Data Privacy Notice
The Duke of Edinburgh’s International Award Foundation Data Privacy Notice
September 2024
Version: 3.0
Introduction
The Duke of Edinburgh’s International Award Foundation (the “Foundation”, “we”, or “us”) is registered in England and Wales as a charity (number 1072453) and a company limited by guarantee (number 3666389). We are committed to keeping your personal information safe and meeting our responsibilities under privacy law.
This Privacy Notice describes how we collect and use personal information about people the Foundation engages and works within our existing network, and those that visit our digital sites (including but not limited to our website – www.intaward.org.uk, the Online Record Book and the Award Community). This includes, but is not limited to, personal information relating to our prospect and licensed Operators, participants, volunteers, and supporters.
[Any organisation or person licensed to administer, manage, or coordinate the Award throughout the world (including without limitation National Award Operators, Independent Award Centres, Operating Partners, and volunteers) must comply with this Privacy Notice.]
For those visiting our digital sites, we will ask you to consent to our use of cookies in accordance with the terms of this Privacy Notice. More information on the cookies on our websites can be found in our Cookie Policy here [https://intaward.org/key-resources/policies/cookie-policy/].
If you have any questions regarding your personal information, please contact us using the Contact Details set out in section 10 below.
- The type of personal information we collect
- Where we get your personal information
- Why we collect and use your personal information and our lawful bases
- How we use and disclose personal information
- International data transfers
- How we store and retain your personal information
- Your rights
- Complaints
- Other websites
- Contact Details
- Updates to this
The type of personal information we collect
- Personal information is any information that relates to an individual. It does not include information where the identity of the individual has been fully and effectively removed (anonymous data).
- Under data protection legislation, certain personal information is considered more ‘sensitive’ (e.g., information relating to race, religion, political affiliation, and health). This is also known as ‘special category data’. In certain circumstances, the Foundation may collect special category data about individuals. For example, you may be asked to provide information on your ethnic origin when registering for the Online Record Book or when completing a research survey (though you are not obliged to do so). This information is typically not used on an individual basis, but to help with research or to analyse the impact of funding or other positive interventions.
Where we get your personal information
- The Foundation generally collects personal information directly from the relevant individual or their authorised intermediaries, for example when you sign up to one of our services or otherwise engage with us.
- We may also collect personal information about you via a third party (rather than from you directly), for example when you have provided your consent for this information to be shared with us. When we do so, we will ensure that the subject of the information has been made aware of this action.
- We may collect personal details about you that are available from public sources, such as from social networks (depending on your settings or the privacy policies for sites and services), company websites, political and property registers, and news archives. We may use data services agencies to collect this information.
- We have set out further details about what personal information we collect and why in Section 3 below.
Why we collect and use your personal information and our lawful bases
- The Foundation generally collects personal information in order to manage, administer, record and support the delivery of the Duke of Edinburgh’s International Award (the “Award”). Information is also collected to keep employees at National Award Operators and at the Foundation, volunteers, supporters, and participants informed about Award activities and events.
- Below we have outlined the different processes where personal information is collected, what type of personal information is collected, how this information is obtained and processed, the purpose for collecting the information and on what lawful basis:
| Process | What | How | Purpose/Why | Lawful basis |
| Training courses & recording of delegate information | · First Name
· Last Name · Email Address · Associated organisation · Previous Award training experience |
· Online booking form via Survey Monkey | · To monitor the number of individuals who have completed online courses to ensure Operator is adhering to its licence requirement and that it is invoiced correctly.
· To facilitate invoicing for paid training opportunities · To pass information onto trainers so they can address delegates by name and keep an attendance register. · To issue training certificates to individuals. |
1. We have a legitimate interest to effectively deliver training courses and the Award as a whole. |
| Award Community | · First Name
· Last Name · Email Address · Optional profile information (additional general statement including work experience or interesting hobbies)
|
· Self-registration form on the Award Community site. | · To access information and communications to support the delivery of the Award.
· To access the self-paced online training courses. · To maintain a record of online training that has been completed by adults in the Award. |
2. We have a legitimate interest to effectively deliver the Award. |
| Online Record Book (ORB) – Participants
|
Required
· First Name · Last Name · Email Address · Date of Birth · Address · Parent/guardian’s name and email · Details of participants’ Award record and achievements.
Optional · Gender · Nationality · Employment status · Profile picture · Profile questions (these vary between Operators)
System information · Various background system information (such as mobile software version, error crash reports, a record of pages viewed). |
· The ORB profile needs to be identifiable to the person whose profile it is. · Awards have age limits for participation and including date of birth can help manage this. · Optional information may used to aid programme analysis or for communication.
