Privacy Policy – LinC – Lawyers in Charities

Lawyers in Charities

Privacy Policy

Introduction
1. This policy explains how and why Lawyers in Charities uses personal data about its members and other members of the public. This includes information that is collected via the Lawyers in Charities website, or through other means such as an online form, email, or telephone communication.
1. When we refer to “we”, “us” or “LinC” in this policy we are referring to Lawyers in Charities, a private company limited by guarantee (no. 10506215) registered at 2 Putney Hill, London SW15 6AB. We use “you” to refer to LinC’s members or any other person about whom we hold personal data.
1. For the purposes of the Data Protection Act 2018, the UK General Data Protection Regulation (GDPR), and any applicable subsequent legislation, we are the data controller in respect of the personal data that we process.
1. In this policy we use the term “personal data” to mean any information we hold about you from which you can be identified. This might include, for example, your name, your home address, your personal email contact details, or your telephone number. Personal data does not include information from which you cannot be identified, either directly or by combining that information with other information we may hold about you (i.e. anonymised data).
1. In this policy we use the term “processing” to mean anything we do with personal data, which includes, for example, collecting it, storing it, retrieving it or using it to contact you.
The personal data we collect
1. LinC may collect or process your personal data when you interact with us in a variety of ways, including as a member, prospective member, a funder, a supplier, or other key stakeholder.
1. In the case of prospective members of LinC, we collect and process the information that you provide when you apply to sign up to LinC’s service and create a profile on the website, which includes your name, login details, photo, email address, phone number, job title, your professional qualification and year of qualification, the organisation you work for, and any specialist sub-groups you have an interest in. If your application is not successful, we will delete your data as soon as we have informed you of this, which we will do within a reasonable time of your application being submitted. If your application is successful, we will continue to hold and process this data.
1. In the case of members of LinC, we may collect and process the following personal data about you:
  1. Sign up, login and profile information: as explained above;
  1. Content: content you create or provide through your use of the LinC website and LinC email addresses, including any emails sent to the group email addresses and any materials that you upload onto the website (including its forums), or provide to us to upload on your behalf;
  1. Correspondence: any correspondence between you and us, including any materials or information that you send us directly, such as in response to surveys and consultations; and
  1. Event registration details: details of your registration for any LinC events made through the website, by email or by telephone;
  1. Payment details: payment information we may use to collect payment from you (where applicable);
  1. Usage information: details of your visits to the website, the resources and pages that you access and/or download and any searches you make;
  1. Information relating to problems: any information we may request from you when you report a problem or complaint; and
  1. Committee member details: in the case of LinC Committee members, information about your Committee membership, any Committee post you hold, and any other information you have given us about yourself to include on the website.
1. In the case of individuals with whom we work, who are not members of LinC, including those working for funders, service providers or external lawyers, we process the contact details that you have provided to us, any correspondence between us and any other materials you send us.
1. Occasionally there may be instances where we process your personal data which has been provided to us by a third party, for example where a member makes a recommendation about you on the website or using a LinC group email address. If we do obtain your personal data from a third party, you are still able to exercise the rights contained within this policy.
1. For the avoidance of doubt, any personal data associated with any direct communications between members of LinC, without the use of a LinC email address, is not processed by LinC and falls outside this privacy policy.
Reasons we process your personal data
1. In the case of LinC members, we will use your personal data in order to provide LinC’s services, in particular to:
  1. enable you to make use of the LinC website and other LinC services;
  1. enable you and other members to identify and contact each other, and members of specific LinC sub-groups, easily;
  1. assist in the administration of the website and services, and manage your registration with us;
  1. help us to resolve any problems or complaints and provide you with support, including support with any technical difficulties relating to the use of the website and LinC email addresses;
  1. provide you with information about LinC membership events and other LinC news, and with updates about the LinC Knowledge Base and website,
  1. improve the service that we offer you, including by highlighting additional materials that are needed in the LinC knowledge base, and by carrying out members’ surveys about our services;
  1. customise our services to your preferences;
  1. assist with internal operations, including troubleshooting, data analysis, testing and statistical purposes; and
  1. administer LinC events and to review the success of these events
1. In the case of all applicants for membership, we will process the personal data you give us to enable us to assess whether you satisfy LinC’s membership criteria.
1. We store any content that you choose to create when you upload materials onto the LinC website (including in the forums) or use the LinC group email addresses in order to make that content available on the website for other members to search and download.
1. We may anonymise your personal data so that it can no longer be associated with you and we may share, for example, aggregated statistics about the use of the website, or survey results, with third parties such as funders or supporters or to promote our services to potential members/supporters/funders.
The basis on which we process personal data
1. We will process the personal data we hold about you because:
  1. we are satisfied that processing it is necessary for our legitimate interests to provide and administer the services we offer and that your interests and fundamental rights do not override those interests. We take this approach, for example, when you provide information about yourself as part of the LinC registration process, or when you share materials in the LinC Knowledge Base;
  1. processing it is necessary in order for us to comply with our obligations under a contract between you and us, for example where you provide financial details to us in connection with payment of LinC subscription;
  1. where we need to process it in order to comply with a legal obligation, such as if we are required to provide information to a regulator; or
  1. where you have consented to the processing of the data.
Data retention
1. Our current data retention policy is to delete or destroy (to the extent we are able to) the personal data we hold about you in accordance with the following:

