Privacy Policy

Who we are and how to contact us

The Alan Turing Institute is a registered charity in England and Wales (charity number 1162533) and a company limited by guarantee, incorporated in England (number 9512457). We are based at the British Library, 96 Euston Road, London NW1 2DB. Our ICO registration number is ZA541179. We also have a subsidiary, Turing Innovation Limited (ICO registration ZB085282). 

If you have any questions about this notice or how we handle your personal information, please contact [email protected].

Turing people

“Turing People” means all people who are authorised to represent the Turing and are contracted to the Turing (including but not limited to employees, secondees, volunteers, consultants, or trustees/directors), including those applying to these roles. 

How do we collect personal information?

We may collect personal information:

• Direct from you, for example when you apply to work with us.
• Indirectly from another source, for example recruitment agencies, universities, former employers, background check agencies or supervisors if you are a Student.
• From public sources of information (for example, open social media such as LinkedIn and university websites).
• In the course of your activities throughout the period of you working for us or while you are on our premises, as well as feedback and opinions from your colleagues.
• If you do not provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as paying you), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of Turing People or other Relevant People).

What personal information do we hold?

We may collect, store and use the following categories of personal information about you (Note that depending on your relationship with the Turing, some of these fields might not apply to you – for example information about salary will be more relevant to those who are salaried Turing People):

• Name and contact details (email, telephone and address).
• Date of birth and gender.
• Marital status and dependants, and next of kin/ emergency contact information.
• National Insurance Number.
• Bank account details, payroll records and tax status information.
• Salary, details of expenses and stipends, annual leave, pension and benefits information.
• Start date and leaving date.
• Location of employment.
• Recruitment information (including copies of right to work documentation, references and other information included in the CV and/or application, and interview notes).
• Employment records (including job titles, work history, holidays and training records).
• Information about your engagement with us including its termination.
• Disciplinary, grievance, and/or complaints information.
• Information about your use of our information and communications systems.
• CCTV footage and other information regarding building access.
• Your photograph.
• Information about the projects you work on, and any publications with which you are involved.
• Criminal records information where we need to request a background check.

Any other information provided to us by one of the methods in How do we collect personal information? above.

How can we lawfully use your personal information?

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information:

• Where we need to perform the contract we have entered into with you.
• Where we need to comply with a legal obligation.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and rights do not override those interests.

We may (less commonly) use your personal information:

• Where we need to protect your vital interests (or someone else's vital interests) in an emergency situation.
• With your consent. 

Where we rely on legitimate interests, our legitimate interests include:

• To ensure the smooth running of the Turing (for example dealing with HR/people issues and business management).
• To conduct research and further the work of the Turing (including managing relationships with Visiting Collaborators and Students and their organisations).
• Managing our contractual relationship with project sponsors and Relevant People.
• Evaluating and updating our services. 

Why do we use your personal information?

We use your personal information (where relevant to your specific role or type of engagement): 

• As part of the recruitment and appointment process.
• As part of the terms on which you work with us and to administer those terms (including but not limited to making salary, expense or stipend payments to you or giving you access to our premises both digital and/or physical).
• To check you are legally entitled to work in the UK.
• To pay you and to deduct tax and National Insurance contributions if you are an employee.
• To provide benefits to you where relevant.
• To enrol you in a pension arrangement in accordance with our statutory automatic enrolment duties where you are an employee.
• As part of the process of making an award.
• For business management and planning, including accounting and auditing.
• As part of any performance reviews, as part of managing performance and determining performance requirements.
• To assist decisions about salary reviews and compensation where you are an employee.
• To assess qualifications for a particular job or task, including decisions about promotions.
• To gather evidence for possible grievance or disciplinary hearings or other complaints.
• To make decisions about your continued employment or engagement with us.
• To provide or facilitate training and development.
• To deal with disputes involving you, or other Relevant Persons, including accidents at work.
• To ascertain your fitness to work where relevant.
• To manage sickness absence.
• To comply with health and safety obligations.
• To prevent fraud.
• To monitor your use of our information and communication systems to ensure compliance with our IT policies.
• To ensure network and information security.
• As part of data analytics studies to review and better understand employee retention and attrition rates.
• To undertake equal opportunities monitoring.
• Or for another reason, if that reason is compatible with the original purpose.

We may share this information with:

We will share your information with third parties where required to by law or where we have another legitimate interest in doing so.

