Privacy Policy

Last updated: 31 July 2026

1. Introduction

Welcome to measuresHE Ltd ("measuresHE", "we", "us", or "our"). We are committed to protecting your privacy and handling personal data in an open and transparent manner. This Privacy Policy explains how we collect, use, store, and protect personal information across our website, our user services, and our specialised data products, including our Academic Reputation & Institutional Affinity Mapping Database (the "Database").

measuresHE Ltd is established in the United Kingdom and this policy is designed to comply with:

  • The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
  • The Privacy and Electronic Communications Regulations 2003 (PECR).

Where individuals are located outside the United Kingdom, we apply the same standards of transparency, lawfulness and respect for individual rights set out in this policy. Where additional obligations apply to us under the law of another jurisdiction, we comply with those obligations and will update this policy accordingly.

For the purposes of data protection legislation, measuresHE Ltd (Company No. 16650577) acts as an independent Data Controller. measuresHE Ltd is registered with the UK Information Commissioner's Office as a Data Controller (Registration Number ZC060809). Our data protection contact is privacy@measureshe.com.

2. What Personal Data We Collect

We collect personal data through two primary routes: directly from users interacting with our online platform, and indirectly via public academic records for our research datasets.

2.1. Information Provided Directly by You (Website & Platform Services)

  • Account Registration: Username, email address, and password. You may optionally provide your full name and institutional affiliation.
  • Forum Participation: The content of posts, comments, and discussions submitted to our community discussion boards.
  • Surveys & Contact Forms: Name, email address, message content, and survey responses submitted through our site.

2.2. Information Collected Indirectly from Public Sources (Academic Database)

To compile and maintain our Academic Reputation & Institutional Affinity Mapping Database, we aggregate publicly available academic and professional data from open research infrastructure (such as OpenAlex, Crossref, DOIs, and ORCID) and public institutional repositories. This dataset may contain:

  • Researcher names, academic identifiers, and professional affiliations.
  • Institutional or professional email addresses that have been made publicly available by the individual in connection with their academic activities.
  • Publication metadata, citation counts, co-authorship relationships, and research subject areas.
  • Derived indicators relating to institutional academic connections and network mapping.

2.3. Information Collected Automatically

  • Cookies & Analytics: Server log data, IP addresses, browser types, and page interaction data collected via essential cookies and analytics tools (e.g., Google Analytics).

Special Category Data: We do not knowingly collect, harvest, or process "Special Category" Personal Data (as defined under Article 9 of the UK GDPR), such as racial or ethnic origin, political opinions, religious beliefs, health status, or sexual orientation.

3. How and Why We Use Your Personal Data

Purpose of Processing Type of Data Legal Basis (UK GDPR)
Providing website services, authentication, and forum operation. Account data, Forum content Performance of a Contract (Art 6(1)(b)).
Compiling, licensing, and updating the Academic Reputation & Institutional Affinity Mapping Database for higher education research, institutional relationship management, and academic engagement — including enabling client institutions to identify and prioritise outreach to academics with a genuine co-authorship or citation connection, and to request participation in recognised university ranking or reputation surveys such as those run by QS and Times Higher Education (THE). Public academic metadata, publication records, institutional contact emails Legitimate Interests (Art 6(1)(f)). We have evaluated that enabling higher education institutions to map academic networks is proportionate and aligns with the reasonable expectations of published researchers — see our Legitimate Interests Assessment, available on request.
Responding to support inquiries and contact submissions. Contact form data Legitimate Interests (Art 6(1)(f)).
Administering research surveys. Survey responses Consent (Art 6(1)(a)). You may withdraw consent at any time.
Website optimization, security monitoring, and analytics. Analytics and log data Legitimate Interests (Art 6(1)(f)).
Legal compliance and maintaining data suppression records. Suppression records, system logs Compliance with a Legal Obligation (Art 6(1)(c)).

4. Article 14 Transparency Notice (Academic Database)

Where personal data is collected from publicly available sources rather than directly from the individual, Article 14 of the UK GDPR applies. Given the broad scale and automated nature of global academic publishing metadata processed by measuresHE Ltd, providing direct individual notice to every published researcher at the point of initial collection involves a disproportionate effort pursuant to Article 14(5)(b) UK GDPR.

To uphold transparency, this Privacy Policy publicly details our database processing activities. Furthermore, when our institutional clients utilize the Database for outreach, our licensing terms require clients to comply with applicable transparency and data protection obligations, including providing appropriate privacy information where required by law.

