The Money and Mental Health Policy Institute (“the Institute”, “the charity”, “we” or “us”) is committed to being transparent about how it collects and uses personal data, and to meeting its data protection obligations. This policy sets out the Institute’s commitment to data protection, and individual rights and obligations in relation to personal data. It sets out how your personal data will be processed as controlled by The Money and Mental Health Policy Institute, 22 Kingsway, WC2B 6LE.
This policy applies to the personal data of anyone who uses our website which is obtained through the use of the website, including job applicants, and those who sign mailing lists or take part in campaigns.
The Charity has appointed the Director as the person with responsibility for data protection compliance within the Charity. Questions about this policy, or requests for further information, should be directed to him/her at firstname.lastname@example.org. This notice may change from time to time, so please check it regularly.
This Privacy and Cookie Notice outlines:
- Data protection principles
- What data we collect
- How we use it
- How long we keep it
- Where we transfer and store it
- Your rights
- Further information
Data Protection Principles
The Institute processes personal data in accordance with the following data protection principles:
- The Charity collects personal data only for specified, explicit and legitimate purposes.
- The Charity processes personal data only where it is adequate, relevant and limited to what is necessary for the purposes of processing.
- The Charity processes personal data lawfully, fairly and in a transparent manner.
- The Charity keeps accurate personal data and takes all reasonable steps to ensure that inaccurate personal data is rectified or deleted without delay.
- The Charity keeps personal data only for the period necessary for processing.
- The Charity adopts appropriate measures to make sure that personal data is secure, and protected against unauthorised or unlawful processing, and accidental loss, destruction or damage.
- The Charity tells individuals the reasons for processing their personal data, how it uses such data and the legal basis for processing in its privacy notices. It will not process personal data of individuals for other reasons. Where the Charity relies on its legitimate interests as the basis for processing data, it will carry out an assessment to ensure that those interests are not overridden by the rights and freedoms of individuals.
- The Charity will update personal data promptly if an individual advises that his/her information has changed or is inaccurate.
The Charity keeps a record of its processing activities in accordance with the requirements of the General Data Protection Regulation (GDPR).
What data we collect
We use your personal data to improve the user experience of our website and provide a better service. We also use it for staying in touch with you. By signing up to our newsletters and updates you agree to be contacted with such information.
Additionally, we may also use your information collected through the submission of various forms through our website or from signing up at our events or other direct contact with you to invite you to take part in research, attend events or otherwise contribute to our work.
Depending on what you provide to us, we may hold the following personal data:
- Full name
- Email address
- Postal address
- Phone number
- Company name
- Job title
- IP Address
- Professional sector
- Areas of interest
- Information about activities you have taken part in (for example, campaigns you have supported or emails you have opened.)
We will process this data on the basis of your consent in signing up to our newsletters and updates and/or our legitimate interest in informing you of our events, research and wider work in order to fulfil our charitable objectives. You are able to opt out from emails at any time via the “Unsubscribe” link present at the bottom of every email communication we send or by emailing email@example.com. We will contact you in relation to services we feel will be useful for you by email or by phone.
When you engage with us directly in relation to certain campaigns, we may also process any data that you provide us in relation to the campaign. This will include, for example, your reasons for participating in the campaign where these are given and any other sensitive data that you provide, for example about your own mental health. We will process such data on the basis of your consent.
If you share your personal experience or the experience of a friend or relative with us, we may collect this sensitive personal data. We will only use this information to inform our charitable research and policy development activities, and to deal with your enquiry. We will not pass on your details to anyone else without your express permission, except in exceptional circumstances, which may include anyone reporting serious self-harm, posing a threat to others, or sharing serious issues such as abuse or exploitation. Where you have given express consent for us to share your story, for example in the media or through a blog, we may publish it.
We will keep your personal data received when you sign up to our updates for two years, after which we will ask you again for consent to continue to receive marketing information from us.
We will also process any data you send us for recruitment purposes in relation to any vacancies that we advertise. We process this with your consent and/or our legitimate interest in identifying the right candidates and offering them new positions.