Where we share information with other ‘controllers’ (organisations who will use the information for their own purposes, rather than to provide services to us) they are responsible to you for their use of your information and compliance with the law. These include: 

• partner universities 
• other research partners 
• project sponsors
• HMRC
• Charity Commission
• professional advisers 
• other entities in our group, partner universities, research partners, service providers (for example payroll and pension providers) 

Where we share information with ‘data processors’ (organisations or suppliers which provide services to us, processing your data according to our instructions and under contract) they are responsible to you for their use of your information and compliance with the law. 

We share the information in a secure way and take appropriate steps to ensure the recipient protects it.

We may also need to share your personal information in the context of the possible merger, restructuring or expansion of the Turing. If you have any questions about the use of your personal information in this way, or would like to object to this particular use, then please contact us at [email protected] 

Special category data 

Certain types of information require greater protection, such as information about your health, disability, and your racial or ethnic origin. We need to have further legal justification for using these types of information. We collect and use these ‘special categories’ of personal information:

• To comply with employment and other laws – for example using information about health to ensure your health and safety in the workplace, to manage sickness absences, and administer benefits including maternity pay where relevant. We will also process health data to assess and administer reasonable adjustments.
• To ensure meaningful equal opportunity monitoring and reporting – for example by collecting information about your race or national or ethnic origin.

Information about criminal convictions

We will only collect information about criminal convictions if it is appropriate and where we are legally able to do so. We collect information about criminal convictions as part of the recruitment process, and share this information with the British Library, in order to meet our obligations to the British Library for building security and access. We may also seek to carry out enhanced background checks where required, for example where your role involves working with children and/or vulnerable adults. 

Research participants

How we get the personal information and why we have it

For research projects where you are a direct participant, such as an interviewee or survey responder, the data is provided directly by you for the purposes of the research project. In addition to this general privacy notice, the researcher will explain in detail how your data will be used. 

We may also receive your personal information indirectly, where it is included in a dataset for a research project. The General Data Protection Regulation (GDPR) and Data Protection Act 2018 includes exemptions around research. This can allow for actions such as processing without providing a privacy notice, retaining data indefinitely or refusing a data subject’s request for their data to be removed from a project.

These elements are carefully qualified by requirements to safeguard personal data, use approaches to minimise or reduce the risk of identification and keep that data securely. Other general approaches should ensure that research using personal data:

• should not, unless in specific medical contexts, lead to a decision or intervention about an individual.
• should not identify that individual in the research outputs.
• should not cause damage or distress to the individual.
• should, where possible, use techniques such as pseudonymisation and anonymisation.

We use the information in order to:

Carry out research projects led by the Turing and its partners, to further the Turing’s Strategy objectives. 

We may share this information with research partners, under contract and data sharing agreements, in order to carry out the research. 

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are: 

The legitimate interest of the Turing and its partners to conduct research and further the work of the Turing. Where we process special category data or criminal convictions data, we process data as necessary for research purposes, with appropriate conditions and safeguards set by the legislation. 

Donors and prospective donors

The Turing will be making bespoke approaches to individuals who have the potential to support its work in a meaningful way. The Turing will therefore carry out research to identify potential individuals to support its philanthropic objectives. This research will use data from publicly available sources, from peers or associates, and (once a person has been contacted) from the individuals themselves. The research will be stored safely on our systems in accordance with current law and guidance, and the Institute’s own data protection policies. 

As we identify and develop relationships with our donors and prospective donors, we collect the following types of information:

• Name, title/s and postal address. 
• Contact details such as email addresses, social media links and telephone numbers. 
• Your track record of philanthropy, as it might relate to our work.
• What kind of connection you have with us.
• Why you have decided to donate to us.
• Your feedback from your dealings with us.

How much of this information we collect depends on the type of relationship we have with you and the information we build during your relationship with us. 

We use the information in order to:

• Provide you with the information you asked for, such as reports on projects that you have helped to fund.
• Invite you to meetings and events that we consider will be of interest to you.
• Administer your contact details and give you the opportunity to change your preferences as well as amend errors and update your data.
• Manage donations including processing Gift Aid.
• Keep a record of your relationship with us, including your feedback.
• Ensure we know how you prefer to be contacted. 
• Flag your data record, for example if you opt out of any specific data processing, or if you have special requirements.
• Carry out standard due diligence exercises, if you decide to donate to us.

How will we obtain this information?

