...
(b) Procedures to deal with any suspected data security breach, and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
7.2. Any personal information that you submit to us will be held on secure servers, based within the European Economic Area (EEA).
7.3. If we are required to transfer your information outside the EEA, we have put in place the appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the EU and UK laws on data protection.
7.4. If you are based outside the EEA we may transfer personal information to the correspondence address you provide to us. We will take all reasonable steps to ensure that such transfers are secure. By instructing us from outside the EEA you acknowledge and agree that such transfers are necessary for us to provide services to you.
8. How long will we keep your personal information for?
8.1. We will only keep your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
8.2. Where a minimum retention period is required by law (such as retaining records for regulatory purposes) we comply with that minimum period plus up to 12 months to allow time for us to anonymise or delete information in accordance with our internal data management processes.
9. Your rights
9.1. You have the following rights:
9.1.1. to be told what we are doing with your personal information. We do this by providing you with this privacy notice;
9.1.2. to correct or update the personal information we hold about you;
9.1.3. to object to the processing of your personal information;
9.1.4. to request a copy of the personal information we hold about you;
9.1.5.to ask us to delete the information that we hold about you where there is no good reason for us continuing to process it;
9.1.6. to ask us to stop processing your personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground and where there is no good reason for us continuing to process it;
9.1.7. to ask us to restrict how we use your personal information for a period of time if you claim that it is inaccurate and we want to verify the position or in some limited other circumstances;
9.1.8. to ask us to send your personal information to another organisation in a computer-readable format;
9.1.9. to complain to the Information Commissioner's office if you are unhappy with our use of your personal data: you can do this at https://ico.org.uk/concerns/. Do contact us straight away if you consider that we are not handling your personal information properly so we can try and sort the problem out.
9.2. If we delete your personal information or restrict our use of it, we will not be able to provide our services to you.
9.3. If you want to exercise any of your rights, please contact data-protection@ucl.ac.uk. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).
Last Updated [ 1st ] June 2020
...