page
Transport Research Innovation Grant – Our Privacy Policy
About Connected Places Catapult
Connected Places Catapult is focused on growing businesses with innovations in mobility services and the built environment that enables new levels of physical, digital, and social connectedness. Our company registration number is 11837978 and our registered office is 170 Midsummer Boulevard, Milton Keynes, United Kingdom, MK9 1BP. Connected Places Catapult is registered with the Information Commissioner Office, registration number ZA773397.
This privacy policy applies to anyone who asks about or is involved in the Transport Research Innovation Grant (TRIG), buys, or uses our services in any way (for example by email, through the website, or by telephone). We take privacy seriously and we want you as our service user, to understand the information we collect about you, how we process and protect the personal information which we collect about you, from you and from third parties, so that you can be confident that the information is being used safely and in ways that are reasonable expected, and what rights you have in respect of your personal information.
When we refer to ‘we’, ‘us’ and ‘our’, means Connected Places Catapult.
We will collect personal information which can include:
- Your name and contact details (inc. job title, address, telephone and mobile number, email address).
- Company details (inc. name, address, registration number, VAT registration number, insurance, category (type) of company).
- Any company links on social media (inc. Twitter, LinkedIn, Instagram, Facebook).
- Any parent company details (inc. company name, address, telephone number, email address, contact name).
- Collaboration details of any companies involved within your project (inc. company name, address, telephone number, email address, contact name).
- Authority details who are involved within the project (organisation name, telephone number, email address, contact name).
- Finance details (inc. contact details, bank account details, VAT number).
- Due diligence information (inc. accounts, policy and process documents, investigation/convictions/notice details, enforcement/remedial orders).
- Details of any conflicts of interests.
- Details of previous project applications.
- Project details (inc. project name, summary, project plan).
- Project finances (inc. individuals involved, daily rates, no. days worked, sub-contractor charges, material costs and other expenses).
- Your IP address (inc. IP tracking within the London office building).
- Cookie preferences.
- Images (inc. footfall sensors within the London office building).
- Voice/video recorded or written feedback (inc. survey, product and webinar reviews, interviews).
- CCTV.
Your personal information collected will be used to allow us to deliver services on behalf of the Department of Transport and to support innovative projects, create new commercial opportunities and improve productivity, socio-economic and environmental benefits for places by:
- CPC using your data to profile individuals by Persona based on their business-related data including but not limited to job title, seniority, preferences, interest, location, company type, company size, turnover, and industry.
- CPC using behaviour data gathered from web and email interactions to:
- automate targeted content-led campaigns
- score and qualify individuals to share with them relevant CPC opportunities and partnerships.
- CPC business development teams will use LinkedIn integration with Microsoft Dynamics CRM to gain insight on existing and prospective customers and partners to make better connections and offer relevant opportunities and partnerships.
- CPC business development teams will also use LinkedIn to create contacts and companies from LinkedIn for business development and relationship management purposes.
- CPC will use AI technologies to enable relationship mapping of its existing stakeholders and partners and understand who knowns who within CPC.
- CPC will use third-party technologies and subscriptions to enrich its contacts and companies with publicly available information
Your IP address will be used to allow Connected Places Catapult to set appropriate access permissions on its website.
Our IP and footfall sensors will track movement within Connected Places Catapult London office as part of a ‘testbed’ project currently being run for SMEs to deploy their technology as a showcase and experimental environment. The data from this project will be used for analytical purposes only.
CCTV recording is un use at all Connected Places Catapult locations, this is used to ensure the security of property and premises and for the preventing and investigating crime purposes only. Area monitored by CCTV are sign-posted. Where necessary or required, this information is shared with you, police forces, security organisations and persons making an enquiry.
In many cases we pseudonymise or anonymise your information before we share it with others, or where we no longer require the information in identifiable form.
Anonymisation is the process of turning data into a form which does not identify individuals and where identification is not likely to take place.
Pseudonymisation is the process of information in such a way that it can no longer be attributed to you without the use of additional information and where that additional information is kept separately. This allows for a much wider use of the information for statistical or other purposes.
Directly from you, to support your application to the Transport Research Innovation Grant programme; this information can be collected when:
- You use our website and platforms.
- When you complete a grant application forms.
- Participating in interviews.
- Attending workshops.
- Attending commercial events.
- Visiting a Connected Places Catapult office.
- You correspond with us by letter, email, telephone, or social media, including where you reference Connected Places Catapult in a public social media post.
- Third parties including but not limited to LinkedIn, Introhive Services, Tracxn and Beauhurst.
