Under data protection law, the University of Bedfordshire needs your consent to process your personal data for the purpose of accessing the iSort (integrated systemic organisational resilience toolkit) web application (hereafter “web app”).

The iSort web app is designed to help organisations and individuals who are working or training in the helping professions understand, build and sustain organisational, team and personal resilience. The iSort has been produced with support from Research in Practice.

Our Privacy Policy explains what personal information we collect, how we use personal information, how personal information is shared, and privacy rights.

We keep our privacy policy under regular review. This version was updated on 16 August, 2024. It may change and if it does, these changes will be posted on this page

Who we are

The University of Bedfordshire is the data controller and data processor for data protection purposes. The University’s address is:

University of Bedfordshire

University Square

Luton, Bedfordshire

UK, LU1 3JU

Phone Number: +44 (0)1582 743885

E-mail: hello@isort.co.uk

Web address: https://www.beds.ac.uk

The type of personal information we collect

If you create an iSort account, we will only collect and use data you provide with your consent. Without this information, we may not be able to provide our services. We may collect, use, store and share the following kinds of personal data:

• Identifiers: name, organisational email address or other similar identifiers

• Profession, employment or student status: employer or organisation, employment and training sector, job role type or student status

• Demographic data: age and gender or gender identity

• Special category data: race or ethnicity, sexual orientation or information about your health.

Special category data

Due to the purpose of the web app to enhance organisational and personal resilience and the ability of users to input personal data, we may process special categories of personal data. The iSort does not automatically collect any special categories of personal data. We will only process special categories of personal data if you specifically input such data into the web app.

How we get the personal information and why we have it

We primarily use your personal data for the iSort to function and deliver services and interactive features within the web app. Most of the personal information we process is provided to us directly by you for one of the following reasons:

• Account information: If you decide to set up an account with us, we may ask you to provide certain contact information, including your first and last name, organisational e-mail address, employer or organisational name (organisational users only), employment sector, job role type as well as password and other authentication-related information.

• Profile and demographic information (individual users only): Through your iSort account, you may have the opportunity to provide additional information about yourself, such as your age, race and ethnicity, gender or gender identity, sexual orientation and information about your health.

• Information that we automatically collect:

Aggregated, anonymous or de-identified data for research purposes. We may create, collect or share aggregated, anonymous or de-identified data from personal information by removing, masking, or otherwise altering data components that make data personally identifiable or potentially personally identifiable to you (“de-identified data”). For example, we may de-identify and aggregate survey or questionnaire data collected to carry out analysis on how organisations, teams and individuals build and sustain resilience for use in research publications, conference presentations or public talks.

De-identified data is not personal information and not subject to this privacy policy. However, if we combine or connect aggregated data so that it can directly or indirectly identify you, we will treat the combined data as personal data which will be used in accordance with this privacy notice.

We may use your personal information in the following ways:

• To provide the iSort web app, including delivery of content and interactive features

• To maintain and improve the quality of the iSort web app, including to perform research and development and understand user trends

• To comply with our legal or regulatory obligations

Who do we share your data with?

All data provided by you are processed by University of Bedfordshire staff and third-party contractors. When you consent to providing us with your personal data, you also consent to us sharing your personal data with the following third parties:

• Our service providers. In some circumstances,we may need to disclose your personal information to a third party so that they can provide a service on our behalf. These service providers include IT and system administration services and web hosting services. Our service providers have access to your personal information only to perform these tasks on our behalf, based on our instructions and are contractually obligated to maintain the confidentiality and security of your personal information, and to not disclose or use your personal information for any other purpose inconsistent with this privacy policy.

• Partners and business transfer. Should the iSort be subject to an asset sale, acquisition or transfer of management responsibility to an iSort partner, your personal information may be transferred to the acquiring body. If such a transfer results in a material change to the use of your personal data, we will provide notice before your personal information is transferred or becomes subject to a different privacy policy.

We may also share aggregated, anonymous or de-identified data with our partner, Research in Practice for research, quality improvement and user analytic purposes.

We never share your personal data with any third party for marketing purposes.

Lawful basis for processing

Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing this information are: Your consent. You are able to remove your consent at any time. You can do this by contacting us info@isort.com. This will not affect the lawfulness of any processing carried out before your consent.

How we store your personal information

The safety and security of your information is very important to us. Our service providers currently provide hosting solutions powered by Digital Ocean. DigitalOcean are compliant with both AICPA SOC 2 Type II and SOC 3 Type II information security controls framework, demonstrating a commitment to protecting sensitive customer and company information. Our Digital Ocean servers are located in their London Data Centre. The site is staffed 24/7/365 with on-site physical security to protect against unauthorised entry.

Data retention

We will keep your personal information for as long as needed to perform our services to you. For example, we keep your account information, like your name, email address, and password, for as long as your account exists so that you may access it.

In some circumstances, you can ask us to delete your data, see section on your data protection rights below. If you request that we delete your data, all of the user generated content that is contained on the web app will be deleted from our servers and will be no longer accessible to us or to you.

In some circumstances, we aggregate, anonymise or de-identify personal data for research purposes, in which case these data will be retained without further notice to you. The length of time for which we keep your data will depend on a number of factors, including research funding and publication requirements. Your information will not be kept for longer than is necessary.

Cookies

When you visit the iSort website, we may collect information from you automatically through cookies, including cookies from third parties. We use cookies to make our website as useful as possible. They are small text files we put in your browser to track usage of our site but don’t tell us who you are.

None of the information can be traced to an individual person, and the cookie only relates to activity on our websites. The information cannot be used for marketing on an individual basis.

The cookies do not collect additional information about you and do not in any way compromise the security of your computer. Please visit www.allaboutcookies.org for information on how to disable and delete cookies from your computer.

Third party links

You may follow links contained in our web app to third-party websites. This privacy policy does not apply to third-party websites. We recommend that you review their privacy policies to understand how your personal information is used and stored by those third parties

Your data protection rights

Under data protection law, you have rights including:

• Your right of access: you have the right to ask us for copies of your personal information.

• Your right to rectification: you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

• Your right to erasure: you have the right to ask us to erase your personal information in certain circumstances.

• Your right to restriction of processing: you have the right to ask us to restrict the processing of your personal information in certain circumstances.

• Your right to object to processing: you have the the right to object to the processing of your personal information in certain circumstances.

• Your right to data portability: you have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

• You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at [DPO@beds.ac.uk] if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at DPO@beds.ac.uk.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113