Guidance

Business Applications and Space Solutions (BASS) Alumni: Privacy notice

Updated 19 August 2024

Version 1
19 August 2024

1. Data protection 

In the course of applying for membership of the Business Applications and Space Solutions (BASS) Alumni, you will provide information about yourself (‘personal data’). We (the UK Space Agency) are the ‘data controller’ for this information, which means we decide how to use it and are responsible for looking after it. This notice sets out how we will process your personal data, and your rights. It is made under Articles 13 and/or 14 of the UK General Data Protection Regulation (UK GDPR). 

2. The type of personal information we collect  

We will collect and process the following personal data: 

• name of organisation 
• name(s) of key contacts and role within your company/organisation 
• email addresses  
• postal contact address of organisation (used to identify region)  

We will not process any special category data.  

There will be some automated processing of your data, allowing us to send you communications regarding updates on the alumni, events and opportunities, the content and frequency of which is further outlined in the Alumni information pack.  

3. How we will use your data 

We will use your data to contact individuals over email (either individually or mass maildrop) with bulletins/newsletters and upcoming opportunities.  

We will only use your data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will seek your consent separately to use it for that new purpose. 

During the pilot phase of the programme, the legal basis for processing your personal data under Article 6 of the UK GDPR is: 

1(a)Consent: You consent to the processing of your personal data for one or more specific purposes. Should you change your mind, you can withdraw consent at any time by contacting space-applications@ukspaceagency.gov.uk, marking the email ‘BASS Alumni GDPR’ in the subject box.  

The subsequent full iteration of the programme will rely on: 

1(f)Legitimate interests: Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Our reasons for using legitimate interest as the primary lawful basis are: 

• it is necessary to ensure alumni are kept informed of opportunities to engage with the UK Space Agency in order to promote relevant activities and upcoming opportunities, supporting key UK Space Agency objectives. The processing of personal information is necessary to be able to achieve these aims
• our potential activity has a limited impact on the privacy of alumni. We have balanced our legitimate interest against the freedom and rights of alumni and we are confident that they don’t override their interests

4. Who has access to your data? 

Access to your data held by the UK Space Agency will be provided to staff within the agency who need to view it as part of their work in carrying out the purposes described above. 

We do not share your data outside of the UK Space Agency.  

5. Retaining your data 

We will retain your personal data until the conclusion of the pilot programme on 1 March 2024. Unless you contact us prior to expiry to opt out of the Alumni or notifying us of any changes to data, we will migrate your personal data into the full version of the programme after which your data will be retained in line with Legitimate Interest as the primary lawful basis.  

6. Where we store and use your data 

Your personal data will be processed in the UK within secure UK government systems which use the Government Microsoft 365 environment and are hosted in UK-based data centres. As your personal data will be stored on our IT infrastructure it will be shared with our data processors Microsoft and may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, the use of Standard Contractual Clauses or a UK International Data Transfer Agreement. We will not make additional copies of personal data to store outside of this environment. 

Your personal data may be processed in the European Economic Area (EEA), or by an international organisation where we use Eventbrite, which stores data in the US. Further information on specific arrangements for this can be found in Paragraph 3.2 of the Eventbrite Data Processing Addendum (DPA).   

For all instances where your personal data is processed in the EEA or outside UK, the following safeguards will be in place: 

• reliance on the EU’s Standard Contractual Clauses together with an international data transfer addendum. 

Personal data supplied through electronic (Microsoft) forms and/or via email will be collated and stored within a BASS Alumni Membership database. Access will be appropriately limited to staff actively involved in managing the BASS Alumni and associated activities.   

Electronic data may be transferred to, and stored at, a destination outside the EEA, for example, when we communicate with you using a cloud based service provider that operates outside the EEA such as Eventbrite. 

Such transfers will only take place if one of the following applies: 

• the country receiving the data is considered by the EU to provide an adequate level of data protection
• the organisation receiving the data is covered by an arrangement recognised by the EU as providing an adequate standard of data protection (Such as transfers to companies that are certified under the EU US Privacy Shield)
• the transfer is governed by approved contractual clauses
• the transfer has your consent
• the transfer is necessary for the performance of a contract with you or to take steps requested by you prior to entering into that contract
• the transfer is necessary for the performance of a contract with another person, which is in your interests

7. Your data protection rights 

You have the right to request information about how your personal data is processed, and to request a copy of that personal data. 

You have the right to request that any inaccuracies in your personal data are rectified without delay. 

You have the right to request that any incomplete personal data is completed, including by means of a supplementary statement. 

You have the right to request that your personal data is erased if there is no longer a justification for them to be processed. 

You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted. 

You have the right to object to the processing of your personal data where it is processed for direct marketing purposes. 

You have the right to withdraw consent to the processing of your personal data at any time. 

You have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format. 

To exercise your rights please contact the UK Space Agency Data Protection Manager using the contact details below. 

8. How to contact us 

If you have any questions or concerns about our use of your personal information, you can contact us in the first instance at: 

UK Space Agency Data Protection Manager
Email: gdrp@ukspaceagency.gov.uk

If you are unhappy with the way we have handled your personal data, please write to the department’s Data Protection Officer in the first instance using the contact details below. 

DSIT Data Protection Officer
Email: dataprotection@energysecurity.gov.uk

DSIT Data Protection Officer
Department for Science, Innovation and Technology
1 Victoria Street
London SW1H 0ET

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an UK independent regulator. The Information Commissioner can be contacted at: 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Helpline number: 0303 123 1113 ICO website: https://ico.org.uk/make-a-complaint/

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts. 

9. Updates to this notice 

If this privacy notice changes in any way, we will issue a revised notice via email. The version number and date of issue can be found in the header section of each page. Please avoid retaining local or offline copies of this notice in case changes are made. A version history will be maintained within the UK Space Agency Records Management system for audit and accountability. 

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.