This Privacy Policy was last updated on 23/09/2025.
As an UMA user, your privacy is important to us and we are committed to being transparent about how we use your personal information and how we keep it safe.
UMA is a centralised User Management Application for managing user accounts and access permissions across the following Archaeology Data Service (ADS) and Heritage Science Data Service (HSDS) online systems:
We refer to these, together with our other services and websites, as “Services” in this Privacy Policy. When signing up for these Services you will also be requested to accept a Privacy Policy and Terms and Conditions for the relevant Service.
The ADS and the HSDS are both Services of the University of York
Personal Information is information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. What personal information do we collect about you in UMA?
We collect information about you when you register for an UMA account, create or modify your UMA profile, set preferences, or sign-up for a Service.
We use cookies to provide functionality within our Services and to recognise you across different Services and devices. For more information, please see our Cookie Policy , which includes information on how to control or opt out of these cookies.
We use a third party service, Matomo Web Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to our websites, where visitors have come to the website from and the pages they visited. This information is only processed in a way which does not identify individuals. We do not make, and do not allow Matomo to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website we will make this clear when we collect personal information and we will explain what we intend to do with it.
We only collect and process information about you where we have a legal basis for doing so under applicable EU laws. The legal basis depends on the Services you use and how you use them. This means we collect and use your information only where:
How we use the information we collect depends, in part, on which Service you use, how you use them, and any preferences you have communicated to us. Below are the specific purposes for which we use the information we collect about you.
We use the personal information that you provide to us to; authenticate you when you log in to online Services, process financial transactions, provide long-term preservation and management of digital archives, and operate and maintain our Services. Personal information required to provide our Services is retained into perpetuity for the purposes of account and/or archive management, unless requested otherwise.
We use the personal information you have provided to us to communicate with you about our Services via email, including sending you automatic notifications, security alerts, and administrative messages related to our Services. Personal information is retained into perpetuity for the purposes of account and/or archive management, unless requested otherwise.
We use your information to resolve technical issues you encounter, to respond to your requests for assistance, and to repair and improve the Services. Personal details provided as part of general customer support enquiries will be kept for no longer than 24 months before deletion unless requested otherwise.
We may communicate with you to provide updates, newsletters and other promotional communications related to our services. We will only communicate with you this way if you have provided your consent. You can opt-out of these communications at any time. Personal details provided with your consent for this purpose, will be retained for as long as we provide the Services or until you request otherwise.
Where required by law or where we believe it is necessary to protect our legal rights, interests and the interests of others, we may use information about you in connection with legal claims, compliance, regulatory, and audit functions.
We may use information about you where you have given us consent to do so for a specific purpose not listed above. For example, we may publish testimonials to promote our Services or publish survey responses for a specific purpose with your permission.
How we share your information with certain third parties depends upon the Services you use. When signing up for these Services you will be requested to accept a Privacy Policy and Terms and Conditions for the relevant Service.
Personal information provided to the OASIS service may be shared with our joint data controllers for this service and are subject to their individual privacy policies; Historic Environment Scotland (Privacy Notice), Historic England (Privacy Policy), The Royal Commission on the Ancient and Historical Monuments of Wales (Privacy Policy), and Jersey Heritage (Privacy Policy). All personal information shared with these organisations will be protected under their individual Privacy Policies. Please follow the links provided to find out more about these Policies. Personal information, limited to name and professional organisation may also be shared with the relevant Historic Environment Record responsible for reviewing the OASIS record.
Data can be deposited with ADS or HSDS via our online data deposition tool INGEST. Personal information provided to this Service may be published, with permission, on our websites. Names of data creators and copyright holders where provided can also appear on our websites or within metadata accompanying data. This information is also available to third party services that harvest our metadata. We do not share any other personal details about our data depositors with any third parties.
Names and email addresses of Service Leads provided to this Service may be published, with permission, in the HSDS Catalogue of Services. Where provided these may also appear on our websites or within metadata services. This information is also available to third party services that harvest our metadata. We do not share any other personal details about HSDS Catalogue of Services with any third parties.
Our Services may include links that direct you to other websites or services whose privacy practices may differ from ours. If you submit information to any of those third party sites, your information is governed by their privacy policies, not this one. We encourage you to carefully read the Privacy Policy of any website you visit.
Some of our Services may contain widgets and social media features, such as the BlueSky button. These widgets and features may collect your IP address, which page you are visiting on the Service, and may set a cookie to enable the feature to function properly. Your interactions with these features are governed by the Privacy Policy of the company providing it.
We do not share personal data with any third party organisation in any other instance than those stated above.
UMA is the centralised User Management Application for the ADS and the HSDS which are hosted by the University of York. We use the University of York's services to help maintain the security and performance of our Services. Find out more about the University of York Information Security Policy. The ADS and HSDS also maintain our own Security Overview and Repository Operations to ensure the safety of data deposited with us.
You have the right to request a copy of your information, to object to our use of your information (including for marketing purposes), to request the deletion or restriction of your information, or to request your information in a structured, electronic format.
You can exercise some of these choices by logging into UMA and using settings available within UMA or the individual Services you are registered with.
UMA allows you to access and update all your information by accessing your user profile information from your account. Each Service may also have additional user information that you can access and edit via each Services user account area.
UMA allows you to request your UMA accounts removal within the application. Please be aware that by removing your UMA account you may not delete your information for all our Services; your information may remain visible to other Service users based on your past participation within the relevant Service, and we may need to retain certain information for archival record keeping purposes, to complete transactions or to comply with our legal obligations.
To delete any information not deletable from the UMA contact [email protected]. Please note, however, that we may need to retain certain information for archival and record keeping purposes, to complete transactions or to comply with our legal obligations.
In some cases, you may ask us to stop accessing, storing, using and otherwise processing your information where you believe we don’t have the appropriate rights to do so. For example, if you believe a UMA account or ADS/HSDS archive contains your personal data without your permission, you can request that we delete your personal information as provided in this policy. When you make such requests, we may need time to investigate and facilitate your request. If there is a delay or dispute as to whether we have the right to continue using your information, we will restrict any further use of your information until the request is honored or the dispute is resolved. Where you gave us consent to use your information for a limited purpose, you can contact us to withdraw that consent, but this will not affect any processing that has already taken place. If you object to information about you being shared with a third-party app, please disable the app.
You may opt out of receiving some communications by updating your email preferences within each Service’s user account area. You can also opt out of all promotional communications from us by using the unsubscribe link within each email, or by contacting us at [email protected].
Please note, however, that you will still continue to receive transactional messages from us regarding provision of our Services, such as emails related to account management or archive deposition.
We keep this Privacy Policy under regular review and it may change from time to time. We will indicate any changes and clearly state the date of last update to this Privacy Policy on this page. Any significant changes will be prominently indicated on our homepages, and account login screens.
If you have any questions you can contact the us at:
Email: [email protected]
University of York
The King’s Manor
Exhibition Square
York
YO1 7EP
The ADS and HSDS is part of the University of York. You can contact the University of York’s Data Protection Officer at:
Email: [email protected]
Telephone: +44 (0)1904 323869
Borthwick Institute for Archives
University of York
Heslington
York
YO10 5DD
