IVAR Privacy Notice
This privacy notice is published on 25/09/2019.
Who are we?
Our charitable mission is to strengthen practice through action research and share insights with those who would find them useful and usable – across the voluntary, public and funding sectors. As a team, we believe in the value of people and organisations working for social change. We see the difference they make every day – particularly those that are smaller and rooted in the heart of their communities.
The term ‘Institute for Voluntary Action Research’ or ‘IVAR’ or ‘us’ or ‘we’ refers to the owner of the website whose registered office is The Old School, Exton Street, London, SE1 8UE. Our charity registration number is 1114403. The term ‘you’ refers to the user or viewer of our website.
IVAR is the data controller and our Data Protection Lead can be contacted by email: firstname.lastname@example.org
When do we collect personal data about you?
When you interact with us in person, through correspondence, by phone, by social media, or through our website.
We may collect personal data if it is considered to be of legitimate interest, and if this interest is not overridden by your privacy interests. Before data is collected we make sure an assessment is made, ensuring that there is an established mutual interest between you and IVAR.
Why do we collect personal data?
We collect and use personal data for:
- Replying to your enquiries
- Contractual and legal obligations
- To carry out research
- To achieve our charitable mission of sharing insights and ideas with people and organisations across the voluntary, public and funding sectors
- To organise events
We also collect data about suppliers, partners and persons seeking a job or working in IVAR.
How do we collect personal data?
We collect your data when you:
- Initiate contact through email, telephone call or other means of direct communication
- Fill and submit a newsletter subscription form on our website
- Submit a comment through our website
- Take part in a research project
- Sign up to an event through our website or Eventbrite
How we use your personal data?
We may use your information for the following purposes:
- To send you updates about our work. These may include information about published research, new projects, events or activities of associated partners. This communication is subscription based. You can unsubscribe from these communications by clicking the unsubscribe link in sent emails.
- If you are an individual subscriber, we are contacting you because you have consented to receive these communications through our website, when you attended an event or when you took part in a research project with us.
- If you are a business contact and subscribed to our newsletter on or after 25 May 2018, we are contacting you because you have consented to receive these communications through our website, when you attended or signed up for an event or when you took part in a research project with us.
- If you are a business contact and subscribed to our newsletter on or before 24 May 2018, we are contacting you on the basis of legitimate interests, as our charitable mission is to share research and insights with those who would find them useful and usable. You consented to receive these communications through our website, when attending an event or in communication with one of our team.
- To contact you about a research project that you have taken part in. This is a legitimate interest.
- To contact you about an event that you have signed up for. This is a legitimate interest.
- To follow up on incoming requests (customer support, emails, or phone calls). This is a legitimate interest.
- To fulfil contractual and legal obligations.
- To notify you about any disruptions to our services (system messages). This is a legitimate interest.
- To process a job application. This is a legitimate interest.
If you would like more information please do get in touch with our Data Protection Lead: email@example.com
What type of personal data is collected?
We collect your name, phone number, title and email address, in addition, your postal address, organisation name and contact information (if relevant). We may also collect feedback, comments and questions received from you in service-related communication and activities, such as meetings, phone calls, documents, and emails. From our website we may collect IP-address and actions taken on the site.
If you add posts or comments, etc. on our website, the information can be read by anyone with access to the site and used for purposes over which we or you have no control. Therefore, IVAR is not responsible for any information you submit to the website.
If you consent to take part in a research project with IVAR, then you will be notified what type of personal data will be collected before giving your consent. You will also be notified about how we will use this personal data and how long we will keep it.
If you apply for a job at IVAR, we collect the data you provide during the application process.
IVAR does not collect or process any special categories of personal data, such as public unique identifiers or sensitive personal data.
How long do we keep your personal data?
We will not store your personal data for any longer than necessary to fulfil the purpose for which the personal data was collected; while also considering our need to answer your queries or resolve possible problems, to comply with legal obligations, to attend to any legal claims/complaints, and for safeguarding purposes.
This means that we may retain your personal data for a reasonable period of time after your last interaction with us. When the personal data that we have collected is no longer required, we will delete it in a secure manner. We may process data for statistical purposes, but in such cases, data will be anonymised.
