We are undertaking a project which involves collecting ideas and perspective on those ideas from the public. This privacy notice sets out how we collect and use your personal data if you are a participant in this project.

This project is being conducted in collaboration with Involve and Martin Lewis (in his personal capacity).

Nesta is the data controller and is responsible for your personal data collected in connection with this project. This means that we will be responsible for keeping your information safe and only using it for the purposes set out in this notice.

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights in relation to your personal data, please contact the DPO and provide enough information to identify yourself:

Email:[email protected]

Post: 58 Victoria Embankment London UK EC4Y 0DS

If you are unhappy about how we use your personal data or have a complaint, you have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please do contact us in the first instance.

We will collect directly from you the following personal data:

• Name
• Email
• Telephone number
• Postcode (not mandatory)

The purpose for which we are processing your personal data is to crowdsource ideas. If you have included your postcode, that data may be used to support additional analyses around the geographical distribution of submitted ideas. If you have indicated that you are happy to consider speaking out to the media about your idea, we will use the information collected to get in touch with you directly.

As part of this research project we may use Google’s Gemini to filter out any hate speech in submitted ideas.

At the point of idea submission data will be pseudonymised to separate personally identifying information from your idea. Only ideas will be shared with project partners with no identifying information.

Legal basis

Data protection law requires us to have a specific legal basis for processing your personal data. For this project, our lawful basis will be:

Consent: You have consented to us processing your personal data for the purposes of this project and have confirmed via a consent tick box on the Small Ideas Initiative website.

You have the right to withdraw your consent at any time by contacting to [email protected].

We have a legitimate business interest in using third party technology, Google’s Gemini, to analyse idea submission.

Your information will be accessed by a limited number of researchers and advisors in our project team working on this project.

In addition, we may disclose your information to third parties in connection with the purposes of processing your personal data set out in this notice. These third parties may include:

• other companies in our group that are based within the United Kingdom;
• regulators, law enforcement bodies and the courts, in order to comply with applicable laws and regulations, assist with regulatory enquiries, and cooperate with court mandated processes, including the conduct of litigation;
• suppliers, research assistants and sub-contractors who may process information on our behalf e.g. website provider the Dextrous Web. These third parties are known as data processors and when we use them we have contractual terms and policies and procedures in place to ensure that your personal data is protected. This does not always mean that they will have access to information that will directly identify you as we will share anonymised or pseudonymised data only wherever possible. We remain responsible for your personal information as the controller.

We may also disclose your personal information if required by law, or to protect or defend ourselves or others against illegal or harmful activities, or as part of a reorganisation or restructuring of our organisations.

Your personal information will not be transferred outside of the UK and the European Economic Area.

We take reasonable steps to protect your personal information and follow procedures designed to minimise unauthorised access, alteration, loss or disclosure of your information. This includes pseudo-anonymisation.

General principle: We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. When it is no longer necessary to retain your personal data, it will be securely deleted.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Nesta will retain pseudonymised datasets for the purpose of analysis and contacting you about your idea, if you have opted into this use.

Taking the above factors into consideration, our anticipated date of deletion for your personal data is 6 months.

Under certain circumstances, you have rights under data protection laws in relation to your personal data, including rights to:

If you wish to exercise any of the rights set out above, please send your specific request to the Data Protection Officer using the contact details provided at section 2

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated

We may change this privacy policy from time to time. We will notify you of any changes that relate to information we already hold about you, where practicable. You should check this policy occasionally to ensure you are aware of the most recent version that will apply each time you access this website.