What information we collect and how we collect it
We collect personal information in the following ways from your use of the Website.
The type and amount of personal information we collect depends on how you use the Website.
If you do not want us to collect any of the information described in this section, please do not use the Website or contact us.
How we use your information
We collect and use your personal information for a number of reasons, including:
- to ensure that we can respond to any queries and contact you if you request us to do so;
- to improve your experience when using the Website;
- to administer the Website for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
- to ensure the effective operation of software and IT services procured by us (including disaster recovery); and
- for other reasons which we may explicitly inform you of from time to time.
Legal bases for using your personal information
There are a number of ways that we are lawfully able to process your personal information. We have set these out below.
Where using your personal information is in our legitimate interests
We may use your personal information where it is in our interests to do so, and those interests aren’t outweighed by any potential prejudice to you. We believe that our use of your personal information is within a number of our legitimate interests, including but not limited to:
- furthering GCD&I’s objective of promoting equity, diversity and inclusion across the legal sector;
- to protect the rights of GCD&I;
- ensuring that the Website runs smoothly; and
- keeping our systems secure and preventing unauthorised access or cyberattacks.
We do not think that any of the above activities prejudice you in any way. However, you have the right to object to us processing your personal information on this basis. You can do so by contacting us at email@example.com.
Where you give us your consent to use your personal information
We may use your personal information where you have specifically consented. If we would like you to consent to any way in which we use your personal information, we will provide you with information so that you understand what it is you are consenting to and are able to make a free, specific and informed decision.
If you give opt-in consent, we may contact you by email, phone or post to give you further information about GCD&I’s work and ways in which you can support us.
You have the right to withdraw your consent to any activities for which you have previously consented. You can do so at any time by contacting us at firstname.lastname@example.org.
Where processing is necessary for us to carry out our legal obligations
There may be legal obligations that we need to comply with and we may use your personal information when we need to in order to comply with these legal obligations.
Who we share your personal information with
We do not disclose your personal information to anyone outside of GCD&I except:
- GCD&I Partners: GCD&I is a group representing the in-house legal functions of a number of major corporations who have come together to support increasing meaningful diversity and inclusion across the legal profession. We may share your personal information with our stakeholders, including our partners and our Board to facilitate the goals of the initiative.
- D&I Working Groups: where we have your permission (for example if you agree to provide information for an initiative, such as Social Mobility Support Programmes, it will be disclosed to the relevant Working Group).
- Service Providers: third party service providers and professional advisors who perform functions on our behalf (including external consultants and professional advisors such as lawyers, auditors and accountants).
- Tax, audit, or other authorities: we may share your personal information with tax, audit or other authorities where necessary.
- Compliance with law: we may share your personal information with third parties to comply with legal or regulatory requirements.
- Other parties in connection with a corporate transaction: in the event that GCD&I merges with or is acquired by another business or company in the future, we may share your personal information with the new owners of the business or company.
How your personal information will be stored
Your personal information will be kept by GCD&I, in the UK, in a secure environment. We care about protecting your information, which is why we put in place appropriate measures designed to prevent unauthorised access to, and misuse of, your personal information.
We do this by having in place a range of appropriate technical and organisational measures, including [security measures on our servers, restricted access controls and encryption programmes].
How we store and transfer your personal information internationally
We want to make sure that your personal information is stored and transferred in a way which complies with our legal obligations under data protection legislation. We will therefore only transfer personal information outside of the United Kingdom where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to your personal information, for example:
- by transferring your personal information to a country where there has been a finding of adequacy, or
- by way of a data transfer agreement with a third party, incorporating standard contractual clauses.
How long we keep your personal information
We will not keep your personal information for longer than is necessary for the purposes for which we collect it unless we believe the law or other regulation requires us to preserve it (for example, because of a request by a tax authority).
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.
Your rights and how to contact us
You have various rights in relation to the personal information which we hold about you.
You have the right to withdraw consent or object to our processing of your personal information. You also have the right to seek access to your personal information and, in certain circumstances, you have the right to erasure, rectification or restriction of our processing. Find out more about your rights here.
In relation to certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal information. Subject certain exceptions, we will respond to you within one month from either: (i) the date that we have confirmed your identity; or (ii) where we do not need to do this because we already have this information, from the date we received your request.s
You also have the right to lodge a complaint with your local supervisory authority which is the Information Commissioner’s Office in the UK. You can contact them in the following ways:
- Phone: 0303 123 1113
- Email: email@example.com
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
If you would like to exercise any of these rights, or withdraw your consent to the processing of your personal information (where consent is our legal basis for processing your personal information), please contact us on firstname.lastname@example.org. Please note that we may keep a record of your communications to help us resolve any issues which you raise.