IMA Data Privacy Notice 2026
Introduction
This Privacy Notice explains how the Institute of Mathematics and its Applications (IMA) collect, use and protect personal data.
We have updated this notice to reflect changes introduced by the Data Use and Access Act (DUAA), which came into law on 19 June 2025, with certain provisions effective from 1 June 2026. We keep this notice under regular review to ensure it remains accurate and up to date.
Who we are
The Institute of Mathematics and its Applications support the advancement and application of mathematical knowledge and promotes mathematical culture in the United Kingdom and beyond for the public benefit.
It is the professional and learned society for qualified and practising mathematicians, with around 5,000 members from all sectors, as well as others with an interest in mathematics.
The Institute of Mathematics and its Applications is a registered charity (number 1017777).
Source of data
We generally will only collect personal data directly from you. In some cases, we may receive information from third parties, such as referees, nominators or institutions, where relevant to your application or engagement with us.
Data we collect
We collect personal data and, in some cases, special category data. We only collect the minimum information necessary to provide our services.
Personal data
Personal data is information that identifies you, either on its own or when combined with other information. This may include:
- title, first name and surname
- gender and date of birth
- qualifications
- contact details (such as telephone number, postal address and email address)
We may also collect employment-related information such as:
- employer
- job title
- areas of interest or expertise
- professional role or function
For some applications, nominations or awards, we may collect the name and contact details of a nominator or referee.
Special category data
Special category data includes information such as racial or ethnic origin, religious or philosophical beliefs, health information, or other sensitive data defined under UK GDPR.
We only process special category data where:
- it is necessary for a specific purpose (e.g. event requirements such as dietary needs),
- the law permits us to do so, and
- we have identified both:
- an appropriate lawful basis under Article 6 UK GDPR; and
- a condition for processing under Article 9 UK GDPR.
Where such data is collected (for example, dietary requirements for events), we:
- collect only what is necessary;
- ask individuals not to provide unnecessary additional information;
- share it only with relevant third parties (e.g. third party outsourced service providers, venues or caterers); and
- retain it only for as long as necessary in line with our retention policy.
International transfers
We do not routinely transfer personal data outside the UK. Where this is necessary, we ensure appropriate safeguards are in place.
Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, in line with our retention policy.
Purposes and lawful basis
We use personal data to:
- administer membership services, events, publications, grants and bursaries;
- respond to enquiries;
- support professional engagement and networking; and
- comply with legal and regulatory obligations.
We process personal data in accordance with the UK GDPR and Data Protection Act 2018.
Depending on the activity, we rely on one or more of the following lawful bases:
- performance of a contract;
- compliance with legal obligations;
- legitimate interests, where these are not overridden by your rights.
Where we rely on legitimate interests, we ensure that our interests are balanced against your rights and freedoms.
Where special category data is processed, we also identify an additional condition under Article 9 UK GDPR.
Use and disclosure
We do not share personal data with unrelated third parties unless:
- you have given clear permission;
- it is necessary to provide a service you have requested; or
- we are required or permitted to do so by law.
Where third parties process personal data on our behalf, they are required to protect it and use it only for specified purposes in line with UK GDPR.
Marketing communications
We will only send marketing or promotional communications where permitted under applicable law. This will usually be:
- based on your consent; or
- based on “soft opt-in” where you are an existing member or contact and have not opted out.
We may contact you about services, events and activities related to the Institute, as well as opportunities for professional engagement where appropriate. These communications are sent by, or on behalf of, the IMA and are subject to appropriate controls.
You can opt out of receiving marketing communications at any time, and we will stop sending them promptly.
We also collect email addresses from individuals who subscribe to mailing lists. These communications are sent with your consent, and you can unsubscribe at any time using the link provided in each email.
Information collected through our websites
Personal data collected through IMA websites is used only for the purpose stated at the time of collection.
We keep this information only for as long as necessary. For example:
- conference delegate data may be retained for up to six years after the event;
- membership data may be retained for the duration of membership and for up to six years afterwards.
You may request deletion of your personal data at any time, subject to legal or regulatory requirements.
Members’ Directory
The myIMA portal includes a Members’ Directory listing members’ names to support professional networking. Access is restricted to members.
We rely on legitimate interests for this processing and consider it reasonable in the context of membership. You can opt out at any time.
Data security
We take appropriate technical and organisational measures to protect personal data.
All data is stored on secure systems and protected against unauthorised access, misuse or disclosure. We also maintain procedures to reduce the risk of accidental loss or damage.
While we take reasonable steps to protect information transmitted over the internet, no method of transmission is completely secure.
In the event of a data breach, we will investigate, take appropriate action and notify affected individuals and the Information Commissioner’s Office where required.
Maintaining data accuracy
We take reasonable steps to ensure that personal data is accurate and up to date.
Individuals may request corrections at any time. Members can also update their details through their myIMA account.
Cookies
We use cookies to ensure the website functions effectively and to understand how it is used.
We use the following types of cookies:
- Strictly necessary cookies – required for core functionality such as login and security.
- Analytics cookies – used to understand how visitors use the site and improve performance.
We use Google Analytics to collect aggregated information about website usage. These cookies are only set with your consent. Google may process this information on our behalf in accordance with its privacy policy.
You can accept or reject non-essential cookies using our cookie banner and can change your preferences at any time. Non-essential cookies are not set until you have provided consent.
Your rights
Under UK data protection law, you have the right to:
- be informed about how your data is used;
- access your personal data;
- request correction of inaccurate data;
- request erasure in certain circumstances;
- restrict or object to processing;
- request data portability;
- withdraw consent where applicable.
These rights may be subject to certain legal limitations.
To exercise your rights, please contact: dataprotectionofficer@ima.org
Complaints
If you have concerns about how we handle personal data, please contact us via our online complaints form in the first instance.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): https://ico.org.uk/concerns
Data controller and contact details
The IMA is the data controller for the purposes of UK data protection law.
If you have any questions, please contact: Email: dataprotectionofficer@ima.org
Address:
The Institute of Mathematics and its Applications
Ground Floor Suite
19–20 Clifftown Road
Southend-on-Sea
Essex
SS1 1AB
Changes to this Privacy Notice
We may update this Privacy Notice from time to time. Updates will be published on our website.
This notice was last updated in June 2026.