European Capacity Building Initiative

Privacy Notice

Oxford Climate Policy

 

Privacy Notice Concerning the ecbi Network 

 

November 2018

 

A summary of what this notice explains

Oxford Climate Policy (‘OCP’) is committed to protecting the privacy and security of personal data. This notice explains what personal data OCP holds about the ecbi network and other associated groups (“you”), how we use it internally, how we share it, how long we keep it and what your legal rights are in relation to it.

 

For the parts of your personal data that you supply to us to us, this notice also explains the basis on which you are required or requested to provide the information. For the parts of your personal data that we generate about you, or that we receive from others, it explains the source of the data. We process your personal data on the basis of your consent. This notice sets out the categories and purposes of data where your consent is needed.

 

What is your personal data and how does the law regulate our use of it?

“Personal data” is information relating to you as a living, identifiable individual.  We refer to this as “your data”. “Processing” your data includes various operations that may be carried out on your data, including collecting, recording, organising, using, disclosing, storing, and deleting it.

 

Data protection law requires us:

  • To process your data in a lawful, fair and transparent way;
  • Only to collect your data for explicit and legitimate purposes;
  • Only to collect data that is relevant, and limited to the purpose(s) we have told you about;
  • To ensure that your data is accurate and up to date;
  • To ensure that your data is only kept as long as necessary for the purpose(s) we have told you about;
  • To ensure that appropriate security measures are used to protect your data.

 

Oxford Climate Policy’s Contact Details 

If you need to contact us about your data, please contact administrator@oxfordclimatepolicy.org or director@oxfordclimatepolicy.org.

 

What personal data we hold about you and how we use it

We may hold and use contact data about you, which we have received from you, at different stages of our relationship with you. Categories of data that we collect, store and use include (but are not limited to):

  • Contact details that you provide to us, including names, addresses and telephone numbers. 
  • Dietary and accessibility requirements 
  • Photographs, audio and video recording of ecbi or OCP events that you attend. 

 

The lawful basis on which we process your data

The law requires that we provide you with information about the lawful basis on which we process your personal data, and for what purpose(s). Most commonly, we will process your data on the following lawful grounds:

  • Where it is necessary to perform the contract we have entered into with you; 
  • Where necessary to comply with a legal obligation; 
  • Where necessary for the performance of a task in the public interest; 
  • Where necessary for our legitimate interests (or those of a third party), providing your interests and fundamental rights do not override those interests. 

 

We may also use your personal information, typically in an emergency at a network event, where this is necessary to protect your vital interests, or someone else’s vital interests. In a small number of cases where other lawful bases do not apply, we will process your data on the basis of your consent.

 

Profiling

OCP may analyse the personal information we collect about you in order to build a profile which helps us to decide what communications are likely to be of interest to you. In addition to information that you have provided to OCP or the ecbi network over time, we may be given information by your colleagues or acquaintances. We may also seek out information, using public databases, in order to fill‐in gaps in our knowledge and thereby deepen our relationship with you.

 

While we do have a legitimate interest in carrying out such analysis, you have the right to request that we do not process your personal data in this way.

 

We do not outsource profiling activity. If we decide to outsource such activity in the future, we will inform you of who we are outsourcing the activity to and provide you with not less than one months’ notice of this.

 

Data that you provide to us and the possible consequences of you not providing it

Most data that you give to us is provided on a wholly voluntary basis – you have a choice whether to do so. Examples include disability and health condition information, which you may choose to provide to us in order that we can take this information into account when considering whether to make a reasonable adjustment under the Equality Act 2010, for example in relation to accessibility for events. 

 

The consequences for any failure to provide such data will depend on the particular circumstances. For example, if you decide not to provide information about your disability, this might mean that we cannot make a reasonable adjustment to assist you.

 

Other sources of your data

Apart from the data that you provide to us, we may also process data about you from a range of sources. These include:

  • Data that we generate about you, such as when communicating with you, and/or inviting you to or arranging your attendance at events; 
  • Third parties such as venues, who may process bookings that you make to the event
  • Local and international media sources, when you are mentioned in published articles, lists or other commentary; 

 

How we share your data

We will not sell your data to third parties. We will only share it with third parties if we are allowed or required to do so by law.Where website information is shared with third parties, we will seek to share the minimum amount of information necessary to fulfil the purpose.  

 

All our third party service providers are required to take appropriate security measures to protect your personal information in line with our policies, and are only permitted to process your personal data for specific purposes in accordance with our instructions.  We do not allow our third party providers to use your personal data for their own purposes.

 

Sharing your data outside the European Union

The law provides various further safeguards where data is transferred outside of the EU. When you are resident outside the EU in a country where there is no “adequacy decision” by the European Commission, and an alternative safeguard is not available, we may still transfer data to you which is necessary for performance of your contract with us (if you are a staff member or student).

 

Otherwise, we may transfer your data outside the European Union, but only for the purposes referred to in this notice and provided either:

  • There is a decision of the European Commission that the level of protection of personal data in the recipient country is adequate; or
  • Appropriate safeguards are in place to ensure that your data is treated in accordance with UK data protection law, for example through the use of standard contractual clauses; or
  • There is an applicable derogation in law which permits the transfer in the absence of an adequacy decision or an appropriate safeguard.

 

Automated decision-making

We do not envisage that any decisions will be taken about you based solely on automated means, however we will notify you in writing if this position changes.

 

How long we keep your data

We retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purpose of satisfying any legal, accounting or reporting requirements. 

 

Your legal rights over your data

Subject to certain conditions set out in UK data protection law, you have:

  • The right to request access to a copy of your data, as well as to be informed of the manner in which your data is being used;
  • The right to have any inaccuracies in your data corrected, which may include the right to have any incomplete data completed;
  • The right to have your personal data erased in certain circumstances;
  • The right to have the processing of your data suspended, for example if you want us to establish the accuracy of the data we are processing.
  • The right to receive a copy of data you have provided to us, and have that transmitted to another data controller (for example, another environmental agency).
  • The right to object to any direct marketing by us, and to require us to stop such marketing.
  • The right to object to the processing of your information if we are relying on a “legitimate interest” for the processing or where the processing is necessary for the performance of a task carried out in the public interest. 
  • The right to object to any automated decision-making about you which produces legal effects or otherwise significantly affects you. 
  • Where the lawful basis for processing your data is consent, you have the right to withdraw your consent at any time.  
  • When you tell us you wish to exercise your right, we will stop further processing of such data. This will not affect the validity of any lawful processing of your data up until the time when you withdrew your consent. You may withdraw your consent by contacting the relevant office within OCP that you are dealing with or that is processing your data, or by contacting OCP’s Office as below.

 

Further guidance on your rights is available from the UK Information Commissioner’s Office (https://.ico.org.uk/). You may also wish to contact OCP’s Director director@oxfordclimatepolicy.org if you are considering how or whether to exercise your rights. 

 

You have the right to complain to the UK’s supervisory office for data protection, the Information Commissioner’s Office, if you believe that your data has been processed unlawfully.

 

Future changes to this privacy notice


We may need to update this notice from time to time, for example if the law or regulatory requirements change, if technology changes or to make the OCP’s operations and procedures more efficient. If the change is material, we will give you not less than two months’ notice of the change so that you can decide whether to exercise your rights, if appropriate, before the change comes into effect. We will notify you of the change by means of updates on the primary public website.