IPPF Data & Information Privacy Notice

Introduction

This is the Website Privacy Notice and Cookie Policy of the International Planned Parenthood Federation (UK registered charity number 229476) whose office is at 4 Newhams Row, London, SE1 3UZ, United Kingdom (“IPPF”).

This Privacy Notice applies where we are a controller in respect of your personal data – this is where we decide how and why your personal data is processed.

If you wish to contact us in connection with our use or processing of your personal data, you can contact our Data Protection Officer by email at dpo@ippf.org, or in writing to:

IPPF London Office
International Planned Parenthood Federation
4 Newhams Row
London
SE1 3UZ
United Kingdom

This Privacy Notice may vary from time to time, so please check it regularly.

Privacy Notice

Categories of personal data we collect

The categories of personal data about you that we may collect, use, store, share and transfer are:

• Personal Characteristics: This includes personal data which relates to your identity, such as your name, gender, and age / date of birth. 
• Contact Information: This includes contact details such as your mailing address, email and telephone number.
• Digital/Online Data: This includes personal data which relates to your use of our website, such as your internet protocol (IP) address, login data, traffic data, cookies, web logs and other communication data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website.
• Complaints/Safeguarding Data: This includes personal data which relates to any complaints or reports that are made to us.
• Financial Information: This includes personal data which relates to your finances, such as your bank account and payment card details, as provided when making a donation to us, and any information which we collect from you for the purposes of preventing fraud.

We also obtain and use certain aggregated data such as statistical or demographic data for any purpose (“Aggregated Data”). Aggregated Data may be derived from your personal data but does not directly or indirectly reveal your identity. For example, we may aggregate your Digital/Online Data to calculate the percentage of users accessing a specific feature on our website. However, if we re-combine or re-connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Notice.

The sources from which we obtain your personal data

We obtain your personal data from the following sources:

• Directly from you, either in person, via digital or written applications, or via telephone. This may include personal data you provide when you:
  1. Subscribe to our publications.
  2. Request information on our services.
  3. Enter into a competition or promotion.
  4. Complete a survey or questionnaire, or provide us with feedback.
  5. Contact us by any means to submit a query, complaint or request, or to provide us with information.
  6. Attend an event organised by us.
  7. Donate to us.
• Via automated technologies, such as cookies and server logs, when you visit our website.
• From someone else where they have provided us with your information regarding a complaint. 

If you provide personal data to us about someone else you must ensure that you are entitled to disclose that personal data to us and that, without our taking any further steps, we may collect, use and disclose that personal data as described in this privacy notice.

Where it is appropriate to do so, you must ensure the individual concerned is aware of the various matters detailed in this privacy notice, as those matters relate to that individual, including our identity, how to contact us, the way in which we collect and use personal data and our personal data disclosure practices, that individual's right to obtain access to the personal data and make complaints about the handling of the personal data, and the consequences if the personal data is not provided.

How we use your personal data

We collect personal data about you in order to:

• Manage our relationship with you, including to:
  • Send your important notices, such as communications about changes to our terms and conditions or policies including this Privacy Notice.
  • Send you information you have requested, including via subscription to our publications.
  • Book your attendance at an event organised by us. 
  • Deal with your enquiries.
  • Ask you to leave a review or provide us with feedback.
• Manage any donations you make. 
• Make suggestions and recommendations to you about goods or services that may be of interest to you.
• Deliver relevant website content and advertisements to you, and to measure or understand the effectiveness of our advertising.
• Communicate with you about, and administer your participation in, special events, programs, promotions, prize draws and competitions. 
• Undertake data analytics, identify usage trends, and improve our website, products/services, marketing, customer relationships and experiences. 
• Administer and protect our business, including dealing with any misuse of our website and to comply with our security policies at IPPF locations.
• Comply with our legal and industry obligations, such as to comply with health and safety requirements, or to assist in a police investigation. 
• Enforce or apply our terms of use. 
• Use your personal data in an official role which we have been designated to carry out by an official authority (e.g. the government) or where we are otherwise carrying out tasks which are in the public interest (e.g. which have been designated as such by government, or which would otherwise be deemed in the public interest).
• Detect and prevent fraud and other illegal activities (and to assist regulators, trade bodies and law enforcement agencies in relation to the same).
• Use our knowledge of any health-related personal data you disclose to us in the event of illness or injury or some other related emergency or to record any accident or injury or other incident you may suffer when visiting any of our locations.
• Investigate and defend any third-party claims or allegations.

