The UK Covid-19 Inquiry is an independent public inquiry set up to examine the UK’s response to and impact of the Covid-19 pandemic, and learn lessons for the future. This notice sets out how we will use your personal data and your rights.

Who we are: We are an independent inquiry team, sponsored by the Cabinet Office. We are a data controller. We also use suppliers, who act as processors of personal data on behalf of the UK Covid-19 Inquiry.

What we use your data for: Your information will be used to confirm your seat reservation and identify you when you arrive at the hearing centre. Your information may be shared with third parties in order to provide counselling services upon your request, or with the Inquiry’s third party facility management provider in the event of an emergency within the hearing centre. Your name (no other details) will be shared with the Inquiry's external security providers and/or emergency and law enforcement services as part of our security process.

What personal information will be collected: The name of the attendee, their email address, the name of the person making the booking (if applicable), the email address of the person making the booking (if relevant), the attendee's accessibility requirements.

What is our lawful basis for for using your information: Where we process personal data provided by you, the legal basis for processing that personal data is because the user consents to us doing so (Article 6(1)(a) UK GDPR.

How long is your personal information stored: The longer of either - 3 months, or the length of the module hearing related to your visit

Where is your personal information stored: As your personal data is stored on our IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the UK. Where that is the case it will be subject to equivalent legal protection through an adequacy decision, or the use of appropriate contractual documents, such as the International Data Transfer Agreement. Paper documents used to record your visit will be destroyed at the end of each day.

What are my rights?
- You have the right to request information about how your personal data are processed, and to request a copy of that personal data.
- You have the right to request that any inaccuracies in your personal data are rectified without delay.
- You have the right to request that any incomplete personal data are completed, including by means of a supplementary statement.
- You have the right to request that your personal data are erased if there is no longer a justification for them to be processed.
- You have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted.
- You have the right to object to the processing of your personal data.
- Your rights may be subject to exemptions or limitations. Requests are dealt with on a case-by-case basis.

How to contact us
The data controller for your personal data is the UK Covid-19 Inquiry Office. The contact details for the data controller: contact@covid19.public-inquiry.uk.

You can raise any privacy and data protection concerns with the UK Covid-19 Inquiry Data Protection Officer. The Data Protection Officer provides independent advice and monitoring of the Inquiry’s use of personal information.

The contact details of the UK Covid-19 Inquiry DPO: dpo@covid19.public-inquiry.uk

Complaints and appeals
If you have already made a complaint to us and are not happy with the outcome, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). The ICO is the supervisory authority responsible for data protection in the UK.

The Information Commissioner can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. 0303 123 1113 or icocasework@ico.org.uk.

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.