We will also be collecting the following information during application, webinar sign up, potential interviews, workshop etc:
- Personal information e.g. name(s).
- Contact information e.g. email(s) and phone numbers.
- Company information e.g. company house number and funding.
When participating in projects, we may collect information about you from other providers.
We use your information for a number of purposes. Whenever we use your information, we must have a legal justification under data protection law for its use. The legal justification will depend on the purpose for which we intend using your information.
Our legal justification for processing your personal information generally falls into the below categories below within Article 6 of the General Data Protection Regulation:
- Article 61(b)Contract-Processing is necessary for a contract CPC has with Transport Research Innovation Grant in order to promote and facilitate the TRIG programme.
- Article 61 (f) Legitimate interest-Processing is necessary for the purposes of the legitimate interests shared by CPC and Department for Transport.
It is important that you understand that we may share your information with others. We may share your personal information within our group of companies and with third parties.
Sharing within the Connected Places Catapult Group
We may share your personal information within the Connected Places Catapult group of companies.
Sharing with third parties
We may share your personal information with the third parties listed below for the purposes identified within this privacy notice:
- SMEs
- Innovate UK
- National and other professional research / audit programmes
- Government bodies and local authorities
- Our regulators
- The police and other third parties where reasonably necessary for the prevention or detection of crime
- Debt collection agencies
- Third parties to the extent required by law, regulation or court orders and statutory requests for information
- Service providers we use to support our business. These processors are trusted partners that work with us and are authorised to use your personal information only as necessary to provide these services to us. We required these third parties to comply strictly with our instructions and data protection law and we ensure appropriate controls are in place. We enter into written contacts with all our processors
- Our third-party service providers such as auditors and lawyers
- Selected third parties in connection with any sale, transfer, or disposal of our business. We may communicate with these third parties in a variety of ways including, but not limited to, email, post, fax, and telephone.
We retain information in accordance with our legal obligations and national best practice. We ensure compliance through regular auditing and ensure information is securely disposed of when it has reached the end of its retention period. We implement data retention periods for different categories of personal data and/or different processing purposes, including where appropriate, archiving periods. We will only keep your personal information for as long as reasonably necessary to support our legitimate business interests and to comply with our legal and regulatory requirements.
A copy of Connected Places Catapult Records Management Policy can be provided upon request.
Connected Places Catapult supports innovative projects globally. We (or third parties acting on our behalf) may store or process information that we collect about you in countries outside the UK. Information may be transferred, processed and stored outside the country where your information is collected, including countries where the level of data protection may net be deemed adequate by local legal or regulatory authority in the country of origin of the data. Where we make a transfer of your personal information outside of the UK, we will take the required steps to ensure that your personal information is protected.
Generally: e.g. if your permanent address is outside the UK, or the project is outside of the UK, we may send details to individuals specifically to promote your involvement within the project.
The safeguards in place to ensure that the data is securely protected are:
- The country to which we send the personal information may be approved by the European Commission, or
- The recipient may have signed a data sharing agreement or contract based on “model contractual clauses” approved by the European Commission, obliging them to protect your personal information.
In other circumstances, the law may permit us to otherwise transfer your personal information outside the EEA. In all cases, however, any transfer of your personal information will be compliant with applicable data protection law.
If you would like further information regarding the steps, we take to safeguard your personal information when making international transfers, please contact the Data Protection Manager using the details on the foot of this Privacy Notice.
Under data protection law you have a number of specific rights in relation to the personal information that we hold about you. These include rights to know what information we hold about you and how it is used. You may also exercise these rights at any time by contacting us using the details set out at the top of this privacy notice and without adversely affecting your service.
We will not usually charge for handling a request to exercise your rights. If we cannot comply with your request to exercise your rights, we will usually tell you why.
If you make a large number of requests or it is clear that it is not reasonable for us to comply with a request, then we do not have to respond. Alternatively, we can charge for responding.
Under data protection legislation you have the right to:
- be informed
- access your personal information
- rectification
- erasure
- restriction of processing
- data portability
- object
- not be subjected to automated decisions
- withdraw consent
You also have the right to complain to the Information Commissioners Office (ICO) if you are unhappy with the way that we have dealt with a request from you to exercise any of these rights, or if you think we have note complied with our legal obligations. Whilst you are not obliged to do so, we would appreciate you making us aware of any issue prior to notifying the ICO and giving us the opportunity to respond. You can contact either the Risk and Compliance Manager or Data Protection Manager using the postal address at the top of the privacy notice. More information can be obtained either on the ICO website (https://ico.org.uk/) or by calling 0303 123 1113.
Making a complaint will not affect any other legal rights or remedies that you have.
