IWPR's Privacy Notice

The Institute for War & Peace Reporting (IWPR) gives voice to people at the frontlines of conflict and transition to help them drive change.

IWPR supports local reporters, citizen journalists and civil society activists in countries in conflict, crisis and transition around the world. We contribute to peace and good governance by strengthening the ability of media and civil society to speak out. We do this by training, mentoring and providing platforms for professional and citizen reporters; building up the institutional capacity of media and civic groups; and working with independent and official partners to remove barriers to free expression, robust public debate and citizen engagement.

Institute for War & Peace Reporting is registered as a charity in the United Kingdom (charity reg. no: 1027201, company reg. no: 2744185); in the United States as a not-for-profit organisation with tax-exempt status under IRS section 501(c)(3); and as a charitable foundation in The Netherlands.

We are also a Data Controller, registered with the Information Commissioner’s Office, Registration Number: ZA436951.

We understand that your privacy is important to you and that you care about how your personal data is used.  We respect and value the privacy of the individuals whom we process personal information.  We will only collect and use personal data in a way that is consistent with our obligations and individual rights under the law.

This policy explains how we collect, manage, use and protect your personal data, including how we work with third parties.

Personal data is any information about you that enables you to be identified. This includes obvious information such as your name and contact details, but also includes any personal data you voluntarily provide to us and less obvious online identifiers, such IP addresses and cookies.

Sensitive personal data (referred as special categories personal data within GDPR), is subject to additional safeguards and includes information relating to race or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; physical or mental health; genetic data; biometric data; sexual life or sexual orientation; and criminal records.

We will only collect or use this type of data if there is a specific reason for doing so. We will always explain this reason to you when we ask for the data and will usually ask for your explicit consent to use it. For example, if you travel abroad on our behalf, we will ask to collect and store information on your health for your own protection and to make sure that we can provide you with appropriate facilities and support. We wouldn’t ask for consent if it is information that you have clearly made public, for example, the political views of a political figure or candidate, or your religion if you are working with us because you represent a faith group such as your church.

Your personal data is protected by specific legislation:

• General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679);
• Privacy and Electronic Communications (EC Directive) 2003.

It is important that you understand your legal rights around your personal data and how we may use it. If you would like to discuss or exercise any of these rights, please contact us.

Right to be informed

This Privacy Policy ensures that you are informed about how we will process your personal data. You might also see messages on some of our forms (or otherwise when we collect personal data from you) that explain why we ask for specific pieces of information from you.

Right of access

You have the right to access a copy of your personal data and receive certain information about what the data is and how and why we are processing it. Please note that we will require you to prove your identity before we disclose any information.

Right to rectification

If you feel that any of the information that we hold about you is incorrect, do let us know so that we can look into it.

Right to object

You have the right to object to the processing that we have outlined in this policy.

Right to erasure/to be forgotten

You have the right to request that we delete your information and can discuss this with us at any time.

You should know that there are some circumstances where we may need to keep your details, for example, if it is necessary to comply with a legal obligation on us. If this situation occurs, then we will explain and discuss these circumstances with you. In some situations, to enable us to honour your request to erase you, there may be minimum information that we are required to maintain.

Right to restrict processing

You can request that we restrict processing of your data, as an alternative to deleting it – this means that we will keep the data but stop processing for most purposes. You may want to exercise this right if you feel that the data is inaccurate, that our processing of it is unlawful, whilst we progress a request from you to object to processing, or if we have no further need of the data, but you require us to keep it in relation to the establishment, exercise or defence of a legal claim.

Rights related to automated decision making

You have rights to avoid being subject to decisions based solely on automated processing (including profiling) which has a significant effect on you. At IWPR we do not carry out any such processing.

Right to data portability

You have the right to request a copy of certain personal data to have it transferred to another organisation in certain circumstances.

You should know that there are some circumstances where these rights may not apply, but where this is the case we will always explain this to you.

In this Notice, we collectively refer to handling, collecting, protecting or storing your personal data as “processing” such personal data.