We use research and screening techniques in order to tailor our communications effectively to our donors. This helps us to understand donors’ motivations for supporting the Institute’s work and means that we can speak to donors and potential donors about projects and sizes of gifts that they might be willing to support and make. 

When conducting this research, we may analyse geographic, demographic, academic, or professional information relating to you in order to better understand your preferences and possible interests in or affiliations with the Turing’s work. In doing this, we may use additional information from third party sources when it is available. Such information is compiled using publicly available data about you from reputable sources such as listed directorships or company shareholder information on the UK Companies House website, or information that you have chosen to put into the public domain such as on corporate/institutional websites of organisations where you work or you have a publicised association with, or where you have made comments in the press. 

We may also use publicly available information from these and other sources (such as mainstream news and media) to gather information regarding prospective donors in order to detect and reduce fraud/credit risk as well as for 'due diligence' purposes to safeguard our reputation. 

What is our lawful basis for processing this information? 

We have a legal obligation to the Charity Act 2011, to process your personal data as required as part of a due diligence exercise.

We have a legitimate interest to support, through philanthropic efforts, the research and other activities of the Turing, according to our Strategy https://www.turing.ac.uk/about-us/our-strategy 

In the course of our research, we may record ‘special category data’, such as a political affiliation or religious faith, where you yourself have manifestly made it public. A standard due diligence procedure may reveal special category or criminal convictions information, which for the Turing is necessary for the substantial public interest of our regulatory requirements under charity law. We may process data relating to equalities and diversity monitoring as set out in the section you can 'Jump to' on the right-hand side of this page. 

Attendees to events

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• You have submitted your contact details and other relevant information when you have booked a place on one of our virtual or in-person events.
• We have recorded any relevant information from your attendance one of our virtual or in-person events. 
• We have given you the option to provide some equalities and diversity information, separate from your booking. 
• You may appear or be included in video, audio, images or transcripts of the event. 

We use the information that you have given us in order to: 

• Facilitate your attendance at the event. 
• Make any reasonable adjustments as required, such as physical access to the building or a dietary requirement. 
• To aggregate the equalities and diversity information you and other attendees choose to provide, allowing us to carry out meaningful equal opportunity monitoring and reporting, to inform our aim to ensure wider access and participation in our activities.
• Promote our events and their outputs as part of our mission. 

We may share this information with 

• Partners hosting the event, such as a venue provider. 
• Videos, audio, images or transcripts of the event may be shared on Turing social media platforms.  

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are: 

• We have a contractual obligation to retain a record of a payment and other relevant information dependent on your entrance to the event.
• We have a legal obligation under the Equality Act 2010 to ensure that reasonable adjustments have been made for you to access the event, where you have requested them. 
• We have a legitimate interest to retain a record of the event, which may include video, audio, images or transcripts that includes you as an attendee. 

Please let the Alan Turing Institute know if you would rather it did not use photographs or recordings of you in this way. You can do this by contacting the event organizers in advance https://www.turing.ac.uk/contact-us. Please also feel free to let any photographers or camera crews working at any events know if you would rather not be photographed or recorded.

Subscribers to our mailing lists and other marketing materials

How we get the personal information and why we have it

• You have provided your email address when you signed up to our mailing list. 

We also receive personal information indirectly, from the following sources in the following scenarios:

• You have a publicly available email address that meets the ‘corporate subscriber’ exemption in the Privacy and Electronic Communications Regulations (PECR) and the activity we are promoting links with your professional role (e.g., a research speciality or sector expertise).  

We use the information that you given us in order to: 

• Keep you updated with our latest news, events and any other service you have requested. 
• Contact you in relation to events or projects related to your research speciality or sector expertise. 

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are: 

• Your consent in signing up to our mailing list. You are able to remove your consent at any time. You can do this by contacting: [email protected]. 
• Where we have a legitimate interest to inform you at your publicly available email address that meets the ‘corporate subscriber’ exemption in the Privacy and Electronic Communications Regulations (PECR). We will state who we are, why we are contacting you and you will be given an option to unsubscribe. 

