Privacy Notice

Controller and legal identity

UK ACADEMY OF ARTS AND SCIENCES, company number 17399439, is the controller of the personal data described in this Notice. The company is registered in England and Wales and uses The UK Academy of Arts & Sciences (“UKAAS”) as its public-facing name. Its registered office is 128 City Road, London, United Kingdom, EC1V 2NX.

Data-protection enquiries, rights requests and complaints may be sent to contact@ukaas.org or by post to the registered office, marked “Data Protection”. UKAAS has not appointed a statutory Data Protection Officer. Responsibility remains with the company as controller.

Scope and related notices

This Notice applies to the UKAAS website, Membership and Events account, Community applications, Member and Fellow records, Honorary Fellowship nominations and invitations, public status verification, events, enquiries, complaints and associated administration.

A form, event, assessment exercise or third-party service may contain a more specific notice. That notice supplements this document for the stated activity. Employment, supplier and governance records are governed by separate notices where appropriate.

UKAAS Community routes are intended for adults aged 18 or over. UKAAS does not knowingly offer an account or paid Community status to a child. If information about a child is submitted in error, contact UKAAS promptly.

Where personal data comes from

Where UKAAS receives personal data about you from someone else, it will provide the information required by Article 14 UK GDPR within the applicable period—normally within one month, at first communication or before disclosure—unless a lawful exception applies. A nominator must not submit information obtained unlawfully or material irrelevant to the nomination.

• Directly from you when you create an account, apply, pay, attend, correspond, exercise a right or set a preference.
• From Google or Microsoft when you deliberately use that provider to sign in.
• From an authorised nominator, Academy officer or referee in an Honorary Fellowship or other authorised nomination process.
• From assessors, committee members, event partners, payment and service providers acting within their authorised role.
• From professional registers, institutional pages, publications, Companies House and other proportionate public sources used to verify an application, distinction or claim.

Account holders and website users

An account is an access record. It does not itself confer Membership, Fellowship, Honorary Fellowship, an award, a qualification or any right to use a post-nominal.

• Name, verified email address, country, preferred name and contact details.
• Account identifier, authentication provider, sign-in timestamps, recovery events, consent records and security history.
• IP address, device, browser, requested pages, server and security logs, and strictly necessary storage identifiers.
• Communication, accessibility, marketing and directory choices kept separately wherever the choice has a different purpose.

Google and Microsoft sign-in

If you select Google or Microsoft sign-in, that provider authenticates you and sends UKAAS the authorised account data required to create or locate your UKAAS account. This normally comprises a provider identifier, verified email address, name and, where made available, a profile image. UKAAS does not receive or store your Google or Microsoft password.

Google and Microsoft process the authentication interaction under their own terms and privacy notices. UKAAS records the provider used and the resulting account event for contract administration, access control, fraud prevention and security. Removing UKAAS from a provider account does not automatically erase the corresponding UKAAS record; account closure and erasure requests remain subject to this Notice and applicable retention duties.

Member applicants and Members

Member information is used to take steps at the applicant's request, form and administer the membership contract, verify eligibility, collect the published subscription, supply benefits, maintain an accurate register and prevent misuse.

• Selected category, eligibility declaration, age confirmation, current study, career or retirement information relevant to that category, and supporting evidence requested for a reduced fee.
• Accepted terms version, subscription period, price, payment status, renewal choice, cancellation record and transaction reference.
• Membership status, start and end dates, administrative correspondence, benefits used and any category correction.
• Public directory fields only where the Member has actively opted in; Member directory visibility is private by default.

Fellow applicants, Fellows and assessors

Assessment is evidence-based and requires human judgment. Application material is disclosed only to authorised staff, assessors and decision-makers who need it. Assessors must observe confidentiality, declare conflicts and use the material only for the assigned assessment.

Data-protection rights do not create an unrestricted right to obtain confidential references, another person's identity, legally privileged material or information whose disclosure would prejudice the rights of others. Each request is assessed under the UK GDPR and Data Protection Act 2018; an exemption is used only where legally available and proportionate.