We do not use automated decision making or profiling on your personal data. 

Our lawful basis for processing your personal data

We rely on the following lawful bases for processing your personal data:

• Consent: For certain purposes, it may be appropriate for us to rely upon Consent. This includes processing of your personal data where:
  • You opt-in to receive news, updates and information from IPPF. 
  • You register your details as part of a donation you make to IPPF. 
  • You participate in surveys or questionnaires, or provide feedback to us. 
  • You have raised a complaint to us. 
  • You opt-in to allow us to share your details with other non-profit organisations similar to IPPF.
• Legal Obligation: We may rely on Legal Obligation where processing is necessary in order for us to comply with our legal obligations (such as compliance with anti-money laundering legislation.)
• Legitimate Interests: Where processing is necessary for the pursuit of our business interests, we may rely on Legitimate Interests. This may include processing of your personal data for:
  • The provision of administration and/or IT services.
  • The security of our IT network.
  • The prevention of fraud.
  • Protecting our operations and property.
  • Direct marketing, where you have provided your personal data for a related purpose.

Where Consent is relied upon as the lawful basis for processing, you have the right to withdraw your consent at any time. You can do this by contacting us directly. 

Extra conditions for sensitive personal data 

When processing sensitive / special category data, the following condition will also apply:

• Explicit Consent: Sensitive or special category data processed as part of complaints or marketing processes relies on Explicit Consent, as you must provide specific consent for the processing of your personal data for this purpose.
• Not-for-Profit Bodies: Sensitive or special category data processed as part of our legitimate activities are reliant on the Not-for-Profit Bodies condition, as we are processing this data in line with the purposes and powers set out in our constitution and governing documents.
• Legal Claims and Judicial Acts: Sensitive or special category data processed as part of a complaint you have raised to us may rely on Legal Claims and Judicial Acts, as it may be required for the establishment, exercise or defence of legal claims. 

How we share your personal data

We may disclose to or otherwise share your personal data with:

• Third-Party Providers: Customer Relationship Management (CRM), finance and reporting systems providers contracted to IPPF may process personal data on our behalf to enable us to carry out our usual business practices. Third parties operating plugins or content (such as Facebook, YouTube and Instagram) on our website may process personal data should you interact with them.
• Law Enforcement Agencies: Law enforcement agencies, courts or any other relevant party to the extent necessary for the establishment, exercise or defence of legal rights, or where necessary for the purposes of prevention, investigation, detection or prosecution of criminal offences.
• Non-Profit Organisations: Like many other groups, we may share names and addresses with other carefully selected non-profit organisations similar to IPPF that we feel our donors would want to know about. This is only done where you have provided consent. 
• External Consultants: External consultants contracted to IPPF, such as lawyers, accountants and auditors. 

International transfers of personal data

We are a global organisation and, as such, personal data we collect from you may be transferred, stored and/or processed outside the UK, European Economic Area and the United States of America. 

Personal data transferred to third-parties will not be processed outside the UK, European Economic Area, or the United States of America, unless processed in your country/jurisdiction of residence.

In connection with transfers outside of the country/jurisdiction of residence, we will ensure that:

• there are appropriate safeguards in place, such as binding corporate rules or the approved EU model contractual clauses between us and the recipient (as per Article 46 GDPR (or English law equivalent)); or
• the transfer is to a country that the European Commission has decided provides an adequate level of protection, such as to a country approved by the European Commission or to certain organisations within the United States pursuant to the Privacy Shield (as per Article 45 GDPR (or English law equivalent)); or
• one of the derogations for specific situations in the first sub-paragraph of Article 49(1) GDPR (or English law equivalent) applies to the transfer including explicit consent or necessary for the performance of a contract or exercise or defence of legal claims.

How we store your personal data

We protect your personal data. Data is secured in transit by Secure Socket Layer (SSL) technology, or similar technology. Only authorised employees or agents with a legitimate business purpose are allowed to access your personal data, and we apply technical and organisational security measures to protect your personal data as required.

How long we will store your personal data for

We will store your personal data for the time period which is appropriate in accordance with the following criteria:

• Our ongoing relationship with you.
• The completion of the purpose for which that personal data was originally provided.
• Our legal obligations in relation to that personal data, and other legal requirements.
• The type and size of personal data held, and whether it is deemed to be special category data.
• Our accounting requirements in relation that personal data.

We keep the length of time that we hold your personal data for under review.

Your rights in relation to your personal data

Subject to applicable law, including relevant data protection laws, you may have a number of rights in connection with the processing of your personal data, including:

• Right to be Informed: You have the right to be informed about the collection and use of your personal data. We fulfil this through the provision of this Privacy Notice.
• Right of Access: You have the right to access and receive a copy of your personal data that we process or control. You can exercise this right by submitting a Data Subject Access Request.
• Right to Rectification: You have the right to have inaccurate or incomplete personal data rectified or completed. You can keep us informed of changes to your personal data by contacting us directly, or by logging into your account on our website.
• Right to Erasure: You have the right to have your personal data erased, where specific conditions apply. You can exercise this right by withdrawing your consent for any data where this is the lawful basis for processing.
• Right to Restrict Processing: You have the right to restrict the processing of your personal data, where specific conditions apply. You may exercise this right if you suspect your personal data to be inaccurate or unlawfully processed, and can do so by contacting us directly.
• Right to Data Portability: You have the right to obtain and reuse your personal data for your own purposes across different services, where specific conditions apply. You can exercise this right by submitting a Data Subject Access Request.
• Right to Object: You have the right to object to the processing of you personal data in certain circumstances. You may only object to data processed under the lawful basis of Legitimate Interests, and can do this by contacting us directly.
• Rights Related to Automated Decision Making, Including Profiling: You have the right to request human intervention or challenge a decision where automated decision making has been used. You can exercise this right by contacting us directly.

You also have the right to lodge a complaint regarding the processing of your personal data with the relevant supervisory body. For example, in the UK, this is the Information Commissioner’s Office (ICO), who can be contacted at https://ico.org.uk/make-a-complaint/.

If you would like to exercise any of the rights above, please contact us using the contact details set out in Contact Information. 

IPPF is not responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us. 

Statutory or contractual obligations in connection with the provision of personal data

You are under no statutory or contractual obligation to provide us with personal data. It is your choice as to whether you provide us with your personal data. If you do not provide your personal data then we may not be able to perform to the level you expect in our relationship with you.

Links to external websites

This Privacy Notice applies only to IPPF. If you leave our website by clicking on a link or advertisement, you should review the applicable privacy policy of the external website. 

If you have questions about your personal data and how IPPF is using it, please don’t hesitate to get in touch with us. Contact details can be found in the Contact Information section of this Privacy Notice.

Cookie Policy

What are cookies?

Cookies are small text files stored to your device when you visit a website. Cookies are stored in your web browser and can do things such as remember your preferences, count the number of people who visit a website, and keep track of what you access.

You can remove cookies from your device at any time, and your device will automatically delete expired cookies. 

Why we use cookies

IPPF uses cookies to keep track of what you are accessing, remember you when you return to our site and for anonymous statistical usage analysis and reporting. Information gathered is used to help improve users’ experiences of the website. For example, we use cookies to help us identify and resolve errors while browsing. 

Types of cookies 

Persistent Cookies

Persistent cookies continue to exist after you close a website. They are eventually deleted, often after six months or longer. They are used to help the website recognise you when you return so that it can remember you preferences, or who you are.

Session Cookies

Session cookies are automatically deleted after you close a website, typically within 30 minutes. They are used to help the website remember the status of your current visit.

First-Party Cookies

First-party cookies are placed on the user’s device by websites they have visited directly.

Third-Party Cookies

Third-party cookies are set by websites other than the one a user has visited directly.

Essential / Strictly Necessary Cookies

Essential cookies are vital for a website’s basic operations, collecting information which enables the functionality of a website.

Non-Essential Cookies

Non-essential cookies are not necessary for the basic function of a website, but are used to enhance user experience and provide insight to website owners.

Cookies we use

The IPPF website uses the following cookies:

Essential / Strictly Necessary Cookies

Non-Essential Cookies – Analytics and Performance

Non-Essential Cookies – Advertising and Marketing

If you log into our website using social media logins (such as Google and Facebook), we may access your public social media profile information.  You can always limit this using your social media service settings.

Managing cookies

We respect your privacy and want to make sure you have control over your data. You can choose your own cookie setting using our preference centre to select which categories of cookies you want to allow.

If you would like to delete cookies or instruct your web browser to delete or refuse cookies, you can do so within your web browser. Please note that, if you delete cookies or refuse to accept them, you might not be able to use all of the features we offer, you may not be able to store your preferences, and some of our pages might not display properly.

To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org.