This Notice explains how Leeds Arts University will collect and use your personal data. This policy outlines what categories of information we retain and how we use it. Leeds Arts University is committed to looking after any personal data that it processes, in accordance with Data Protection Legislation, including the UK GDPR, the EU GDPR and the Data Protection Act as amended. Leeds Arts University is a Controller for the purposes of Data Protection Legislation. This means that we are responsible for deciding how we hold and use personal information about you. We are required under Data Protection Legislation to notify you of the information contained in this privacy notice.
Throughout this Notice, “University” "we", "our" and "us" refers to Leeds Arts University and "you" and “your” refers to those individuals who take part in a research project or activity that is being undertaken by the University.
It is important that you read and retain this notice, together with any other information we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using that information and what your rights are under Data Protection Legislation. If you have any questions about your participation in a research project or activity, including how your personal data will be processed, then please contact the University research staff indicated on your participant information sheet.
If you have any other questions, or would like any further information about how the University processes your personal data more broadly, then please contact dpo@leeds-art.ac.uk.
Where do we get your personal data from?
We obtain your personal data from the following sources:
When you sign up to, and participate in, one of our research projects or activities. This may include:
Participant consent forms
Live in-person interviews with you, which may be filmed and/or sound recorded
Live virtual interviews with you, which may be filmed and/or sound recorded
Online surveys
Paper-based surveys
Workshops
Any other meetings, discussions or specific activities which relate to the research projects
What personal data do we hold?
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include instances where it is not possible to identify individuals from the data (e.g. anonymous data). The personal data that we collect and hold about you will depend on the research project or activity that you are participating in. As a minimum, regardless of the research project or activity, we are likely to collect your:
Name
Date of Birth
Address
Phone Number
Consent preferences that you have provided, including information participant consent forms as well as any project specific consents that may apply
Engagement record in the research activity, including attendance at sessions
Information that you submit to us as part of the research project or activity, including any answers to questionnaires or surveys or information disclosed during interview or workshops which may include your personal information
Any specific categories of personal data that may be required to be collected as part of a particular research project or activity will be made clear to you in the participant information sheet.
Special Category Personal Data
There are certain types of more sensitive personal data which require a higher level of protection, known as special category personal data, which we collect and process. Special category personal data has a very specific definition in Data Protection Legislation, and includes, but is not limited to, your:
Health data, including any disability information and/or additional support needs
Race or ethnicity
Religious or philosophical beliefs
Sexual orientation
We won’t always need to process your special category data, and it will depend on the research project or activity that you are taking part in. Any specific categories of special category personal data that may be required to be collected as part of a particular research project or activity will be made clear to you in the participant information sheet.
When we process special category personal data, we are required to apply additional protections to it. We only process it in certain situations, where the law allows us to do so. This could include where we have a legal obligation, or where the purpose satisfies another legal justification. More information about our legal bases for processing your special category personal information can be found below.
Will we send your data to third party organisations?
Your personal data may be shared with third party organisations that we are collaborating with on a particular research project or activity. We will make it clear to you in the participant information sheet if we are collaborating with any organisations who may also receive or have access to your personal data. We will also make it clear if a research project or activity is being funded by any third parties, who may also have access to personal data as a result.
We do not otherwise sell or transfer personal data to any third parties unless you have consented to this or this is permitted by law.
Instances where we may share your personal data with a third party include:
Where there is a legal requirement for us to do so;
Third party service providers, such as for email services and CRM services within the University’s standard administrative environment;
On occasion, and where necessary, with University auditors;
On occasion, and where considered necessary, information may be shared with the police and/or other law enforcement agencies;
In instances, only when it is considered absolutely necessary, where we believe that you, or someone else, is at serious risk of being harmed.
When we use third party service providers, we only disclose to them any personal information that is necessary for them to provide their service. This includes the third-party provider we use to send you surveys. All of our third-party service providers are required to take appropriate security measures to protect your personal information. We only permit third-party service providers to process your personal data for specified purposes and in accordance with our instructions.
Occasionally we may need to send your personal data outside of the UK. Where this is the case, we will ensure that adequate levels of protection are in place to support the security of the transfer. Adequacy regulations in the UK currently apply to countries in the European Economic Area and countries covered by existing European Union adequacy decisions. Where these regulations do not apply, additional safeguards will be put in place for any necessary restricted transfer of your personal data.
Data Security
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Additionally, we limit access to your personal information based on business need.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Automated decision-making
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
We do not envisage that any decisions will be taken about you using automated means. However, we will notify you in writing if this position changes.
How and why will we communicate with you?
Once you have signed up to participate in a research project or activity with Leeds Arts University, our staff will communicate with you via email. Any other research project or activity specific communication channels will be outlined to you in the participant information sheet.