Securing your data
We have implemented appropriate technical and organisational security to protect your personal information, this includes:
- Ensuring our staff complete regular training
- Ensuring personal information is only accessible and shared with individuals that have a need to access it
- Implementing physical access controls within our offices and technical controls such as encryption
- Using information about you that does not uniquely identify you, where appropriate
- Where personal information is transferred outside of the UK, we will ensure there are appropriate security measures in place to protect the data in accordance with UK data protection laws.
Please contact us if you require further information about how we secure your data.
Queries
If you have any queries or would like to exercise your rights or to establish whether any rights apply to you, please speak to the Data Protection Manager (dataprotection@cp.catapult.org.uk).
or by writing to the address at the top of this privacy notice, marking your communication “Private and Confidential – FAO Connected Places Catapult Data Protection Manager”
Telephone: +44 (0)1908 359 999
Updates to this Privacy Notice
We may update this Privacy Notice from time to time to ensure that it remains accurate. In the event that these changes result in any material difference to the manner in which we process your personal data then we will provide you with an updated copy of the Policy and signpost you to specific changes.
Privacy
Modern Slavery Policy
The purpose of this policy is to specify the details of how Connected Places Catapult (“CPC”) approaches and supports the elimination of modern slavery and meets its obligations under the Modern Slavery Act 2015 (MSA).
Further, this policy outlines our commitment to ensuring that all current and future suppliers meet their obligations under the requirements of the MSA.
This policy has been approved by CLT on August 2022. This policy will be reviewed on an annual basis and where necessary an updated version will be published.
1. What is modern slavery?
Modern slavery is a crime and a violation of fundamental human rights. It takes various forms, such as: slavery, servitude, forced and compulsory labour and human trafficking, all of which have in common the deprivation of a person’s liberty by another in order to exploit them for personal or commercial gain.
2. CPC’s approach
CPC has a zero-tolerance approach to modern slavery and is committed to acting ethically and with integrity in all its business dealings and relationships.
CPC is dedicated to implementing and enforcing effective systems and controls to ensure modern slavery is not taking place anywhere in its business or supply chain. Further, it is committed to ensuring there is transparency in its approach to tackling modern slavery throughout the supply chain – consistent with its obligations under the MSA.
CPC expects the same high standards from all of its agents, contractors, sub-contractors, suppliers and their sub-contractors, consultants, third-party representatives and other business partners.
3. Scope
This policy covers all colleagues, including those engaged in duties for the organisation under a letter of authority, secondment contract or work experience/internship; volunteers and any other third party such as contractors who have authority to perform work for or procure goods and services on behalf of CPC.
4. Responsibilities
Procurement Team
The Procurement Team has primary and day-to-day responsibility for ensuring that procurement processes are effective in countering modern slavery, including:
- implementing this policy;
- providing an induction process to new starters within the Procurement Team;
- delivering regular training to relevant people in the business;
- monitoring the use and effectiveness of procurement processes;
- dealing with any queries; and
- auditing internal control systems and procedures.
Management
Management at all levels of CPC are responsible for ensuring those reporting to them understand and comply with this policy and that they are given adequate time to attend training regarding the issue of modern slavery in supply chains as appropriate.
Colleagues
The prevention, detection and reporting of modern slavery in any part of CPC’s business or supply chain is the responsibility of everyone working for or under the control of CPC.
5. Reporting Process
Raise your concerns
If modern slavery is suspected either within CPC’s own business or as part of the supply chain, take one or more of the following actions:
- avoid any further activity that might lead to, or suggest, a breach of this policy;
- raise the concern with your Head of Department or Programme Director at the earliest opportunity; and
- notify the Procurement Team as soon as possible if you believe or suspect that a breach of this policy has occurred, or may occur in the future.
If you are unsure about what constitutes the various forms of modern slavery, please contact the Procurement Team.
Feel safe to raise your concern
CPC is committed to ensuring no one suffers any detrimental treatment as a result of reporting their suspicion that modern slavery is, or may be, taking place in any part of the business or its supply chain.
If you do not feel comfortable raising your concern internally, you can raise it with our independent whistleblowing service: SeeHearSpeakUp. Refer to the Whistleblowing Policy for more information.
Zero-tolerance
CPC may terminate its relationship with individuals, suppliers, and organisations if they are deemed to have breached this policy.
6. Communication and Awareness
CPC’s zero-tolerance approach to modern slavery will be adequately communicated to all agents, contractors, suppliers, consultants, third-party representatives, and other business partners and reinforced as appropriate thereafter.
Whistleblowing Policy
Disciplinary Policy
Grievance Policy
