WHO WE ARE AND HOW TO CONTACT US
your use of this website (including, but not limited to, any data you may provide through this website); and/or
engaging with us on third party websites and platforms (including, but not limited to, Facebook, WhatsApp, Instagram and Twitter).
By collecting such data, we will be able to inform you about relevant developments that relate to the Institute and what you can do to get involved with the Institute.
We may share your data with other non-profit partners that share the values, principles and aims of the Institute (including, but not limited, to the OECD) and which are supportive of our objectives. This will only be done in limited circumstances where we are satisfied that there is a lawful basis to permit such a transfer to take place.
This website is not intended for children and we do not knowingly collect data relating to children.
THE DATA WE COLLECT ABOUT YOU
Personal data, or personal information, means any information from which your individual identity could be discerned. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
identity data, including first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and/or gender;
contact data, including address, email address and/or telephone number(s);
technical data, including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website and/or third party websites and platforms hosting our content;
profile data, including your username, your interests, preferences, feedback and/or survey responses;
usage data, including information about how you use our website; and/or
marketing and communications data, including your preferences in receiving content and/or marketing from us and our third parties and your communication preferences.
HOW WE COLLECT YOUR PERSONAL DATA
We use different methods to collect data from and about you.
Provided by you – directly
You may give us your name and contact details by filling in forms or by corresponding with us by post, phone, email or otherwise.
This also includes personal data you provide when you register as a supporter of the Institute, subscribe to any mailing lists, give feedback and/or contact us directly via such forms, email, telephone or similar mediums.
Third party sources – indirectly
Automated technologies or interactions, including cookies: as you interact with our website, we will automatically collect technical data about your equipment, browsing actions and patterns – where this is strictly necessary to enable the delivery of the website to you, then these cookies will be downloaded automatically. We collect this personal data by using cookies and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies. You will have the option of declining cookies which are not strictly necessary for the delivery of the website if you do not wish to provide this kind of data to us.
Publicly available sources: we may receive personal data about you from public sources where there is a lawful basis for such transfers to take place.
Third party sources: this may include data that is:
indirectly collected from publicly accessible sources or other public records;
on social media platforms, where you have made the information public, or you have made the information available in a social media forum; and/or
from commercial organisations with whom we have a contract guaranteeing full data protection compliance.
HOW WE USE YOUR PERSONAL DATA
We will only use your personal data when the law allows us to. We will use your personal data in the following circumstances:
Register you as a supporter of the Institute;
Inform and engage you about the Institute;
Inform and engage you with any other organisation that share the values, principles and aims of the Institute;
Manage donations, payments, fees and/or charges;
Comply with our legal obligations; and/or
Answer your queries and respond to your questions and/or complaints.
The legal bases
Where you have specifically consented to a particular use of your data (such as where you have subscribed to receive information about the Institute);
Where you have entered into a legal agreement with us that necessitates that particular use of your data (such as where you make a payment or donation to us);
Where it is a necessary lawful basis for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; or
Where we are obliged to process your data in a particular way by law (for example, if we are required to notify any authority or regulator of the data we hold about you).
WHEN WE WILL SHARE YOUR DATA
We will never sell your personal data to any other organisation and we will not share your personal data unless it is obvious that this is what we are going to do (such as signing up for an event hosted by a third party). We may share your data:
With third parties to perform services on your behalf and to help promote the Institute and similar organisations by serving you advertisements and content online about the Institute, policies we think you might be interested in and/or other organisations that share the values, principles and aims of the Institute (including, but not limited, to the OECD). We require all third parties to respect the security of your personal data and to treat it in accordance with the law;
With your consent, we will share your data with third parties so they may send you direct marketing communications via email or text message. You have the right to withdraw consent to marketing at any time by contacting us;
To enable transfers to take place (where appropriate);
Where we need to comply with a legal obligation; and/or
With suppliers who act as our ‘data processors’ and who provide the means of processing financial transactions including, but not limited to, Orca, PayPal and others.
We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
WHEN YOUR DATA MAY BE USED FOR MARKETING
You will receive marketing communications (i.e. communications promoting the Institute and/or individuals related to it) from us if you have requested information from us and/or you have subscribed to receiving that marketing.
Third party marketing
We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.
Right to object/Opting-out
You can ask us or third parties to stop sending you marketing messages at any time by contacting us at email@example.com.
You have a right to opt out of your data being used for direct marketing.
If we process your data on the basis of “legitimate interests” or “a task carried out in the public interest”, then you have the right to object to us using your data in that way.
This right is not absolute and we may continue to process your data if we can demonstrate compelling legitimate grounds for the processing.
Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of other engagement or transactions with us (so, for example, if you opt-out of receiving messages from us – this will not cause us to change the way we use data you have provided for processing donation payments).
