Guidance

Office for Veterans’ Affairs - User research privacy notice

Updated 12 March 2024

The Office for Veterans’ Affairs (OVA) carries out research to test and improve services and to gather evidence in support of policy making.

OVA is part of the Cabinet Office. The data controller for OVA is the Cabinet Office. A data controller determines how and why personal data can be processed. Read the Cabinet Office’s entry in the Data Protection Public Register for more information.

We may also carry out user research with other government departments. In these situations we will either be a joint controller with the other government department or data processor acting on behalf of the other government department. Where this is the case you’ll be notified in the information sheet for specific projects.

This privacy notice gives you general information on how we handle research data at OVA.  For more details about a specific piece of research, you can refer to the information sheet provided when you’re invited to take part in that project. This should also include contact details for the researcher and their team in case you have any further questions.

Why we need your data

We use your contact details to ask you to participate in research exercises you might be interested in.

We need additional information about you when inviting you to take part in research to ensure that:

• you meet the criteria for this piece of research
• we are including a wide range of people

We will collect information about you and your opinions during research sessions to ensure we gather a wide range of views and perspectives.

We may, with your consent, record research sessions  to ensure that we have an accurate record of what was said and enable further analysis..

We will only contact you if you have already said you are willing to take part in OVA research in previous surveys, or have responded to us as a result of external advertising. Participation is completely voluntary.

We will also from time to time contact individual representatives of veteran charities and service providers to understand how they provide support to veterans and their families to inform OVA’s future work.

Our legal basis for using your data

If you are an individual veteran or veteran’s family member who has volunteered to participate in OVA research

We process your personal data on the basis that you have provided your consent.

Sensitive (special category) personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, data concerning health or data concerning a natural person’s sex life or sexual orientation, or personal data relating to criminal convictions.

The legal basis for processing your sensitive personal data, or data about criminal convictions (where it is volunteered), is that you have freely and explicitly given your consent.

If you are a representative of a veteran charity or service provider

We process personal data on the basis that processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller (in this case, to improve support to veterans).

What data we collect from you

When inviting you to take part

The personal data we collect from you at this stage could include information about your:

• name
• age
• gender
• ethnicity
• disabilities, such as details of any condition that can affect your ability to use a computer
• details of previous armed forces service
• email address
• location
• phone number

We may collect additional information, based on the specific topic being researched. For example, if we’re conducting research on a specific government service, we might want to know whether you’ve used this service in the past.

We sometimes work with other organisations to carry out research. This can include companies that help us recruit people to take part in research. If we do this, these companies may also collect additional data for which they are the data controller, and their privacy policy will also apply.

If you are a representative of a veteran charity or service provider, we will collect your name, official email address and your opinions.

During the research session

We will collect your opinions during the research session. This could be in the form of:

• online forms
• paper forms
• audio recordings
• video recordings
• screen recordings
• written notes
• photos

We will notify you in advance of the  methods we intend to use.

What we do with your data

Collecting and analysing

We sometimes use external organisations to book a venue for research outside of our offices, and external tools to conduct remote research sessions. We may also use the following third party tools and services to collect, transcribe or analyse your data:

• survey tools
• online collaboration tools, including video conference and virtual whiteboard tools
• transcription services, including automatic transcription and analysis tools
• consent management tools

If we do any of the above, we will monitor and limit the access that people outside OVA have to your data. The privacy policies of these external organisations will also apply.

Reporting the results

When using your responses in reports or presentations, or sharing with other government departments, we will make sure you cannot be identified from your data. Each person taking part in a piece of research will be assigned a number, and any names or other personal and identifiable data will be removed.  In the case of surveys, reports will be produced using anonymised and aggregated data.

Only researchers working at OVA will have access to the full original recordings though we may share short audio or video clips with other colleagues within OVA and other government departments if we have your express permission to do so. The only exception to this is during the transcription and analytics phase (described above) when transcription and analytics services may be used.

If we do any of the above, we will monitor and limit the access that people outside OVA have to your data. The privacy policies of these external organisations will also apply.

Legal obligations

We will share your data if we’re required to do so by law - for example, by court order, or to prevent fraud or other crime. We will also share your data in the event of a serious safeguarding concern - for example, if we are concerned about the welfare of a child or vulnerable adult.

We will not:

• sell or rent any of your data to third parties
• share your data with third parties for marketing purposes

Where your data is processed and stored

Your personal data will be stored on our IT systems, which are provided by third party email, document management and storage service providers.

Your personal data may be transferred outside the United Kingdom while being processed by OVA. If this happens, it will be subject to equivalent legal protection through the use of adequacy decisions. If no relevant adequacy decision exists, standard contractual clauses will be used instead.

How long we keep your data

We will retain your personal contact data for 2 years from the date you provide it. We will delete your personal data from our research contact list unless you agree to remain on the list for a further 2 years. You may ask to be removed from our research contact list at any time, in which case your personal data will be deleted from that list.

The personal data collected when we invite you to take part in research will be held for a maximum of 2 years. We will hold the data from research sessions, your name, and a record of consent for a maximum of 2 years. After this point, we will delete all personal data relating to you, but we might retain reports that contain your anonymised quotes.

How we protect your data and keep it secure

We are committed to doing all that we can to keep your data secure. We have set up systems and processes to prevent unauthorised access to or disclosure of the data we collect about you. For example, we protect your data using varying levels of encryption and access to your personal data on our IT systems will be restricted to a small number of people within OVA working directly on the research project. All third parties that process personal data for OVA are also required to keep that data secure.

Your rights

You have the right to withdraw consent to the processing of your personal data - for example original recordings and notes where you can be identified. If a report with anonymised quotes has been published (internally or externally) we will not be able to remove this as it does not constitute personal data.

You also have the right to request:

• information about how your personal data is processed
• a copy of that personal data
• that anything inaccurate in your personal data is corrected without delay
• that your personal data is erased if there is no longer a justification for holding it
• that the processing of your personal data is restricted in certain circumstances (for example, where accuracy is contested)
• you have the right to withdraw consent to the processing of your personal data at any time
• you have the right to request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format.

If you have any of these requests, please contact us using the details in the information sheet provided to you, or the contact details listed below.

International transfers

As your personal data is stored on our IT infrastructure, and is processed by our data processors, it may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, or the use of Standard Contractual Clauses or an International Data Transfer Agreement.

Questions and complaints

If you have questions about research that you’ve been invited to participate in, you can contact the researcher named on the information sheet provided to you.

Contact the Cabinet Office if you:

• have any questions about anything in this document
• think that your personal data has been misused or mishandled
• want to make a subject access request (SARS)

The data controller for your personal data is the Cabinet Office. The contact details for our Data Protection Officer are:

Data Protection Officer

Email: DPO@cabinetoffice.gov.uk

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information.

You can also complain to the Information Commissioner, who is an independent regulator.

Information Commissioner’s Office

Email: icocasework@ico.org.uk
Online: contact form
Telephone: 0303 123 1113
Textphone: 01625 545 860

Changes to this privacy notice

We may change this privacy notice. When we make changes, the ‘last updated’ date at the top of the page will also change.

Any changes to this notice will apply to you and your data immediately. If these changes affect how your personal data is processed, OVA will take reasonable steps to make sure you know.