Privacy Notice

Our lawful basis for obtaining and using your data

Article 6 of the UK GDPR sets out the lawful bases for processing personal information. The following bases apply to the membership activities described below:

The data we collect

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

The information we ask for is used to maintain a record of you as a member, and in some cases also as an office bearer, and to maintain up-to-date contact information.

The information we will process includes:

• Contact details – home and professional
• Exam results with related communications and correspondence
• Continuing Professional Development (CPD) records
• Fellowship proposal information
• Place of work, role, specialty and interest
• Communication preferences
• Subscription fee payment requests

You may also be asked to provide equal opportunities information, so we can promote equality and diversity. This is not mandatory information – if you don’t provide it, it will not affect your status with the College. This information will not be made available to anyone outside of the College in a way which can identify you. Any information you do provide will be used only to produce and monitor equal opportunities statistics.

What we do with your data

We aim to communicate with you about the work that we do in ways that you find relevant, timely and respectful. To do this, we use data that we have stored about you, such as your specialty and interest, the events you have registered for in the recent past, as well as any preferences you may have told us about, to personalise the communications you receive and the on-line services you use. 

For postal marketing, we rely on our legitimate interests in promoting College services and charitable work, subject to your interests and rights. You can object at any time. In the case of email, we will give you an opportunity to opt out of receiving College promotions and newsletters or to choose which you would like to receive through setting your College email communication preferences. You can unsubscribe, update your College email preferences or contact us using the details in this notice. Essential membership service messages are separate from marketing.

We may also contact you by telephone about our work, but we will obtain your express consent before making promotional calls. This does not apply to necessary service calls about your membership subscription, requests for assistance or difficulties contacting you by email.

In additional to promotional communications, we also process personal information in the following ways that are within our legitimate organisational interests:

• We may analyse data we hold about you to ensure that the content and timing of communications we send you are as relevant to you as possible.
• We may analyse website use and interactions with content or advertisements to improve our website, and may tailor social media promotions to your interests.
• To keep membership records up to date, we may check information held by the Federation of Royal Colleges of Physicians in the UK and the General Medical Council (GMC).
• We may analyse data we hold about you in order to identify and prevent fraud.
• Supporting our charitable fundraising activities, including undertaking proportionate fundraising research to ensure our communications are appropriate and relevant.

Card details used to pay your subscription are processed securely through the WorldPay Payment Gateway and are not stored on our website. If you pay by credit or debit card in person, by telephone or by post, we handle the payment securely in accordance with the Payment Card Industry Data Security Standard (PCI DSS). We retain transaction records separately from card details.

When we share your data

Your membership data will not be shared with any external third party other than:

• Where the College has your express consent to do so,
• Where the College has a legal obligation,
• Where sharing with another Royal College is necessary for the membership or professional activities described in this notice, supported by an appropriate lawful basis and a Board-approved intercollegiate data-sharing agreement.
• We may share information with service providers processing it on our behalf and under our instructions, including print and postal mailing providers. Where a provider acts as our processor, we will ensure there is a written contract containing the data protection terms and appropriate security safeguards.
• We may also share limited personal data with specialist third party organisations who carry out fundraising research or analysis on our behalf. These organisations act solely as data processors and must comply with our written instructions and data protection requirements.

How long we keep your data

We retain membership information for as long as necessary to administer your membership. After membership ends your core membership record will be retained permanently for our historical records. Retention of any other information will depend on the type of record and its continuing purpose, including outstanding subscriptions, complaints, legal claims and any justified historical or archival purpose.

We will keep any records relating to financial transactions for a period of seven years.

How you can access your data

To request personal information we hold about you, contact our Membership team using the details below or contact our Data Protection Officer. 

You can contact the Membership Team at memsubs@rcpe.ac.uk

Fellows and Members can make a subject access request under the UK GDPR. Subject to applicable exemptions, we will provide a copy of your personal information and the supplementary information required by law, including:

• A description of what we hold.
• An overview of why we are holding it.
• Details of who it could be disclosed to.
• A copy of your personal information in an appropriate format, normally without undue delay and within one calendar month, subject to the response-period rules explained earlier in this notice.

If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

Our lawful basis for obtaining and using your data

Article 6 of the UK GDPR sets out the lawful bases for processing personal information. The bases below apply where their conditions are met. 

The data we collect

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

We use the information requested to process your application and update your contact details where you are already a member or client. The information we process includes:

• Contact details – home and professional
• Other details to support your:
  • membership application
  • MTI application
  • job application

You may also be asked to provide equal opportunities information to help us promote equality and diversity. Providing it is optional and will not affect your application to the College. We use it only to produce and monitor equal opportunities statistics and do not disclose it outside the College in a form that identifies you. 

What we do with your data

Your data will be used for the purposes of processing your application and any additional information about the use of your data will be given with the application form. If you agreed to receiving promotional communications from us it will be used for these purposes.