Category of personal data	Length of retention
Data processed in order to enable you to apply for membership, to log in and use the LinC website and email addresses, and to enable other members to identify and contact you (including, for example, your email address, login details and profile details).	In the case of applicants who are not admitted to membership, this data is deleted as soon as the LinC Committee have informed you that your application has been unsuccessful, which they will do within a reasonable time of your application being submitted. In the case of members of LinC, this data is retained until you cease to be a member of LinC.
Content you create or provide through your use of the LinC website and LinC email addresses, or otherwise provide to LinC.	For as long as the content remains relevant and useful to LinC’s members.
Personal data processed with non-members in relation to a contract or funding agreement between you and us, or between an organisation you work for and us.	8 years from the end of the contract.
Records relevant for tax purposes.	8 years from the end of the tax year to which the records relate.

- For any category of personal data not specifically defined in this policy, and unless otherwise specified by applicable law, the required retention period for any personal data will be deemed to be 8 years from the date of receipt by us of that data.
- We may extend or reduce the retention periods given above if we deem it necessary, for example to defend legal proceedings or if there is an ongoing investigation relating to the data.
- If you wish to request that data we hold about you is amended or deleted, please refer to clause 8 below, which explains your privacy rights.
Sharing your personal data
- We only ever use your personal data if we are satisfied that it is lawful and fair to do so. We will never sell your personal data or share it with third parties who might use it for their own commercial purposes.
- We do not disclose your personal data to any third parties other than as follows:
  - your profile information, the materials that you provide for the LinC Knowledge Base, emails that you send to the LinC email addresses, and any other data that you post on the LinC website (including the forums) will be available to other LinC members;
  - if you communicate directly with LinC’s members or committee members or through LinC administered email lists with the committee or other LinC members, they will receive your messages in their email accounts at the charities for which they work;
  - we may disclose your personal data to third parties for the purposes set out in section 3 above (“Reasons we process your personal data”). For example, if you register for one of LinC’s events, we will share your name and the name of the charity you work for with the law firm or other organisation that is hosting the event.
  - if we are under a duty to disclose or share your personal data in order to comply with any legal obligation (for example, if required to do so by a court order or for the purposes of prevention of fraud or other crime), or where we need to share your personal data with a regulator such as when making returns to HMRC;
  - we may need to share your personal data in order to enforce any terms and conditions or agreements between you and us;
  - we may transfer your personal data to a third party as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation, but we will always notify you in advance and aim to ensure that your privacy rights continue to be protected; and
  - we will share your personal data to the extent that we need to protect our rights, property and safety, or the rights, property and safety of our users or any other third parties. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
- We will only supply your data to a third party as outlined above if we have your consent to do so or if there is another legal basis for us to share that data.
- We may also disclose your personal data to third parties who are providing services to LinC, such as our provider of IT support, providers of online and other payment services, and law firms who are providing paid or unpaid services to LinC. Where we do this we will enter into contracts requiring these third parties to comply with data protection laws and to ensure that they have appropriate controls in place to protect the security of your data.
Security
- We will take all reasonable steps to ensure that appropriate technical and organisational measures are carried out in order to safeguard the personal data we collect from you and protect against unlawful access and accidental loss or damage. These measures may include (as necessary):
  - protecting our servers by both hardware and software firewalls;
  - locating our data processing storage facilities in secure locations;
  - encrypting all data stored on our server with an industry standard encryption method that encrypts the data between your computer and our server so that in the event of your network being insecure no data is passed in a format that could easily be deciphered;
  - when necessary, disposing of or deleting your data so it is done so securely;
  - regularly backing up and encrypting all data we hold.
- We will ensure that our committee members and employees (if applicable) are aware of their privacy and data security obligations. We will take reasonable steps to ensure that the employees of third parties working on our behalf are aware of their privacy and data security obligations.
- This policy and our procedures for handling personal data will be reviewed as necessary.
- Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to the LinC website or using the LinC email addresses; any transmission is at your own risk. Once we have received your data, we will use the strict procedures and security features referred to in this clause to try to prevent unauthorised access.
Your privacy rights
- UK data protection law gives you certain rights in respect of the personal data we hold about you. Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances.

