Privacy Policy

At the National Biofilms Innovation Centre (NBIC), we’re committed to protecting and respecting your privacy.

This Policy explains when and why we collect personal information about people who visit our website, how we use it, the conditions under which we may disclose it to others and how we keep it secure. We may change this policy from time to time so please check this page occasionally to ensure that you’re happy with any changes. By using our website, you’re agreeing to be bound by this policy.

NBIC is led by four Universities (Edinburgh, Liverpool, Southampton and Nottingham). The University of Southampton is the sole ‘data’ controller’ of the data on this website. This means that we are responsible for deciding how we collect and use personal information about you, and for explaining this clearly to you.

This Privacy Policy informs you about how and why your personal data will be used and how long it will usually be retained by us. It provides you with certain information that must be provided under the General Data Protection Regulation (EU 2016/679) (GDPR 2016), the UK Data Protection Act 2018 (DPA 2018), the Privacy and Electronic Communications Regulation (PECR) and any other relevant data protection legislation that may apply (together ‘Data Protection Legislation’). Our registration number with the Information Commissioner’s Office is Z6801020.

“Data” refers to the information that we hold about you from which either on its own or in combination with other information you can be identified. It may include names, contact details, photographs, identification numbers, online identifiers and expressions of opinion about you or indications as to our intentions about you. Categories of data held by the University about people who interact with the website are set out below. “Processing” means doing anything with your data, such as collecting, recording or holding the data, as well as disclosing, destroying or using the data in any way.

If you have any questions regarding this policy and our privacy practices, you can email us on nbic@biofilms.ac.uk or write to us at our registered office address in Southampton: National Biofilms Innovation Centre, Building 85, Institute of Life Sciences, University Road, Southampton.

Data Protection Principles

We will comply with data protection law and principles, which means that your data will be:

  • Used lawfully, fairly and in a transparent way.
  • Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
  • Relevant to the purposes we have told you about and limited only to those purposes.
  • Accurate and kept up to date.
  • Kept only as long as necessary for the purposes we have told you about.
  • Kept securely.

What data does NBIC collect?

In connection with our research and innovation activities, the data we collect and store about you might include:

  • The biographical data and contact details you have provided, including your first and last name, email address, telephone number, company name, areas of industry, and photographs
  • Event attendance
  • Details of interactions with between you, industry, and academics
  • Records of all contact we have with you
  • Financial data including bank account and payment card details
  • Transaction data including details about payments to and from you and other details of products and services you have purchased from us
  • Technical data including internet protocol (IP) address, cookie identifiers, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website
  • Usage data including information about how you use our website, products and services
  • Marketing and communications data including your preferences in receiving marketing from us and your communication preferences
  • Data that you provide in the course of your interaction with NBIC, for example, submitting an application to an NBIC funding call or NBIC opportunity; completing a contact form or newsletter registration form and entry into competitions.
  • We also collect, use and share aggregate data such as statistical or demographic data. Aggregate data may be derived from your personal data but does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature
  • Any other data you provide to us to support the progression of your research or developments.

Special Category Data

GDPR singles out some types of personal data as ‘special category data,’ as likely to be more sensitive:

  • personal data revealing racial or ethnic origin;
  • personal data revealing political opinions;
  • personal data revealing religious or philosophical beliefs;
  • personal data revealing trade union membership;
  • genetic data;
  • biometric data (where used for identification purposes);
  • data concerning health;
  • data concerning a person’s sexual orientation.

Where possible we will collect special category data as anonymous. We will only process your special category data with your consent or if it is necessary and will only be used for legitimate purposes, such as post-award reporting to our funders for EDI purposes. 

How do we collect data from you?

We obtain data about you when you use our website, for example, when you complete the contact form, when you complete the newsletter registration form, or engage with other forms within our site. Data collection is carried out in line with relevant data protection laws and the University of Southampton Data Protection Policy.

We collect data from publicly available sources to support service delivery.

