This privacy policy explains how and why we collect your personal data, how we use it and how we keep it secure. Your personal data is defined as any information that can directly or indirectly identify you. This notice also explains how we keep your information safe and secure and includes information you need to know about your rights and how to exercise them. We may change this policy from time to time so we recommend you check this page occasionally to make sure you are aware of any changes. This policy was last updated in December 2024.
If you have any questions about this policy and our use of your personal data or would like to exercise any of your rights, please get in touch with us:
Email us: dataprotection@resus.org.uk
Or, write to us at:
Data Protection Officer, Resuscitation Council UK, First Floor, 60-62 Margaret Street, London, W1W 8TF
Telephone us: 020 7388 4678
If you are unhappy with the way we process your data, you can also make a complaint directly to:
Information Commissioners Office (ICO)
Telephone: 0303 123 1113
Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
www.ico.org.uk/make-a-complaint
Who are we?
We are RCUK, and for the purposes of data protection laws, we are a controller. We work to save lives by developing guidelines, influencing policy, delivering courses, and supporting cutting-edge research. Through education, training and research, we’re looking towards the day when everyone in the country has the skills they need to save a life.
In this policy, Resuscitation Council (UK) (RCUK) and Resuscitation Council (UK) Trading Limited ‘we’, ‘us’, ‘our’, means:
Resuscitation Council UK, a limited company in England and Wales under registration number 0299414, charity registration number 1168914, with a registered office address at First Floor, 60-62 Margaret Street, London, W1W 8TF.
How do we collect from you?
The personal information we collect, store and use includes the information required when you:
- are added to a course faculty or candidate list register on the RCUK Learning Management System
- complete a course evaluation form
- apply to work or volunteer with us
- submit a research grant application
- register as an RCUK course centre
- join as an employee or volunteer
- become a member of RCUK
- subscribe to our newsletter
- purchase from our shop
- register a subscription to e-Lifesaver
- register a subscription to BLSi
- register to access the ReSPECT learning app
- are added to the ReSPECT implementation network register to apply for a research and development grant register as a course centre administrator
- register for an RCUK event
- register to access the Adult Resuscitation e-learning portal
- are added to the Generic Instructor Course Virtual Learning Environment register to access the Generic Instructor Course
- contract with us or correspond with us
- attend an online webinar or virtual meeting
- when you register on the RCUK ResusReady website
- when you interact with our website
- when you sign-up to the GIC emergency cover WhatsApp group.
Your personal data may be provided to us by someone other than you, with whom you and we are both connected (e.g. someone with whom you and we are both collaborating, or your employer if we are doing business with them and they need us to liaise with you, or, if you are a candidate using our learning management system your details might be provided to us by the course centre administrator when they create an account for you), or may be gathered by us in our market research, or provided to us by third party market researchers, if you have a public profile at an organisation with whom we collaborate or wish to collaborate.
What type of information do we collect from you?
The personal information we collect from you directly may include your name, address, role, email address, other contact details, or, if you are a user of our Learning Management System, information regarding your completion of courses and qualification. Personal information which is on your profile page of the Learning Management System can be amended at any time by you.
As part of our ongoing monitoring and evaluation of our products and services, we may request feedback from you to allow us to monitor our products and services. Where you have attended a course or utilised a service it is possible that anonymous feedback becomes identifiable in a small data set. Data will be used only for the purpose for which it is collected and will only be shared with the relevant course centre and / or RCUK staff.
We may indirectly collect data about your use of our websites, which we obtain through our analytics tracking systems. The usage data may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency, and pattern of your service use. We may collect and use your personal information by using cookies on our website, more information on cookies can be found under ‘the use of cookies’ section below. Whenever we use non-essential cookies, we will request your Consent.
Where you correspond with us, we may have records of that correspondence. If we have a collaborative or business relationship with you or your employer, we may have your organisational contact details and any documents related to that relationship (such as contracts or transaction details).