• Identity, contact details, principal field, career history, qualifications, appointments, publications, practice, achievements and evidence of impact.
• Declarations concerning accuracy, professional standing, conflicts, sanctions, conduct and lawful use of submitted material.
• Assessment allocation, conflict checks, assessor notes, committee records, outcome, reasons, review or appeal material and audit history.
• For approved Fellows: status, admission date, Fellowship route, use of FAAS(UK), renewal or Life status, and the minimum public verification record required by the Fellowship Regulations.

Honorary Fellowship nominations and recipients

A nomination is confidential and does not confer status. UKAAS may contact the nominee to provide privacy information, verify identity and obtain material needed for a fair decision. A public announcement or profile is not made unless the distinction has been conferred and accepted, subject to a lawful exceptional disclosure.

UKAAS distinguishes verified fact, nominator opinion and committee assessment. Material that is excessive, discriminatory, unlawfully obtained or unrelated to the published criteria must not be submitted and may be removed from the record.

• Nominator identity, authority, relationship to the nominee and conflict declaration.
• Nominee identity, contact details where available, biography, field, distinctions, public contribution and evidence supporting the proposed honour.
• Due-diligence, conflict, reputational, sanctions and committee records necessary to protect the integrity of the honour.
• Invitation, acceptance or decline, approved citation, publication choices and the permanent record of a conferred distinction.

Events, directories and communications

Members are private by default. A Fellow's limited verification record may be a condition of the distinction under the Fellowship Regulations, with a restricted listing considered for safety, legal or compelling privacy reasons. An Honorary Fellow's approved name and citation may form part of the Academy's permanent honours record after acceptance.

Operational messages are not marketing merely because they concern an existing contract or security. Promotional email to an individual is sent only with valid consent or where every condition of a lawful PECR soft opt-in is met. Each marketing message provides a simple way to object.

• Event registration, ticket or access status, attendance, role, affiliation, accessibility and dietary requirements, questions, recordings and agreed expenses.
• Directory display name, status, post-nominal, field, admission date, biography, image and links according to the applicable status rules and visibility choices.
• Service communications needed for an application, assessment, account, payment, renewal, security event, event or governance matter.
• Marketing preferences and evidence of consent or opt-out. Marketing is not a condition of account creation or Membership.

Special-category and criminal-offence data

UKAAS does not require special-category data for ordinary account creation. It may receive limited health or disability information for accessibility, or optional equality-monitoring information kept apart from decision material. The collection point identifies whether provision is optional and the applicable Article 9 condition, normally explicit consent for optional monitoring or a legal-claims or substantial-public-interest condition where the law permits it.

Allegations, sanctions checks or conduct material may include criminal-offence data. UKAAS processes such data only where Article 10 UK GDPR and the Data Protection Act 2018 permit it, for example where necessary for legal claims or a qualifying substantial-public-interest condition, with an appropriate policy document where required. It is not used for routine speculative screening.

Purposes and lawful bases

UKAAS does not make a decision producing legal or similarly significant effects solely by automated processing. Automated checks may flag duplication, security risk or incomplete information, but a material status, assessment, suspension or disciplinary decision requires authorised human review.

• Contract and pre-contract steps: account creation requested by you, applications, membership, events, payments, renewals, cancellation and delivery of contracted services.
• Legitimate interests: operating a credible multidisciplinary membership and honours body; assessing evidence; maintaining accurate status records; protecting confidential review; securing systems; preventing fraud and misuse; non-marketing administration; and establishing, exercising or defending legal claims. UKAAS carries out the required necessity and balancing assessment.
• Legal obligation: company, accounting, tax, consumer, sanctions, court, law-enforcement and data-protection duties.
• Consent: optional marketing, non-essential storage technologies, Member directory publication, optional extended profiles, and other purposes expressly presented as a choice. Consent can be withdrawn for future processing.

What must be provided

Fields marked as required are necessary to create the requested account, assess an application, form or administer a contract, verify status, meet a legal duty or protect the service. If required information is not supplied, UKAAS may be unable to open an account, assess the application, take payment, provide an event place or maintain the relevant status. Optional profile, marketing, diversity and Member directory fields are not conditions of service unless a form clearly states a separate lawful reason.

Recipients and service providers

UKAAS does not sell personal data or provide application evidence or account contact data to data brokers. A processor may act only on documented instructions, keep data secure, assist with rights and incidents, and delete or return it at the end of the service, subject to law.

