Privacy Notice

What is our legal basis for processing your data?

Privacy law (the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018) requires us to have a legal reason to process your personal data. Our reason is that we need it to perform a public task.

This is because the University has a public function, which includes carrying out research projects. We need to use personal data in order to carry out this research project.

Information about your health, ethnicity, sexual identity and other sensitive information is called “special category” data. We have to have an additional legal reason to use this data, because it is sensitive.

Our additional reason is that it is needed for research purposes. All research projects at the University follow our research ethics policies.

The legal reasons are given in full detail below:

Our legal reason “public function” refers to UK GDPR Article 6 (1) (e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Our public function is defined in Our charter and statutes, which state: 4.f. To provide instruction in such branches of learning as the University may think fit and to make provision for research and for the advancement and dissemination of knowledge in such manner as the University may determine.
Our legal reason “because it is needed for research purposes” refers to UK GDPR Article 9 (2) (j): processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

How will you use my data?

  • You will be given the option to upload your name, age, gender, photograph, and voice recording during the workshop (using the application).
    • The age and gender may be used for demographic information.
    • The voice recording made during the session may be edited and published as part of a performance at the BBC Centenary Concert.
    • The name and photograph may be used in research outputs from the University of York, social media accounts by the University of York and the BBC Singers, as well as being displayed at the concert at the Barbican.
    • Please Note: Names, voice recordings and photographs will not be linked with one another in any of the outputs of this project.
  • Your email address will be used for the purposes of communication about the workshop. If you consent, we may contact you after the workshop for feedback, or with further opportunities.
  • Basic, device information, such as phone make and model, method of audio connection (wired/ bluetooth), internet connection will also be collected with the app.

Will you share my data with 3rd parties?

Yes, the final recordings will be sent to BBC, who may post-process the audio as part of the performance for BBC Centenary Concert. They will also have access to participant names and photographs, which may be included in the performance, but not linked together.

Will I be identified in any research outputs?

Personal data, including name, photograph, and voice recording, will not be linked together in any research outputs.

How long will you keep my data? 

  • If provided, names, photos, and voice recordings will not be destroyed and may be made public, but will not be linked together.
  • Age and gender data will be categorised after the workshop and individuals’ data will be destroyed following the end of the project in December 2024.
  • Device information will also be categorised after the workshop and individuals’ data will be destroyed following the end of the project in December 2024.
  • If you consent to further contact, your email address will be retained. Otherwise, email addresses will be destroyed following the end of the project in December 2024.

What rights do I have in relation to my data? 

Under the GDPR, you have a general right of access to your data, a right to rectification, erasure, restriction, objection or portability. You also have a right to withdrawal. Please note, not all rights apply where data is processed purely for research purposes. For further information see the Individuals’ rights webpage.

How do we keep your data secure?

The University is serious about keeping your data secure and protecting your rights to privacy. We don’t ask you for data we don’t need, and only give access to people who need to know. We think about security when planning projects, to make sure they work well. Our IT security team checks regularly to make sure we’re taking the right steps. For more details see our security webpages.

How do we transfer your data safely internationally?

If your data is stored or processed outside the UK, we follow legal requirements to make sure that the same level of privacy rules still apply.

Questions or concerns

If you have any questions about this participant information sheet or concerns about how your data is being processed, please contact project investigators by emailing in the first instance. If you are still dissatisfied, please contact the University’s Data Protection Officer at

Right to complain 

If you are unhappy with the way in which the University has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, see