If you attend an online webinar or join a virtual meeting we may, with your consent, keep a recording of your face, voice or name, job title and email address.
How do we use your information?
We are required to identify both our purposes of processing and the “lawful basis” of processing (the “lawful basis” being one of the bases set out in Article 6 of The UK General Data Protection Regulation (UK GDPR).
| Purpose/activity | Type of data | Legal basis for processing |
|---|---|---|
|
To deliver our apps, content and learning material, to verify course completion or certification in response to third party enquiries. |
Information that is provided in the LMS or otherwise when registering to access or use our apps, content or materials, |
(a) Performance of a contract with you. |
|
To gather course evaluation data |
Your course evaluation free-text comments; course results by course type and date; job role and grade. |
Consent. |
|
To correspond with you and to address any queries you may raise through our website or otherwise correspond in connection with any actual or potential business |
Contact information, including information that you provide by filling in forms on our site or otherwise by contacting us, and copies of your correspondence with us. |
(a) Performance of a contract with you (b) Our legitimate interests (to address our users’ concerns and queries, to properly administer our business and communications, to conduct marketing, and to develop our relationships with interested parties) |
|
To carry out our obligations arising from any contracts entered into between you and us |
Contact information, including information that you provide by filling in forms on our site or otherwise by contacting us, and copies of your correspondence with us. Documents featuring personal data, such as POs, proposals, contracts and the like. |
Performance of a contract with you |
|
To process job and volunteer applications Anonymised job applicant diversity monitoring forms to allow us to monitor and evaluate the diversity of applicants and reach of our recruitment processes. Providing this information is strictly voluntary. |
Contact details, employment history and qualifications. Anonymised data relating to age, ethnicity, gender, sexual orientation. |
Consent
Consent |
|
To carry out our obligations regarding your employment or volunteer status with us
|
Name and other contact information, training, performance, financial data and other relevant information regarding your employment or volunteer role with us. In some cases, this may include special category data, for example, sickness, maternity/paternity, health, safety and wellbeing |
Performance of a contract with you.
Employment law obligations |
|
To use data analytics to improve the website and ensure that content from the website is presented in the most effective manner for you and for your computer. |
Information relating to your visits to the website including IP address and traffic data. This includes the use of cookies: https://www.resus.org.uk/cookies |
Our legitimate interests (to keep the website updated and relevant, to develop our business, for network security). |
|
To provide you with information regarding our products or services, news or updates that you request from us or which we feel may interest you. |
Information that you provide by filling in forms on our website, or by contacting us, or information which we receive from third parties, and copies of your correspondence with us. This information may include your name, address, and email address. |
(a) Our legitimate interests (to develop our products/services and grow our audience); or (b) Your consent, where required by law |
|
Record-keeping and hosting, back-up and restoration of our systems |
Any personal data |
Our legitimate interests (ensuring the resilience of our IT systems and the integrity and recoverability of our data). Data subjects data is stored under contractual obligation. Information about Data subjects who subscribe to the newsletter will be stored under their consent. |
|
Bringing and defending legal claims |
Any personal data |
Our legal obligation. |
|
Legal compliance (e.g. maintaining tax records) |
Any personal data |
Necessary to comply with a legal obligation |
|
Recording of meetings or webinars that are recorded for the purpose of sharing learning |
Name, email, video or voice recording |
Consent |
|
To process applications for research grants |
Contact details, qualifications and employment history |
Consent |
|
To undertake or support research and development in the field of resuscitation |
Anonymised datasets of course and/or instructor data |
Legitimate interest |
| To register on the GIC Instructors emergency contact Whatsapp group | Name, phone number and profile | Consent |
ResusReady: INDIVIDUAL REGISTRANTS
| Purpose/activity | Type of data | Legal basis for processing |
|---|---|---|
|
To register you on the ResusReady website |
Name, address, email |
Consent |
|
To share the geographical region of registrants on the ResusReady website map |
Region / constituency of registrant location |
Consent |
ResusReady: ORGANISATIONS
| Purpose/activity | Type of data | Legal basis for processing |
|---|---|---|
|
