Privacy Policy

Accelerating Clinical Trials Ltd (ACT) is a Clinical Research Organisation specialising in blood cancer studies. We are registered with the Information Commissioners Office as a Data Controller, registration number ZB505572. 

Accelerating Clinical Trials Limited (“ACT”, “we”, “us”, “our”) is the data controller responsible for the personal data described in this Privacy Notice.

Our registered business address is: 48 Chancery Lane, London, WC2A 1JF

This privacy notice is addressed to any identified or identifiable natural person, all customers, vendors, suppliers, contact persons, and other individuals (“Data Subjects”, “you”) of or in contact with ACT.It is meant to help you understand what personal data we collect, why we collect it, and how you can exercise your data protection rights. “Personal Data” in this document is any information relating to an identified or identifiable natural person, by direct or indirect means. This can sometimes be called “personally identifiable information”.

You might have been provided with a privacy notice or contract to you for a specific purpose. If that is the case, the terms of the notice or contract will control your interaction with ACT, to the extent that such notice or contract conflicts with this notice.

We take your data privacy and the protection of your personal data seriously and we are committed to the highest data privacy standards, patient confidentiality and adherence to the Data Protection Act 2018 and UK GDPR. We adopt the core principles of data protection:

  1. Lawfulness, fairness and transparency– we process personal data lawfully, fairly and in a transparent manner in relation to you, the data subject.
  2. Purpose limitation– we only collect personal data for a specific, explicit and legitimate purpose. We clearly state what this purpose is in this Privacy Notice, and we only collect data for as long as necessary to complete that purpose.
  3. Data minimisation– we ensure that personal data we process is adequate, relevant and limited to what is necessary in relation to the processing purpose.
  4. Accuracy– we take every reasonable step to update or remove data that is inaccurate or incomplete. You have the right to request that we erase or rectify erroneous data that relates to you, and we will complete this task as soon as possible but guarantee to do so within a month.
  5. Storage limitation– we delete personal data when we no longer need it. Whilst the timescales in most cases aren’t set, we outline our retention strategy within this Privacy Notice.
  6. Integrity and confidentiality– we keep personal data safe and protected against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

