Privacy policy

About UKHSA and the Culture Collections service

The UK Health Security Agency (UKHSA) is an executive agency of the Department of Health and Social Care (DHSC). We are responsible for protecting the nation from the impact of infectious diseases, chemical, biological, radiological, and nuclear incidents, and other health threats. We provide intellectual, scientific, and operational leadership at national and local level, as well as on the global stage, to make the
nation's health secure.

Our remit includes embedding effective clinical, scientific, and operational functions in the public health system. To support this, we provide and maintain the Culture Collections service. The service provides scientists with cells and microorganisms to determine the effects of drugs, cosmetics, radiation, viruses, pesticides, and household chemicals on human cells. No patient or other personal information is provided with these cells and microorganisms. This privacy notice describes the personal and other information we collect and use when you:

• visit our website (https://www.culturecollections.org.uk)

• purchase our products or services

• register an account on our service portal (https://digitaltools.phe.org.uk)

• subscribe to our emails (https://dotdigital.com)

• correspond and engage with us in other ways

The UKHSA general privacy notice provides further information on the personal information UKHSA collects and uses to fulfil its wider remit from the government.

The information we collect and how we use it

The personal information we may collect from you when you use the Culture
Collections service includes:

• identity and contact information, including your name, email address, postal address, and telephone number – which we use to provide you with our services and manage our interactions with you

• identity and contact information, including your name, email address and postal address – which we use for marketing purposes

• service usage information, including data on how you use our website and

  services – which we use to improve the services we provide

• communications information, including your preferences for receiving communications from us and information on how you use our emails – which we use to communicate with you and improve our services

• financial information, including bank account and payment card details – which we use to provide you with our services

• technical data, including your internet protocol (IP) address, login data and browser type and version, and information on your use of our website collected by cookies and page tags – which we use to improve the services we provide

If you’ve signed up for email alerts, you can unsubscribe or manage your preferences at any time by selecting the link that appears in every email. Amending or removing your information from your account on our website or service portal can be managed via your online accounts.

 

Who we share your information with

We may share your personal information with third parties, including:

• Service providers contracted by us to host, maintain, and support our information technology services and systems

• Legal and other professional advisers, including accounting and audit services, contracted by us to support the services we provide (for example,

  to enforce our terms and conditions of supply), and other agreements and support our legal, financial and other obligations

• Relevant regulators

If we do share your personal information, we will only so where the law allows, and we will only share the minimum amount of information that is necessary for the purpose. We may share your information with our data processors. A data processor is an organisation other than us that we have a contract with to assist us in collecting, storing, or managing your personal information. We do not allow our data processor to use your personal information for any purposes other than those specified by us, they are not allowed to keep your information once their work for us has ended, and they must comply with strict data security and protection requirements when processing your information on our behalf. We do not share your personal information with any third party for commercial or marketing purposes.

 

How we protect your information

We have put in place a range of organisational processes and technical security measures to protect your personal information from loss, misuse and unauthorised access, disclosure, alteration, and destruction. Your information is stored on computer systems that are kept up-to-date and regularly tested to make sure they are secure and protected from viruses and hacking. Your personal information can only be seen by our staff and data processors who have been trained to protect your confidentiality and in understanding data protection laws and regulations. Strict controls are in place to make sure they can only see your information if they need it to do their job, and they are only provided with access to the minimum necessary information.

Where we store your information

We store your personal information mainly in the UK and only in other countries, where necessary, if they are formally recognised by the UK government as providing legal protections over privacy at least equivalent to the those that apply here in the UK, such as the countries of the European Economic Area (EEA).

How long we keep your information

We will only keep your personal information for as long as we need it to provide our services to you. We keep your information in line with our retention policies and only for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, reporting or compliance requirements. For example, financial information will be retained for 7 years as per regulations.

Your rights over your information

If you have any questions about how we collect and use your information, you can contact the Culture Collections service team in the first instance at culturecollections@ukhsa.gov.uk.

Under data protection law, you have a number of rights over your personal information. These include, but are not limited to:

• asking for a copy of any information we hold about you

• asking for any information we hold about you to be changed or not used if it is inaccurate

• asking us to delete any information we hold about you, although this is not an absolute right, and we may need to continue to use your information

You can exercise these or any of your other data protection rights by contacting us at InformationRights@ukhsa.gov.uk.

If you have any concerns about how we use and protect your personal information, you can contact the DHSC Data Protection Officer at data_protection@dhsc.gov.uk or by writing to:

You also have the right to contact the Information Commissioner’s Office with any concerns. You can do so by calling the ICO’s helpline on 0303 123 1113 or visiting the ICO’s website at www.ico.org.uk or writing to the ICO at:

 

Our legal basis to use your information

As UKHSA is an executive agency, the Department of Health and Social Care is the data controller for the personal information we collect and use to provide the Culture
Collections service.
Our legal basis to collect, use and share your personal information may vary according to the purpose we use it for, but in most circumstances will include:

• UK General Data Protection Regulation (GDPR) Article 6(1)(b) ‘processing is necessary for the performance of a contract’

Where we process personal data to comply with a legal duty, the following section of the law may also apply:

• UK GDPR Article 6(1)(c) ‘processing is necessary for compliance with a legal obligation’

 

About this privacy information

The personal information we collect, and use may change so we may need to revise this notice. If we do, the publication date provided at this top of this notice will change.