Privacy Policy

1. Overview

This notice (“Notice”) relates to all individuals whose personal data is processed by the PACE Partners and tells you what to expect the PACE Partners to do with your personal data when you contact us or engage with the PACE Programme.

2. Who we are and how to contact us

The PACE Programme; a translational programme in anti-microbial resistance (“AMR”) research delivered in collaboration by LifeArc, Innovate UK and Medicines Discovery Catapult (“the PACE Partners”) (the “PACE Programme”). [The full name of the PACE Programme is PACE (Pathways to Antimicrobial Clinical Efficacy)].

The details of the PACE Partners are as follows:

• LIFEARC, a company limited by guarantee incorporated in England and Wales (company number 02698321) and registered charity (charity number 1015243 and SC037861) whose registered office is at Lynton House, 7-12 Tavistock Square, London WC1H 9LT (“LifeArc”);
• MEDICINES DISCOVERY CATAPULT LIMITED, a company limited by guarantee incorporated in England and Wales (company number 09928547) whose registered office is at Block 35g, Mereside Alderley Park, Alderley Edge, Macclesfield, Cheshire, England, SK10 4ZF (“MDC”); and
• INNOVATE UK, part of UK RESEARCH AND INNOVATION, an executive non-departmental public body established by the Higher Education and Research Act 2017 and sponsored by the Department for Science, Innovation and Technology, whose principal office is at Polaris House, North Star Avenue, Swindon, SN2 1FL (“IUK”).

The PACE Programme aims to bring together the AMR medicines and diagnostics R&D sector to help innovators with early-stage antimicrobial and diagnostics proposals to move forward with greater speed and confidence, ultimately accelerating the delivery of new innovations to tackle anti-microbial resistance.

For data protection purposes, the PACE Partners are “joint controllers”, this means that we are all jointly responsible for determining how and why your personal data is collected, used and otherwise processed, and we are all responsible for protecting your information. We have set out our roles and responsibilities in relation to data protection in agreements between us. For example:

2.1 PACE Partners are bound to specific obligations in relation to data protection under a 2023 PACE Agreement for the duration of the relevant data processing as joint controllers.

2.2 PACE Partners work to high standards when it comes to processing personal data and will comply with applicable legislation, including the UK GDPR and the UK Data Protection Act 2018.

You can contact us via phone, email, and post:

• Name: MDC Data Protection Representative
• Address: Block 35G, Mereside, Alderley Park, Alderley Edge, Macclesfield, Cheshire, England, SK10 4ZF
• Phone number: 01625 238734
• Email address: compliance@paceamr.org.uk
• Telephone number: +44 (0) 2073912700

Please note that for the purpose of maintaining this Notice, the MDC Data Protection Representative is the owner of this document and will lead on the receipt of enquiries and Data Subject Rights requests that you might have, including reporting these enquiries and requests to the joint data controllers. MDC will also lead on providing responses to you on behalf of the PACE Partners.

3. What information we may collect from you and how we collect and process your personal data

This Notice tells you how we, the PACE Partners, will collect and use your personal data for the PACE Programme, including the identification and support of projects aimed at tackling AMR through engagement across the AMR community. Personal data is any information that relates to an individual. It does not include information where the identity of the individual has been fully and effectively removed (anonymous data).

3.1 In order for us to deliver the aims of the PACE Programme we need to collect personal data for correspondence purposes, understanding the scope of a project to make relevant introductions for the purpose of funding and application assessments and reviews and other related administrative tasks. In any event, we are committed to ensuring that the information we collect and process is appropriate for this purpose.

3.2 All personal data will be processed by the PACE Programme in line with the data protection principles.

3.3 The personal data we will collect from/process about you are:

4. Why we use your personal data and lawful bases

The personal data we collect will be used for the following purposes:

• to review enquiries from Third Parties and determine whether an enquiry is in scope for further engagement with the PACE Programme;
• to fulfil our obligations, as PACE Partners, around assessing enquiries and facilitating introductions, in accordance with the aims of the PACE Programme;
• to fulfil our obligations around assessing applications and engaging reviewers in accordance with relevant terms and conditions;
• to communicate with all relevant parties involved within a funded project under the wider programme in all available formats;
• to fulfil legal, financial, tax and regulatory reporting and record-keeping requirements and obligations that apply to MDC, LifeArc and IUK;
• to inform PACE Programme management and governance regarding all funding applications, support decision-making processes, provide project collaboration and support and fulfil MDC’s role as the liaison hub for the PACE Programme;

We will only use personal data when the law allows us to (i.e. where we have a ‘lawful basis’). Our legal basis for processing the personal data is:

• Contractual Necessity: processing is necessary for the performance of a contract that we enter into with you or in order to take steps at your request prior to entering into a contract;
• Legitimate Interests: processing may be necessary for the purpose of the legitimate interests pursued by the PACE Programme or by a relevant third party, and with the assurance that such interests will not override your fundamental rights and freedoms. For example, the PACE Partners have a legitimate interest in pursuing the aims of the PACE Programme as part of our work;
• Public Task: The lawful basis Innovate UK as part of UKRI use to process personal data relating to research and funding innovation applications and awards is primarily public task. UKRIs public task is laid out in the Higher Education Research Act (2017); and
• Explicit Consent: UK data protection law recognises that certain categories of personal data are more sensitive. This is known as ‘special category data’ and covers health information. When third parties make an enquiry to the PACE Programme or request news about the PACE Programme, we will ask whether you have lived experience of AMR. You do not have to provide this information if you do not wish to do so. We hold this information on our database so that we can evaluate how we are engaging with the different elements of our community to help connect you with news, events and collaboration opportunities that may be relevant to you. If we want to collect this information from you directly, we will only do so with your specific consent. Innovate UK will not process identifiable special category data.

