GW4 Alliance Privacy Notice

We take your privacy seriously. This privacy notice explains how the GW4 Alliance looks after your personal data, tells you about your privacy rights, and how the law protects you.

This privacy notice applies to your use of our website (including when you contact us or sign up to our newsletters), attend our events, apply to one of our programmes, or collaborate with us. It is important that you read this privacy notice so that you are fully aware of how and why we are using your information.

Who we are

The GW4 Alliance is a collaboration between four universities: University of Bath, University of Bristol, Cardiff University, and University of Exeter.

Under data protection law, these four universities are “joint controllers” of your personal data for the purposes described in this notice. This means that the four universities work together through the GW4 Alliance to decide how and why your personal data is used.

How to contact us

Depending on the nature of your communication, you may contact us via the following:

• If you have a general query about this privacy notice or the way we process personal data, please contact: info@gw4.ac.uk
• If your communication relates to a request about your own personal data (see the “Your rights” section below) or a data breach, please contact the University of Bristol Compliance Team via: data-protection@bristol.ac.uk 

If you wish to communicate with the DPO of any of the universities that comprise the GW4 Alliance, please contact info@gw4.ac.uk

What types of personal data we process

Personal data means any information that can be used to identify a person, that relates to them in some way. For example, your name, your contact details, and other information about you (such as your bank details).

We may collect, use, store, and transfer different kinds of personal data about you depending on our interactions with you. These include:

• Identity data such as your title, name, pronouns, position, and organisation.
• Contact details such as your address, email address and telephone number.
• Marketing and communications information including your preferences in receiving marketing from us and your communication preferences.
• Events information including access and dietary requirements, and whether you are happy to be photographed or filmed.
• Bid development information, which may include information relating to salaries, and contained within CVs.
• Images for example if you attend one of our events. We will always make sure you are aware if we plan to film or photograph an event you are attending.
• Technical and user information collected via the GW4 website. The website uses cookies to enhance user experience and analyse site traffic. Google analytics collects anonymous information about how visitors use the site to improve performance. Embedded YouTube videos may also set cookies to track video views, remember preferences and manage consent. Users can manage cookie preference at anytime via browser settings.
• Other personal data that you choose to share with us, for example when contacting us via our website or in connection with an application.

If you attend an event, we will ask you for any dietary restrictions or access needs, which may involve processing personal data relating to your health, or religious or philosophical beliefs.

If you make an application to us, you have the option to provide equality and diversity information. If you choose to provide this, this information will not be linked to your name.

How we use your personal data

When we collect, use, and store your personal data, we will only do so where the law allows us to. Data protection law requires us to have a legal basis for processing your personal data.

In the table below, we set out further information about why we process your personal data and the legal reasons we rely on to do so. Please note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if, where more than one ground has been set out in the table below, you need details about the specific legal ground which we are relying on to process your personal data.

How we collect your personal data

We collect your personal data in the following ways:

• Information you give us directly: you may provide your personal data when you interact with us in any of the scenarios outlined above, for example when you:
  • Sign up to attend GW4 Alliance events;
  • Communicate with us via email; or
  • Sign up to our mailing lists.

When we collect personal data directly from you, we will make it clear whether you are required by law or under a contract, to provide your personal data, and what will happen if you do not provide that data.

• Publicly available information: we may process personal data via public sources, including social media when you interact with us or from your university’s website.
• Information shared by third party organisations: we may receive information about you from third parties, including:
  • The University of Bath, the University of Bristol, Cardiff University and the University of Exeter, where the universities are not acting through the GW4 Alliance; and
  • External service providers including universities and project collaborators.

Marketing

If you sign up to our mailing list, you can opt out any time by clicking the ‘unsubscribe’ link at the end of any email or by contacting us directly via info@gw4.ac.uk. Please be aware, if you unsubscribe from marketing emails, we may still contact you by email (e.g. to provide information about an event you have signed up to attend).