We may use third party processor communication platforms to share information which could include your personal data. This will only ever to be to facilitate the University’s standard processing activities in instances where it is necessary for us to do so.
Your rights as a data subject
Data Protection Legislation gives you a number of rights to protect your personal data and its use. You have the right, subject to any exemptions, to:
Withdraw consent where that is the lawful basis of our processing. Please see the section later on in this notice as to how consent is used for research projects and activities, and the instances in which it may and may not be withdrawn.
Access your personal data that we process and obtain a copy of your data in a commonly used electronic format
Rectify inaccuracies in personal data that we hold about you
Be forgotten. This means that in certain circumstances you can request that your details be removed from systems that we use to process your personal data
Restrict the processing of your personal data in certain circumstances
Object to certain processing of your personal data by us
If you would like to exercise any of these rights you can contact us at dpo@leeds-art.ac.uk. Please note that we may need to request specific information from you, such as photographic ID, to help us confirm your identity and ensure your right to access the information (or to exercise your other rights). This is another security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Please see ico.org.uk for further information on the above rights.
How can I complain?
If you have any concerns or complaints, you can contact the Data Protection Officer at: dpo@leeds-art.ac.uk.
You can also lodge a complaint with the Information Commissioner’s Office. They can be contacted via their website, or at:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Legal bases for processing your Personal Data and Special Category Personal Data under Data Protection Legislation and retention
We will only keep your information for as long as is necessary for us to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements. Sometimes we may anonymise personal information so that you are no longer identifiable by the data. In these cases, we may use this information without further notice to you.
We only process your personal data where we have established a legal basis for processing under Article 6 of the UK GDPR, and Article 9 if we are processing your special category personal data. There are 6 bases for processing that are laid out under Article 6 of the UK GDPR, which we use to support our processing of your personal information. In addition, Article 9 of the UK GDPR requires us to meet an additional legal basis for processing where we are processing your special category personal data. The special category information that we collect will depend on the nature of the specific research project or activity, but may include information relating to your health (for example if you have a disability), your ethnicity or your sexual orientation.
Typically, when Leeds Arts University is undertaking research projects or activity, we will process your personal data under the Article 6 legal basis of:
Public Interest
This is when processing is necessary for the performance of a task carried in the public interest. Much of the processing we undertake is under this basis, including research activity, within our capacity and core functions as an educational establishment.
In addition, when we are processing your special category personal data as part of research projects or activities, we will do so under the Article 9 basis of:
Research and Statistics
This is when processing is necessary for research purposes or statistical purposes. This condition requires measures to be put in place to safeguard your data and your interests, which are described within this privacy notice.
We may also use the following Article 9 legal bases to process your special category personal data:
For provision of support where you have disclosed information about your physical health, mental health and/or disability status;
Equal opportunity monitoring and reporting, including where this is required to external bodies;
Where it is necessary for the purposes of carrying out obligations and exercising rights as required by law;
Where it is necessary to protect the vital interest of you or another person;
Where it is necessary for the establishment, exercise or defence of legal claims.
Consent
We do not generally use consent as the legal basis for processing your personal data when we are undertaking research projects or activity. Relying on consent requires that you are also able to effectively withdraw your consent at any time. This would often not be possible without affecting the validity and integrity of the research process, including outputs.
Consent is requested for active participation in research projects or activity, which can be withdrawn at any time. This applies to participation in workshops and interviews, and completing surveys, and means that you can choose not to complete these surveys or attend these sessions if you change your mind. However, for the avoidance of doubt, and as outlined above, withdrawal of your consent from active participation does not mean that we will always be able to withdraw your personal data from the research activity or project completely. We will remove your data wherever it is possible to do so without affecting the validity and integrity of the research activity, but this may not always be possible. The participant information sheet will outline the date from which we would not be able to withdraw your data.
There are very limited circumstances where we may ask for consent for specific uses of your data as part of a research project or activity. If we want to use your personal data in an identifiable way as part of our research outputs, we will always ask for your specific consent before we do so. This includes your name, any photos or footage that you clearly appear in, or any other information that you share with us as part of the research activity or project which clearly identifies you. Consent for usage of this material can be withdrawn at any time prior to it being used in publication, however please be aware that withdrawal of your consent for this specific activity does not affect the legal bases of processing your personal data for the research itself, as described above.
Consent collection for specific use of your data as outlined in this privacy notice will be collected as part of a participant consent form. This form will also ask you to confirm that you have been given access to this privacy notice.
Changes to this Information
We may update this information and we will notify you when we do this where necessary. This document was last updated on 31 July 2025.
This site uses cookies to improve your experience, track the performance of the site and serve targeted advertising. To find out more and how to change your cookies settings visit our Cookie Policy.