Why we collect and use personal data

We collect personal data to help us to process your requests, keep in touch with you and to help us to interact with you in the most effective way.

Examples of why we process your personal data include:

• Keeping you updated on our work and the impact of your support;
• Making sure you know about events that you can participate in as an IWPR supporter;
• Inviting you to participate in campaigns;
• Sending you fundraising appeals;
• Processing donations or other payments, and verifying financial transactions to protect you from fraud;
• Processing Gift Aid donations and Gift Aid Declarations;
• Processing a legacy or gift that you leave in your will;
• Providing services, products or information you have requested;
• Checking with you on how you want us to contact you, and record these preferences;
• Keeping notes of conversations that you have with our team, as a reference if you want to revisit the conversation later;
• Notifying you of changes to our policies when these affect you;
• Ensuring that content from our site is presented in the most effective way for you and your computer;
• Processing a job application you may make with us, or
• If we need to do so, to comply with a law, process or regulatory requirement.

The information that we collect

The personal data that we collect about you will be based on how you interact with us, including through your use of our website, when you contact or request information from us or as a result of our work.  The personal information that we process includes:

• Your name;
• Your postal and email addresses;
• Your telephone number or numbers;
• Details of any correspondence that we have had with you. For example, if you call our office, a staff member may make a note of the conversation, in case you need anything else on that matter;
• How you would like to hear from us, and when you told us this;
• Details of any donations that you have made to us;
• Whether or not you have signed up to the Gift Aid Scheme, and when you did so;
• Your date of birth;
• Any fundraising appeals that you may have responded to;
• Events that you have taken part in or enquired about.

There is also other information that we may collect and hold in specific circumstances. For example:

• Your bank account details if you set up a direct debit with us;
• Health information that you give us if you are participating in an event, to help us to ensure your safety;
• Campaigning actions that you have taken on our behalf;
• Our telephone system lists the numbers that have recently called or been dialed, but we do not link these to any personal records;
• Information to support our work with high net worth individuals, to understand their philanthropic interests, and complete any necessary due diligence.

How and when we collect information about you

There are a number of ways that we collect information; most often this will be directly from you, for example, if you fill out a form on our website, or directly with one of our fundraisers. Whenever we ask for information from you we will explain why we are asking for it (including by reference to this policy), and, where applicable, you will always be given a choice about how we communicate with you.

In some very specific circumstances we will gather data from publicly available sources, to help us in our work with High Net Worth Individuals. You can find more information on this research and details of these sources in our Information on profiling section below. We use data from third parties to keep our records up to date, (such as where you have signed up to the Telephone or Fundraising Preference Services) or to enhance the information that we hold. Sometimes you will also provide data to third parties who then pass it to us with your permission. For example, you may be raising money for IWPR through JustGiving or similar fundraising platforms, or you may have signed up to one of our campaigns through an external website.

You can find out more about this in our section on how we work with third parties, below.

We do not buy lists of data to use for our marketing purposes or share data with other charities for them to use in their marketing purposes.

Use of IWPR’s website

IWPR’s website privacy policy explains how what data is collected about those using IWPR’s website and how it is used. It includes an explanation of IWPR’s use of “cookies”. Like most websites, the IWPR site uses cookies – small data files that are downloaded when you use a website, to make the site easier to use. The information that is gathered is totally anonymous to us, but it helps us to see how people use our site, so that we can provide a better user experience

We will make it easy for you to tell us if you would like to receive “marketing” communications (including fundraising and campaigning communications) from us and hear more about our work, and the ways in which you would like to receive this information (post, email, SMS and phone). In every communication, we will always make it clear how you can tell us if you choose not to receive further marketing communications, either at all, on certain topics or by certain methods.

How to control the marketing that we send you

We want to make sure that we keep in touch with you when, and how you want. Every marketing communication that we send will outline how you can update us on your preferences, and all of our emails have an Unsubscribe link.

