The material in the SAP website is produced and controlled by Imperial College London SAP group. We are responsible for the content describing the group and its resources and services. All information is provided as guidance only and should not be treated as a substitute for legal advice.
Where appropriate we do provide links to other websites that we believe may be of interest to our users. We acknowledge the work of others in making these sites available but cannot be responsible for the quality of information found there.
The web pages are regularly reviewed and updated.
Data controller and Data Protection Officer details
For the purposes of any applicable data protection laws in England and Wales, including from 25 May 2018 the EU General Data Protection Regulation 2016/679 (GDPR), the College is the data controller of your personal data. The College has appointed a Data Protection Officer, who can be contacted via email at firstname.lastname@example.org, via telephone on 020 7594 3502 and via post at Imperial College London, Data Protection Officer, Faculty Building Level 4, London SW7 2AZ.
General data processing
Scope the processing of personal data
We only process personal data of our users, as far as this is necessary for the deployment of an operational site as well as our content and services. The processing of personal data of our users are regularly only after the consent of the user. Except in such cases where a previous a consent for actual reasons it is not possible and the processing of data by legal regulations is permitted.
Legal basis for the processing of personal data
As far as we get a subject’s consent for processing of personal data, article 6 serves par. 1 lit. a EU General Data Protection Regulation 2016/679 (GDPR)as the legal basis.
In the processing of personal data, which is necessary for the performance of a contract, whose party is the person, article 6 serves par. 1 lit. b GDPR as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.
As far as processing of personal data for the performance of a legal obligation is required, our company is subject to the article 6 serves par. 1 lit. (c) GDPR as the legal basis.
The case that vital interests of the data subject or another natural person require a processing of personal data, article 6 serves for par. 1 lit. d GDPR as the legal basis.
The processing to maintain a legitimate interest of our company or a third party is required and outweigh the interests, rights and freedoms of the person concerned the former interest does not, so article 6 para 1 is lit. f GDPR as the legal basis for the processing.
Data deletion and storage duration
The personal data of the data subject be deleted or blocked, if the purpose is storage. A can be stored in addition, if this has been provided by the European or national legislator in Union legal regulations, laws or other regulations, the person in charge. A blocking or deletion of data is carried out even if a storage deadline prescribed by the above mentioned standards, unless that is a necessity for further storage of data for a conclusion of the contract or the performance of a contract.
Providing the site and creation of log files
Description and scope of data processing
Each time our website our system captures data and information from the computer system of the calling computer automated. The following data are collected here:
- the address (URL) of the Web page from which the file was requested
- the name of the invoked file
- the date and time of the request
- the amount of data
- the access status (file transferred, file not found, etc.)
- the description of the used we browser type or of the operating system used
- the anonymized IP address of the requesting computer.
The stored data are required for technical or statistical purposes only; a comparison with other databases or even a transfer to third parties, also in extracts, does not take place. The data is stored in the log files of our system. The IP address of the user or other data that enable the mapping of the data to a consumer are not affected: before storing it, each record is made anonymous by changing the IP address. Store this data along with other personal data of the user does not take place.
Legal basis for the data processing
Legal basis for the temporary storage of the data and the log files is article 6 par. 1 lit. f GDPR.
Purpose of the data processing
The temporary storage of the IP address of the system is necessary to allow a delivery of the site to the user’s computer. For this purpose, the IP address of the user for the duration of the session must be stored.
It is stored in log files to ensure the functionality of the website. In addition the data serve to optimize the site and to ensure the security of our information technology systems. An analysis of data for marketing purposes does not take place in this context.
In these purposes also our legitimate interest is data processing according to article 6 par. 1 lit. f GDPR.
Duration of storage
The data will be deleted when they are no longer necessary for the achievement of the purpose of their collection. In the case of the collection of information to provide the website this is the case when that session is finished.
In the case of storage of the data in log files, this is the case no later than seven days. A scholar storage is possible. In this case, the IP addresses of users be deleted or modified so that a mapping of the calling client is no longer possible.
Opposition and removal ability
The collection of data to provide the site and the storage of data in log files is mandatory for the operation of the website. There is therefore no objection on the part of the user.
Description and scope of data processing
- Language settings
- Log-in information
The data collected in this way the user will be artists through technical measures. Therefore, a mapping of the data to the calling user is no longer possible. The data are stored not together with other personal data of the users.
Legal basis for the data processing
The legal basis for the processing of personal data by using cookies is article 6 par. 1 lit. f GDPR.
Purpose of the data processing
The use of analysis cookies is carried out for the purpose of improving the quality of our website and its contents. Through the analysis cookie, we will learn how to use the site and can constantly optimize our service.
