Privacy Policy: Signatories and Partners

For the purpose of this Privacy Policy and applicable data protection legislation, the data controller and the company responsible for your personal information is General Counsel for Diversity & Investment (“GCD&I“, “us” or “we“).

This document sets forth the ‘Privacy Policy’ for:

Individual representatives from GCD&I’s Partners (“Partners“); and
Individual representatives from member organisations who have signed up as signatories to GCD&I’s initiative (“Signatories“).

Please read this Privacy Policy carefully as it informs you what we do with your personal information when you are a Partner or Member.

It is important to point out that we may amend this Privacy Policy from time to time. Changes to this Privacy Policy will come into effect immediately upon such changes being notified to you. Please visit this page if you want to stay up to date, as we will post any changes here.

What information we collect and how we collect it

We collect certain limited personal information about you in the following ways:

If you contact us (whether by email, telephone or otherwise), we will collect any information that you voluntarily provide to us, for example your name, contact details and other information which you may choose to provide to us. The information provided to us may constitute special categories of personal data to the extent that it includes information on your political or religious beliefs, ethnicity, health, sexual orientation or any other special category of personal data (as set out in data protection law in the UK) that you disclose within the content of your correspondence with us. If you voluntarily provide us with any special category information then you consent to us using that information for the purposes set out and in accordance with this Privacy Policy.
If you or a representative from your employer organisation has completed and returned to us a Signatory Contact Form, we will collect any information that has been completed on the form, for example your name, contact details, employer, job title and the GCD&I pillars and working groups which you have signed up for.
If you or a representative from your law firm has contacted us on behalf of your law firm to become a GCD&I partner firm, we will collect any information that has been provided to us as part of this process, for example your name, contact details, employer, job title and the GCD&I pillars and working groups which you have signed up for.
We may also collect personal information contained in correspondence and documents provided to us in the course of our business dealings with you, your employer organisation or our partner law firms.

How we use your information

We collect and use your personal information for a number of reasons, including:

to ensure that we can respond to any queries and contact you if you request us to do so
to further our objective of promoting equity, diversity and inclusion across the legal sector
to carry out our obligations arising from any contracts entered into between you and us and to provide you with the information, products and services that you request from us
to give you information about our initiatives
to tell you about changes to our objective
to comply with legal and regulatory requirements; an
for other reasons with your consent.

Legal bases for using your personal information

There are a number of ways that we are lawfully able to process your personal information. We have set these out below.

Where using your personal information is in our legitimate interests

We may use your personal information where it is in our interests to do so, and those interests aren’t outweighed by any potential prejudice to you. We believe that our use of your personal information is within a number of our legitimate interests, including but not limited to:

to fulfil our objective of promoting equity, diversity and inclusion across the legal sector;
to identify metrics to measure the success of our initiatives;
to define and share best practice;
to protect the rights of GCD&I;
to provide Partners, Signatories, members and other interested third parties with information and materials about our organisation, our campaigns, updates and other information.

We do not think that any of the above activities prejudice you in any way. However, you have the right to object to us processing your personal information on this basis. You can do so by contacting us at mary.mullally@gcdandi.com.

Where you give us your consent to use your personal information

We seek consent from our Partners and Members for various processing activities. We may use your personal information where you have specifically consented. If we would like you to consent to any way in which we use your personal information, we will provide you with information so that you understand what it is you are consenting to and are able to make a free, specific and informed decision.

If you give opt-in consent, we may contact you by email, phone or post to give you further information about GCD&I’s work and ways in which you can support us.

You have the right to withdraw your consent to these activities. You can do so at any time by contacting us at mary.mullally@gcdandi.com

Where processing is necessary for us to carry out our legal obligations

There may be legal obligations that we need to comply with and we may use your personal information when we need to in order to comply with these legal obligations.

Who we share your personal information with

We work closely with trusted organisations and we may share personal information with them to help us successfully implement our initiatives and further our objectives.

We may disclose your personal information to the following groups outside of GCD&I:

Signatory Members: any current or future member organisation (including other Signatories)
Partners: any current or future partner law firm (including other Partners).
Service Providers: third party service providers who perform functions on our behalf (including external consultants and professional advisors such as lawyers, auditors and accountants).
Charities: partner charities and support service providers.
Tax, audit, or other authorities: we may share your personal information with tax, audit or other authorities where necessary.
Compliance with law: we may share your personal information with third parties to comply with legal or regulatory requirements.
Other parties in connection with a corporate transaction: in the event that GCD&I merges with or is acquired by another business or company in the future, we may share your personal information with the new owners of the business or company.

How your personal information will be stored

Your personal information will be kept by GCD&I, in the UK, in a secure environment. We care about protecting your information, which is why we put in place appropriate measures designed to prevent unauthorised access to, and misuse of, your personal information.

We do this by having in place a range of appropriate technical and organisational measures, including security measures on our servers, restricted access controls and encryption programmes.

How we store and transfer your personal information internationally

We want to make sure that your personal information is stored and transferred in a way which complies with our legal obligation under data protection legislation. We will therefore only transfer data outside of the United Kingdom where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to your data, for example:

by transferring your data to a country where there has been a finding of adequacy, or
by way of a data transfer agreement with a third party, incorporating standard contractual clauses.

How long we keep your personal information

We will not keep your personal information for longer than is necessary for the purposes for which we collect it unless we believe the law or other regulation requires us to preserve it (for example, because of a request by a tax authority).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.

Your rights and how to contact us

You have various rights in relation to the data which we hold about you.

You have the right to withdraw consent or object to our processing of your personal information. You also have the right to seek access to your personal information and, in certain circumstances, you have the right to erasure, rectification or restriction of our processing. Find out more about your rights here.

In relation to certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal information. Subject certain exceptions, we will respond to you within one month from either: (i) the date that we have confirmed your identity; or (ii) where we do not need to do this because we already have this information, from the date we received your request.

You also have the right to lodge a complaint with your local supervisory authority which is the Information Commissioner’s Office in the UK. You can contact them in the following ways:

Phone: 0303 123 1113
Email: casework@ico.org.uk
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

If you would like to exercise any of these rights, or withdraw your consent to the processing of your personal information (where consent is our legal basis for processing your personal information), please contact us on mary.mullally@gcdandi.com . Please note that we may keep a record of your communications to help us resolve any issues which you raise.