ICO website user survey 2025

• How we collect and process your personal data
• Purpose and lawful basis for processing
• How long we keep your data
• What are your rights?
• Your right to complain
• Do we use any data processors?
• Data controller contact information
• Your agreement

How we collect and process your personal data

The ICO has commissioned CACI (as our research and design partner) to conduct a survey of our website users so we can understand user’s’ current experiences with the site and to inform future improvements.

CACI will only collect personal data when you voluntarily submit it to them for the purpose of conducting research on behalf of the ICO, and only after you have read this privacy policy and freely indicated your consent to participate (as per the form in this survey).The ICO control the processing of personal data. We are responsible for the research  conducted on our behalf, and CACI only process personal data according to our instructions. As the data controller (as such term is defined in the data protection legislation), we may request that they  transfer all your personal data collected with your consent during the research.

Categories of personal data processed: all the personal data which you have freely given whilst completing the ICO’s survey.  t However, we request that you do not include any personal data in the free text boxes when completing the survey, if possible. 

Purpose and lawful basis for processing

Legal basis for processing your personal data: The lawful basis we rely on to process your data is consent under article 6(1)(a) of the UK GDPR.  When we collect information about accessibility requirements or if you choose to disclose any special category data the lawful basis we rely on is article 9(2)(a)

The processing of your personal data is based on your freely given consent so that CACI will have access to your personal data for the time necessary for the research. You can withdraw your consent at any time by sending a request to the ICO or CACI.

How long we keep your data

For information about how long the ICO hold personal data, please see our retention schedule.

CACI will only retain your personal data for the purpose stated until the end of the research project or a longer period, as required by law or any contractual obligations. However, if requested by the ICO, CACI, will, at the ICO’s choice, either return to the them or delete all personal data received as well as any copies of such personal data immediately.

CACI will conduct regular data reviews then securely delete your data in line with the above.

What are your rights?

Your participation in this research is voluntary. Under the data protection legislation you have a number of rights which are explained below:

Your right of access
You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can read more about this right here.

Your right to rectification
You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this right here.

Your right to erasure
You have the right to ask us to erase your personal information in certain circumstances. You can read more about this right here.

Your right to restriction of processing
You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here.

Your right to object to processing
You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests. You can read more about this right here.

Your right to data portability
This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. You can read more about this right here.

You are not required to pay any charge for exercising your rights. We have one month to respond to you.

If you want to make a request to exercise any of your rights listed above or if you have any concerns about how your personal data is being handled, please contact the ICO at [email protected]. ADD CACI EMAIL HERE

When you submit a request, please indicate your name, the name of this project, and other details you think will be useful for us to comply with your request.

Your personal data will be processed to manage your participation in the research in accordance with the UK GDPR and Data Protection Act 2018. Your personal data is processed and stored securely, then deleted in line with the Privacy Policy set out in this document.

Withdrawing your consent

You can withdraw your consent to the processing of your personal data at any time.

If you would like to withdraw your consent at any stage before or after the survey, please notify us at the ICO at [email protected], and we will remove all your personal data from our system. Your other rights listed in the above section heading ‘What are your rights?’ will not be affected if the right of withdrawal is exercised. When you withdraw your consent, we will not collect additional information related to you. We may also erase the personal data we already collected. ADD CACI EMAIL HERE

Do we use any data processors?

We use CACI as a data processor to conduct a survey of our website users . We encourage you to read their privacy information, which can be found on their website: 
https://www.caci.co.uk/data-privacy/privacy-policy/

To conduct the ICO website user survey CACI are using a third party sub-processor called Optimal Workshop. Any personal data collected when responding to survey questions will be shared with them and we encourage you to read their privacy information which can be found on their website www.optimalworkshop.com 

The table below contains links to CACI’s sub-processors' websites, who have their own privacy policies, which we encourage you to carefully read.

Your right to complain

We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact us.

If you remain dissatisfied, you can make a complaint about the way we process your personal information to us as the UK supervisory authority. Please follow this link to see how to do that.

Complaints about us are handled in the same way as a complaint about any another organisation.

Data controller contact information

If you have any questions about this Privacy Policy, data protection and practices, please contact us at:

Information Commissioner’s Office
www.ico.org.uk
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

0303 123 1113

Our Data Protection Officer is Louise Byers who you can contact through our online form or via our postal address. Please mark the envelope ‘Data Protection Officer’.

Your agreement

By agreeing to these terms and taking part in the website user survey you:

• acknowledge that you have completely read and fully understood the terms described above and in the Privacy Policy;
• authorise CACI to process your personal data according to the terms provided in this document and in the Privacy Policy for the purpose of completing this research study on behalf of the ICO, including the use of sub-processors listed in the Privacy Policy. You understand that the survey will be conducted by Optimal Workshop;
• authorise CACI to process your special category personal data, on behalf of the ICO, solely for the purposes of the research study.
• authorise CACI to transfer to the ICO all your personal data in an anonymised manner, to the extent possible, for the purposes indicated and according to the terms of this document.