Privacy Policy

The data controller for personal data processed through this website is:

This notice covers visitors to this website, www.foundry120.com, only. Two other populations have their own notices, and this one does not describe them:

• Platform users. If you hold an account on the Foundry120 platform, a separate privacy notice covers your account data, your role and study memberships, and the audit log of your activity. It is published inside the platform, and on the resources page of this site.
• Research participants. Processing of research participant data is governed by each study's own ethical approval and participant information sheet, not by this notice and not by the platform's user notice. If you took part in a study, the research team that recruited you is your point of contact.

This site collects three things:

• Aggregate analytics. Page views, the referring site, the country the request came from, and the general device and browser type. Alongside these, page performance timings, which measure how quickly pages render and respond. These are collected in aggregate and are not used to build a profile of you.
• Server request logs. Our hosting provider records the usual details of each request, including your IP address, the time, the page requested, and your browser's user agent string. These are used to deliver the site and to detect abuse, and are held by the provider for a short period.
• What you send us by email. If you email the address published on this site, we hold your message and whatever it contains, typically your name, email address, institution, and what you want to discuss. That correspondence sits in a University of Glasgow mailbox.

This site sets no cookies of its own. It runs no advertising cookies, no cross-site tracking, no remarketing pixels, and no social media trackers, and it does not sell or share data with anyone for marketing. The analytics described in section 03 are cookieless: they store no identifier in your browser and do not follow you between sites. This is why the site does not show you a cookie banner, and why there is no consent setting for you to manage.

Under UK GDPR we rely on:

• Public task, Article 6(1)(e). Describing research infrastructure and responding to enquiries about it is part of the University of Glasgow's task in the public interest.
• Legitimate interests, Article 6(1)(f). Aggregate analytics and security logging serve our interest in knowing whether the site works and in keeping it available. We have considered the effect on you, and it is minimal, because neither activity identifies you or profiles you.

Two organisations process data on our behalf for this website. Neither is given access to the platform or to research data.

Vercel Inc.

Hosts this website and provides its analytics and performance measurement. This means Vercel handles the request logs in section 03 and the aggregate analytics in section 04. Vercel is a United States company, so this involves a transfer outside the UK, made under its data processing terms and the standard contractual clauses with the UK International Data Transfer Addendum. See vercel.com/legal/privacy-policy.

Microsoft

Provides the University of Glasgow’s email service, so an enquiry you send us is held there. Processing is within the UK and EEA under the University’s own agreement with Microsoft.

We may also disclose personal data where the law requires it, for example to a regulator or in response to a valid legal request.

The platform uses a different and larger set of processors than this website does, and each is named, with its purpose, processing location, and transfer mechanism, in the platform’s sub-processor register. That register is available on request from shaun.chuah@glasgow.ac.uk.

Aggregate analytics

Retained by Vercel in aggregate form for the period set by our plan, then discarded. Because the data is aggregated and carries no identifier, it cannot be traced back to an individual visit.

Server request logs

Held by Vercel for a short operational period, measured in days, and then deleted. We do not copy them into any longer-term store.

Enquiry correspondence

Kept while your enquiry is open and for as long as a record of the discussion is needed, in line with the University of Glasgow's records management policy, then deleted.

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to erase your data, where no legal or records-management obligation requires us to keep it.
• Object to processing we carry out on the basis of legitimate interests.
• Ask us to restrict how we process your data.

Data portability is not listed, because the right under Article 20 applies to processing based on consent or on a contract, and we rely on neither.

For most visitors there is little for these rights to reach, because we hold nothing that identifies you. Where we do hold something, it is usually an email you sent us.

To exercise any of these rights, contact shaun.chuah@glasgow.ac.uk or the University’s Data Protection Officer at dp@glasgow.ac.uk. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

This site is served over HTTPS. The University of Glasgow applies appropriate technical and organisational measures to the email systems that hold enquiry correspondence.

This site is aimed at researchers, research teams, and institutions. It is not directed at children and we do not knowingly collect data about them.

We may update this notice. The current version is always the one on this page, and the date at the top changes when the notice does.

For any question about this notice or about your data, contact: