Privacy Notice

1. Introduction

The Research Engagement Network (REN) is a shared digital infrastructure platform, run by Nottingham Trent University (NTU). REN is designed to connect researchers and voluntary, community and social enterprise (VCSE) organisations in a more structured, transparent and reciprocal way. It helps organisations be visible for relevant opportunities, supports consent-based matching and relationship building, and gives institutions a better way to manage and evidence community engagement, collaboration and impact.

In simple terms, REN acts like a bridge and a guide. It connects the right people to the right opportunities, helps them work together smoothly, and makes sure everything is done in a structured, fair, and purposeful way. By the end of the process, both researchers and organisations can clearly see the outcomes and impact of their work, rather than just completing a project without measurable results.

At REN, we are committed to protecting the privacy and security of your personal information. This privacy notice explains what REN ("REN", "we", "us", "our", "the platform") does with your personal information, your rights and how we protect it.

This Privacy Notice applies to all individuals and users ("you" or "your") whose personal information is collected as part of the REN platform.

REN encourages you to review the privacy statements of any websites you choose to navigate to from our website or digital services that we provide links to. Any third-party sites that you can access through the website are not covered by this Privacy Notice and we accept no responsibility or liability for these sites.

2. Who we are

REN is a platform run by Nottingham Trent University. For the purposes of the UK GDPR, REN is not a sole legal entity; NTU is the "data controller" which means it is responsible for deciding how we hold and use personal information about you.

For information about how NTU uses your personal data, please find the relevant privacy notice on the NTU website. You can find NTU in the Information Commissioner's register of organisations who have paid the controller fee.

We want to be clear about our privacy practices so that you are fully informed and can make choices about the use of your information. If you have any questions about the use of your personal data in respect of the REN platform please contact:

Alternatively, if you have any questions about the use of your personal information by NTU, or wish to exercise your rights, please contact:

We may need to update this Privacy Notice from time to time. If changes are considered material, we will notify you during the course of the research.

3. Personal information

REN is committed to the responsible handling and protection of personal information. Personal Data, or personal information, means any information about an individual from which that person (a "Data Subject") can be identified. It does not include data where the identity has been removed (anonymous data).

The information will be personal data if a person can be identified either directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. For example, personal data may include names, addresses, email addresses and telephone numbers; it may also include images in photographs or films and audio recordings of interviews.

4. Why we process your data

We process (collect, use, disclose, transfer, and store) personal information to enable us to run and facilitate your participation in and usage of the REN platform, including but not limited to:

• To enable users to register for the Platform
• To enable users to manage their account preferences
• To enable research users to browse and apply to projects that match their skills and interests
• To enable us to share platform-related events and opportunities that users may be interested in
• To enable VCSE users to host projects, upload project details and milestone data and manage requests from research users
• To provide research and VCSE users of the Platform with a high-level management overview of projects (status and progress) for the lifetime of the project
• To enable outputs, insights and aggregated reporting for participating organisations
• To improve the platform, associated services and maintain the security integrity of our systems
• To improve system performance and usability

As a part of the REN, we will only collect information that is necessary and proportionate for the purpose of the platform. You are not legally or contractually obliged to supply us with your personal information and it is entirely voluntary whether you decide to do so.

5. The types of personal information we collect

Where you use our REN platform, you will fall into one of the two types of end-users: Research or VCSE. The categories of personal information that we may collect, store and use about you include (but are not limited to):

From Research Users:

• Name (mandatory)
• Email address (mandatory)
• IP Address (optional)
• LinkedIn, ORCID iD, Google Scholar links and other public profile links (optional)
• Institution affiliated with (mandatory)

From VCSE Organisation Users:

• Name of organisation (mandatory)
• Organisation email address (mandatory)
• Charity Number (if a registered Charity) (optional)

The REN Platform is hosted on GoDaddy. For further information as to how our platform uses cookies, please see the GoDaddy cookies policy.