NBIC also uses services from Google on this website to measure and analyse visitor information. For further information on these, please visit Google Analytics.

 

How does NBIC use your data?

We may use your data to:

  • Contact you regarding queries raised in the contact form;
  • Carry out our obligations arising from any contracts entered into by you and us;
  • Seek your views or comments on the services we provide;
  • Notify you of changes to our services;
  • Send you communications that you have requested and that may be of interest to you, which may include our monthly newsletter, information about campaigns, funding opportunities, events and workshops, partner searches, and other activities relevant to the NBIC mission.
  • Create a profile of your interests and preferences so that we can contact you with information relevant to you.

Processing for limited purposes

We will only process your Data for the specific purpose or purposes that we tell you about, in compliance with the UK Data Protection Act 2018, and will only process your data to the extent necessary for that specific purpose or purposes.

None of the personal data collected about you will be used as part of any automated decision-making about you.

How will your personal data be secured?

We limit access to your personal data to those employees of the University and third parties who have a business need-to-know. They will only process your data on our instructions and they are subject to a duty of confidentiality. The University has procedures in place to deal with any suspected data security breach and will notify you and any applicable regulator of a breach in accordance with our legal obligations.

Who has access to your personal data?

Your information will be shared internally within NBIC for the purposes described in the section “How we use your personal data”.

We will never sell your data.

We only share data for purposes that are compatible with the original purpose of its collection.

Contracts will be put in place with all third-party data recipients to ensure that any personal data shared will be held in accordance with the requirements of the Data Protection Legislation. Third-party data recipients are required to take appropriate security measures to protect your personal data in line with our policies. We only permit third-party data recipients to process your personal data for specific purposes and in accordance with our instructions.

Third-party services

HubSpot: We store all personal data in HubSpot, which is our CRM (Customer Relationship Management system) and where we keep a record of all customer and partner interactions. We use this platform for our marketing communications, which include our NBIC External Newsletter and regular partner searches. HubSpot transfers all customer data to the USA. Customer data is processed and secured in the EU before being transmitted and stored in the US. The cloud infrastructure hosted on Google Cloud Platform (GCP) provides additional redundancy for all HubSpot customers. Various HubSpot services are routed through the GCP EU data centre before being securely transferred to the USA and securely stored in AWS. The HubSpot privacy policy can be found here.

Google Analytics: We use cookies from Google analytics to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site and the user experience. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited. For more information on the Google Analytics privacy policy please visit the Google website. It is possible to switch off cookies by setting your browser preferences. Please note that turning cookies off may result in a loss of functionality when using our website. The Google Privacy Policy can be found here.

Your choices

The accuracy of your information is important to us. You have the right to request a copy of the information we hold about you so that you can ensure its accuracy and you can change your electronic communication preferences at any time.

You have a choice about whether or not you wish to receive information from us. If you do not want to receive electronic communications from us about our services, then you can select your choices by ticking the relevant boxes situated on the form on which we collect your information.

We will not contact you for direct marketing purposes by email, phone or text message unless you have given your prior consent. We will not contact you for direct marketing purposes by post if you have indicated that you do not wish to be contacted in this manner. You can amend or withdraw your consent by contacting us via email on nbic@biofilms.ac.uk or by writing to us at our registered office address in Southampton: National Biofilms Innovation Centre, Building 85, Institute of Life Sciences, University Road, Southampton.

 

Retention

We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations in connection with our research and innovation activities. We will hold data on our systems only for as long as is necessary for the relevant activity, or as long as is set out in any relevant contract you hold with us. Personal data will be stored on our HubSpot CRM for the duration of our business relationship with you, or until you request to remove your data from our CRM.

 

Links to other websites

Our website may contain links to other websites run by other organisations. This privacy policy applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our website. In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the policy of that third party site.

 

Review of this policy

We keep this policy under regular review. This policy was last updated in February 2025.