If you tell us that you do not want to receive marketing communications, we will remove you from our list and will then not send you any further marketing materials.

We will ensure that our records are updated as soon as possible once we receive your instructions. For our postal communications, it can take up to 28 days for any change to take full effect because of the production times for our campaigns, but in most cases we would expect the change to be effective much more quickly.

Administrative messages

There are some administrative messages that we legally must share with you, which are not affected by how you have told us you would like us to contact you for marketing materials.

Examples of these are:

• Confirming the details of any direct debit that you set up with us, including your bank account and payment details;
• Confirming where you have made a Gift Aid Declaration orally, so that we can give you the information on the tax implications of this.

If we send you one of these messages, we will only use it to share the detail that we have to legally provide you with and will not use it for marketing.

We undertake a number of different activities that can be known as “profiling”. We use these to help us to understand how best to manage our resources, so that we can understand your interests or your capacity to give, and give you a truly tailored experience.

The most common form of profiling that we undertake is to segment and analyse our supporter data. In practice this means sorting our data to build reports to understand the characteristics of our supporters, and how they choose to interact with us. We also use segmentation to identify particular audiences for some of our communications: for example, to send information on events to supporters who have previously enquired about or participated in these in the past. One part of segmentation is propensity modelling, where we look at different aspects of the data that we hold to determine how likely a supporter is to respond to communications that we send. Based on what you’ve done before, we will tailor any ask we make to you.

We also use profiling to help us to understand wealthy or influential individuals who are happy to support IWPR to a greater extent than is possible for most people. We will research their philanthropic interests so that we can reach out to them and invite them into a dialogue about the ways in which they might help.  You can find more about this type of profiling below.

If you do not wish us to use your details in this way, please let us know.

Working with/understanding high net worth individuals

We value the opportunity to work with people, trusts, foundations and companies that are able to support our work through partnerships, networks and higher levels of giving (typically over £5,000 a year). This is a crucial area of fundraising for us, and so we use profiling to help us to identify other individuals who may also be able to give at this level and form mutually beneficial partnerships.

We analyse our database and use information on how supporters have engaged with us in the past to see if we believe that they would be interested in building a relationship with our Major Donor fundraisers. We then use publicly available sources of information to understand their philanthropic interests and capacity to give greater support, and we may also identify other potential new supporters this way. Using this information means that we can tailor communications to areas of our work that we believe will be of interest to them, as we know that donors want information relevant to their motivations. It enables us to spend less money than we otherwise would to raise more funds, faster. It also allows us to ensure that we do not contact people inappropriately.

These external data sources include:

• Official sources such as Companies House, Charity Commission and other registers, the Electoral Roll, Who’s Who and Debrett’s guides;
• Publicly available materials such as in newspapers, magazines and reputable websites;
• Information that individuals put into the public domain such as on company websites or biographies on professional networking sites;
• Geographic and demographic information based on postcode.

We may also use a third-party companies to analyse our database against their demographic database. This helps us to understand our supporters, personalise communication for them and helps us to make the most appropriate requests to supporters who may be able and willing to contribute more. For the avoidance of doubt, we do not undertake what has traditionally been known as “wealth screening”, where an organisation asks a company to provide information that it holds on the wealth of specific named individuals.

For very high value donations we also have a responsibility (and often a legal duty) to understand the source of that money. We therefore also carry out some research on that basis, to assess and manage potential risks with regards to money laundering and other offences and ensure that there is no conflict with IWPR’s aims and ideals.

We will always make sure that we consider why we are processing your personal data and identify our legal basis for doing so. Often this will be because you have given us your consent. We may also process your data where we are furthering our legitimate aims and have assessed that the processing is not likely to be too intrusive, or to unduly infringe on your rights and freedoms. In legal terms, this is called the “legitimate interests” basis. You can find more about legitimate interests below.

In some cases, we have a legal or statutory duty to process information, and we will always comply with any legal requirement.

We may also process your personal data where it is necessary to carry out the terms of a contract which we have with you (or when we are in the process of forming that contract with you).