The Personal Data that We Collect

  1. Website Visitors
  • We may collect information from individuals who visit our website, such as IP address and geographic location. We also may collect Personal Data from individuals who voluntarily submit enquiries on our website.
  • The purpose of collecting and processing this Personal Data is our legitimate business interests.
  • For individuals who choose to contact us and provide us with their Personal Data, we will collect and use their Personal Data to respond to them, to provide them with information that they have requested (which may relate to our products or services), or to communicate with them for other purposes which are requested by them in their enquiry. Other purposes may include, from time to time, monitoring our regulatory compliance.
  • We may disclose Personal Data within our company and with associates, or contractors when it is necessary for them to have access to complete their assigned responsibilities or provide their contracted services, all of whom agree to treat it in accordance with this Privacy Policy.
  • Information collected as referenced above will be retained for no longer than 12 months.
  1. Personal Data of Clinical Trial Participants
  • If you are a participant in a clinical trial or other study managed by ACT more information about how your Personal Data will be collected, used and stored has been provided in the participant information sheet you were given when you joined the study. Please refer to this for further details, a copy can be provided by your study doctor and/or clinical trial site staff.
  1. Personal Data of Investigators, Clinical Trial Location Staff and third parties
  • We collect Personal Data from parties that do business with us, which may include the investigators and clinical trial location staff before, during, and after a clinical trial. The Personal Data that is collected is your contact information
  • Contact details described above, collected during the conduct of a clinical trial may be stored and used to inform you of future projects, services, or events that we believe may be of interest to you. The data collected for these purposes will be limited to only what is necessary. We rely on legitimate interests as the lawful basis for this processing under data protection law. This means we only send you communications that relate to similar professional research contexts, and we balance our interests with your rights and privacy. When we send you electronic communications, we will always include a clear and simple way to opt out of future messages (for example, contact details). You can exercise your right to object to this communication, and we will respect your choice and update our records accordingly.
  • We collect Personal Data from vendors and business partners before, during, and after a clinical trial. We may also collect Personal Data of vendors and business partners who conduct business with us that is not related to a clinical trial. We collect the Personal Data of our vendors and business partners to fulfil our contractual obligations to said vendors and business partners and to serve our legitimate business interests.
  1. Conducting Clinical Trials
  • We retain Personal Data for as long as necessary for the purposes described above. We will retain different categories of Personal Data for different periods of time depending on the category of individual to whom the Personal Data relates, the type of Personal Data, the purposes for which we collected the Personal Data, and any legal or regulatory retention requirements with respect to the Personal Data.
  • We do not engage in automated decision-making using Personal Data.
  1. Recruitment Candidates
  • In connection with your application for work with us, we will collect, store, and use the following categories of personal information about you:
  • The information you have provided to us in your curriculum vitae (CV) and any covering letter
  • The information you have provided upon application, if applicable, including name, title, address, telephone number, personal email address, date of birth, gender, employment history, qualifications, training
  • Any information you provide to us during an interview
  • Information about your right to work in the United Kingdom
  • We may also collect, store, and use the following types of more sensitive personal information:
  • Information about your health, including any medical condition, health, and sickness records
  • We collect personal information about candidates from the following sources:
  • You, the candidate
  • Your named referees, from whom we collect the following categories of data:
  • Information about your competencies and experience levels
  • We will use the personal information we collect about you to:
  • Assess your skills, qualifications, and suitability for the role
  • Carry out background and reference checks, where applicable
  • Communicate with you about the recruitment process
  • Keep records related to our hiring processes
  • Comply with legal or regulatory requirements
  • Having received your CV and any covering letter, we will then process that information to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will decide whether your application is strong enough to invite you for an interview. If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then take up references. The lawful basis we rely on for processing your personal data is article 6(1)(b) of the UK GDPR, which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract.
  • The lawful basis we rely on to process any information you provide as part of your application which is special category data, such as health information is article 9(2)(b) of the UK GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights. And Schedule 1 part 1(1) of the DPA2018 which again relates to processing for employment purposes.
  • If you provide us with any information about reasonable adjustments, you require under the Equality Act 2010 the lawful basis we rely on for processing this information is article 6(1)(c) to comply with our legal obligations under the Act.
  • If you are unsuccessful after assessment for the role, we may ask if you would like your details retained in our talent pool. If you say yes, we will proactively contact you should any further suitable vacancies arise. You have the right to withdraw your consent for processing for this purpose at any time. To withdraw your consent, please see the section on how to exercise your rights. Once we have received notification that you have withdrawn your consent, we will remove you from our talent pool.
  • If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, references for this role and you fail to provide us with relevant details, we will not be able to take your application further.
  • We will use your particularly sensitive personal information in the following ways:
  • We will use information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview
  • We may use information about your race or national or ethnic origin, religious beliefs, sex, gender and disability to ensure meaningful equal opportunity monitoring and reporting
    • We may only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and provided, we do so in line with data protection regulations.
    • We will only collect information about criminal convictions if it is appropriate given the nature of the role and where we are legally able to do so.
    • We will retain your personal information for a period of 12 months after we have communicated to you our decision about whether to appoint you to the role. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with our data retention policy.
    • If we wish to retain your personal information in our Talent Pool, on the basis that a further opportunity may arise in future and we may wish to consider you for that, we will contact you separately, seeking your explicit consent to retain your personal information for a two-year period on that basis.
    • We will only share your personal information with the following third parties for the purposes of processing your application:
  • A nominated Recruitment Agency, if applicable
  • Outsourced HR provider
  • IT provider
    • All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
  1. Use of Cookies

For our website to function properly we use cookies. To obtain your valid consent for the use and storage of cookies in the browser you use to access our website and to properly document this we use a consent management platform: CookieFirst. This technology is provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH, Amsterdam, The Netherlands. Website: https://cookiefirst.com referred to as CookieFirst.

When you access our website, a connection is established with CookieFirst’s server to give us the possibility to obtain valid consent from you to the use of certain cookies. CookieFirst then stores a cookie in your browser in order to be able to activate only those cookies to which you have consented and to properly document this. The data processed is stored until the predefined storage period expires or you request to delete the data. Certain mandatory legal storage periods may apply notwithstanding the aforementioned.

CookieFirst is used to obtain the legally required consent for the use of cookies. The legal basis for this is article 6(1)(c) of the General Data Protection Regulation (GDPR).

  1. Sharing of Personal Data

Your personal data will only be shared with our own staff, associates, or contractors when it is necessary for them to have access to complete their assigned responsibilities or provide their contracted services. Sharing of your data will be relative to the nature of our engagement with you.

We utilise the services of other organisations who are critical for the provision of our service to you and will be viewed as data processors. Their access is restricted, and they are contractually bound to strict confidentiality and the protection of your personal data.

