lowRISC C.I.C. Privacy Notice

Our contact details

The type of personal information we collect

We currently collect and process the following information:

• Personal identifiers, names and contact details (for example, email addresses, postal addresses and phone numbers)

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• You have joined a project that is administered by lowRISC
• You have joined a group or mailing list that is administered by lowRISC
• You have contacted lowRISC with an enquiry
• You are doing business with lowRISC

We may also receive personal information indirectly, from the following sources in the following scenarios:

• The organisation that employs you has provided your contact details for one of the above reasons
• Third party tools, such as GitHub, Slack, Zulip or JazzHR, where you have an account and used this for one of the above reasons

We use the information that you have given us in order to:

• Administer the project, group or mailing list
• Communicate with you concerning one of the above reasons
• Do business with you

We may also share this information with:

• Other people that have also joined the same project, group or mailing list as you and that is administered by lowRISC

Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing this information are:

a. Your consent. You are able to remove your consent at any time. You can do this by contacting lowRISC using the contact details provided at the beginning of this document b. We have a legitimate interest

How we store your personal information

Your information is securely stored.

We will dispose of your information by removing your Personal Identifiers from the files and/or systems we use:

• within one month of your request for erasure or
• we will retain your Personal Identifiers for as long as is necessary to fulfil the purposes we collected them for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Where you have signed up for a service provided by a third party you should contact the third party to have your Personal Identifiers erased.

We may use cloud based systems provided by third parties to store your Personal Identifiers such as Google Workspace, Google Cloud, Azure DevOps, GitHub, Slack, Zulip, Jira, Xero or JazzHR.

Your data protection rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at the contact details in the Our Contact Details section if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at the contact details in the Our Contact Details section.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk