Draft for review and approval by the Executive Committee and legal counsel.
Principles
BACRS collects only the personal data needed to run ethical review, membership and the public directories; uses it only for those purposes; keeps it accurate; protects it with technical and organisational safeguards; and keeps it no longer than necessary under its retention policy.
Safeguards
- Role-based access: reviewers see only assigned applications; applicants see only their own records.
- Two-factor authentication for staff accounts, hashed passwords, encrypted secrets, HTTPS, audit logging of important actions.
- Uploaded documents are stored outside the public web area, checksummed and access-controlled.
- Public pages show only information a member has chosen to make public, or the limited facts needed to verify a certificate.
Your rights
You may ask to see, correct or (where law and regulatory record-keeping allow) erase your personal data by contacting the Secretariat. Regulatory records such as ethics certificates and decisions are retained as required and are not deleted.