Privacy policy

How we collect and use personal data.

Who are we?

The Institute for Voluntary Action Research (IVAR) is a small, independent charity. We work with other charities, foundations and public agencies to strengthen communities across the UK. We do this through action research – working with specific groups in communities and sharing findings more widely. As a team, we believe in the value of people and organisations working for social change – we see the difference they make every day.

Our website address is www.ivar.org.uk

When do we collect personal data about you?

When you interact with us in person, through correspondence, by phone, by social media, by signing up to an event, or through our website. We may collect personal data if it is considered to be of legitimate interest, and if this interest is not overridden by your privacy interests. Before data is collected, we make an assessment to ensure that there is an established mutual interest between you and IVAR.

Why do we collect personal data?

We collect and use personal data for:

• Replying to your enquiries
• Contractual and legal obligations
• To carry out research
• To achieve our charitable mission of sharing insights and ideas with people and organisations across the voluntary, public and funding sectors
• To organise events

We also collect data about suppliers, partners and people seeking a job or working at IVAR.

How do we collect personal data?

We collect your data when you:

• Initiate contact through email, phone or other means of direct communication
• Sign up to our newsletter (e.g. on our website or by following an email link)
• Submit a comment through our website
• Take part in a research project (or an organisation you are affiliated with takes part in a research project)
• Sign up to an event (e.g. through our website, Eventbrite or Calendly)

How do we use your personal data?

We may use your information for the following purposes:

• To send you updates about our work. These may include information about published research, new projects, events or activities of associated partners. This communication is subscription based. You can unsubscribe from these communications by clicking the unsubscribe link in emails we send.
  • If you are an individual subscriber, we are contacting you because you have consented to receive these communications through our website, when you attended an event or when you took part in a research project with us.
  • If you are a business contact and subscribed to our newsletter on or after 25 May 2018, we are contacting you because you have consented to receive these communications through our website, when you attended or signed up for an event or when you took part in a research project with us.
  • If you are a business contact and subscribed to our newsletter on or before 24 May 2018, we are contacting you on the basis of legitimate interests, as our charitable mission is to share research and insights with those who would find them useful and usable. You consented to receive these communications through our website, when attending an event or in communication with one of our team.
  • If you are a business contact, we may also be contacting you on the basis of legitimate interests because a colleague consented to receive communications from us and has referred these communications to you (e.g. after leaving the organisation or going on maternity leave).
• To contact you about a research project that you have taken part in. This is a legitimate interest.
• To contact you about an event that you have signed up for. This is a legitimate interest.
• To follow up on incoming requests (customer support, emails, or phone calls). This is a legitimate interest.
• To show photos of the kinds of people we work with on our website. We will only display images that people have consented to being used for communications purposes – to us or to organisations we work with.
• To fulfil contractual and legal obligations.
• To notify you about any disruptions to our services (system messages). This is a legitimate interest.
• To process a job application. This is a legitimate interest.

If you would like more information please do get in touch with our Data Protection Lead: diana@ivar.org.uk

What type of personal data is collected?

We collect your name, phone number, title and email address, in addition, your postal address, organisation name and contact information (if relevant). We may also collect feedback, comments and questions received from you in service-related communication and activities, such as meetings, phone calls, documents, and emails. From our website we may collect IP-address and actions taken on the site.

If you add posts or comments, etc. on our website, the information can be read by anyone with access to the site and used for purposes over which we or you have no control. Therefore, IVAR is not responsible for any information you submit to the website.

If you consent to take part in a research project with IVAR, then you will be notified what type of personal data will be collected before giving your consent. You will also be notified about how we will use this personal data and how long we will keep it.

We may ask for your consent to take photos or video of you for use in our communications.

If you apply for a job at IVAR, we collect the data you provide during the application process.

IVAR does not collect or process any special categories of personal data, such as public unique identifiers or sensitive personal data.

How long do we keep your personal data?

We will not store your personal data for any longer than necessary to fulfil the purpose for which the personal data was collected; while also considering our need to answer your queries or resolve possible problems, to comply with legal obligations, to attend to any legal claims/complaints, and for safeguarding purposes.

This means that we may retain your personal data for a reasonable period of time after your last interaction with us. When the personal data that we have collected is no longer required, we will delete it in a secure manner. We may process data for statistical purposes, but in such cases, data will be anonymised.

Your rights to your personal data

You have the following rights with respect to your personal data:

1. The right to withdraw any consent to personal data processing at any time. For example, your consent to receive our newsletter. If you want to withdraw your consent to our newsletter, please make use of the unsubscribe link included in our communication. Please note that you may still receive administrative communications from us.
2. The right to request that IVAR provides you with your personal data and, if possible, to pass on this information directly (in a portable format) to another data controller when the processing is based on consent or contract. You can send this query to diana@ivar.org.uk
3. The right to request a restriction on further data processing, in case there is a dispute in relation to the accuracy or processing of your personal data. You can send this query to diana@ivar.org.uk
4. The right to object to the processing of personal data, in case data processing has been based on legitimate interest and/or direct marketing. You can send this query to diana@ivar.org.uk

Any query about your personal data and privacy rights should be sent to diana@ivar.org.uk

The use of cookies and beacons

We use cookies and web beacons (Website Navigational Information) to collect information as you navigate IVAR’s website. Website Navigational Information includes standard information from your web browser, such as browser type and browser language; your Internet Protocol (IP) address; and the actions you take on the IVAR’s website, such as the web pages viewed and the links clicked.

