Privacy Policy
Royal College of Pharmacy (RCPharm)
v01.0
Last updated 15th April 2026
Introduction
The Royal College of Pharmacy (RCPharm) (“we”, “our”, “us”) is the controller of personal data obtained via our website and associated platforms. We comply with UK GDPR and the Digital United Adequacy Act 2025 (DUAA).
Children under 18 are not the target audience of our services.
What This Policy Applies To
– Public website (www.rcpharm.org)
– Member‑only sections
– RCPharm‑operated apps/platforms
– Third‑party platforms supporting membership, learning, assessments, events, recruitment, and professional networks
– All data processing carried out by our subsidiary organisation Royal College of Pharmacy Enterprises Limited (a limited company which delivers some commercial functions for the College, such as events administration and processing insurance products for our members)
Personal Data We Collect About You
The personal data we collect depends on the services you use. The table below sets out each category and its typical retention.
| Category | Types of Data Included | Retention Period |
| Identity Data | Names, titles, membership numbers; optional equality and diversity data (only with consent) | Duration of membership + 4 years; up to 40 years for assessment‑related identity data |
| Contact Data | Postal address, email address, telephone numbers | Membership duration + 4 years; +1 year after an assessment |
| Financial Data | Bank and card details (handled by third‑party processors) | 6 years after transaction |
| Transaction Data | Payments, orders, services purchased | 6 years after transaction |
| Technical Data | IP address, login data, browser type/version, device information | 28 days (cookies per cookie policy) |
| Profile Data | Usernames, passwords, CPD entries, preferences, survey responses | Membership duration + 4 years |
| Pharmacist Data | Practice sector, employer, GPhC registration & renewal details, credentialed status | Membership duration + 4 years; credential lists updated annually |
| Professional History | Insurance claims, Fitness‑to‑Practise investigations | Membership duration + 4 years |
| Assessment Data | Results, candidate numbers, portfolio materials | Results up to 40 years; other assessment material 1 year |
| Recruitment Data | Applications, special category data | 6 months after job closing date |
| Usage Data | Website/app usage patterns | Membership duration + 4 years; other usage logs anonymised after 28 days |
| Marketing & Communications Data | Communication and marketing preferences | Membership duration + 4 years |
| Video & Audio Data | Recordings from meetings or events | Up to 2 years |
How Your Personal Data Is Collected
We collect data directly from you, indirectly via our systems, and from trusted third parties. The table below summarises the principal collection methods.
| Category of Data | Collection Method |
| Identity, Contact, Profile, Pharmacist | Direct entry on membership application forms and/or online user profiles |
| Identity, Contact, Profile, Pharmacist, Recruitment, Transaction, Financial | Direct interactions such as registering a profile, filling in forms, entering a contract, or corresponding by post/phone/email (e.g., purchase membership, book events, engage with interactive features, complete surveys, become a speaker/outworker) |
| Identity | Internal authentication from your existing RCPharm membership account verifies membership status |
| Identity & Contact, Pharmacist | If nominated as a collaborator/peer in E‑portfolio/MyPortfolio by a Member/Registered User, your email is provided by the nominator; if you decline, we delete this data |
| Identity, Pharmacist | Authentication with the General Pharmaceutical Council (GPhC) to check your registration number |
| Contact, Financial, Transaction | Third‑party providers of technical, payment, and delivery services |
| Technical, Usage | Automated technologies such as cookies, server logs, analytics; may involve analytics providers, search information providers, and troubleshooting services |
| Marketing & Communications | Direct interactions when you opt in/out of marketing through your account settings or unsubscribe links |
| Identity, Contact, Pharmacist, Marketing & Communications | When you respond to lead advertising on our social media partner platforms (e.g., Facebook/Instagram) |
| Special Category (incl. video/audio) | Direct interactions: completing surveys; registering for assessments; consenting to recording during online meetings/events; submitting job applications via our recruitment module |
How and Why We Use Your Personal Data
We only process personal data where we have a lawful basis. The table below explains what we use your personal data for and the relevant legal basis.
| Purpose/Activity | Type of Data | Lawful Basis (including legitimate interests) |
| Register you as a new member or registered user | Identity; Contact | Performance of a contract |
| Process and deliver orders for events/products; manage payments, fees, and charges; collect and recover money owed; perform Direct Debit credit reference checks (via Braintree/Stripe/Worldpay) | Identity; Contact; Financial; Transaction; Marketing & Communications | Contract; Legitimate interests (recover debts) |
| Carry out obligations arising from our contractual relationship (membership services, elections, member database entry, membership changes) | Identity; Contact; Financial; Professional History; Special Category (where relevant) | Contract; Consent (where special category data is involved) |
| Notify third‑party organisations (e.g., NICE/HEE/NES) of pre‑registration members | Identity; Contact | Contract; Legitimate interests (education and development of the profession) |
| Manage our relationship with you (policy/terms updates; reviews/surveys; event information and feedback) | Identity; Contact; Profile; Marketing & Communications | Contract; Legal obligation; Legitimate interests (keeping records up to date; service analysis) |
| Enable you to plan, record and enter CPD records on MyCPD Portfolio; prize draws/competitions; surveys | Identity; Contact; Profile; Usage; Marketing & Communications; Special Category | Contract; Legitimate interests (service development; equal opportunities monitoring) |
| Manage and administer assessments that you apply for or act as assessor | Identity; Contact; Assessment; Special Category | Contract (delivery of assessment); Legitimate interests (conduct fair/high‑quality assessments); Consent; Legal obligation |
| Collate and analyse responses to professional standards consultations; follow up on case studies supporting standards/advocacy | Identity; Contact; Pharmacist | Legitimate interests (represent the profession; promote excellence); Consent |
| Administer and protect our business and website (troubleshooting, data analysis, testing, system maintenance, support, reporting, hosting) | Identity; Contact; Technical | Legitimate interests (running our business; IT services; network security; fraud prevention; reorganisation); Legal obligation |
| Deliver relevant website content/advertisements and measure effectiveness | Identity; Contact; Profile; Usage; Marketing & Communications; Technical | Legitimate interests (service development; business growth; marketing insight) |
| Use data analytics to improve our website, products/services, marketing, customer relationships and experiences | Technical; Usage | Legitimate interests (define customer types; keep site updated and relevant; develop business; inform marketing) |
| Make suggestions and recommendations about goods or services that may interest you | Identity; Contact; Technical; Usage; Profile | Legitimate interests (develop products/services; grow our business) |
| Process your application for a job | Identity; Contact; Recruitment; Special Category | Legitimate interests (recruitment); Legal obligation (employment law); Consent (special category) |
| Administer our Consultant Pharmacist List (credentialing) | Identity; Contact; Pharmacist | Legitimate interests (maintain integrity of the profession) |
| Send you information about RCPharm products and services based on your membership | Identity; Contact; Technical; Usage; Profile | Legitimate interests (grow our business) |
| Enable participation in recorded meetings/events; publish recordings of governance meetings | Video data; Special Category | Consent (participants); Contract (performers) |
| Process your nomination for a fellowship | Identity; Contact; Professional History | Contract (membership management); Consent |
Special Category Personal Data
We process special category data only where necessary and lawful, including:
– Equality and diversity monitoring
– Disability accommodations during assessments
– Video/audio recordings during events
Where required, we obtain explicit consent, which you may withdraw at any time.