· System information can be used for auditing purposes, for analysis to help improvements or to identify and fix errors. |
· To enable users to manage and support participants and/or Award Centres in order to deliver the Award. · To maintain a record of participants, adults in the Award and Award Centres. · To use data on the above to monitor progress, provide analysis of impact, and to enable payment by participants or invoicing of Award Centres and Operators. |
1. We have a legitimate interest to process this data in order to be able to operate the ORB.
|
| Online Record Book (ORB) – Adults in the Award
|
· First Name
· Last Name · Email Address · Date of Birth · Address · Gender (optional)
|
· The ORB profile needs to be identifiable to that person.
· Award. Operators have age limits for Award Leaders and including date of birth can help manage this. · Information may be used to aid programme analysis or for communication. |
· To enable users to manage and support their participants or Award Centres in order to deliver the Award.
· To maintain a record of participants, adults in the Award and Award Centres. · To use data on the above to monitor progress, provide analysis of impact, and to enable payment by participants or invoicing of Award Centres and Operators. |
1. We have a legitimate interest to process this data in order to be able to operate the ORB.
2.If we must process the information to comply with a legal a legal obligation on us (for example, reporting to HM Revenue & Customs, Companies House, or the Charity Commission). |
| Licence application process & ongoing account management of licensees | · First Name
· Last Name · Email Address · Associated organisation
|
· Submission of a completed expression of interest or licence application form.
· Submission of evidence during the licence review process. |
· To send the licence agreement to the correct responsible person at the Operator.
· To send a pro-rata invoice to the correct responsible person at the Operator. · To provide induction to the person responsible for the day-to-day coordination and operation of the Award at the Operator. · To send communications to the correct persons at the Operator, concerning important information about Award delivery. · To inform the Operator about its licence review. · To arrange meetings with individuals at the Operator as part of the licence review. · To adhere to the requirements in an Operator’s licence. |
1. Processing is necessary for the performance of a contract (requirement of the Operator’s licence agreement). |
| Supporters | · First Name
· Last Name · Email Address · Mailing Address · Telephone Number (including mobile number) · Financial Information
|
· World Fellowship pledge agreement form.
· Charity Gift Aid Declaration form. · Online donation form. · Event registration form. |
· Send email updates and news of the work of the Award (if consent is provided to do so).
· Send invitations to a programme of World Fellowship events throughout the year (if consent is provided to do so). · Send an annual report showing what our donations have been spent on. · Provide a dedicated personal contact within the Philanthropy team.
|
1. Your consent. You are able to withdraw your consent at any time. You can do this by contacting us using the details provided in section 10.
2. We have a legitimate interest in promoting and furthering the aims of the Foundation and providing our supporters with information. |
| Website users
[Domain name www.intaward.org]
|
The list provided below may vary depending on the content of the email submitted:
· First Name · Last Name · Email Address · Mailing Address · Bank Details · Taxpayer Status |
· Email form on our website.
|
· Manage enquiries and process requests accordingly.
· Process donations. |
1. We have a legitimate interest in managing the enquiries and requests we receive, as well as processing any donations to the Foundation. |
| Events
|
· Full name
· Date of birth · Email address · Home address/preferred address · Telephone number · Company and job title · Financial information.
|
· World Fellowship pledge agreement form.
· Givergy platform. · Eventbrite platform. |
· To manage guests who confirm attendance to the Foundation’s events.
· To market relevant events to existing supporters and/or contacts. |
1. We have a legitimate interest to effectively run our events. |
| Research | · Full name
· Email address · Special Category Data such as, religion, ethnic background, linguistic background and health. |
· Outcome research survey
· Satisfaction survey · Social value survey |
· To provide robust and plausible evidence of the Award’s impact globally.
|
1. We have a legitimate interest in reviewing the impact of the Award.
|
| Alumni | Information collected as part of registration for social and professional networking sites, including but not limited to:
· Full name · Email address · Professional affiliations |
· Engaging with our Alumni digital platform hosted on LinkedIn.
|
· To create an Alumni Directory for members to search, so that they can connect based on their location, mentorship offering and profession.
|
*management of the data available on LinkedIn can be managed through the LinkedIn settings. |
In addition to the above, we may use your personal information:
- to inform you of Award programme news, activities, and events. We will ask for your consent prior to sending you any marketing communications. You can unsubscribe from our email communications by following the instructions in any email that we send you, or you can withdraw your consent and request us to remove your personal information at any time by emailing us at [email protected];
- Where it is necessary to comply with a legal obligation on us (for example, reporting to HM Revenue and Customs, Companies House, or the Charity Commission).
- We do not carry out any automated decision-making using personal information which produces legal effects or otherwise significantly affects individuals.