In these purposes, also our legitimate interest in the processing of personal data under article 6 para 1 is lit. f GDPR.
Duration of storage, opposition and removal ability
This site uses SSL encryption for safety reasons and to protect of the transfer of sensitive content, such as for example the requests you send to us as site operators. You will know an encrypted connection that changes the address bar of the browser from “http://” to “https://” and the lock icon in your protocol.
When the SSL encryption is enabled, the data that you submit to us, cannot be read by others.
Rights of the person concerned
Personal data will be processed by you, are concerned i.S.d. GDPR and there are to following rights against the person responsible:
Right to information
You can ask a confirmation of the responsible, whether personal data concerning you, will be processed by us.
Such processing is present, you can request information by the maintainers of the following information:
- the purposes to which personal data are processed
- the categories of personal data, which is processed;
- the recipients or categories of recipients to whom personal data have been disclosed or be disclosed yet
- the planned duration of the storage of personal data concerning you or, if specific information are not possible criteria for determining the period of storage;
- the existence of a right of correction or deletion of personal data concerning him, a law on restriction of processing by the person in charge or a right of objection against this processing;
- the existence of a right of appeal to a supervisory authority;
- all available information about the origin of the data, if collected the personal data not in the affected person;
- the existence of an automated decision making including profiling in accordance with art. 22 para. 1 and 4 GDPR and – at least in these cases – meaningful information about the involved logic, as well as the scope and the desired impact a such processing for the affected person.
Entitled to them, to ask whether the your personal data to a third country or to an international organization be transmitted information. In this context, you may require about the appropriate guarantees pursuant article in connection with the delivery to be informed 46 GDPR.
This right may be limited in so far as it probably makes it impossible for the achievement of the research or statistical purposes, or seriously affected and is necessary for the fulfilment of the research or statistical purposes.
The right to rectification
You have a right to rectification and/or completion against the person responsible, as long as the processed personal data concerning you is incorrect or incomplete. The officer has to make the correction immediately.
Your right may be limited to correction in so far as it probably makes it impossible for the achievement of the research or statistical purposes, or seriously impaired, and the limit for the fulfilment of the research or statistical purposes necessary is.
Law on the restriction of the processing
You can ask for the restriction of the processing of personal data concerning you under the following conditions:
- If you deny the correctness of relevant personal for a period which allows the controller to verify the accuracy of the personal data;
- the processing is unlawful and reject the deletion of the personal data and require instead the restriction of the use of personal data;
- the responsible no longer requires the personal data for the purposes of the processing, you need them but to assert, exercise or defense of legal claims, or
- para lodged objections to the processing referred to in article 21 1 GDPR and is not yet fixed, whether the proper reasons of controller to your reasons outweigh.
Was the processing of personal data concerning you is restricted, this data – from their storage may one apart – only with your consent or to the claim, exercise or defense of legal claims, or to protect of the rights other natural or legal person or be processed for reasons of important public interest of the Union or a Member State.
Was the restriction of the processing is restricted to the above requirements, you are taught by the person in charge before the restriction is lifted.
Your right may be limited to constraint processing in so far as it probably makes it impossible for the achievement of the research or statistical purposes, or seriously impaired, and the limit for the fulfilment of the research or Statistical purposes is necessary.
Right to cancellation
You can ask the officer, that the personal data concerning you will be deleted immediately, and the officer is required immediately to delete this data, unless one of the following reasons applies:
- The personal data concerning you are no longer necessary for the purposes for which they were collected or processed in any other way,.
- You withdraw your consent, that is the processing in accordance with article 6 par. 1 lit. a or article 9 lit. a GDPR supported para. 2, and there is no on any other legal basis for processing.
- Set according art. 21 para. 1 GDPR object to the processing of a and there are no priority legitimate grounds for processing, or set according art. 21 para 2 GDPR object to the processing on.
- The personal data concerning you have been unlawfully processed.
- The deletion of personal data concerning you is to fulfil a legal obligation according to the EU law or the law of the Member States is necessary, the officer is subject to.
- The personal data concerning you were raised in relation to services of the information society in accordance with article 8 paragraph 1 GDPR.
Information to third parties
The officer made public the personal data concerning you and he is according to art. 17 para 1 GDPR committed to their deletion, it shall take appropriate measures, taking into account the available technology and the cost of implementation technical way for data processing to inform managers that handle the personal data, that you as a person concerned of them deleted all links to these personal data or of copies or replication This personal data required have.