To register your organisation on the ResusReady website |
Contact name, email, organisation name, organisation postcode |
Consent |
|
To share the geographical location of organisations registered with ResusReady, via RCUK website map |
Organisation name and address |
Consent |
ResusReady: ALL USERS
| Purpose/activity | Type of data | Legal basis for processing |
|---|---|---|
|
To use data analytics to improve the RCUK website and ensure that content from ResusReady is presented in the most effective manner for you and for your computer |
Information relating to your visits to the website including IP address and traffic data. This includes the use of cookies: https://www.resus.org.uk/cookies |
Our legitimate interests (to keep the website updated and relevant, to develop our business, for network security) |
|
To provide you with information regarding our products or services, news or updates that you request from us or which we feel may interest you |
Information that you provide by filling in forms on our website, or by contacting us, or information which we receive from third parties, and copies of your correspondence with us. This information may include your name, address, and email address. |
Your consent, where required by law |
|
Record-keeping and hosting, back-up and restoration of our systems |
Any personal data |
Our legitimate interests (ensuring the resilience of our IT systems and the integrity and recoverability of our data). Data subjects data is stored under contractual obligation. |
How and why is your information used?
We keep your information for no longer than is necessary for the purposes it was collected for.
The length of time we keep your information for is determined upon our legal and operational considerations. For example, we are legally required to hold certain types of information to fulfil our statutory and regulatory obligations (e.g. Employment law, health and safety and tax/accounting purposes).
We review our retention periods on a regular basis and update our Records of Processing Activities accordingly. If you would like to know about how long we hold your personal information for please get in touch via any of the contact details listed at the start of this policy.
Who has access to your information?
The processing of personal information may require sharing the information with our employees, contractors and professional advisers, or within our group.
We will not sell or rent your information to third parties. We will not share your information with third parties for marketing purposes.
Third Party Service Providers working on our behalf: We may pass your information to our third party service providers, subcontractors and other associated organisations for the purposes of completing tasks and providing services. When we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. Please be assured that your data will not be processed by any third party for any other reason than stated unless you have requested us to do so, or we are required to do so by law. For example, for the purposes of prevention of fraud or other crime or any other requirement by law.
If you are a user of the Learning Management System: Our Learning Management System is not used solely for learning management, but also as a network of healthcare professionals. Any public profile information associated with your account may be visible to other users of the LMS or to healthcare bodies with access to the LMS (and we recommend for that reason you use professional rather than personal contact details). In addition, we use information from our LMS to verify candidates’ course attendance or qualification to third parties who have been authorised to request this information (such as employment agencies, or NHS Trusts), in which case we would confirm whether the candidate has undertaken the training in question, whether they hold a valid RCUK certificate and the dates on which they attended courses or obtained certificates.
We may disclose your personal information if we are under a duty to disclose or share it in order to comply with any legal obligation, or in order to enforce or apply any terms or agreements we may have in place with you.
Anonymised data may be shared with our network of clinical experts to support developments in resuscitation research. All requests for data will be submitted for approval by the Chair of the relevant Subcommittee and notified to the Director of Customer and Business Standards to ensure sufficient anonymization have been applied, and clear processing agreements are in place.
International transfers of your personal data
Some of the third parties to whom we may transfer your personal data, discussed above, may be located outside the EEA or may transfer your personal data to their own service providers located outside the EEA. If so, then we will ensure that transfers by our appointed data processors will only be made lawfully (e.g. to countries in respect of which the European Commission has made an “adequacy decision”, or with appropriate safeguards such as the use of standard clauses approved by the European Commission or the use of the EU-US Data Privacy Framework). You may contact us if you would like further information about these safeguards.
