)
- Training history and development needs
We also collect the following special category information, which is subject to additional protection: racial or ethnic origin, religious or philosophical beliefs, health information, and sexual orientation information.
Salaries and expenses
Where applicable, we collect or use the following for managing pay and expenses:
- Job role and employment contract details
- Time records and leave (sick leave, holidays, special leave)
- Expense or other payment claims
- Bank account details and tax status
Special category information: health information (e.g. fit notes relating to sick pay).
Staff and volunteer health and wellbeing
We collect or use the following for managing health and wellbeing:
- General health and wellbeing information
- Sick leave records and fit notes
- Access needs or reasonable adjustments
- Protected characteristics for equal opportunities monitoring
Special category information: health information.
Research participants and event attendees
Where you participate in CSRH research, workshops, or outreach activities, we may collect your name, email address, and attendance information. Feedback and evaluation responses may also be collected. This is used to organise and deliver activities, communicate relevant updates, and evaluate the effectiveness of our work. Research data is anonymised or pseudonymised wherever possible. Participation is voluntary and participants are informed of how their data will be used before taking part.
Contact and mailing list enquiries
When you contact us or ask to be added to our mailing list, we collect your name and email address to respond to your enquiry and, where requested, to send updates about our research and publications.
Website analytics
Our website uses Google Analytics to collect anonymised data on how visitors use the site (pages visited, time on site, general location at country or region level). No personally identifiable information is collected through analytics. The Google Analytics script is only loaded after you have given consent via the cookie banner. Website traffic is also processed by Cloudflare as part of our hosting and security infrastructure.
Lawful bases and data protection rights
Under UK data protection law, we must have a lawful basis for collecting and using your personal information. Depending on context, we rely on one or more of the following:
- Consent — we have your permission after providing all relevant information. You may withdraw consent at any time.
- Contract — processing is necessary to enter into or carry out a contract with you.
- Legal obligation — we are required by law to collect or use the information.
- Legitimate interests — processing benefits you, our organisation, or others without undue risk of harm.
You have the right to access your personal data, request rectification or erasure, restrict or object to processing, data portability, and to withdraw consent. To make a request, contact us at compliance@csrh.uk. We will respond within one calendar month.
Where we get personal information from
- Directly from you
- Schools, colleges, universities or other education organisations
- Referees (external or internal)
- Occupational health and other health providers
- Public sources (e.g. LinkedIn or other professional websites)
How long we keep information
We retain personal information only for as long as necessary for the purpose it was collected, and in line with standard legal and regulatory expectations:
- Staff and volunteer records — retained for 6 years after termination, then deleted.
- Recruitment records (unsuccessful applicants) — retained for 6 months after the end of the recruitment process, then deleted.
- Financial and payroll records — retained for 6 years after the relevant tax year, as required by HMRC.
- DBS and right to work checks — retained for the duration of involvement with CSRH and for 6 months thereafter.
- Research and participant data — retained for the timeframe specified before collection. Where no timeframe is specified, anonymised data is retained for up to 5 years for research integrity purposes.
- Event and workshop records — sign up and attendance records are retained for 12 months after the event, then deleted.
- Mailing list — email addresses are retained until you request to be removed from the mailing list.
- General correspondence — retained for as long as reasonably necessary to fulfil the purpose, then deleted.
Who we share information with
We may share information with the following where necessary:
- HMRC and other statutory bodies (legal obligation)
- Training suppliers
- External auditors
- Suppliers and service providers
- Regulatory or statutory authorities (where legally required)
Data processors
| Organisation | Purpose | Country | Transfer mechanism |
|---|---|---|---|
| Cloudflare | Web hosting and security, processes website traffic data including IP addresses as part of standard hosting and DDoS protection | Worldwide | International Data Transfer Agreement (IDTA) |
| Analytics, processes website usage data via Google Analytics | Worldwide | International Data Transfer Agreement (IDTA) |
For further information or to obtain a copy of the appropriate safeguard for any of these transfers, contact us at compliance@csrh.uk.
Cookies
Our website uses cookies to support analytics (Google Analytics) and performance and security (Cloudflare). Analytics cookies are only set after you give consent via the cookie banner. You can change your preferences at any time using the “Cookie settings” link in the footer, or manage cookies through your browser settings.
How to complain
If you have any concerns about our use of your personal data, please contact us first at compliance@csrh.uk. If you are still unhappy, you can complain to the ICO at:
Information Commissioner's Office Wycliffe House, Water Lane Wilmslow, Cheshire, SK9 5AF Website: https://www.ico.org.uk/make-a-complaint