The “legitimate interests” basis

We have a duty to the beneficiaries of our work: to promote ourselves and our work; to responsibly raise as much money as possible to further our charitable aims; to update our supporters and the general public on our progress; and to operate in an effective way. We always pursue these interests in a respectful manner, with our supporters at the heart of what we do.

We might further our legitimate interests in the following ways:

To communicate with you about marketing and fundraising materials or products:

• To respond to requests for information, such as where you have asked for a fundraising pack;
• To send you mail relating to activity that we think you may be interested in (unless you have told us you do not want this). We will always consider how much mail you receive from us, and what the topic is, to ensure that it is appropriate;
• To contact you by telephone for fundraising or marketing purposes where you have provided us with your number. (If you have already told us that you prefer not to receive telephone calls from us, or are registered with the Telephone Preference Service then we will not call you.);
• To use social media so that you see IWPR adverts on your newsfeed. You can find more information on this in our Working with Third Parties section.

To ensure that we understand our supporters and so can contact them in a way that is relevant for them, and to make sure that we are using our marketing budgets effectively:

• To segment and analyse our data that we hold so that we can understand who our supporters are and contact them about specific activity. For example, to identify which supporters have previously participated in events, and to send them details of future activities;
• To undertake research on potential high value supporters, to understand their philanthropic interests and ensure that we only contact people whose interests align with our business. You can find further information on this below.

To manage our everyday business needs

• To work with third party suppliers, where we can make use of their expertise in a specialist field, or where they can provide services at a more cost-effective rate than we could manage internally. You can find more information on this in our Working with third parties section;
• To update our database records to keep them accurate, for example, to amend an address where we receive returned mail;
• To contact former job applicants who have been placed in our Talent Bank. You can find out more about how we use your information if you apply for a job with us below.

You have the right to object to us processing your data on the grounds of our legitimate interests. If you would like us to stop using your data on this basis, please do get in touch via info@iwpr.net. You will also see a ‘please do not contact me by post’ box on our communications where we are using the legitimate interest basis, and you can also tick this to ask us to stop sending these.

Processing your data on the basis of your consent

There are a number of circumstances where we only process your data on the basis of your consent. Examples of this are:

• To send you marketing by email;
• To send you marketing by SMS (text message);
• To send you direct messages through social media;
• To process health information that you give us if you are participating in an event or travelling with IWPR overseas.

When you give your consent for us to contact you, we do not treat this as valid indefinitely. However, we understand that our supporters want to continue to hear from us whilst they have an active relationship with us, and for a period afterwards.

Here are some examples of what we mean by an active relationship:

• If you make a donation or sponsorship payment to us, including regular monthly gifts or child sponsorship donations;
• If you attend an event we organise;
• If you tell us that you have left us a gift in your Will;
• If you take a campaigns action for us, such as signing a petition;
• If you have an ongoing conversation with one of our fundraisers about our work.

We will consider your consent to be valid whilst you take these actions, and then for 24 months afterwards, to enable us to keep you up to date with our work and to offer you other ways you might choose to support us. At the end of this time period then we will get in touch with you to re-confirm that you are happy to continue to hear from us.

We never sell or swap your details with any other organisation for their marketing purposes.

Withdrawing your consent

Where we process your personal data based upon consent, you may change your mind and withdraw your consent at any time by contacting us at info@iwpr.net.

We keep your personal data for no longer than reasonably necessary to fulfil the purposes outlined in this Notice unless a longer retention period is required or permitted by law. 

We want to make sure that we have up to date records for as long as you are actively supporting IWPR, so for as long as you take actions on our behalf or to engage with us, such as participate in our campaigns, donate to us or correspond with us. Once you are no longer an active supporter, we will keep your data for a set period of time, which we calculate depending on the information that you originally provided, and why you gave it to us. At the end of this time period, we will remove any personal details from our records of you, to ensure that any information is entirely anonymous.

