Implementation and Process Evaluation of upReach: Privacy notice

upReach has commissioned the National Centre for Social Research (NatCen) to carry out an independent evaluation of their programme. As part of this, we are conducting focus groups with upReach Associates from their 2024 and 2025 graduating cohorts.

This privacy notice sets out how we will process information from everyone who takes part in this strand of the evaluation. In line with the UK General Data Protection Regulation (GDPR), it explains the legal basis for data processing; who will have access to participants’ personal data; how this data will be used, stored and deleted; and how to submit a query or a complaint.

What is the legal basis for processing my data?

For the use of personal data to be lawful, we need to satisfy one or more conditions in the General Data Protection Regulation (GDPR), as set out in Article 6(1). For this project, the legal basis is ‘legitimate interest’. This means we believe that there is a genuine reason for us to process this data (to evaluate upReach), this data is needed to fulfil this purpose (we could not evaluate upReach without this information) and using this data will not interfere with individuals’ interests, rights or freedoms.

upReach is the data controller for this research and NatCen is the data processor. This means upReach are responsible for deciding the purpose and legal basis for processing data, and NatCen is responsible for the collection, processing and storage of the data.

Who will have access to my personal data?

Where permission is given for these to be shared, NatCen’s research team will have access to participants’ names and contact details. With participants’ permission, the focus group discussions will be audio recorded to provide an accurate record of the discussion, and written notes may also be made. NatCen will hold and process the recordings and any notes taken during the groups.

McGowan Transcriptions is the service we use to transcribe focus group data. They will have access to audio recordings and transcripts from the focus groups; no other data will be shared with them. The focus group data will be shared through our secure online file transfer portal (FTP) system, and held in accordance with NatCen’s security policy requirements.

Only a small number of staff at NatCen will have access to the data for this project.

How will my data be used?

Your data will only be used for research purposes. Information obtained from the focus group discussions will be analysed and brought together into a report for upReach. No data that can identify you as an individual will be passed on to them. The report may include some quotes from participants, but no identifying information (including, for example, names of individuals or places) will be included, to protect participants’ anonymity as far as possible. There is a possibility, however, that somebody who knows you and your views well may be able to recognise something you have said if this is quoted in the report. This includes the upReach team, who identified eligible individuals to be invited to participate in the research.

How will my personal data be stored?

All personal data held by NatCen will be stored securely in the UK, in line with international best practice and NatCen’s ISO27001, ISO 20252 and Cyber Essentials Plus certifications.

Will my personal data be deleted?

All personal data will be securely deleted one year after completion of the project.

Can I change my mind?

Yes. You have the right to change your mind and withdraw your permission for processing at any time before the focus group takes place. You don’t have to justify or explain why you are doing so if you don’t want to state your reasons. To withdraw your permission, please contact the research team at upreachevaluation@natcen.ac.uk.

Once you have taken part in the focus group, it will not be possible for us to identify your contribution to a group discussion. Because we will not be able to identify you in the results, we will be unable to remove your data after you have taken part in the group.

If you do decide to withdraw before the focus group takes part, we will no longer process any information we have on you for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

You can also request access to your personal data, ask for it to be deleted or updated by NatCen, and/or for an explanation of how it has been used, at any time before it is destroyed. Rights requests will be responded to without delay and within 30 days. Individual rights requests apply to personal data only, and there may be some occasions where you will receive an explanation of why the request you've made cannot be complied with.

Disclosure notice

Information provided by you for this research will be kept confidential. The only exception to this is if you tell the research team details of a crime, or about an imminent threat to life or serious harm to yourself or involving somebody else you identify. In this case, the research team will need to pass the information on to NatCen’s disclosure board, who will determine whether the information needs to be shared outside NatCen, for example with the local police or local authority.

Who can I contact with a query or a complaint?

We would welcome the opportunity to discuss the research with you to address any concerns directly. Please do feel free to contact us if you have any questions – email upreachevaluation@natcen.ac.uk or phone 020 7549 7112.

If you believe we have not complied with your data protection rights, you can contact our Data Protection Officer at dpo@natcen.ac.uk. 

You also have the right to lodge a complaint with the Information Commissioner’s Office if your query is not satisfactorily addressed by us. You can do this via phone, on 0303 123 1113, online at https://ico.org.uk/concerns, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.