Card details used to pay for your application are processed securely through the WorldPay Payment Gateway and are not stored on our website. If you pay by credit or debit card in person, by telephone or by post, we handle the payment securely in accordance with the Payment Card Industry Data Security Standard (PCI DSS). We retain transaction records separately from card details.

When we share your data

We may share application information with external recipients only in the following circumstances:

• Where the College has your express consent to do so,
• Where the College has a legal obligation,
• Where sharing with another Royal College is necessary for the application process described in this notice, supported by an appropriate lawful basis and a Board-approved intercollegiate data-sharing agreement.
• We may share information with service providers processing it on our behalf and under our instructions, including print and postal mailing providers. Where a provider acts as our processor, we require a written contract and appropriate security safeguards.

How long we keep your data

We retain application information for as long as necessary to assess the application and deal with related enquiries, reviews, complaints or legal claims. Successful applicants’ information is transferred to the relevant internal system and retained according to the purposes of that system. We will retain applications for unsuccessful applicants for a period that allows for re-submission of applications

We will keep any records relating to financial transactions for a period of seven years.

How you can access your data

To request personal information we hold about you, contact the team handling your application or our Data Protection Officer. For membership applications, use the Membership team details below.

You can contact the Membership Team at membersupport@rcpe.ac.uk

Applicants can make a subject access request under the UK GDPR. Subject to applicable exemptions, we will provide a copy of your personal information and the supplementary information required by law, including:

• A description of what we hold.
• An overview of why we are holding it.
• Details of who it could be disclosed to.
• A copy of your personal information in an appropriate format, normally without undue delay and within one calendar month, subject to the response-period rules explained earlier in this notice

If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

We need to store examiner information to allow us to organise exams and to provide you with relevant and timely information about the examinations that we deliver. 

Our lawful basis for obtaining and using Examiner data

Article 6 of the UK GDPR sets out the lawful bases for processing personal information. The following bases apply to the examiner activities described below:

The data we collect

We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

The information we ask for is used to maintain a record of you as an examiner, and to maintain up-to-date contact information.

The information we will process includes:

• Name
• Professional and/or home address
• Specialty
• Telephone number(s)
• Email address(es)
• GMC number
• Examiner number
• Fellowship/Membership of RCPE, RCPL, RCPSG
• Questions as required by MRCP(UK) Central Office for census / compliance purposes

What we do with Examiner data

We use your data to:

• Contact you about exams
• Allocate you your chosen PACES centre(s) and record your examining activity
• Assist with your accommodation requirements
• Process any legitimate expense claims in relation to your examining commitment
• Provide the relevant centre/Host Examiner with your details and any special requirements/assistance that you might need
• Inform MRCP(UK) Central Office of compliance responses and any other relevant information in relation to examining.

In addition to examination-related emails, we process personal information for the following purposes, subject to an appropriate lawful basis and any applicable consent requirements:

• We may analyse data we hold about you to ensure that the content and timing of communications we send you are as relevant to you as possible.
• We may analyse website use and interactions with content or advertisements to improve our website, and may tailor social media promotions to your interests.
• To keep examiner records up to date, we may check information held by the Federation of Royal Colleges of Physicians in the UK and the GMC.

When we share Examiner data

We share examiner information where necessary to organise and deliver examinations, supported by an appropriate lawful basis. Recipients include the administrative teams at RCPL, RCPSG and MRCP (UK) Central Office, and host examiners and examination administration teams. We may also share information where legally required or with your consent. We limit the information shared to what is necessary for the purpose.

The information shared may include:

• Name
• Professional address
• Specialty
• Telephone number(s)
• Email address(es)
• GMC number
• Examiner number
• Fellowship/Membership of RCPE, RCPL, RCPSG

To deliver examination services, we may share information with service providers processing it on our behalf and under our instructions, including print and postal mailing providers. Where a provider acts as our processor, we require a written contract and appropriate security safeguards.

How long we keep Examiner data

We retain your personal information and examining record while you examine for us and retain relevant records for seven years after your examining activity ends, and a subset of this data thereafter.  

How you can access your Examiner data

To make a request for any personal information we may hold, you should contact the College Examinations team at the details provided below.

You can contact the RCPE Examinations team on 0131 247 3612 (open Monday-Friday, 9am-5pm UK time)

Examiners can make a subject access request under the UK GDPR through the Examinations team or our Data Protection Officer. Subject to applicable exemptions, we will:

• Give you a description of it.
• Tell you why we are holding it.
• Tell you who it could be disclosed to.
• Provide a copy of your personal information in an appropriate format, normally without undue delay and within one calendar month.

If you agree, our Examinations team will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

Purpose

We are committed to protecting your personal information and being transparent about any information we hold about you.

Using personal information allows us to develop a better understanding of our customers and to provide you with relevant and timely information about the work we do.

