Privacy Notice

What has changed:

1. Secton 1. 'Who we are':
   (i) We have added two partners: Lancaster University and UKRI Natural Environment Research Council.
   (ii) In the list of Joint Data Controllers, we have made some minor wording changes. 
2. Section 2. 'Scope':
   (i) Where we describe why we are collecting your information, we have changed the wording to make it easier to read. The list of data we may collect has not changed, neither have the lawful bases that we rely on for collecting and processing personal data.
3. Section 3. 'General Principles':
   (i) We have added the sections 'Role-Based Access and Data Minimisation', 'Anonymisation and Aggregation' and 'Training and Accountability'.
   (ii) Under 'Sharing your personal information', we have deleted the line 'we will always adhere to current UK Data Protection Legislation'.
4. Section 4. 'Your Rights and Legal Purpose':
   (i) We have changed to wording, making it easier to read.
   (ii) We have added the section 'Data Breach Notification'.

Who we are

The Floods and Droughts Research Infrastructure (FDRI) project is a major capital investment by the UK Government that will enable essential science and innovation to improve the UK’s resilience to hydrological extremes. It is being led by the UK Centre for Ecology & Hydrology (UKCEH) with project partners the British Geological Survey (BGS), the University of Bristol, Imperial College London, Lancaster University, and UKRI Natural Environment Research Council (NERC). 

UKCEH is an independent, not-for-profit research institute and is a registered Charity in England & Wales (number 1185618) and in Scotland (number SC049849), and a registered Company Limited by Guarantee in England & Wales (number 11314957). 

Joint Data Controllers for all processing of personal data are: 

• UK Centre for Ecology & Hydrology (“UKCEH”), Maclean Building, Benson Lane, Crowmarsh Gifford, Wallingford, Oxfordshire OX10 8BB 
• British Geological Survey (“BGS”), Nicker Hill, Keyworth, Nottingham NG12 5GG 
• University of Bristol, Beacon House, Queens Road, Bristol BS8 1QU 
• Imperial College London, Exhibition Road, London SW7 2AZ 
• Lancaster University, University House, Bailrigg, Lancaster LA1 4YW 
• UKRI Natural Environment Research Council (“NERC”), Polaris House, North Star Avenue, Swindon SN2 1EU 

The main UKCEH Privacy Notice is here.

Why are we collecting your information?

FDRI collects the minimum amount of personal data required to run the project and communicate with you. This includes activities such as the website, workshops, surveys/questionnaires, interviews, meetings, and newsletters. FDRI team members also contribute to a database capturing events and outputs of meetings led by or involving FDRI.

Personal data we may collect includes: 

• Name, title and role 
• Email address and phone number 
• Name and category of organisation or community group 
• FDRI Project interactions and engagements 

We rely on the lawful bases of legitimate interest and consent for collecting and processing your personal data. The data will not be used for marketing purposes. 

All data held by FDRI complies with UK data protection legislation. Personal data we collect from you, or that you provide to us, is covered by this Privacy Notice, the UKCEH Privacy Notice, or the other Joint Controllers’ Privacy Notices. 

FDRI will adhere to ethical approval processes where relevant, ensuring that your interests are protected and that all activities are carried out to the highest standards. The FDRI Project Management Office (PMO) will clearly inform you about the information they intend to collect and how it will be used. Your consent will always be obtained before any data is collected or used as part of this project. 

How are we storing your information, and will we share it?

The personal data that we collect will be stored securely and comply with UK GDPR for as long as we may need to engage with you.

Anonymisation and Aggregation

Wherever possible, personal data will be anonymised or aggregated before being used for reporting, analysis, or publication. Identifiable information will only be used when strictly necessary and with your explicit consent. 

Training and Accountability

All FDRI team members with access to personal data are required to complete mandatory UK GDPR training. This ensures they understand their responsibilities and the importance of safeguarding personal data in line with UKCEH’s data protection policies. 

Sharing your personal information

Your data may contribute to our internal reporting requirements and external communication activities (e.g. as part of a conference presentation, public talk or research publication). The project will not use any information that would identify you without obtaining your specific consent first. Other than as set out above, and except where we have a legal obligation to do so, we will not share your personal data with anyone else. Any data that will be published or reported externally will be anonymised.

We are collecting and processing this data under legitimate interest and consent. Your rights under UK GDPR include: 

• The right of access to your data 
• The right to correct your data if it is incorrect 
• The right to ask for your data to be deleted 
• The right to withdraw your consent at any time 

To exercise your rights, please contact us at fdri@ceh.ac.uk. We will respond to your request within one calendar month, in accordance with Article 12 of the UK GDPR. 

If you have any concerns or complaints about how your personal data is being used, we will try to answer any questions you have. The UKCEH Data Protection Officer can be contacted at cehdataprotection@ceh.ac.uk. 

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) and to seek an effective judicial remedy against decisions of the ICO. 

Data Breach Notification

In the unlikely event of a personal data breach, UKCEH and its partners will follow the UK GDPR’s breach notification procedures. This includes notifying the ICO within 72 hours where required and informing affected individuals without undue delay if there is a high risk to their rights and freedoms. 

Deletion of Data

Personal data deletion will be managed according to Article 5(1)(c): 
“Personal data shall be: (c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.”

This Privacy Notice may be updated from time to time. The latest version will always be available on the FDRI website. If changes are made, a prominent notice will be posted on the website.