Data Submission Policy

• We remove direct identifiers, such as names and addresses, first.
• We match the dataset onto individual records and enrich it with the data we already hold.
• We do not try to identify anyone, and we do not match records to named people.
• The joined result is shared.

This is not immediate. We will tell you when your dataset has been through.

A dataset sent to us may contain personal data, because administrative data usually does. This section is the information we make available to the people that data is about. We did not collect it from them, and we normally have no way of contacting them.

Who is responsible

Cambium AI Ltd. We are the controller for this data in our own right. We are not processing it on behalf of whoever sent it to us.

Where it comes from

Datasets sent to us by other organisations: public bodies, researchers, and others holding public or administrative data.

What we use it for

We remove direct identifiers, then use what is left to build statistical models of populations. We do not use it to make or inform any decision about an individual. We do not carry out automated decision-making or profiling that has legal or similarly significant effects on anyone.

Our lawful basis

Our legitimate interests in building statistical population models, under Article 6(1)(f) of the UK GDPR. Where the processing is for research purposes, we also rely on the research provisions of the UK GDPR and the Data Protection Act 2018.

Who else receives it

We share statistical output. We do not share the direct identifiers we remove.

How long we keep it

Indefinitely, both the dataset and the models built from it. The project is cumulative: a dataset contributed now still informs the model years later, and removing it would degrade work that later contributions depend on.

Your rights

Set out below. They apply to this data as they do to any other personal data we hold, subject to the limits described there.

Some data is treated differently by law: information revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, health, sex life or sexual orientation, and personal data about criminal offences.

We accept datasets that contain it. Refusing them would exclude much of the administrative data this project exists to bring together, and ethnicity in particular appears in a great deal of it.

Where we handle it:

• we remove direct identifiers before anything else;
• we do not use it to identify anyone;
• we do not use it to make or inform a decision about any individual; and
• what we produce from it is statistical.

We rely on the condition for processing that is necessary for statistical or scientific research purposes, under Article 9(2)(j) of the UK GDPR and the research provisions of the Data Protection Act 2018, and we apply the safeguards those provisions require.

If you know your dataset contains data of this kind, including a note in the documentation you zip with it helps us handle it correctly from the start.

We use the email address you enter on the form to tell you when your dataset has been through, to ask you about it if we have questions, and to contact you about the project. Our lawful basis is our legitimate interests in doing what we said we would do with the dataset you sent, and in keeping contributors informed.

We do not add it to a marketing list. We do not sell it or share it for anyone else’s marketing.

We keep it until you ask us to stop. Email help@cambium.ai and we will delete it. You do not have to give a reason, and it does not affect a dataset you have already sent.

Datasets sent to us are stored with Amazon Web Services in the United States. Cambium AI Ltd is the controller. Amazon Web Services acts as our processor.

This means personal data inside a contributed dataset leaves the United Kingdom. For those transfers we rely on the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, as included in our agreement with Amazon Web Services.

You have the right to ask us for access to personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable form.

For personal data that reached us inside a contributed dataset, acting on a request depends on us being able to find the data in question. Because we remove direct identifiers as the first step, we often cannot connect a request to a particular record. Where that happens we will tell you, and explain what we checked, rather than leave the request unanswered.

To make a request, or to object to our use of data about you, email help@cambium.ai.

You can also complain to the Information Commissioner’s Office at ico.org.uk.

We reserve the right to change this policy at any time. The date at the top of the page shows when it last changed.