There may also be legal obligations under which we have to share data as requested by nationally recognised regulators or authorities.

Transferring information outside the UK

Our operations are based in the UK, and your personal information is generally processed within the UK and countries within the European Economic Area (EEA). In some instances, we may transfer your personal information to third countries, for example, where our suppliers or cloud service providers are situated outside the UK and EEA.

If the recipient is situated in a third country that has not received an adequacy decision from the relevant regulator, we will ensure additional safeguards are in place including the use of applicable standard contractual clauses. To obtain a copy of these standard contractual clauses, please contact actdpo@clinicaldpo.com.

  1. Securing and Processing of your Personal Data

We employ physical, electronic, and administrative measures that are designed to protect your Personal Data from loss, misuse and unauthorised access, disclosure, alteration, and destruction.

We undertake regular reviews of our processing activities, their risks and technical and organisational measures in place to ensure that the integrity and confidentiality of your data is protected.

In the unlikely event that we lose your data, or a device on which your data resides, or it is accessed by someone unauthorised, and we identify a risk to your rights and freedoms, we will report this to the Information Commissioner’s Office (ICO), who are responsible for regulating data protection legislation in the UK. Where the loss or unauthorised access of your data has potential to cause you harm we will notify you without undue delay.

How to contact us?

For all data protection matters or questions relating to how we manage your data, or if you are concerned about how your data is being handled, you can contact our

Data Protection Officer:

Data Protection Officer: Clinical DPO

Phone Number: 0203 411 2848

Email: actdpo@clinicaldpo.com

For complaints, please include the following where possible:

  • Your name and contact information.
  • A description of your concern or the data protection issue.
  • Any relevant supporting information.

Complaints will be acknowledged within 30 days. We aim to fully respond and resolve the matter without undue delay. If your issue requires more time or clarification, we will keep you informed throughout.

If you are dissatisfied in how we have handled your data, you have the right to complain to the UK Information Commissioner’s Office (ICO):

  • Website: https://ico.org.uk/make-a-complaint/
  • Phone: 0303 123 1113
  • Address: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Rights of access, correction, erasure, and restriction

Your rights in connection with personal information

Under UK data protection law, you have following rights:

Right Explanation
Right to be Informed This means that we must be transparent in how we collect and use your personal data
Right of Access You have the right to access your personal data
Right to Rectification If the information we hold about you is inaccurate or incomplete, you can request that we correct this
Right to Erasure You can request that we delete or remove personal data in certain circumstances
Right to Restrict Processing You have the right to request that we cease processing your data if.

  • you consider it inaccurate or incomplete and/or
  • you object to the reason we’re processing your data

We will review the validity of your request and respond to you with our decision
Right to Data Portability Where you have consented to our processing your data or where the processing is necessary for us to deliver a contract you can request a copy of that data be provided to a third party
Right to Object You have the right to object to our processing in certain circumstances and an absolute right to object to direct marketing.
Rights relating to Automated Decision-Making including Profiling We do not use automated decision-making or profiling.

Consent to the use of cookies.

For our website to function properly we use cookies. To obtain your valid consent for the use and storage of cookies in the browser you use to access our website and to properly document this we use a consent management platform: CookieFirst. This technology is provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH, Amsterdam, The Netherlands. Website: https://cookiefirst.com referred to as CookieFirst.

When you access our website, a connection is established with CookieFirst’s server to give us the possibility to obtain valid consent from you to the use of certain cookies. CookieFirst then stores a cookie in your browser in order to be able to activate only those cookies to which you have consented and to properly document this. The data processed is stored until the predefined storage period expires or you request to delete the data. Certain mandatory legal storage periods may apply notwithstanding the aforementioned.

CookieFirst is used to obtain the legally required consent for the use of cookies. The legal basis for this is article 6(1)(c) of the General Data Protection Regulation (GDPR).

Data processing agreement

We have concluded a data processing agreement with CookieFirst. This is a contract required by data protection law, which ensures that data of our website visitors is only processed in accordance with our instructions and in compliance with the GDPR.

Server log files

Our website and CookieFirst automatically collect and store information in so-called server log files, which your browser automatically transmits to us. The following data is collected:

  • Your consent status or the withdrawal of consent
  • Your anonymised IP address
  • Information about your Browser
  • Information about your Device
  • The date and time you have visited our website
  • The webpage url where you saved or updated your consent preferences
  • The approximate location of the user that saved their consent preference
  • A universally unique identifier (UUID) of the website visitor that clicked the cookie banner