Evaluation of 'Send Me a Pic?': Privacy notice

This privacy notice sets out how we will process information from everyone who takes part in this research. In line with the UK General Data Protection Regulation (GDPR), it explains the legal basis for data processing; who will have access to participants’ personal data; how this data will be used, stored and deleted; and how to submit a query or a complaint.

What is the purpose of the research?

The National Centre for Social Research (NatCen) has been commissioned by the National Crime Agency (NCA) to carry out an evaluation of the Send Me a Pic? (SMaP) education resource. The aim of the evaluation is to:

  • Assess the impact of the SMaP education resource on pupils’ knowledge, understanding, and behaviours relating to nude image sharing and nude image based abuse.
  • Understand the factors that impact successful implementation of SMaP education resource.

If you would like to know more about the research, what taking part will involve, or how to contact the research team, please see the relevant information sheet page, or visit our study webpage at natcen.ac.uk/sendmeapic.

What is the legal basis for processing my data?

For the use of personal data to be lawful, we need to satisfy one or more conditions in the General Data Protection Regulation (GDPR), as set out in Article 6(1). For this project, the legal basis is “legitimate interest”. This means we believe that there is a genuine reason for us to process this data (to evaluate SMaP), this data is needed to fulfil this purpose (we could not evaluate SMaP without this information) and using this data will not interfere with individuals’ interests, rights or freedoms.

NatCen is the data controller for this research and will also be processing the data. This means we are responsible for deciding the purpose and legal basis for processing data.  

Who will have access to my personal data?

NatCen is carrying out this evaluation. Named individuals on the NatCen research team will have access to:

  • Sample files provided by each school, containing information about all eligible pupils whose parents have not opted them out of the evaluation. For each pupil, this will include:
    • Unique Pupil Number (UPN)
    • Date of birth
    • First and last name
    • Gender
    • Year group
    • Class (if a multi-form-entry school)
  • Teachers’/staff members’ names and contact details provided by the school.
  • Audio recordings of pupil focus groups and teacher interviews
  • Pupil survey responses
  • Teacher survey responses
  • Lesson observation notes

McGowan Transcriptions transcribe our interviews and focus groups and will have access to audio recordings and transcripts from interviews and focus groups. McGowan Transcriptions is on our approved supplier list and compliant with all our information security policies.

The NCA will not have access to any personal data, recordings or transcripts. Rather, NatCen will provide a written report to the NCA that presents thematic findings from the research. The report may include some verbatim quotations, but no identifiable information will be included.

No personal data will be shared with any other organisation unless a research participant discloses harm or a risk of serious harm to themselves or somebody else they identify.

How will my data be used?

The results collected will be used for research purposes only. All data collected will be handled in accordance with GDPR. The information you provide will be used to write research outputs (such as published and internal reports and presentations). All findings, including any verbatim quotations that are used will be anonymised: we will not include the names of any individuals or organisations in the research outputs.

Where will my personal data be stored?

All personal data will be stored securely, in line with international best practice and NatCen’s ISO27001, ISO 20252 and Cyber Essentials Plus certifications. Identifiable data will be stored by NatCen for six months after publication of the report (which we expect to be by the summer of 2025) and then securely destroyed.

What are your rights under GDPR?

Under certain circumstances, by law you have the right to:

  • Be informed about the collection and use of your personal data. We must provide this privacy notice to explain the purpose for processing your personal data, retention periods for your personal data, and who it will be shared with.
  • Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
  • Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
  • Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.  You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
  • Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object to processing on this ground.
  • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Request the transfer of your personal information to another party.
  • Rights in relation to automated decision-making and profiling. We will not use your data for automated decision making or profiling in any way.

If you want to review, verify, correct, or request erasure of your personal information; object to the processing of your personal data; or request that we transfer a copy of your personal information to another party, please contact the study team at smap-evaluation@natcen.ac.uk

Can I change my mind?

Yes. You have the right to withdraw your permission for processing at any time and you don’t have to justify or explain why you are doing so if you don’t want to state your reasons. To withdraw your permission, please contact the study team at smap-evaluation@natcen.ac.uk

When any data you provide has been aggregated with other responses in analyses, we will be unable to remove your data from those analyses. However, the original data will be erased, and it will not be possible to identify you in these aggregated results.

Once we have received notification that you have withdrawn your permission, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Who can I contact with a query or a complaint?

We would welcome the opportunity to discuss the research with you to address any concerns directly. Please do feel free to contact us if you have any questions – at smap-evaluation@natcen.ac.uk  or 0808 168 8519.

If you believe we have not complied with your data protection rights, you can contact us at dpo@natcen.ac.uk.

You also have the right to lodge a complaint with the Information Commissioner’s Office on 0303 123 1113, at https://ico.org.uk/concerns, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.