5. Disclosure to Institutional Clients and Third Parties

We may license access to our Academic Database to verified higher education institutions, research bodies, and related organizations for academic engagement and relationship management. Clients using the Database act as independent Data Controllers for their own processing activities and are responsible for ensuring their direct communications comply with applicable laws (including PECR).

We may also share necessary data with trusted service providers who assist in operating our platform:

  • Google Workspace (including Google Drive): Secure cloud storage and collaboration services.
  • Google Analytics: Anonymised website usage analytics.

6. Data Storage, Security, and Retention

6.1. Security

Data is stored on secure, encrypted cloud infrastructure. Access is restricted to authorised personnel according to strict role-based access controls (least privilege principle).

6.2. International Transfers

We license the Database to higher education institutions worldwide. Where an institution is located outside the United Kingdom in a country without UK adequacy regulations, we put in place an approved transfer mechanism before any transfer takes place — normally the UK International Data Transfer Agreement (IDTA) issued by the Information Commissioner's Office — and we complete a transfer risk assessment for the destination country.

You may request a copy of the safeguards we have in place by emailing privacy@measureshe.com.

6.3. Retention and Suppression

Account data. Retained for as long as your user account remains active, and deleted within 12 months of account closure.

Academic Database — our own retention. We retain the personal data used to compile the Database for as long as we continue to offer the Database as a product, and we review the necessity of that retention annually. Records are removed where an individual objects or requests erasure, where the underlying source data is withdrawn, or where the record is no longer relevant to the purposes described in section 3.

Academic Database — retention by our clients. Licences to the Database are granted for a limited term, currently twelve months. On expiry or termination of a licence, the institution must securely delete all copies of the data it received and certify in writing that it has done so within thirty days. Institutions may not sublicense, resell or transfer the data to any third party.

Currency of the data. The Database represents a periodic snapshot of publicly available academic information. Because academic publications, affiliations and contact details change over time, information in the Database may become outdated between updates. We correct records on request under your right to rectification, and issue corrections to licensed institutions.

Suppression list. If you object to processing or request erasure, we retain a minimal record — your identifier and the date of your request — indefinitely. This is necessary to give effect to your request: without it we could not reliably prevent your information being collected again in a future build. The suppression list is not used for any other purpose and contains no information beyond what is needed to recognise and exclude your records.

7. Your Right to Object — Removal from our Academic Database

If you do not wish your information to be included in our Academic Reputation & Institutional Affinity Mapping Database, you have the right to object at any time, and you do not need to give a reason.

To object, submit a suppression request or email privacy@measureshe.com with your name and, if you have one, your ORCID identifier.

When we receive your objection:

  • We add you to our suppression list and stop processing your information.
  • You are excluded from all future versions of the Database.
  • We issue a suppression notice to every institution currently licensed to use the Database. Under our licence terms those institutions must stop contacting you immediately and delete your records within twenty business days.
  • We will confirm to you when this has been done.

We aim to complete this within one month of your request, as required by Article 12(3) UK GDPR.

You may also object to processing on other grounds, or exercise any of the further rights set out in section 8 below.

8. Your Data Protection Rights

Under data protection legislation, you have rights regarding your personal information:

  • Right of Access: Request a copy of the personal data we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete information.
  • Right to Erasure (Right to be Forgotten): Request deletion of your personal data where applicable.
  • Right to Object (Article 21): Object to processing carried out under our Legitimate Interests (including inclusion in our Academic Database).
  • Right to Restriction: Request that we restrict the processing of your data under specific circumstances.
  • Right to Data Portability: Request the transfer of data you directly provided to us.

Where we process personal data under our legitimate interests, individuals may object to that processing at any time. We will consider all such requests in accordance with applicable data protection law and will update our suppression list where appropriate to prevent future processing. To exercise any of these rights or to request removal from our Academic Database, please email us at privacy@measureshe.com.

We use cookies to maintain basic site operation and gather analytics:

  • Essential Cookies: Required for user session management and authentication.
  • Analytics Cookies: Utilised to understand visitor interactions and improve platform usability.

10. Complaints & Supervisory Authorities

If you have concerns regarding our processing of your personal data, please contact us first so we can resolve the issue. You also have the right to lodge a complaint with a supervisory authority:

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, legal obligations, or data processing activities. Any updated version will be published on this page with the revised "Last updated" date.