From the people behind the Alan Turing Cryptography Competition.

Privacy Notice

This Privacy Notice explains how we use your personal information: for teachers and participants in the competition. It outlines the types of data that we hold and how we use it. We aim to be clear when we collect your personal information, and not do anything you would not reasonably expect. In collecting and using (processing) your personal information we must comply with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. Our website uses 'cookies' which are text files placed on your computer when you visit a site which help us understand how you use our websites. Cookies don’t collect personal data from your computer, only the data created by your browsing. Some cookies remain on your computer after you leave the website; these are called ‘persistent’ cookies. Others are deleted automatically when you close your browser and others simply expire. We use the following cookies on our websites:

• Session cookies: These cookies are necessary to allow you to log in to the website.
• Google analytics cookies: We may collect non-person-identifying information relating to your use of our sites via Google Analytics technology. This may include: which pages you see; how long you stay; what you click on our pages; if you visit the website again; which country and city you are browsing from; etc. This data is collected for the purpose of monitoring and understanding the effectiveness of our websites.

'Personal information' means any information which relates to or identifies you as an individual (e.g. name, date of birth, postcode etc.) and includes information which may not explicitly identify you (e.g. where your name has been removed) but which nevertheless does identify you if it is combined with other information that is readily available. The information provided here applies to the use, sharing and disclosure (processing) of your personal information by The University of Manchester for the purpose of the Mathsbombe and Cryptography competitions. Further information about who your information will be shared with is included in Section 4. According to data protection law the University is a Data Controller for this processing.

We need to collect, maintain and use personal data of teachers who have pupils taking part in the competition. This consists of a teachers title, name, e-mail address and school address.

We do not store personal information of pupils taking part in the competition. We collect the name of competition participants and send this data to their teacher automatically, but their name is not stored or used subsequently.

The personal information is processed so that we may contact teachers in order to administer the competition. For example, reasons we may contact a teacher may include notification of their students' registration or progress in the competition, notification that a team of their pupils has won a prize and the posting of that prize to the school, and reporting of suspected breaches of the competition rules by their students. Names of students are provided to their teachers in order that teacher has a record of which students are taking part and which team they are a part of.

We will share the personal information of teachers with relevant University of Manchester staff for the purpose of administering the MathsBombe and Cryptography competitions. Also for this purpose, we will share the names of competitors with their teacher, and the surname of the teacher with the competitors registered to them.

• We do not keep personal information relating to competitors
• Personal information relating to teachers will be kept only for as long as is necessary to administer the competition, until the end of the academic year in which the competition is held.
• School names will be kept so that winning teams/schools and leaderboards for previous competitions can be maintained, until school requests deletion.
• E-mail addresses added to our e-mail reminder list will be kept until the data subject requests that they are removed. This can be done at any time.

After these periods, any personal information will be removed from our records, and only the anonymised data extract will be retained for secondary research purposes.

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it

Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected

Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.

Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.

Request the restriction of processing of your personal information. This enables you to ask to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

Request the transfer of your personal information to another party. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

If you would like to exercise any of these rights, you should contact the university using the details below.

Who can I contact?

If you have questions about how your personal information is used, or wish to exercise any of your rights, please contact the Cryptography Competition (cryptography_competition@manchester.ac.uk) or MathsBombe (mathsbombe@manchester.ac.uk) organisers in the first instance. You can also contact the University Data Protection Officer by email: dataprotection@manchester.ac.uk, or write to The Information Governance Office, University of Manchester, Christie Building, Oxford Road, Manchester M13 9PL. Further information about your rights is available from the University's data protection web pages.