• Authorised UKAAS staff, officers, assessors and committee members, subject to role-based access, confidentiality and conflict controls.
• Supabase, used for authentication and managed data services, and Cloudflare, used for delivery, security and infrastructure connectivity.
• Google or Microsoft when you choose the corresponding identity provider; each also acts under its own privacy terms for its part of sign-in.
• A payment, email, event or professional service provider identified when its service is introduced and bound by an appropriate contract where it acts as processor.
• Professional advisers, auditors, insurers, banks, courts, regulators, law-enforcement bodies or a corporate successor where disclosure is necessary and lawful.

International transfers

The primary Supabase project region is London. Cloud infrastructure, assessors, identity providers and support operations may nevertheless involve access or processing outside the United Kingdom. A transfer is made only after UKAAS identifies the parties and data flow and confirms a lawful mechanism.

Depending on destination and recipient, the mechanism may be UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where applicable; the ICO International Data Transfer Agreement; the UK Addendum to EU Standard Contractual Clauses; binding corporate rules; or a limited statutory exception. Where safeguards are used, UKAAS carries out the required transfer risk assessment and adopts supplementary measures where necessary. A copy or description of the relevant safeguard may be requested, subject to lawful redaction.

Retention schedule

At the end of the applicable period, data is deleted, anonymised or placed under justified archival controls. Retention may be suspended for an active legal claim, regulatory request, fraud investigation or preservation duty. UKAAS reviews retained data rather than treating archival value as an unlimited exception.

• Unsubmitted or abandoned account records: ordinarily 24 months after last activity, unless linked to another retained record or needed for security.
• Member contract and status records: the active term and six years after it ends; core financial and tax records: six years after the relevant financial year.
• Unsuccessful Fellow application and assessment material: three years after the final decision or review; successful Fellow records: while status continues and six years afterwards. A minimal historical status record may be retained permanently where necessary to verify a distinction and prevent misuse.
• Unsuccessful or withdrawn honorary nomination material: three years after final closure, unless a shorter period is appropriate; a conferred and accepted honorary distinction, approved citation and essential provenance: permanently as part of the honours record.
• Event administration: three years after the event, except financial records retained for six years and authorised recordings retained for their documented archival or publication purpose.
• Security logs: ordinarily 12 months; complaints, appeals and conduct files: normally six years after final closure, with a longer period only for an active sanction, safeguarding need, litigation hold or other documented legal reason.
• Marketing suppression records: a minimal record may be kept for as long as needed to respect the objection and demonstrate compliance.

Security and incident handling

UKAAS applies data protection by design and default, least-privilege access, separation of public and restricted fields, encryption in transit, provider security controls, audit events, recovery procedures and periodic access review. Assessors receive only the material required for their task. Secrets and complete payment-card details are not stored in ordinary application records.

No internet service is risk-free. UKAAS assesses personal-data breaches, records the decision, notifies the Information Commissioner where legally required and informs affected individuals without undue delay where the breach is likely to result in a high risk.

Your data-protection rights

A request is free in ordinary circumstances. UKAAS may ask for proportionate identity evidence and clarification needed to locate the information. It responds without undue delay and normally within one calendar month after the applicable response period begins. A complex request or multiple requests may permit a lawful extension; manifestly unfounded or excessive requests are handled only as the law allows.

Rights are not absolute. UKAAS explains any lawful refusal, restriction or redaction and the right to complain. Account closure does not require deletion of records UKAAS must retain to meet a legal duty, preserve an accepted honour, enforce a sanction or establish, exercise or defend legal claims.

• Access to personal data and specified information about its use.
• Correction of inaccurate data and completion of incomplete data.
• Erasure, restriction or objection where the legal conditions are met.
• Data portability for qualifying automated processing based on consent or contract.
• Withdrawal of consent at any time for future consent-based processing.
• Objection at any time to direct marketing, including related profiling.
• A review of any decision said to have been made solely by automated means with a significant effect.

Changes to this Notice

UKAAS reviews this Notice when systems, providers, processing or legal duties change. The version and effective date appear at the top. A material change affecting an existing account or application will be brought to the individual's attention where law requires it. A new purpose incompatible with the original purpose requires a fresh lawful basis and any required notice or consent before processing begins.