Pepal is committed to protecting any personal information we have about programme participants, partners, facility members, staff and other groups we communicate with. This Privacy Statement sets out how we obtain, use and protect personal information.
We are a "data controller" for the purposes of the Data Protection Act 1998 and (from 25 May 2018) the EU General Data Protection Regulation 2016/679 ("Data Protection Law"). This means that we are responsible for, and control the processing of, your personal information.
The Pepal website contains links to websites owned and operated by third parties. These third-party websites have their own privacy policies - we cannot accept any responsibility or liability for the privacy practices of any such third party websites.
2. Who we are
Pepal Foundation is a registered charity (Charity no. 1137688) and Pepal Limited is a Limited Company (6949484). Pepal's registered address is Somerset House, Strand, London, WC2R 1LA. Pepal brings together leaders from NGOs and global corporations to find practical solutions to pressing social issues.
3. What personal data does Pepal collect?
When you communicate with Pepal, for example when participating in a Pepal programme; partnering with Pepal; applying for a job; engaging with online content, such as newsletters; or you telephone, email, write to, text, or engage with Pepal via social media channels, we may receive and retain personal information about you. This can consist of information such as your name, email address, postal address, telephone number and date of birth.
By submitting your details, you enable Pepal (and where applicable any sub-contractors we may use) to provide you with the services, information, activities or online content you select.
Data Protection Law recognises that certain categories of personal information are more sensitive than others. This is known as ‘sensitive personal data’ and covers information such as health information, race, religious beliefs and political opinions. We do not routinely collect ‘sensitive personal data’.
We do collect sensitive personal data where there is a clear reason for doing so and we will request explicit consent at the point of collection. Reasons include, but are not limited to: participation in a Pepal Programme, where medical information is needed to ensure that we can keep you safe, or when you are employed with us and we need more detailed information around your health, for example.
We will also seek explicit consent whenever we take, store and publish photographs or request for stories and/or quotes.
4. How will Pepal use the information you collect?
Pepal may use your personal information for a number of purposes including the following:
- To reply to correspondence (whether by letter, email, text, social media, message board or any other means)
- For administration purposes (e.g. running Pepal programmes)
- For internal record keeping
- To fulfil sales contracts, Memorandums of Understanding or other contracts that you or your organisation has entered into with Pepal
- To contact you about any content you provide
- To invite you to participate in surveys or research about Pepal or our work (participation is always voluntary)
- For marketing purposes
- To provide you with information about our activities
- Employment: we need to ensure that we meet our obligations as an employer and manage people effectively in the organisation
- Legal, regulatory and tax compliance: where we are subject to a legal obligation, we may process your personal information to fulfil that obligation
6. Legal basis for collecting Information
In some situations, the best approach for Pepal is to process personal data because of our legitimate interests, rather than consent.
When we use your personal information, we will always consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that are not unduly intrusive or unfair.
7. Your choice
If you do not want us to use your personal information to keep you updated about our activities, please let us know.
You may opt-out of our communications at any time by clicking the ‘unsubscribe’ link in at the end of our news emails. You can also change any of your contact preferences at any time by emailing ‘sarah <dot> galvin@pepal <dot> org’
We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted by us for such purposes. However, we will retain your details on a list to help ensure that we do not continue to contact you again.
8. Will Pepal share my personal information with anyone else?
Pepal will not, under any circumstances, share or sell your personal data with any third party for marketing purposes and you will not receive offers from other companies or organisations as a result of giving your details to us.
We may need to share your information with 'data processors', such as our service providers, associated organisations and agents who help us to prepare and send the materials relating to our work. These 'data processors' will only act under our instruction and we will not allow them to use your data for their own purposes and will take care to ensure that they keep your data secure.
We will also comply with legal requests where disclosure is required or permitted by law (for example to government bodies for tax purposes or law enforcement agencies for the prevention and detection of crime, subject to such bodies providing us with a relevant request in writing).
9. How long will Pepal keep my personal information?
If you have taken part in a Pepal programme we will delete all information one month after the completion of the programme. However, we will retain your contact details to update you about Pepal projects. Where you have given us your explicit permission, we may retain photographs and comments you have made about the programme and attribute them to you.
For information collected outside Pepal programmes, we will retain information as long as is reasonable and necessary.
If you request that we stop sending you materials, we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.
10. How do Pepal update, correct, or delete my personal information?
The accuracy of your information is important to us. We want to ensure that we are able to communicate with you in ways that you are happy with, and to provide you with information that is of interest. If you wish to change how we communicate with you, or update the information we hold, please contact us:
- Email at: ‘sarah <dot> galvin@pepal <dot> org’
- Write to us at: Pepal Foundation, Somerset House, Strand, London, WC2R 1LA
Under the Data Protection Act you have the right to request a copy of the personal information we hold about you and to have any inaccuracies corrected.
11. Under 16s
Pepal does not collect and store information about anyone under 16.
If you have any questions or concerns about the use of your data, please contact our Data Compliance Officer, Sarah Galvin on ‘sarah <dot> galvin@pepal <dot> org’
If you believe that we have not complied with this statement or not acted in accordance with the Data Protection Law, please notify Sarah Galvin immediately.
You can also make a referral to the Information Commissioner’s Office (ICO), although we request that you try to resolve the matter with us first.