5. Sharing your personal data

5.1 We will pass your personal data on to the relevant PACE Partner, or member of the PACE Programme governance, and any relevant third-party service providers contracted by MDC in the course of dealing with your enquiry, funding application, subsequent funded project or participation in a PACE Programme project or event.

5.2 Any third parties that we share your data with are obliged to keep your details securely and to use them only to fulfil the outlined programme purpose, in accordance with the relevant data sharing agreements put in place, or to fulfil the service they provide you on our behalf. When they no longer need your data to fulfil this service, they will dispose of the details in line with either (a) the procedure we have set out for them (if they are processing your personal data on our behalf) or (b) their own retention schedules, per their listed privacy notice/policy.

5.3 The following third parties will receive your personal data for the following purpose(s) as part of usual processing activities. However, please note that we may share your personal data with other third parties in accordance with the categories of organisations set out in 5.1-5.2 above in some circumstances.

We may also share your personal data with third parties in the following circumstances:

• as part of a sale, merger or acquisition, or other transfer of all or part of our assets including as part of a bankruptcy proceeding;
• pursuant to a subpoena, court order, or other legal process or as otherwise required or requested by law, regulation, or government authority programs, or to protect our rights or the rights or safety of third parties;
• with our professional advisors, lawyers, accountants and auditors; or
• with your consent or as otherwise disclosed at the time of data collection or sharing.

6. Data Retention

6.1 The PACE Partners will process personal data for the PACE Programme for as long as required for the purpose of delivering the PACE Programme and the obligations of the PACE Partners under the PACE Agreement].

6.2 Records will be stored in our CRM until the end of the five-year term of the PACE Programme. At this point, your personal details will be deleted from the CRM system unless the PACE Programme is extended.

6.3 Applications to the call for projects will be kept for the duration of the funding call and for the duration of the 5-year term of the PACE Programme. After this time applicants’ data will be deleted.

6.4 Records associated with approved research projects will be kept for the duration of the five-year term of the PACE Programme and for 6 years following the end of the PACE Programme. After this time research project data will be deleted.

6.5 We are required to retain some personal data in accordance with the law, such as information needed for tax and audit purposes. How long certain kinds of personal data should be kept may also be governed by specific business-sector requirements and agreed practices. Personal data will be held in addition to these periods depending on individual business needs and only where an appropriate lawful basis exists to do so.

6.6 Should you wish a copy of our ‘Retention Schedule’, please use the contact details in section 2 of this Privacy Notice. For the retention policies and schedules of the PACE Partners, you should review their own individual privacy notices to understand how they will retain and delete your personal data.

7. International Data Transfers

Your personal data may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).

Specifically, our headquarters and website servers are located in the United Kingdom, and some of our third-party service providers and partners operate around the world. This means that when we collect your personal data, we may process it in any of these countries.

However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Privacy Notice. Before transferring personal information outside of the EAA, we will ensure an international data transfer safeguard mechanism is in place.

8. Your rights as a Data Subject

8.1 At any point while we are in possession of or processing your personal data, you (the data subject) have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you (please see section 9 below for further details).
• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten – in certain circumstances, you can ask for the data we hold about you to be erased from our records, in line with the MDC Subject Rights Policy.
• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.
• Right of portability – in some circumstances you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to certain types of processing such as direct marketing.
• Right to object to automated processing, including profiling – you also have the right not to be subject to the legal effects of automated processing or profiling.
• Right to withdraw consent – whenever we rely on your consent to collect and/or otherwise use your personal data (whether in the context of marketing, your special category data or any other reason), you have the right to withdraw that consent at any time.
• Right to judicial review – in the event that MDC refuses your request under ‘right of access’, we will provide you with a reason why we have refused some or all of your request(s). You have the right to complain as outlined in clause 8 below.
  • All of the above requests that we receive will be forwarded to IUK, LifeArc and any other third party if they are involved (as stated in .5.3 above) in the processing of your personal data.

9. Subject Access Requests

At your request, MDC, on behalf of the PACE Partners, can confirm what information we each hold about you and how it is processed (subject to any exemptions or legal requirements that may be applicable). We treat our responsibilities for data privacy very seriously and will ensure we take all reasonable steps to correctly identify anyone submitting a subject access request to our business, per our Data Subject Access Request Procedure. Should you wish a copy of this procedure, please contact the Data Protection Representative using the details in section 2 above.

10. Complaints

In the event that you wish to make a complaint about how your personal data is being processed by the PACE Partners (or third parties as described in section 5 above), or how a complaint you have made to us in relation to this processing has been handled, you have the right to lodge a complaint directly with the relevant data protection supervisory authority and where applicable, MDC’s Data Protection Representative as outlined in 2 above who shall report the complaint to the joint data controllers.

The details for the relevant supervisory authority are:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number
Fax: 01625 524 510
Website: ico.org.uk