Privacy notice for Lecturecast system

University College London, (we or us) is a company incorporated by Royal Charter (number RC000631) . Our registered office is at Gower Street, London, WC1E 6BT.

1 What is the purpose of this document?

1.1. We are committed to protecting and respecting your privacy. This privacy notice sets out the basis on which we collect and use personal data via the Lecturecast system both during lectures and access to recordings via our intranet site (Lecturecast).

1.2. This privacy notice applies to: lecturers and other staff within the University who use and access the Lecturecast System, visiting and guest speakers and students (you).

1.3. We are a data controller. This means that we are responsible for deciding how we hold and use personal information about you, and for explaining this clearly to you.

1.4. Please read this privacy notice carefully to understand what we do with your personal information and what rights you have in relation to our activities for the Lecturecast System.

2. What is personal data and our lawful basis for processing?

2.1. Personal data, or personal information, means any information relating to an individual from which that person can be identified. There are special categories of more sensitive personal information which require a higher level of protection (see further at section 4, below).

2.2. We will only use your personal information when the law allows us to. Our principle lawful basis for processing is set out in the table below. However, some of our grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

2.3. We may only rely on our legitimate interests (or those of a third party) to process your personal information, if your interests and fundamental rights do not override those interests. Where we rely on legitimate interests for our processing, we have set out the relevant interest below.

2.4. We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will 2.1. notify you and we will explain the legal basis which allows us to do so.

2.5. Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law.

3. Information we collect from you and about you and how our use complies with the law?

Information we collect from you
Information	How we use your information	How our use complies with the law
From lecturers, unless you opt out of lecture recordings, we collect your recorded image and voice, the content of your lecture (including any material that may be projected via a presentation or slide show, or any material projected via the lectern document camera) and the information contained therein as spoken by you during the lecture.	To provide recordings of the lectures after the event through the Lecturecast system.	Processing is necessary for the performance of our tasks in the public interest: providing educational courses and the ancillary activities to facilitate this task in line with our statement of tasks in the public interest.
From visiting lecturers or guest speakers we collect your recorded image and voice, the content of your lecture and the information contained therein as spoken by you during the lecture.	To provide recordings of the lectures after the event through the Lecturecast system.	We only record the lectures with your consent.
From students attending the lectures we collect your image if you enter the lecture theatre whilst recording is in process and any questions that may be asked and that may be caught by the microphone during the recording of the lecture.	To provide recordings of the lectures after the event through the Lecturecast system.	Processing is necessary for the performance of our tasks in the public interest: providing educational courses and the ancillary activities to facilitate such task in line with our statement of tasks in the public interest.
From students accessing recordings via the Lecturecast system we collect your username and access details.	To monitor use of the Lecturecast system and interaction with other parts of the UCL system.	Processing is necessary for the performance of our tasks in the public interest: providing educational courses and the ancillary activities to facilitate this task in line with our statement of tasks in the public interest.
From students accessing the interactive content associated with the lecture, we collect the notes, questions and any responses that are posted by you or the lecturers. Where you respond to questions, any responses will be anonymous to other students, but course tutors will be able to view your names.	To monitor use of the Lecturecast system.	Processing is necessary for the performance of our tasks in the public interest: providing educational courses and the ancillary activities to facilitate this task in line with our statement of tasks in the public interest.
Information we receive from third parties
From the Lecturecast system we receive analytics data on every student's usage of the interactive content.	To monitor use of the Lecturecast system.	Processing is necessary for the performance of our tasks in the public interest: providing educational courses and the ancillary activities to facilitate this task in line with our statement of tasks in the public interest.

4. Special Category Data

4.1. We do not process particularly sensitive personal information in relation to the Lecturecast system as part of our usual course of business. However, we may process information relating to a health condition or disability otherwise in order to meet our legal obligation to make reasonable adjustments in the provision of our Lecturecast services.

4.2. We may also process special category data as necessary:

4.2.1. to ensure meaningful equal opportunity and diversity and inclusion monitoring and reporting;

4.2.2. where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent;

4.2.3 where it is necessary to establish, exercise or defend a legal claim;

4.2.4 where you have manifestly made the information public; or

4.2.5. otherwise with your explicit consent.

5. Sharing your information

5.1. We may share information collected via the Lecturecast system with third parties as follows:

5.1.1. our regulators, professional advisors and auditors;

5.1.2. if we sell any business or assets, in which case we may disclose your personal information to the prospective buyer of such business or assets;

5.1.3. if we have a legal obligation to do so;

5.1.4. for investigation into appropriate use of University systems; and

5.1.5. for the purposes of fraud protection.

5.2. If you object to our sharing or continuing to use your personal data with any specific third party please contact us at data-protection@ucl.ac.uk .

5.3. Data recorded via the Lecturecast system is processed by our third-party service provider, Echo360. All of our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes.

6. Automated decision-making

6.1. Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention.

6.2. We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

7. Data security

7.1. We have put in place:

(a) Appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

(b) Procedures to deal with any suspected data security breach, and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

7.2. Any personal information that you submit to us will be held on secure servers, based within the European Economic Area (EEA).

7.3. If we are required to transfer your information outside the EEA, we have put in place the appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the EU and UK laws on data protection.

7.4. If you are based outside the EEA we may transfer personal information to the correspondence address you provide to us. We will take all reasonable steps to ensure that such transfers are secure. By instructing us from outside the EEA you acknowledge and agree that such transfers are necessary for us to provide services to you.

8. How long will we keep your personal information for?

8.1. We will only keep your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

8.2. Where a minimum retention period is required by law (such as retaining records for regulatory purposes) we comply with that minimum period plus up to 12 months to allow time for us to anonymise or delete information in accordance with our internal data management processes.

9. Your rights

9.1. You have the following rights:

9.1.1. to be told what we are doing with your personal information. We do this by providing you with this privacy notice;

9.1.2. to correct or update the personal information we hold about you;

9.1.3. to object to the processing of your personal information;

9.1.4. to request a copy of the personal information we hold about you;

9.1.5.to ask us to delete the information that we hold about you where there is no good reason for us continuing to process it;

9.1.6. to ask us to stop processing your personal information where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground and where there is no good reason for us continuing to process it;

9.1.7. to ask us to restrict how we use your personal information for a period of time if you claim that it is inaccurate and we want to verify the position or in some limited other circumstances;

9.1.8. to ask us to send your personal information to another organisation in a computer-readable format;

9.1.9. to complain to the Information Commissioner's office if you are unhappy with our use of your personal data: you can do this at https://ico.org.uk/concerns/. Do contact us straight away if you consider that we are not handling your personal information properly so we can try and sort the problem out.

9.2. If we delete your personal information or restrict our use of it, we will not be able to provide our services to you.

9.3. If you want to exercise any of your rights, please contact data-protection@ucl.ac.uk. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).

Last Updated [ 1^st ] June 2020