Marketing
We may contact you about RCPharm events, services, or updates. You can opt out via unsubscribe links, STOP codes, your preference‑centre settings, or by contacting us directly. We do not sell your data to third parties for their marketing.
Who We Share Your Personal Data With
We share data with trusted third‑party processors who support our operations (see Annex). All vendors enter into DUAA‑compliant data processing terms and are subject to appropriate technical and organisational measures.
International Transfers Under DUAA 2025
We only transfer data internationally if:
– The destination is subject to a DUAA Adequacy Regulation; or
– DUAA‑approved Standard Data Protection Clauses apply; or
– A DUAA‑recognised exception is met.
We conduct ongoing DUAA‑compliant adequacy assessments and will update this policy if transfer mechanisms change.
Cookies
See our cookie policy.
Your Rights
You may request: access, correction, erasure, restriction, portability, objection (including marketing), and withdrawal of consent by contacting our data protection officer (details shown at the bottom of this policy).
Keeping Your Data Secure
We use robust technical and organisational controls (encryption, access controls, security audits, breach‑response procedures). Unauthorised AI‑based transcription or monitoring tools are prohibited on RCPharm systems.
Data Retention
We only retain data in line with the retention periods shown in the table above (in the “Personal Data We Collect About You” section).
Changes to this Policy
We may update this policy. Significant updates will be communicated on our website or directly by email where appropriate.
How to Contact Us
Royal College of Pharmacy (RCPharm)
Email: [email protected]
Phone: 0207 572 2737
Data Protection Officer: Calvin Smith
Email: [email protected]
Phone: 0207 572 2402
ICO: https://ico.org.uk/make-a-complaint
Annex: Third‑Party Data Processors
| Third‑Party | Purpose | Location |
| Access | Recruitment module services | EU |
| Amazon Web Services | Hosting | Ireland & US |
| Aon | Membership services | UK |
| Aventri | Event booking system | US |
| Axia Digital | E‑portfolio | UK |
| Box.com | Cloud storage | US |
| Braintree | Payment processing | US |
| Brightspace / D2L | Learning platform | Canada |
| Cantarus | Website development/hosting | EU |
| Centre for Pharmacy Postgraduate Education | Training programmes | UK |
| Chrysalis | Market research | UK |
| Course Merchant | Catalogue management | UK |
| CrazyEgg | Website analytics | US |
| Crowdcompass | Membership service support | UK |
| Dotdigital | Mailing services | EU (with global sub‑processors) |
| ETC Venues | Event hosting | UK |
| Fusion Insight | Market research | UK |
| Google Analytics | Analytics | US |
| Google Ads | Advertising | US |
| GB Group | Identity verification | EU |
| Hall & Partners | Telemarketing | UK |
| HEIW | Education validation | Wales, UK |
| HMRC | Government/regulator | UK |
| JIRA/Atlassian | Support ticketing | US |
| M+F Health | PR services | UK |
| MHRA | Registration validation | UK |
| Meta (Facebook/Instagram) | Advertising | US |
| Microsoft | Video/meeting services | US |
| Monday.com | Project management | US |
| NICE | Education and training | UK |
| Mi‑Voice | Elections | UK |
| NHS England / NES / HEIW | Training programmes | England/Scotland/Wales |
| OneTrust | Cookie management | US |
| Oracle | Data storage services | US |
| PageLizard | MyCPD app | UK |
| PerformLearnDevelop | Mentoring platform | UK |
| Reedwords | Copywriting | UK |
| Restream | Streaming | US |
| Salesforce | CRM/data storage | US |
| SendGrid | Email delivery | US |
| SurveyMonkey | Survey platform | US |
| Stripe | Payment processing | US |
| Tray.io | Marketing integrations | US |
| TUG Ltd | Analytics consultancy | UK |
| University of Cardiff | Assessment submissions | UK |
| University of East Anglia | Training programmes | UK |
| University of Sunderland | Training programmes | UK |
| WDM | Mailing house | UK |
| Webex | Webinar services | US |
| WorldPay | Payment processing | US |
| Zendesk | Support services | US |
| Zoom | Webinars | US |