This policy sets out how we will treat your personal information in compliance with General Data Protection Regulation (GDPR) which came into law on May 25th 2018.

Data protection can be confusing so we’ve tried to avoid too much ‘legal-ese’.

For enquiries on data protection please contact Oliver Monty (Data Protection Officer)

Key Pledges

  • We collect and use your personal data to improve your experience and the experience of charities and social enterprises we support.
  • Trust is important to us and we’re dedicated to protecting your personal data to the best of our ability.
  • We want to be as transparent as possible with how we use your data. This means no surprises.
  • We want to communicate with you in the right way based on the information we have. This means sending relevant messages. No spam.
  • We only keep things as long as we need to. We don't hold your data indefinitely.

 

1. How we manage your data

2. What kind of data we collect and why

3. Your rights as a data subject

4. How we protect your data

5. On what grounds we use your data

6. How long we hold your data

7. Sharing your data

8. Marketing and website 'cookies'

9. Profiling 

10. Changes to our data privacy policy

 

1. How we manage your data

Social Investment Business is a data controller registered with the ICO. We decide how and why our data is used (as a controller) while also working with the data to achieve a purpose (as a processor). 

Back to top

2. What kind of data we collect and why

We may process certain types of personal data about you as follows:

  • Identity data may include your first name, maiden name, last name, username, marital status, title, date of birth and gender.
  • Contact data may include your address, email address and telephone numbers.
  • Financial data may include your bank account and payment card details.
  • Transaction data may include details about payments between us.
  • Technical data may include your login data, internet protocol addresses, browser type and version, browser plug-in types and versions, time zone setting and location, operating system and platform and other technology on the devices you use to access this site.
  • Profile data may include your username and password, purchases or orders, your interests, preferences, feedback and survey responses.
  • Usage data may include information about how you use our website, products and services.
  • Marketing and communications data may include your preferences in receiving marketing communications from us and our third parties and your communication preferences.

We use your data for the primary goal of delivering our service to support charities and social enterprises. Like many organisations, processing data is critical for the day-to-day operations of our business; from marketing to fund management.

We may also process sensitive personal data, for example, health records of staff or criminal records for recovery funds. We require your explicit consent for processing sensitive data, so when you submit your details, we will ask for your explicit agreement in providing this information to us.  

We process personal information about:

  • employees
  • customers and clients
  • suppliers
  • complainants, enquirers
  • professional advisers and consultants

Back to top

3. Your rights as a data subject

If we hold your personal data you have rights outlined by General Data Protection Regulation and the Data Protection Act 1998/2018.

  • You have the right to be informed about the collection and use of your personal data when it is obtained.
  • You have the right to be forgotten i.e. for us to no longer store your information. However, there are instances such as statutory/contractual agreements which mean we may have to keep hold of some details.
  • You have the right to ask for a subject access request (SAR). This means you can ask us for all the information we hold on you and we are obliged to provide this to you in a portable format by one month (30 days). Please note that requests deemed as ‘excessive’ can be denied or charged for. To request a SAR please contact us.
  • You have the right to complain to the ICO if you believe your personal data is compromised in any way.

Back to top

4. How we protect your data

We have various security measures in place to protect all personal data we hold.

Internally, we maintain strict staff permission sets and a control group policy which limits data access to the relevent staff. We also educate staff on data protection through practical workshops and training at the start and throughout their employment with us.

To protect ourselves from external threats, we maintain active cyber security management (e.g. SSL encryption) and have a robust emergency response plan in place in the event of a data breach.

As part of our ongoing contractual agreements with third-party processors, we adhere to strict rules and guideline policies.

Back to top

5. On what grounds we use your data

There are several rules that guide how we use your data.

Basis

Examples of how we do this

Consent

If you apply for a fund we will ask you to confirm that you are happy for us to inform you about future funds.

Contract

If you receive funding from us it will be necessary for us to maintain certain details for administrative purposes.

Legal obligation

If you enter into a legally-binding financial agreement with us certain personal information will need to be kept.

Legitimate interest

Our legitimate interest is to provide support to organisations through finance and related services. We need to prove that this is balanced with your rights as a data subject.

Back to top

6. How long we hold your data for

We have varied retention periods for each type of data we process but will always try to limit the length of time we hold your data.

Reason for retaining

Example

Retention period

Statutory

Information on staff

Data on ex-employees must be kept for six years (from the end of employment).

Contractual

Applications for funding

Length of time specified in contract.

Administrative

Email enquiries to helpline

No longer than necessary for the purposes we obtained it for.

If you would like more detail on how long specific type of data is kept please get in touch.

Back to top

7. Sharing your data

We may disclose information about you to any of our employees, suppliers or subcontractors insofar as reasonably necessary for the purposes as set out in this privacy policy.

We will not without your express consent provide your personal information to any third parties for the purpose of direct marketing.

Occasionally, Social Investment Business will act as a ‘joint controller’. This means we will share information between us and a partner organisation – for example, on a collaborative fund where another controller is providing business support. We don’t share your information without your consent.

Third party organisations which we use for data processing are chosen on the grounds of their adherence to a Privacy Shield Agreement (US-EU, Swiss Shield).

We may provide third parties with aggregated but anonymised information and analytics about our customers and, before we do so, we will make sure that it does not identify you.

Back to top

8. Marketing and website 'cookies'

We want to promote our new fund launches, resources and news with you. We do this in the following ways:

  • Emailing website visitors that consent to our email marketing.
  • Emailing organisations that have applied to our fund programmes who we might assume may be interested in hearing about similar funds.
  • Promoting our funds to our 'followers' across social media platforms.

You can unsubscribe from our fund updates from this at any time or tailor what you would prefer to receive via our email preference centre.

We use cookies to track the use of our website. We do this in order to monitor and improve the user experience through Google Analytics.

A cookie consists of information sent by a web server to a web browser, and stored by the browser. The information is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.

Most browsers allow you to reject all cookies, whilst some browsers allow you to reject just third party cookies.  For example, in Internet Explorer you can refuse all cookies by clicking “Tools”, “Internet Options”, “Privacy”, and selecting “Block all cookies” using the sliding selector.  Blocking all cookies will, however, have a negative impact upon the usability of many websites.

Back to top

9. Profiling

We operate a limited form of profiling in the interests of providing relevant targeted marketing communications to our stakeholders. For example, news subscribers who have willingly given us the information that they work in the physical health or sports space may receive an alert about a sports fund launch.

We do not currently have any automated or AI-based decision-making in place.

Back to top

10. Changes to our data privacy notice

We may change this page from time to time, to reflect how we are processing your data.

If we make significant changes, we will make that clear on our website or contact you so that you are able to review the changes before you continue to let us use your data.

Back to top

Contact us

For enquiries on data protection please contact Oliver Monty (Data Protection Officer) via the link below.

 

accreditation
SEUK Logo
accreditation
CAN Logo
accreditation

The Social Investment Business is the trading name for the Social Investment Business Foundation, Registered Company No. 05777484 (England), Registered Charity No 1117185 (England & Wales), The Social Investment Business Limited, Registered in England No. 06490609, VAT No. 927456693 and Futurebuilders-England Limited, Registered in England No. 05066676. Registered Office: CAN Mezzanine, Borough, 7-14 Great Dover Street, London, SE1 4YR

We use cookies to improve your experience using this website. Learn more