How we use and disclose personal information
- The Foundation limits its use and disclosure of personal information to the purpose for which it was collected and other related purposes that would be expected by you.
- The Foundation may disclose personal information with third parties, including:
- with various organisations within the International Award Association and/or to the appropriate Award Operator responsible for administering Award delivery;
- with contractors, suppliers, or other third parties that provide services on our behalf (such as website host providers);
- as part of a sale, merger or acquisition, or other transfer of all or part of our assets including as part of a bankruptcy proceeding;
- pursuant to a subpoena, court order, or other legal process or as otherwise required or requested by law, regulation, or government authority programs, or to protect our rights or the rights or safety of third parties;
- with our professional advisors, lawyers, accountants, and auditors; or
- with your consent or as otherwise disclosed at the time of data collection or sharing.
International Data Transfers
We may at times use suppliers who run their operations outside of the UK or European Economic Area (EEA). Where we do so, we take steps to ensure that your personal information is protected in accordance with appropriate safeguards, especially where the recipient country is not considered to be adequate under UK law. In particular, we will rely on appropriate safeguards under data protection legislation, such as standard contractual clauses approved by the UK Government to protect your personal information.
How we store and retain your personal information
- All personal data collected and processed is securely stored in the Foundation’s internal shared drives or databases including but not limited to the Customer Relationship Management (CRM) system, accounting system, Online Record Book (ORB) and SharePoint.
- The Foundation will take reasonable steps to ensure there are appropriate technical controls to protect the personal information it holds from misuse and loss and from unauthorised access, modification, or disclosure. While we seek to use appropriate organisational, technical and administrative measures to protect personal information within our organisation, unfortunately no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance using the information set out in the ‘Contact Details’ section below.
- The Foundation will only store personal information for the period of time that is necessary in light of the purposes for which we collected the persona information. The criteria we use to determine the retention period of personal information are: (i) the respective statutory retention period; (ii) our contractual and/or business relationships with you; (iii) (potential) disputes; and (iv) any guidelines issued by relevant regulators. After expiration of that period, the relevant information is routinely deleted, as long as it is no longer necessary for the fulfillment of a contract, the initiation of a contract or to protect or defend our position or that of a third party. If you have any questions about our retention periods, please contact us at [email protected].
- After the expiration of appropriate retention periods, the Foundation will take reasonable steps to destroy or permanently de-identify the relevant personal information, as long as it is no longer necessary for the fulfilment of a contract, the initiation of a contract, or to protect or defend our position or that of a third party. If you have any questions about our retention periods, please contact us at: [email protected].
- The Foundation undertakes regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, contractors, or volunteers.
Your rights
Your data protection rights under data protection law are as follows:
Your right of access – You have the right to ask us for access to the personal information we hold about you.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
Consent – Where we have previously obtained your consent, to withdraw that consent to processing your personal information.
- To exercise these rights, contact us using the details set out in section 10 below. You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. However, please be aware that the Foundation may be unable to provide these rights to you under certain circumstances, for example if we are legally prevented from doing so or can rely on exemptions.
- You also have the right to lodge a complaint against IAF, which you can do by contacting the supervisory authority in your country of residence. In the UK, this is the Information Commissioner’s Office at www.ico.org.uk/make-a-complaint.
Complaints
- If you believe that the Foundation has not complied with this Privacy Notice with respect to the handling of your personal information, please contact the Foundation using the details in section 10. The correspondence should describe in detail the nature of the enquiry or the ways in which you believe that this Notice has not been complied with. Please also send proof of identity (passport or driving licence) and proof of address (for example a utility bill).
- As noted above, you may also contact the supervisory authority in your country of residence. In the UK, this is the Information Commissioner’s Office (ICO) (contact details provided below). However, we would always appreciate the opportunity to resolve your complaint ourselves in the first instance, if possible.
Other websites
Our websites may contain links to other websites. Please note that when you click on one of these links, you are entering another website for which the Foundation has no responsibility (even if you access the website via a link to one of our websites). We encourage you to read the privacy notices on all such websites.
Contact details
Any individual who has a question or complaint about how the Foundation handles their personal information or who wishes to access or correct the personal information that the Foundation holds about them should contact:
Via email: [email protected]
Via post: The Duke of Edinburgh’s International Award Foundation
Award House
7-11 St Matthew Street
London
SW1P 2JT
You can also complain to the ICO if you are unhappy with how we have used your data using the details below:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk/make-a-complaint
Updates to this Privacy Notice
- This Privacy Notice may change from time to time – for example, to take into account changes at IAF or to reflect changes in regulation or legislation. It was last updated in February 2022.
- Updates to this Notice will be posted on this page – please check back from time to time. We will also use reasonable efforts to inform you of any significant changes by email where appropriate.
