CoSTAR Access Programme Applicant Privacy Notice

Introduction

The CoSTAR National Lab (“National Lab”) is led by Royal Holloway and Bedford New College also known as Royal Holloway, University of London (“Royal Holloway”), in collaboration with the University of Surrey, Abertay University and the National Film and Television School ("NFTS").

The CoSTAR Realtime lab is led by Abertay University in collaboration with the University of Edinburgh.
The CoSTAR Live Lab is led by the University of York.
The CoSTAR Screen Lab is led by Ulster University.

The CoSTAR Network is the CoSTAR National Lab, CoSTAR Realtime Lab, CoSTAR Live Lab, and CoSTAR Screen Lab.

The CoSTAR Access Programme application process is managed by Royal Holloway.

Royal Holloway and Bedford New College, also known as Royal Holloway, University of London, will act in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 when controlling and processing your personal data.

This privacy notice relates to the information you provide to Royal Holloway when you apply to participate in one of the CoSTAR Access Programmes. 

This notice explains how we collect, use and share your personal data and your rights in relation tothe processing of your data.

In this notice:
- ‘personal data’ means any data which can identify you directly or indirectly (whether by itself or when combined with other data), regardless of the format or media on which the data are stored. This includes data that can identify you when combined with other data that is held separately (pseudonymous data) but does not include data that has been manipulated so that you can no longer be identified from it (anonymous data).
- ‘special category data’ is personal data that needs more protection because it is sensitive. The GDPR defines special category data as personal data related to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic, biometric, health, sex life and sexual orientation.
- ‘processing’ means any activity relating to your personal data including collection, use, alteration, storage, disclosure and destruction.

We keep this notice under regular review. This notice was last updated on 10 February 2025.

What personal data will be collected

The data Royal Holloway collects includes:

your name;
your role/job title;
your email address;
your telephone number;

Special category data processed may include:

age;
gender;
sexual orientation;
ethnicity;
disability status;
physical or mental health details;
religion;
socioeconomic background;
caring responsibilities

Purpose and legal basis for processing

Overall, we will use your personal data in connection with your application to one of the CoSTAR Access Programmes. The main purposes for which we process your personal data as an applicant are set out in the table below.

Data protection laws require us to meet certain conditions before we are allowed to use your personal data in the manner described in this notice, including having a "legal basis" for the processing. Where we process special category personal data, we are required to establish an additional legal basis for processing that data.

We take our responsibilities under data protection laws extremely seriously, including meeting these conditions. The main legal bases on which your personal data are processed for a particular purpose are also explained in the table below

Purpose	Legal basis/justification
Assess your eligibility to participate in the CoSTAR Access Programmes.	The processing of your personal data may be necessary in relation to the contract we will enter into with you if you become a successful applicant (participant) at the CoSTAR Access Programmes. We process special category personal data in order to monitor equality of opportunity/treatment.
Form a decision with a view to accepting or rejecting your application to participate in the CoSTAR Access Programmes. Communicate with you about the status of your application to participate in the CoSTAR Access Programmes.	The processing of your personal data may be necessary in relation to the contract we will enter into with you if you become a successful applicant (participant) at the CoSTAR Access Programmes. We process special category personal data in order to monitor equality of opportunity/treatment.
To analyse interest in the CoSTAR Network.	Our legitimate interest in assessing interest in our projects and programmes.
Tracking, monitoring and evaluation of project activity or outcomes for internal and statutory reporting purposes	Our legitimate interest in analysing programme activities, and reporting to our funder.
To send you newsletters, informing you about future opportunities and developments surrounding the CoSTAR Network.	Your consent, and our legitimate interest in publicising the CoSTAR Network. We will only send you electronic marketing with your consent and each of our newsletters will give you the option to unsubscribe.
To send you newsletters from partners in the CoSTAR Network, regarding future opportunities and updates from activities in the creative industry.	Your consent, and our legitimate interest in publicising the news and opportunities in the creative industry. We will only send you electronic marketing with your consent and each of our newsletters will give you the option to unsubscribe.

How and when do we collect your personal data?