Your rights to your personal data
You have the following rights with respect to your personal data:
1. The right to withdraw any consent to personal data processing at any time. For example, your consent to receive our newsletter:
If you want to withdraw your consent to our newsletter, please make use of the unsubscribe link included in our communication. Please note that you may still receive administrative communications from us.
2. The right to request that IVAR provides you with your personal data and, if possible, to pass on this information directly (in a portable format) to another data controller when the processing is based on consent or contract.
You can send this query to firstname.lastname@example.org
3. The right to request a restriction on further data processing, in case there is a dispute in relation to the accuracy or processing of your personal data.
The right to object to the processing of personal data, in case data processing has been based on legitimate interest and/or direct marketing.
You can send this query to email@example.com
Any query about your personal data and privacy rights should be sent to firstname.lastname@example.org
This information is used to make websites work more efficiently, as well as to provide business and marketing information to the owners of the site, and to gather such personal data as browser type and operating system, referring page, path through site, domain of Internet Service Provider (ISP), etc. for the purposes of understanding how visitors use a website. Cookies and similar technologies help us tailor our website to your personal needs, as well as to detect and prevent security threats and abuse. If used alone, cookies and web beacons do not personally identify you.
For further information visit http://www.aboutcookies.org or http://www.allaboutcookies.org. You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However, in a few cases some of our website features may not function as a result.
Links to other websites
Our website may contain links to other websites of interest. However, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.
Do we share your data with anyone?
We do not sell, rent or trade your information with any third parties.
Unless we have your permission, we do not share your information with any third parties except from what is described below:
Building Health Partnerships and Transforming Healthcare Together
Your data may be shared with our trusted partners – these programmes are run by us in partnership with Social Enterprise UK, and funded in partnership by NHS England and The National Lottery Fund. Elements are also delivered by The King’s Fund and the National Council for Voluntary Organisations. We will provide only the information required to perform specific services.
If you have signed up to an event through Eventbrite, your details will be shared with the organisers of that event. Your information will only be used for the organisation of that event and to notify you of follow up events, unless you consent to join the Building Health Partnerships or Transforming Healthcare Together mailing list. If you consent to join the Building Health Partnerships mailing list, your details will be shared with Mailchimp (see below).
If you sign up to the Practice Development Network (part of Transforming Healthcare Together) your data will be shared with Social Enterprise UK and NHS England’s Voluntary Partnerships Team, who coordinate the network.
Divert Digital Ltd
Facebook, Twitter, LinkedIn
Facebook, Twitter and LinkedIn are social networks. Integration of social network components allows them to track which page on our site you are accessing, but only if you are logged in to their account. If you do not wish this, please log out of your social network accounts before browsing the web.
When someone visits our website we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.
Google Analytics is further explained here: https://www.google.com/analytics/
When someone visits our website we use a third party service, HotJar, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as how far down the webpage users scroll. This information is only processed in a way which does not identify anyone. We do not make, and do not allow HotJar to make, any attempt to find out the identities of those visiting our website.
Further information about HotJar can be accessed here: https://www.hotjar.com/legal/policies/privacy
We use a third-party provider, MailChimp, to deliver our newsletter. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our e-newsletter. For more information, please see MailChimp’s privacy notice: https://mailchimp.com/legal/privacy/
You can unsubscribe to general newsletter mailings at any time by clicking the unsubscribe link at the bottom of any of our emails or by emailing our Data Protection Lead email@example.com
SystemsIT is our IT systems provider. Your data is stored on a secure, password protected hosted desktop cloud-based system within the European Economic Area (EEA). If you require further information, please contact firstname.lastname@example.org
We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect.
Your right to complain with a supervisory authority
If you are unhappy with the way in which your personal data has been processed, you may, in the first instance, contact IVAR’s Data Protection Lead email@example.com
If you remain dissatisfied, then you have the right to apply directly to your national supervisory authority for a decision. The supervisory authority for the United Kingdom is the Information Commissioner’s Office, which can be contacted at: https://ico.org.uk/concerns/
Existence of automated decision-making
As a responsible organisation, we do not use automatic decision-making or profiling.