6. How we collect and use personal data

REN collects your data through your interaction with the platform, including:

1. Direct submissions (registration, preference amendment, completion of forms, system inputs)
2. Internal systems and workflows
3. Automated logging (for system performance and security)

When processing personal data, we rely on a combination of lawful bases permitted by data protection law:

• Article 6(1)(a) Consent — to enable you to utilise the REN platform, including account registration and management, marketing where you have opted in, or to enable us to share your personal data with platform partners with appropriate safeguards in place.
• Article 6(1)(e) Public Task — We undertake this programme as part of NTU's function for the community under its public task, in this instance in providing a platform (REN) designed to support public-interest research engagement and encourage community involvement across the VCSE sector.

7. Who we share your data with

Your personal data will be stored on a private server hosted by our website hosting and infrastructure provider, GoDaddy, which acts as a data processor on our behalf. This data is accessible only to members of the REN Team.

REN does not share your personal data with any other third parties for their own purposes, other than those mentioned in this privacy notice. All data:

• Remains within REN-controlled systems
• Is accessed only by authorised personnel
• Is used strictly for internal purposes

Information you have shared as part of your engagement with others, including your user profile, will not remain visible after you close your account or delete the information from your own profile. However, we do not control data that other members have copied out of our services.

Where outputs, insights and aggregated reporting is created, this data is anonymised and cannot be linked to, or used to identify you. Once information has been anonymised, it no longer constitutes personal data and falls outside the scope of UK GDPR.

Your personal information will not be shared for marketing purposes. Where necessary we will share information to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities.

Unless stated otherwise, we will not transfer personal data outside of the United Kingdom. Where information is shared outside the UK and European Economic Area, we take appropriate steps to ensure that personal information is processed, secured, and transferred according to applicable law.

8. How long we keep your data

We will not store your personal information for longer than is necessary to fulfil the purposes for which it has been collected. Your data is stored on a GoDaddy VPS server and will be retained for as long as your account remains active.

If you choose to delete your account, your data will be retained for 90 days, after which it will automatically be deleted. The 90-day retention period for deleted accounts does not apply to statutory requests for erasure or withdrawal of consent by you.

9. Security of your personal information

REN takes the security of personal data seriously and implements appropriate technical and organisational measures to protect it from unauthorised access, loss, misuse, or disclosure. REN operates as a closed, internally governed system.

Personal data is stored on a secure Virtual Private Server (VPS) provided by GoDaddy. Where GoDaddy processes personally identifiable information on behalf of REN as part of the hosting services, it acts as a Data Processor on behalf of NTU.

In addition to hosting-level protections, REN applies internal controls including:

• Restricted access to personal data based on roles and responsibilities
• Secure authentication and access management processes
• Monitoring and audit logging of system activity
• Secure storage and controlled data handling procedures
• Regular review of data access and permissions
• Staff awareness and adherence to data protection practice

10. Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us. You can update your profile details at any time from your account settings.

11. Your rights

We respect your right to access and control your information, and we will respond to requests for information and, where applicable, will correct, amend, or delete your personal information. Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of personal information that we hold about you. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.
• Request erasure of your personal information in limited circumstances. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You can also delete your account directly from your account settings.
• Object to processing of your personal information where we are processing it on the basis of our legitimate interest (or that of a third party) and there is something about your particular situation which makes you want to object.
• Request restriction or suspension of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Object to direct marketing (for example, email notifications) by us, and to require us to stop such marketing. You can manage your email preferences from your account settings at any time.
• Object to automated decision-making about you which produces legal effects or otherwise significantly affects you.
• Request data portability — the transfer of your personal information to another party.

12. Updates

This notice may be updated to reflect changes in REN operations or legal requirements. During the sign-up process, users have the option to opt in to marketing communications. This is entirely optional. If users wish to withdraw from marketing communications at any time, they can email vcseobservatory@ntu.ac.uk or update their preferences in their account settings.

13. How to contact us

If you have any questions about the use of your personal data in respect of the REN Platform please contact:

Alternatively, if you have any questions about the use of your personal information by NTU, or wish to exercise your rights, please contact:

You have the right to raise concerns with the Information Commissioner's Office (ICO):