In general, we will keep records of financial donors for at least seven years, to meet our requirements for any Gift Aid audit from HMRC. If we have asked for sensitive personal data specific to an event, we will dispose of this data within a month after the event.

In most cases we will keep records for seven years after you last make a donation to us.  This ensures that we keep the information we need for any financial audit (including Gift Aid audits).

We keep contact information (such as mailing list information) until a user unsubscribes or requests that we delete that information. If you choose to unsubscribe from a mailing list or newsletter, we may keep certain limited information about you so that we may honour your request.

What happens at the end of this time period?

At the end of this time period, we will remove your personal details from our records, to ensure that they are entirely anonymous. We keep records on how our supporters have interacted with us, but not of who those supporters are. For example, we want to be able to see how many supporters donated to a particular appeal, told us that they took a campaign action or requested information from us. This helps us to understand how to use our resources in the future, so that we can raise funds in the most effective way.

At IWPR, it is sometimes necessary to share your personal data with third parties. It’s important that you understand the circumstances where this might happen, and who we work with.

We never sell or swap your details with any other organisation for their marketing purposes.

These are some examples of how we work with third parties:

• Where we work with other IWPR offices, subsidiaries or affiliates;
• Where we sign a contract with a third-party supplier to carry out services for us. These contracts will always hold a supplier to our own high standards of data protection, to ensure that they treat your information with the same care as we do;
• Where you register to take part in an event, and we have to provide your details to the event organiser to secure your place;
• Where a company sends us data because you have given permission for them to share it, for example, where you set up an online giving fundraising page, sign up for an event via a third party or register with the Telephone or Fundraising Preference Services;
• Where we use companies who can help us to enhance the information that we hold about you, for example, to help us to understand which parliamentary constituency you fall into, the size and composition of your household, or the demographic of people living in your postcode area;
• Where we might use your phone number or email address to communicate with you on social media. This won’t be through direct, personal messages, but updates about our work and stories that we think you might be interested in, which might appear in the form of content on your newsfeed;
• Where we legally have to share information. For example, if you make a Gift Aid declaration to enable us to claim Gift Aid on donations that you make, we have to share your name and address with HMRC so that they can audit our claim.

Third party suppliers (data processors)

We may use companies to provide services and process your personal data on our behalf, where they have a specific expertise or can offer the most cost-effective solution for us. Some of the activities that third-party companies carry out for us are:

• Packing and delivering postal mail;
• Making telephone calls to our supporters;
• Signing up new supporters for us in door to door, street or private site campaigns;
• Sending emails;
• Processing credit card payments.

Whenever we work with a company in this way, we will always have a contract with them, to be certain that they treat your data with the same level of care and respect as we do. We will only send them the data that they need to carry out their specific service, and they are required to delete it or return it to us once they have completed this. Your data will only ever be passed to them for the services that they carry out on our behalf, it is never shared for their marketing purposes.

Vendors and suppliers

We will expect our vendors and suppliers to assist us in ensuring compliance with IWPR’s obligations including assisting IWPR with notifying a supervisory authority or a data subject of a data breach and assisting IWPR with carrying out a data protection impact assessment.

We will also require our vendors and suppliers to delete or return all the personal data to IWPR, at IWPR’s option, after the end of the services relating to such processing, and delete any existing copies of the personal data unless otherwise required by EU law. In addition, we will expect our vendors and supplies to make available to IWPR all information necessary to demonstrate its compliance with its obligations under Article 28 of the GDPR, and allow for and contribute to audits by IWPR or another auditor mandated by you.

Social media

Using social media is a great way for us to update you on our work, and let you know the difference your support is making. We do not collect or store any information about our social media followers outside of those platforms.

This notice does not cover IWPR’s presence on social media platforms such as, including but not limited to: YouTube, Facebook, Google+, LinkedIn, Twitter on which we have established our own presence. In the context of those platforms, we are merely another user and the privacy policies as well as the terms and conditions of those platforms are applicable.