We receive your personal data when you submit an application via Submittable

How long CoSTAR will retain your personal data

We will normally keep your data which you have supplied to us for the purposes of expressing your interest in the CoSTAR Network until March 2029.

Beyond that date, we will contact you to ask if you consent to us keeping your data. 

If you go on to participate in a CoSTAR Access Programme, we will continue to retain your personal data for the purposes of facilitating your participation in the project, informing you for opportunities and activities, and for analysis and evaluation of CoSTAR for up to ten years past the point that the project came to a close.

There will be a separate privacy notice, covering these issues at the point of your involvement in the project

Sharing your personal data with third parties

Where Royal Holloway uses partners and third parties to process personal data on its behalf (acting as data processors), a written contract will be put in place to ensure that any personal data shared will be held in accordance with the requirements of data protection law and that such data processors have appropriate security measures in place in relation to your personal data.

All Academic Partners of the CoSTAR National Lab (Royal Holloway, University of Surrey, Abertay University and the NFTS), our partners in the CoSTAR Network, and 3rd party assessors will be able to access your personal data in order to assess your application. We will not share your personal data with any other third parties or use it for marketing purposes other than as detailed above. 

We use the following third parties for the following purposes;

Submittable to store and assess your applications, and also communicate to you about the status of your applications. Also to aggregate anonymised personal data including protected characteristics in order to monitor equality of opportunity/treatment.
Zoho CRM to store all personal data for monitoring and reporting purposes and for future marketing.

Please refer to their privacy policies for more information on how they handle your data. 

Submittable’s Privacy Policy can be found here: https://www.submittable.com/privacy/ 

Zoho's privacy policy can be found here: https://www.zoho.com/privacy.html.  

This includes the following:

Please note that in certain circumstances we may need to share your personal information with a regulator or to otherwise comply with the law.

International Data Transfers

Most personal data about you will be stored on servers within the UK or elsewhere within the European Economic Area (EEA).

As well as within the UK, Royal Holloway, its contracted partners in the CoSTAR Network and contracted third parties may transfer the personal information we collect about you to the USA and European Economic Area. This will only take place in circumstances where there are appropriate and adequate safeguards in place which incorporate appropriate assurances to ensure the security of the information and compliance with legislative and regulatory requirements If you require further information about these protective measures, you can request it from dataprotection@rhul.ac.uk or via the third party privacy notices provided above.

How Royal Holloway keeps your personal data secure

Royal Holloway has put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in any unauthorised way or altered or disclosed. In addition, Royal Holloway limits access to your personal data to the persons and organisations including those describes above, who have a lawful and/or legitimate need to access it.

Royal Holloway has also put in place procedures to deal with any suspected personal data security breach and will notify you and any applicable regulator of a suspected breach where legally required to do so.

You and your data

You have a number of rights in relation to the processing of your personal data by Royal Holloway.

Royal Holloway may be entitled to refuse any request in certain circumstances and where this is the case, you will be notified accordingly.

Where the lawful ground relied upon by Royal Holloway to process any of your personal data is your consent, you have the right to withdraw such consent at any time without having to give any reason. However, if you do so, Royal Holloway may not be able to provide some or all of its services to you or the provision of those services may be affected.

You will not have to pay any fee to exercise any of the above rights, though Royal Holloway may charge a reasonable fee or refuse to comply with your request if any request is clearly unfounded or excessive. Where this is the case, you will be notified accordingly.

To protect the confidentiality of your personal data Royal Holloway may ask you to verify your identity before fulfilling any request in relation to your personal data.

Changes to this notice

Royal Holloway may update this notice at any time and may provide you with further notices on specific occasions where we collect and process personal data about you. You should check this notice regularly to take notice of any changes. Where any change affects your rights and interests, we will make sure we bring this to your attention and clearly explain what this means for you.

Questions or comments

If you have any questions or comments regarding this notice or you wish to exercise any of your rights you should contact our Data Protection Officer by email at dataprotection@rhul.ac.uk.

You also have the right to complain to the Information Commissioner’s Office and you can find more information on their website – www.ico.org.uk