We may transfer your personal data outside the United Kingdom (UK). In such circumstances we may undertake a transfer risk assessment in accordance with UK data protection law. We may also ensure appropriate UK safeguard is in force which includes the UK addendum in conjunction with the EU SCCs or the UK international data transfer agreement.
Access to your information and correction, and your other rights
You have rights under data protection law – they are complex, and subject to exemptions, and you can read guidance from the Information Commissioner’s Office at www.ico.gov.uk for a fuller explanation of your rights. In summary:
Right to be informed
You have the right to be informed as to how we use your data and under what lawful basis we carry out any processing. This privacy notice sets this information out however if you would like further information or feel that your rights are not being respected, please get in touch with any of the contact details listed above.
Right of Erasure
You may ask us to delete some or all your information we hold about you. Sometimes where we have a legal obligation, we cannot erase your personal data.
Right to object
You have the right to object to processing where we are using your personal information such as where we are processing your data based on our legitimate interest or for direct marketing.
Inaccurate personal information corrected
Inaccurate or incomplete information we hold about you can be corrected. You are able to view and update your personal information which we hold in our Learning Management System at any time by logging on to your profile page on the Learning Management System.
Verification, updating or an amendment of personal data will take place within 30 days of receipt of your request. If you subsequently make a data protection instruction to RCUK which contradicts a previous instruction (or instructions), then RCUK will follow your most recent instruction.
Right of restriction
You have the right to restrict the processing of some of all your personal information if there is a disagreement about its accuracy, or we are not lawfully allowed to use it.
Right to access your information
You have the right to request access to a copy of your personal information that we hold about you, along with the information on what personal information we use, why we use it, who we share the information with, how long we keep it for and whenever it has been used for automated decision making. You can make a request for access free of charge and proof of identity is required.
Automated decision making
Automated decision making takes place when an electronic system uses personal information to make a decision without human intervention. You have the right to question the outcome of automated decisions that may create legal effects or create a similar significant impact on you. We do not currently undertake automated decision making.
Portability
You can ask us to provide you or a third party with some of the personal information that we hold about you in a structured, commonly used, electronic form so it can be easily transferred.
If you would like to request a copy of some or all of your personal information or otherwise exercise your rights please contact us.
You can also write to us at:
Resuscitation Council UK
First Floor
60-62 Margaret Street
London
W1W 8TF
Security
When you give us personal information, we take steps to ensure that it is treated securely. We use industry standard encryption for your transactions with us. It encrypts all of your personal information, including credit card number, name, and address, so that it cannot be read as the information travels over the Internet.
Credit Card information is not held by RCUK at any time, all payment information is handled by an accredited payment provider.
Keeping your information safe
We take looking after your information very seriously. We have implemented appropriate physical, technical and organisational measures to ensure that your personal information is secure when under our control, both online and offline, form improper access, use, alteration, destruction, and loss.
Any sensitive information (such as your credit card or debit card details or any information that is classed as ‘sensitive’ or ‘special category’ data) is encrypted and protected. All debit and credit card details are passed securely to our payment processing partner, according to the payment industry security standards.
Retention
We will retain the information we receive and collect about you for a period which is reasonably required for us to use it in accordance with this Policy or in accordance with our legal rights and obligations.
Use of cookies
Resuscitation Council UK websites use cookies. A cookie is a small piece of data that is stored on your computer’s hard drive by a website. They collect statistical data about your browsing actions and patterns. Cookies do not typically contain any information that personally identifies a user (except for IP addresses in some cases).
See the cookies we use on this website.
Links to other websites
RCUK websites may contain links to other websites run by other organisations. RCUK is not responsible for the privacy guidance on third party websites even if you access these using links from our website. RCUK recommends that you read the privacy guidance on other websites before registering any personal data.
Review of this policy
Any changes we may to this policy in the future will be posted on this website so please check this page occasionally to ensure that you’re happy with any changes. If we make any significant changes, we’ll make this clear on our website or we may contact you. We keep this policy under regular review.
This policy was last updated 17 December 2024.