Sharing your Personal Data

In certain circumstances we may share your personal data with third parties. We will only share it where the law allows us to do so. We share your personal data with:

• The University of Bath, the University of Bristol, Cardiff University and the University of Exeter, where they are acting as controllers in their own right. For example:
  • When running careers events, information will be shared with careers advisers within the individual universities.
• The University of Bristol is responsible for hosting our SharePoint site and will process personal data on behalf of the universities that form the GW4 Alliance.
• Suppliers and sub-contractors (such as Mailchimp, Brevo, and Eventbrite).
• Project collaborators and relevant partners, such as Jisc.
• Events organisers.
• Funders.

International transfers

We share your personal data with the individual universities that form the GW4 Alliance. These universities are all UK-based, however the universities do use systems and suppliers that may base based outside the UK.

Whenever we transfer your personal data out of the UK, we make sure that it continues to be protected as though it stayed in the UK. We do so by using the following methods:

• By using suppliers and third parties in countries that have been deemed to provide an adequate level of protection for personal data by the UK Government. Companies we work with that host data outside the UK within adequate countries include Amazon Web Services and Brevo (which both store data within the European Union)
• If the country is not considered adequate, we use specific contracts approved for use in the UK (such as the International Data Transfer Agreement) and undertake a transfer risk assessment to ensure the protection of your data. For example, Mailchimp (which we use for sending out email communications) is based in the USA.

Please contact us via info@gw4.ac.uk if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

To decide the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

Further information about our retention periods and criteria used to determine how long we retain personal data can be found within our retention policy: https://www.bristol.ac.uk/media-library/sites/secretary/documents/information-governance/records-retention-schedule.pdf

Your rights

Under data protection law you have various rights over your personal data. These include:

• The right of access (often called a “subject access request” or “SAR”): This right allows you to request a copy of the personal data we hold about you.
• The right to rectification: You can ask us to correct the personal data we hold about you if it is inaccurate or incomplete.
• The right to erasure (also known as the right to be forgotten): You have the right to request that we delete your personal data (such as where we no longer need it for the purpose it was originally collected for).
• The right to restrict processing of your personal data: You may ask us to restrict the use of your personal data (such as where you believe we hold inaccurate personal data, and we need to verify this)
• The right to object: You may object to any processing of your personal data where we are relying on the legal basis of “legitimate interests” or “performance of a task in the public interest”. You also have the right to object to processing of your personal data for direct marketing purposes.
• The right to data portability: This allows you to ask us to transfer your personal data to you or another third party. Please note, this right only applies to certain types of personal data.
• The right to withdraw consent: Where we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time. You may do so by contacting us via info@gw4.ac.uk. If you decide to withdraw your consent, that does not mean that our use of your personal data before you withdrew your consent is against the law.

These rights do not apply in all circumstances, and we may be able to refuse or partially refuse requests in certain circumstances such as where a legal exemption applies. In most cases we have one month to respond to you. Occasionally, we may need to verify your identity before we are able to process a request.

If you wish to exercise any of these rights (other than to withdraw your consent), please contact data-protection@bristol.ac.uk in the first instance. Following this, depending on the scope of your request it may be allocated to another university within the GW4 Alliance. If this happens, we will update you to let you know.

Automated decision-making and profiling

Automated decision-making is a process where an automated system uses personal data to make decisions about people without any human involvement. Profiling is a type of automated decision-making process that takes place when different aspects about a person (such as their behaviour, interests, or personality) are analysed to make predictions or decisions about them.

We do not carry out automated decision making (including profiling). If this changes, we will update this privacy notice and notify you in writing (if appropriate).

Complaints

If at any time you are not happy with how we are processing your personal data, please contact info@gw4.ac.uk in the first instance.

If you are not satisfied with the handling of your issue, you may raise a complaint with the Information Commissioner’s Office, which regulates and enforces data protection law in the UK. Details of how to do this can be found at https://ico.org.uk/make-a-complaint/.

Changes to this Privacy Notice

This privacy notice was published on 19/05/2025. We will update and change this privacy notice from time to time to reflect changes to the way we handle your personal data or changing legal requirements. Whenever you visit our website or interact with us, please check back so that you are aware of any changes.