Where we have a legal requirement

We will always share data where we have a legal requirement to do so. Examples of this include providing audit information to HMRC for our Gift Aid claims or if we are required to do so by law enforcement officials. If we were to merge with another charity or restructure, we may also share your personal details with other entities involved in the merger/restructure for that purpose.

IWPR takes the care of your data very seriously and we use a combination of organisational and technological security measures to protect your personal information to the highest possible standards. This includes the use of secure servers, firewalls, virus & malware protection, secure socket layer (SSL) encryption and secure file transfer protocol for our work with third parties. We follow payment card industry (PCI) security compliance guidelines when processing credit card payments.

Access to all IWPR data is protected by complex passwords, including letters, numbers and characters: in some cases more than one method of authentication is used. We make sure that only staff who need to access your personal data can do so. Any member of our staff who has access to your personal data is given training to make sure that they understand the importance of keeping your information safe and secure at all times.

Whilst we take all of the measures that we’ve outlined above, unfortunately, the transmission of information using the internet is not completely secure. Although we will do our best to protect your personal data sent to us this way, we cannot guarantee the security of data transmitted to our site.

In the extremely unlikely event that we experience a data breach, our Data Protection Representative would immediately work with the Information Commissioner’s Office if necessary.

IWPR is aware that countries outside of the European Economic Area have differing standards of data privacy. Much of our data is kept within IWPR systems in the UK, but there are a number of exceptions that you should be aware of:

• If you donate to us or indicate you would like to be added to our list of potential donors, your name and address will be added to our international database. This can be accessed by international staff from IWPR (including those from our subsidiaries and affiliates) in other parts of the world so that they can send you messages or programme updates. Your financial details are never shared; your information stored here is purely for correspondence;
• If you apply for a job with us, particularly a job based overseas, your data may be reviewed by managers who work for IWPR based in other countries outside Europe;
• Your data may also leave the European Economic Area if you travel with us. This will only be information specifically related to your trip, for example to book your travel, or to arrange your visit to one of our sites with our overseas colleagues.

Some countries (but not every country in which we work) have been determined by the European Commission to have “adequate” standards of data protection compliance. Organisations we work with who process data in the USA have verified that their data processing standards meet the standards in the EU-US Privacy Shield, which sets out clear safeguards and transparency responsibilities for US-based organisations processing data from EU citizens, or that they otherwise have proper safeguards in place.

We collect information from anyone who applies to work or volunteer at IWPR. We only use this information for our recruitment or employment purposes and it is entirely separate to our supporter data. As an applicant or employee, you are entitled to the same rights as our supporters, and these are outlined in our Rights section.

Applicants

When you apply to work or volunteer at IWPR we will ask for information about you and your work history to understand how your skills and past experience matches the requirements of a role.

There are circumstances where we might disclose details outside of IWPR as we process your application, for example:

• We will ask for details of referees, and we will contact them to verify the information that you have given us – when we contact them, we will share your name and the role that you have applied for. We contact referees on the basis of our legitimate interests as an organisation to understand applicants and their suitability for the roles they apply for.

All candidates applying to work or to volunteer at IWPR will automatically have their application details saved and retained in our applicant tracking system for 24 months (or as long as is required by donor regulations), unless they request their details are removed from our systems.

If you would like for us to remove your personal details from our system at any time before that, please write to HRglobal@iwpr.net to let us know.

We may keep anonymous statistical information about applicants to develop our recruitment processes and for equality and diversity monitoring, but this does not contain any information that could be used to identify individual job applicants.

If you would like more information on anything in this policy or would like to contact our data protection representative, please contact us at info@iwpr.net.

You also have the right to make a complaint direct to the UK’s data protection authority, the Information Commissioner’s Office (ICO).

The ICO can be contacted here.

This policy was last updated in August 2018.

From time to time, we may make changes to this policy and you will always be able to see here when it was last updated. If we make significant changes, such as in how or why we process your personal data, we will also publicise these changes on our website or may contact you directly with more information.

Please revisit this policy each time you consider giving your personal data to IWPR.