The right to delete does not exist, as far as the processing is required
- to the exercise of the right to freedom of expression and information;
- to comply with a legal obligation, which requires processing according to the law of the Union or the Member States, is subject to the person in charge, or to carry out a task that is in the public interest or in the exercise of public Violence takes place, which was transferred to the responsible
- for reasons of public interest in the field of public health in accordance with article 9 para. 2 lit. h and i, as well as article 9 para 3 GDPR;
- for public interest archive purposes, scientific or historical research purposes or for statistical purposes pursuant Article 89 para. 1 GDPR, where the right referred to in section “Deletion duty” expected to the achievement of the objectives This processing makes it impossible or seriously impaired, or
- to the claim, exercise or defence of legal claims.
Right to be informed
Have asserted the right to rectification, erasure or throttling the processing to the person in charge it is obliged, all receivers which have been disclosed to the personal data concerning you, this correction or Deletion of the data or limitation of processing to be communicated, except when this proves to be impossible or involves a disproportionate effort.
Entitled to against the responsible them, to be informed about these recipients.
Law on data portability
You have the right to obtain your personal data, which you have deployed the responsible, in a structured, conventional and machine-readable format. Also, you have the right these data an other responsible without hindrance by the person in charge, which the personal data have been provided to convey, if
- processing on a consent pursuant Article 6 par. 1 lit. a GDPR or article 9 para. 2 lit. a GDPR or on a contract pursuant Article 6 par. 1 lit. b GDPR based and
- is processed using automated procedures.
In this exercise, you have also the right to obtain a guarantee that the personal data concerning you, delivered an other responsible directly by a responsible person as far as this is technically feasible. Freedoms and rights of others must not be impaired thereby.
The law on data portability does not apply to processing of personal data, which is required for the execution of a task, which is in the public interest or in exercise of official authority is awarded to the person in charge.
Right of objection
You have the right, for reasons arising from their specific situation, at any time to the processing of your personal data, which on the basis of article 6 par. 1 lit. e or f GDPR is made to appeal; This applies also to an assessment based on these provisions.
The officer no longer handles the personal data concerning you, unless, he can demonstrate compelling protection worthy reasons for processing that outweigh your interests, rights and freedoms, or processing is used the Exercise, exercise or defence of legal claims.
Be processed personal data concerning you, to operate direct mail, have the right at any time to appeal to the processing of personal data concerning you for the purpose of such advertising; This applies also to profiling, insofar as it is with such direct marketing in conjunction.
Object to the processing for purposes of direct marketing, to the personal data concerning you will no longer be processed for these purposes.
You have the opportunity to exercise your right of objection by means of automated procedures in connection with the use of services of the information society – regardless of the Directive 2002/58/EC -, in which technical specifications are used.
You also have the right, for reasons arising from your particular situation affect you in the processing of personal data, the scientific or historical research purposes or for statistical purposes pursuant Article 89 para. 1 GDPR., to contradict this.
Your right of objection may be limited in so far as it probably makes it impossible for the achievement of the research or statistical purposes, or seriously affected and is necessary for the fulfilment of the research or statistical purposes.
Right of withdrawal the privacy consent form
You have the right at any time to revoke your privacy consent form. The lawfulness of the processing carried out on the basis of the consent to the withdrawal is not affected by the withdrawal of consent.
Automated decision in the individual case, including profiling
You have the right not to be subjected to not only on an automated processing – including profiling – based decision, you has legal effect or significantly affected in a similar way. This does not apply if the decision
- is necessary for the conclusion or the performance of a contract between you and the person in charge,
- is allowed by legislation of the Union or the Member States, is the responsible subject and these laws contain adequate measures to safeguard your rights and freedoms, as well as your legitimate interests or
- is done with your explicit consent.
However these decisions may not be based para 1 GDPR on special categories of personal data pursuant to article 9, if not article 9 para 2 lit. a or g GDPR is valid and appropriate measures for the protection of rights and freedoms, as well as your interests.
With regard to the cases referred to in (1) and (3) the responsible appropriate measures, meets at least the right to obtaining of the intervention of a person on the part of the person responsible, to maintain the rights and freedoms, as well as your legitimate interests, including Presentation of the own position and heard to contest the decision.
Right of complaint to a supervisor
Without prejudice to an other administrative or judicial appeal is the law on appeal by a supervisory authority, in particular in the Member State of their residence, their job, or the location of the alleged Infringement, too, if you believe that the processing of personal data concerning you is contrary to the GDPR.
The supervisory authority, in which the complaint was filed, informs the State and the results of the appeal including the possibility of a judicial remedy 78 GDPR the complainant about article.