Visitors to our website

Please see our cookie notice  https://www.turing.ac.uk/cookie-notice

Your rights

Under certain circumstances, by law you have the right to:

• Ask for a copy of your personal information (commonly known as a "subject access request").
• Ask that we update or correct the personal information that we hold about you if you believe it to be inaccurate.
• Ask that we erase the personal information that we hold about you, where there is no good reason for us continuing to hold it. We may not need to erase it, but we will need to show that we continue to have a good reason to refuse your request. 
• Object to our use of your personal information if we are relying on a legitimate interest and there is something about your situation which makes you want to object. We may not need to stop, but we will need to show a good reason to keep using it. You can always ask us to stop using your personal information for direct marketing purposes.
• Ask that we restrict our use of your personal information so that we are simply storing it, for example if you want us to establish its accuracy or our reason for using it.
• Request the transfer of your personal information to you or another party. This only applies where you have provided us that information and we are processing it with your consent or to perform a contract with you. This is unlikely to apply in most cases.
• Change your mind and withdraw consent you have given us.

To exercise any of the above rights, please contact [email protected]

These are legal rights, so they only apply in certain circumstances and are subject to exemptions.

We may also need to take steps to confirm your identity. This is another security measure to ensure that your personal information is not disclosed or controlled by any person who has no right to receive it.

If you have concerns about the way we are handling your personal information, you also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.

Transferring information outside the UK and EU

We are based in the UK. Generally, we hold personal information on servers located within the UK. However, we do use suppliers that operate around the world, which means it is possible that personal information we collect from you may be stored outside of the UK or the EU. Some of our sites may have servers outside of the UK or EU.

Certain countries outside the UK have a lower standard of protection for personal information, including lower security protections and fewer rights for individuals. Where your personal information is transferred outside the UK to a country which does not offer similar protection, we put in place appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and respects UK data protection laws (such as requiring the recipients to enter into contracts which have been approved by the relevant UK authorities for this purpose).

Data security

We have put in place suitable technical and organisational measures to protect the security of your information. These measures include limiting access to your personal information to those individuals who have a business need to know.

Automated decision making and profiling

As a research institute, we may use personal information in ways which involve ‘automated decision making’ and which might constitute ‘profiling’; however, we do not typically do this in ways which will have a significant legal effect on you.

We do not make automated decisions based on any particularly sensitive, or ‘special category’ data, unless it is justified in the public interest, in which case we will put in place appropriate measures to safeguard your rights.

When you use our sites, we may use the information collected to profile you as a website visitor. This is done to help us monitor the demographics of individuals who are engaging with certain materials where such monitoring is considered to be essential to the core aims of the relevant site - for example to meet our aim of engaging with a diverse cross section of our community in steering projects.

We may carry out profiling in our fundraising work. Please see the section on ‘Donors and fundraising’. 

Equalities and diversity information

The Alan Turing Institute (the Turing) recognises the importance of building a diverse community. To make the great leaps in research that we aspire to as the national institute for data science and artificial intelligence, promoting and embedding equality, diversity and inclusion (EDI) is integral to achieving our mission. See our dedicated page for more information https://www.turing.ac.uk/about-us/equality-diversity-and-inclusion 

We collect data to ensure meaningful equal opportunity monitoring and reporting. When processing special category data on for the purpose of diversity monitoring, we rely on the condition in the Data Protection Act 2018, which allows for processing of certain categories of special category data for monitoring equality of opportunity or treatment. This statistical analysis will not identify you or lead to any decision making about you. 

Childrens' data

In our general operations, the Turing does not provide services directly to children or proactively collect their personal information. Where a particular project or event engages with children, the Turing will ensure that it plans and implements the project according to the data protection principles and guidance provided by the Information Commissioner's Office. Any research projects involving childrens' data will be subject to the Turing's research ethics process.

Special category and criminal convictions data

Certain types of information require greater protection, such as information about your health, ethnicity or criminal convictions. The legal conditions we can rely on to process these ‘special category’ data or criminal convictions data require us to have an ‘appropriate policy document’. Our appropriate policy document is covered in a section of the Turing Data Protection Policy for the following processing: 

• Processing special category data on Turing People in order for the purposes of carrying out our employment law obligations. For this, we rely on Article 9(2)(b) of the UK GDPR. 
• Processing special category data on Turing People and event attendees for the purpose of diversity monitoring. For this, we rely on the condition in Paragraph 8 of Part 1 of Schedule 1 of the Data Protection Act 2018, which allows for processing of certain categories of special category data for monitoring equality of opportunity or treatment. 

In both cases, this policy sets out our procedures for complying with the data protection principles when processing this special category data. Our policies relating to retention and erasure of this special category data are set out in our Data Retention Policy. 

Updates to this notice

We may update this notice. If we make substantial changes, we will bring these to your attention where reasonably possible. Otherwise, you can access the latest version of this notice on our main website.