The right to be informed	You have the right to know about our personal data protection and data processing activities, details of which are contained in this policy.
The right of access	You can make a Subject Access Request (“SAR”) to request a copy of the personal data that we are holding about you and to check that we are processing it lawfully (free of charge, save for reasonable expenses for repeat requests). Provided we are satisfied that you are entitled to see the information requested and we have successfully confirmed your identity, we will provide you with your personal information subject to any exceptions that apply.
The right to correction	Please inform us if personal data we hold about you is incomplete or inaccurate in any way and we will update our records. We will take reasonable steps to communicate the change to any third parties to whom we have passed the same information.
The right to erasure (the ‘right to be forgotten’)	Please notify us if you no longer wish us to hold personal data about you. Unless we have reasonable grounds to retain the data, we will securely delete the personal data in question. The data may continue to exist in certain backup, but we will take steps to ensure that it will not be accessible. We will communicate the erasure request to any third parties to whom we have passed the same information. Please note, however, that in practice it will not be possible to provide our services, or some of our services, to you without holding some of your personal data.
The right to restrict or suspend processing	You can request that we no longer process your personal data in certain ways, whilst not requiring us to the delete that data.
The right to data portability	In limited circumstances, you have the right to receive copies of personal data we hold about you in a commonly used and easily portable format. You may also request that we transfer your personal data directly to third party, where technically possible.
The right to object	Unless we have overriding legitimate grounds for processing your personal data, you may object to us using it for direct marketing purposes (including profiling) or for research or statistical purposes.
Right to withdraw consent	If we are relying on your consent as the basis on which we are processing your personal data, you have the right to withdraw your consent at any time.

If you would like to exercise any of these rights, please contact privacy@lawyersincharities.org.uk.
- We will endeavour to comply with such requests as soon as possible but in any event we will comply within one month of receipt (unless a longer period of time to respond is reasonable by virtue of the complexity or number of your requests).
Other websites
- The LinC website may contain links and references to other websites. Please be aware that this policy does not apply to those websites.
- We cannot be responsible for the privacy policies and practices of websites that are not operated by us, even if you access them via the LinC website and/or any other service that is operated by us. We recommend that you check the policy of each website you visit and contact its owner or operator if you have any concerns or questions.
- In addition, if you came to LinC’s website via a third party website, we cannot be responsible for the privacy policies and practices of the owners or operators of that third party website and recommend that you check the policy of that third party website and contact its owner or operator if you have any concerns or questions.
Transferring your personal data outside Europe
- We may transfer the personal data you give us to countries outside the European Economic Area (“the EEA”).
- If we transfer your personal data outside the EEA in this way, and the country or international organisation in question has not been deemed by the EU Commission to have adequate data protection laws, we will provide appropriate safeguards and we will be responsible for ensuring your privacy rights continue to be protected as outlined in this policy.
- If you use LinC’s services while you are outside the EEA, your personal data may be transferred outside the EEA in order to provide you with those services.
- By submitting your personal data to us you agree to the transfer, storing or processing of your personal data outside the EEA in the manner described above.
Cookies
- A cookie is a piece of data stored locally on your computer and contains information about your activities on the internet.
- On the LinC website, we use cookies to track users’ progress through the website, allowing us to make improvements based on usage data. We also use cookies if you log in to one of our online services to enable you to remain logged in to that service. A cookie helps you get the best out of the website and helps us to provide you with a more customised service.
- Once you close your browser, our access to the cookie terminates. You have the ability to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. To change your browse settings you should go to your advanced preferences.
- We are required to obtain your consent to use cookies. If you continue to use the website having seen the notice on the website then we assume you are happy for us to use cookies.
- If you choose not to accept the cookies, this will not affect your access to the majority of information available on the website. However, you may not be able to make full use of LinC’s online services.
- An Internet Protocol (IP) address is a number assigned to your computer by your Internet Service Provider (ISP), so you can access the internet. We may use your IP address to diagnose problems with our server, report aggregate information, and determine the fastest route for your computer to use in connecting to the LinC website, and to administer and improve the LinC website.]
Notification of changes to this policy
- We will post details of any changes to this policy on the LinC website.
Contact us
- If you have any questions or concerns relating to your personal data or how it is handled, please contact: privacy@lawyersincharities.org.uk
- You also have the right to make a complaint at any time to the Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/).