This information is used to make websites work more efficiently, as well as to provide business and marketing information to the owners of the site, and to gather such personal data as browser type and operating system, referring page, path through site, domain of Internet Service Provider (ISP), etc., for the purposes of understanding how visitors use a website. Cookies and similar technologies help us tailor our website to your personal needs, as well as to detect and prevent security threats and abuse. If used alone, cookies and web beacons do not personally identify you.

For further information visit http://www.aboutcookies.org or http://www.allaboutcookies.org. You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However, in a few cases some of our website features may not function as a result.

Links to other websites

Our website may contain links to other websites of interest. However, you should note that we do not have any control over these other websites. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Do we share your data with anyone?

We do not sell, rent or trade your information with any third parties.

Unless we have your permission, we do not share your information with any third parties except from what is described below:

Calendly

We may collect your data through Calendly, which is an event organisation tool. You can access Calendly’s privacy policy here: https://calendly.com/privacy

Connecting Health Communities

Your data may be shared with our trusted partners – these programmes are run by us in partnership with local steering groups, and funded by The National Lottery Fund. We will tell you when we collect your data whether it may be shared and with whom. We will provide only the information required to perform specific services.

If you have signed up to an event through Eventbrite, your details will be shared with the named organisers of that event. Your information will only be used for the organisation of that event and to notify you of follow up events, unless you consent to join our health partnerships mailing list. If you consent to join this mailing list, your details will be shared with Mailchimp (see below).

Facebook, Twitter, LinkedIn

Facebook, Twitter and LinkedIn are social networks. Integration of social network components allows them to track which page on our site you are accessing, but only if you are logged in to those accounts. If you do not wish this, please log out of your social network accounts before browsing the web.

Facebook privacy policy can be accessed here: https://facebook.com/about/privacy/
Twitter privacy policy can be accessed here: https://twitter.com/privacy?lang=en
LinkedIn privacy policy can be accessed here: https://www.linkedin.com/legal/privacy-policy

Eventbrite

We may collect your data through Eventbrite, which is an event organisation tool. You can access Eventbrite’s privacy policy here: https://www.eventbrite.co.uk/support/articles/en_US/Troubleshooting/eventbrite-privacy-policy?lg=en_GB

Google Analytics

When someone visits our website, we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

Further information and the applicable data protection provisions of Google can be accessed here: https://www.google.com/intl/en/policies/privacy/ and http://www.google.com/analytics/terms/us.html

Google Analytics is further explained here: https://www.google.com/analytics/

HotJar

When someone visits our website we use a third party service, HotJar, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as how far down the webpage users scroll. This information is only processed in a way which does not identify anyone. We do not make, and do not allow HotJar to make, any attempt to find out the identities of those visiting our website.

Further information about HotJar can be accessed here: https://www.hotjar.com/legal/policies/privacy

MailChimp

We use a third-party provider, MailChimp, to deliver our e-newsletter. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our e-newsletter. For more information, please see MailChimp’s privacy notice: https://mailchimp.com/legal/privacy/

You can unsubscribe to general newsletter mailings at any time by clicking the unsubscribe link at the bottom of any of our emails or by emailing our Data Protection Lead diana@ivar.org.uk

Beacon CRM

We use a third-party provider, Beacon, as our Customer Relationship Management (CRM) System.  You can access Beacon’s privacy policy here:Privacy Policy – Beacon (beaconcrm.org).  

It’s sub-processor is Google Cloud Platform, and you can review the full list of sub-processors on the Beacon sub-processor page.

SystemsIT

SystemsIT is our IT systems provider. Your data is stored in Microsoft’s Office 365 public cloud with security controls and policies in place to protect this data. All data is stored within the United Kingdom. If you require further information, please contact diana@ivar.org.uk

Security

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect.

Your right to complain with a supervisory authority

If you are unhappy with the way in which your personal data has been processed, you may, in the first instance, contact IVAR’s Data Protection Lead diana@ivar.org.uk

If you remain dissatisfied, then you have the right to apply directly to your national supervisory authority for a decision. The supervisory authority for the United Kingdom is the Information Commissioner’s Office, which can be contacted at: https://ico.org.uk/concerns/

Existence of automated decision-making

As a responsible organisation, we do not use automatic decision-making or profiling.

Changes to this privacy policy

IVAR reserves the right to remove or amend this this privacy policy. If we decide to replace or change it, we will post a new policy, or the changes, to this privacy policy on this page. We encourage you to visit this page frequently to stay informed.