Historical Photographs of Hong Kong Privacy Notice

The University of Bristol (“The University”, “We”) is committed to protecting your personal data and for keeping you informed about how information about you is used.

This notice outlines how we collect and process your personal data in relation to Historical Photographs of Hong Kong, and how we adhere to the requirements of UK General Data Protection Regulation (UK GDPR) and the Data Protection Act (2018).

This notice should be read in conjunction with the University’s top level privacy notices.

Types of personal data processed

The following is a non-exhaustive list of the types of personal data that we may process about you when you use Historical Photographs of Hong Kong:

  • IP Address (anonymised for analytics with your consent)
  • Email addresses (if you contact us)

How we collect your data and how we use it

The information we process about you is collected from the following:

  • The server software automatically logs IP addresses
  • Matomo, a third-party analytics solution, collects anonymised usage data with consent

The above information is processed to provide valuable insights into site usage. Additionally, we may collect geographic and statistical data on user behaviour to evaluate the website's popularity and efficiency. Any shared data will be aggregated and will not disclose individual user identities.

We will use your information to better understand the website's audience and to guide future improvements.

The analytical data is anonymised before it is stored and used to understand site usage, and aggregated data might be used in reports for funders.

We will not use your personal data for automated decision making about you or for profiling purposes.

We will process your personal data either in ways you have consented to, or because it is otherwise necessary for a lawful purpose.

The lawful basis for us to process your personal data for the above purposes is

  • Consent – because you have agreed to it being used as set out in this notice
  • Legitimate interests – because it is necessary for the University’s legitimate interests or the interest of a third party

‘Consent’ refers to the anonymised IP address collected by Matomo when consent to tracking is given. Research IT (IT Services) staff and the project researchers can access this tracking data. ‘Legitimate interest’ refers to the full IP address recorded in the server logs, which is accessible to IT Services and used for operational monitoring of the service's health.

Sharing your personal data

Your personal data will be collected and processed primarily by University staff.

We may need to share your personal data with internal parties. Namely, IP addresses in server logs when trying to address system issues.

University of Bristol IT Services acts as a data processor for this activity in its capacity as the service provider. IP addresses in access and error logs are used in technical support. For further information on how we process personal data, please see the University’s top level privacy notices.

We may need to share your personal data with third parties. In this case, we only share anonymised IP addresses with our third-party analytics service provider, Matomo.

Where the University is using a third-party service, it will ensure appropriate contracts are in place to ensure this is handled securely and in accordance with our instructions

Please note that we may need to share your personal information with a regulator or to otherwise comply with the law, and the list above is not necessarily exhaustive.

Storage and retention of personal data

The University has put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost or used, accessed, altered or disclosed in any unauthorised way.

Access to your personal data is limited to those that have a lawful and legitimate need to access it.

IP addresses in server logs are retained by the University’s servers and in backups, and are held only in accordance with the University’s retention policy.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We will keep your personal data according to the University’s Records Retention Schedule, holding it for 90 days.

Your rights

Under certain circumstances, you may have the following rights in relation to the data we process:

  • Right to request access to your personal data;
  • Right to request correction of your personal data;
  • Right to request erasure of your personal data;
  • Right to object to processing of your personal data;
  • Right to request restriction of the processing your personal data;
  • Right to request the transfer of your personal data; and
  • Right to withdraw consent.

For more information on these rights please visit the University’s guidance here. To exercise any of the above rights please contact the Data Protection Officer via data-protection@bristol.ac.uk

Questions, comments and complaints

If you have any questions or comments regarding this Privacy Notice, please contact: research-it@bristol.ac.uk.

You can also contact the University’s Data Protection Officer at: data-protection@bristol.ac.uk.

If you are unhappy or have any complaints about how we process your personal data, we encourage you to follow our internal complaints procedure, as outlined here on our website. Should you remain dissatisfied after exhausting our internal complaints process, you have the right to raise your complaint with the Information Commissioner’s Office (ICO).