This statement explains how we collect and use the information we receive from you.

The lawful basis for obtaining and using your data

Article 6 of the UK GDPR sets out the lawful bases for processing personal information. The following bases apply to the conference, training and event activities described below:

The data we collect

We collect and process information when you book an event through this website, in person, by telephone, by email or in writing. This may include your name, email address, postal address and telephone number. Card details are processed through a secure payment service, and any temporary payment information is handled and securely disposed of in accordance with applicable security requirements. We retain event registration and transaction records separately for the purposes and periods described below.

We keep a record of mailings sent to you. Email services may also record opens and link clicks, and website technologies within our website and Education Portal may record interactions with our content. 

We occasionally receive information about you from third parties. For example, when an RCPE event is taking place at an external venue and where an appropriate data sharing agreement is in place.

What do we do with your data?

We aim to communicate with you about the work that we do in ways that you find relevant, timely and respectful. To do this we use data that we have stored about you, such as which events you have booked to attend in the past, as well as any preferences you may have told us about.

We use our legitimate organisational interest as the legal basis for communications by post and email. In the case of postal mailings, you may object to receiving these at any time using the contact details at the end of this policy. In the case of email, we will give you an opportunity to opt in to receiving them during your first purchase with us. We will provide you with an option to unsubscribe or change your preferences in every email we send you. Alternatively you can use the contact details at the end of this policy.

We may contact you by telephone about our work, but we will obtain your express consent before making promotional calls. This does not apply to necessary service calls about events you are attending or related payment arrangements.

Other processing activities

In addition to marketing communications, we also process personal information in the following ways that are within our legitimate organisational interests:

• We may analyse data we hold about you to ensure that the content and timing of communications that we send are as relevant to you as possible.
• We may analyse website use and interactions with content or advertisements to improve our website or Education Portal, and may tailor social media promotions to your interests. 
• To ensure membership records are up to date, we will share data with the the College Membership team.
• For the smooth running of events, we may share data with front-of-house staff.
• We may analyse data we hold about you in order to identify and prevent fraud.
• Supporting our charitable fundraising activities, including undertaking proportionate fundraising research to ensure our communications are appropriate and relevant.

Card details used to pay for an event through Eventbrite are processed securely through its payment arrangements and are not stored on this website. If you pay by credit or debit card in person, by telephone or by post, we handle the payment securely in accordance with the Payment Card Industry Data Security Standard (PCI DSS). We retain transaction records separately from card details.

When we share your data

In addition to the service providers and fundraising research processors described below, we may share personal details and event registration information with external recipients in the following circumstances:

• Where the College has your express consent to do so,
• Where the College has a legal obligation,
• We may share information with service providers processing it on our behalf and under our instructions, including print and postal mailing providers. Where a provider acts as our processor, we require a written contract and appropriate security safeguards.
• We may also share limited personal data with specialist third party organisations who carry out fundraising research or analysis on our behalf. These organisations act solely as data processors and must comply with our written instructions and data protection requirements.

How long we keep your data

We retain event registration and customer information only for as long as necessary to administer bookings, provide related services and deal with enquiries, complaints or legal claims. Retention depends on the record type, the date of the event, our continuing relationship with you and any legal requirements. We retain financial transaction records for seven years. 

How you can access your data

To access booking and payment information held in your Eventbrite account, visit the Eventbrite website. College members can also update their preferences on our main website. You can request personal information held by the College by contacting us or our Data Protection Officer; your rights and the applicable response periods are explained earlier in this notice.

Alternatively, you can contact the College on +44 (0)131 247 3600 (open Mondays-Fridays, 9am-5pm).

What can you do if you want to complain about how your data is being used?

The College greatly values the relationship it has with its customers and aims to resolve any issues relating to data protection informally, efficiently and amicably. We will respond quickly to any requests to change your preferences, correct errors with the data we hold, provide access to your data or, if necessary, erase your data.

If you have concerns about how we use your information, contact our Data Protection Officer using the details earlier in this notice. The complaints arrangements described there apply to event customers too, including your right to complain to the Information Commission (ICO).

As a registered charity, the Royal College of Physicians of Edinburgh (RCPE) undertakes fundraising activities to support our educational, professional and public benefit work. To ensure our fundraising is effective, proportionate and relevant, we may carry out fundraising research. This helps us understand the interests and potential capacity of individuals who may wish to support our charitable aims.

We may engage carefully selected third party organisations to carry out screening or analysis on our behalf. These organisations act strictly under our instructions, are contractually bound to protect your information, and are not permitted to use your data for their own purposes. We only share the minimum data necessary for them to provide the service.

We rely on legitimate interests as our lawful basis for this activity. We have assessed that this processing is necessary to support our charitable objectives and that it does not unduly impact your rights or interests. You may opt out of fundraising research or fundraising communications at any time by contacting us using the details provided in this notice.