CHANGE OF PURPOSE
THIRD PARTY LINKS
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We will notify you and any applicable regulator of a breach where we are legally required to do so.
HOW LONG WE WILL HOLD YOUR PERSONAL DATA FOR
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
YOUR LEGAL RIGHTS
As a data subject, you have a number of rights in relation to your personal data. Below, we have described the various rights that you have, as well as how you can exercise them.
Right of access
You may, at any time, request access to the personal data that we hold which relates to you (you may have heard of this right being described as a “subject access request”).
We follow the ICO’s “Subject Access Code of Practice” when dealing with requests for access to personal data. You can read this code by visiting https://ico.org.uk/media/for-organisations/documents/2014223/subject-access-code-of-practice.pdf.
Please note that this right entitles you to receive a copy of the personal data that we hold about you in order to enable you to check that it is correct and to ensure that we are processing that personal data lawfully. It is not a right that allows you to request personal data about other people, or a right to request specific documents from us that do not relate to or contain your personal data.
You can exercise this right at any time by contacting us at firstname.lastname@example.org and telling us that you are making a subject access request. You do not have to fill in a specific form to make this kind of request.
Your right to rectification and erasure
You may, at any time, request that we correct personal data that we hold about you which you believe is incorrect or inaccurate. You may also ask us to erase personal data if you do not believe that we need to continue retaining it (you may have heard of this right described as the “right to be forgotten”).
Please note that we may ask you to verify any new data that you provide to us and may take our own steps to check that the new data you have supplied us with is right.
Further, we are not always obliged to erase personal data when asked to do so; if for any reason we believe that we have a good legal reason to continue processing personal data that you ask us to erase, we will tell you what that reason is at the time we respond to your request.
You can exercise this right at any time by contacting us at email@example.com and telling us that you are making a request to have your personal data rectified or erased and on what basis you are making that request. If you want us to replace inaccurate data with new data, you should tell us what that new data is. You do not have to fill in a specific form to make this kind of request.
Your right to restrict processing
You may also ask us to stop processing your personal data: (a) if you dispute the accuracy of that personal data and want us verify that data’s accuracy; (b) where it has been established that our use of the data is unlawful but you do not want us to erase it; or (c) where we no longer need to process your personal data (and would otherwise dispose of it) but you wish for us to continue storing it in order to enable you to establish, exercise or defend legal claims.
Please note that if for any reason we believe that we have a good legal reason to continue processing personal data that you ask us to stop processing, we will tell you what that reason is, either at the time we first respond to your request or after we have had the opportunity to consider and investigate it.
You can exercise this right at any time by contacting us at firstname.lastname@example.org and telling us that you are making a request to have us stop processing the relevant aspect of your personal data and describing which of the above conditions you believe is relevant to that request. You do not have to fill in a specific form to make this kind of request.
Your right to portability
Where you wish to transfer certain personal data that we hold about you, which is processed by automated means, to a third party, you may write to us and ask us to provide it to you in a commonly used machine-readable format.
Because of the kind of the nature of our work do and the systems that we use, we do not envisage this right being particularly relevant to the majority of individuals with whom we interact. However, if you wish to transfer your data from us to a third party, we are happy to consider such requests in good faith.
Your right to stop receiving communications
As noted above, where we send you email marketing communications (or other regulated electronic messages) you have the right to opt-out at any time. You can do this by using the ‘unsubscribe’ link that appears in the footer of each communication (or the equivalent mechanism in those communications).
Alternatively, if for any reason you cannot use those links, or if you would prefer to contact us directly – you can unsubscribe by contacting us at any time by contacting us at email@example.com and telling us which communications you would like us to stop sending you.
Your right to object to automated decision making and profiling
You have the right to be informed about the existence of any automated decision making and profiling of your personal data, and where appropriate, be provided with meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing that affects you.
Exercising your rights
When you write to us making a request to exercise your rights, we are entitled to ask you to prove that you are who you say you are. We may ask you to provide copies of relevant ID documents to help us to verify your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
It will help us to process your request if you clearly state which right you wish to exercise and, where relevant, why it is that you are exercising it. The clearer and more specific you can be, the faster and more efficiently we can deal with your request. If you do not provide us with sufficient information, then we may delay actioning your request until you have provided us with additional information (and where this is the case, we will tell you).
You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
We try to respond to all legitimate requests within one (1) month. However, it could take us longer than a month if your request is particularly complex or if you have made a number of requests. In this case, we will notify you of this and keep you updated.
RIGHT TO LODGE A COMPLAINT
If you are unhappy with the way that we have processed or handled your data then you have a right to complain to the Information Commissioner’s Office (ICO). The ICO is the supervisory body authorised by the Data Protection Act 2018 to regulate the handling of personal data within the United Kingdom.
The contact details for the ICO are:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: 0303 123 1113
Last updated: 31 March 2020