This will include:
- Full name
- Email address
- Full address
- Telephone number
- Education and qualifications
- Employment history
- Sensitive personal data, including racial, ethnic, sexual, religious and/or disability information
- Any other details in your CV, cover letter or other application materials
We process this data on the basis of our legitimate interest in delivering an effective recruitment process. We may also process additional data later on in the recruitment process, which will be processed on the basis of your consent and/or legitimate interest, where we have a legal obligation or it is in the public interest to do so (such as for immigration or diversity monitoring purposes). This will be further detailed alongside your employment offer and contract.
We will keep your personal data received when you take part in a recruitment process for six months, after which it will be destroyed. We will hold this for longer if you are appointed.
Where we transfer and store it
In addition to our systems, the information that you provide to us may be stored in secure servers which are operated by trusted providers. We share your information with these trusted providers, who work on our behalf to deliver our services, but they only process this information under our instructions. These include MailChimp, Google and Platform One. Mailchimp and Google use servers based in the United States of America. Mailchimp and Google have certified under the EU-U.S. Privacy Shield certification, which allows us to legally transfer your personal data to them.
A cookie is a small text file that is downloaded onto your computer when you visit our website and allows us to recognise you as a user. Typically, these contain two pieces of information: a site name and unique user ID. All information these cookies collect is aggregated and anonymous – you cannot be identified by a cookie on its own. Cookies are essential to the effective operation of our website. Cookies make the interaction between you and the website faster and easier. Cookies may also be set by the website you are visiting (first party cookies) or they may be set by other websites who run content on the page you are viewing (third party cookies).
- that are strictly necessary to enable you to move around our websites or to provide certain basic features;
- to enhance the functionality of the website by storing your preferences;
- to help improve the performance of our website on your device;
- to collect information about your browsing habits in order to make advertising relevant to you and your interests.
Our site also includes a number of features which allow users to share some of our content via social media. This does not set a cookie by itself, but if one is present it will read it. Another service we use is provided through MailChimp, which helps us to design email newsletters, share them on social networks and integrate with our other services. Money and Mental Health doesn’t have direct access to those cookies and the use of those third-party cookies is governed solely by the respective service provider’s Privacy statement.
Additionally, you may delete and block all cookies from any website, within your web browser settings if necessary. Please be aware that restricting or deleting cookies will impact on the functionality of the site.
The cookies are stored for a period of two years unless you clear their cache and the cookies themselves.
Opting Out of Cookies
You can manage the cookies stored on your device as well as stop cookies from being installed on your browser. You can opt out of all our cookies (except the strictly necessary ones). Find out how to control and delete cookies in your browser. If you choose to refuse all cookies, our website may not function for you as we would like it to.
Your Individual Rights
You have several individual rights in relation to your personal data that we collect, which we are committed to respecting. In particular, you have the right to:
- make a subject access request about the data that the Institute holds about you (see below);
- ask us to provide you or a third party with some of the personal information we hold about you in a portable electronic format;
- rectify inaccurate data;
- stop processing or erase data that is no longer necessary for the purposes of processing;
- stop processing or erase data if the individual’s interests override the Charity’s legitimate grounds for processing data (where the Charity relies on its legitimate interests as a reason for processing data);
- stop processing or erase data if processing is unlawful; and
- stop processing data for a period if data is inaccurate or if there is a dispute about whether or not the individual’s interests override the Charity’s legitimate grounds for processing data.
- not be subject to automated decision-making that may have legal effects or have a similar significant impact on you, without consent, if it is necessary for a contract, or otherwise permitted by law. We do not currently carry out any automated decision-making.
Additionally, where we collect your personal details for sending you newsletters, campaigns or updates related to our work, you have the right at any time to notify us that you no longer want to receive this information.
If you wish to exercise any of these rights, or make a complaint, you can do so by contacting us, by email at firstname.lastname@example.org, by phone on 0207 848 1448, or by post at Money and Mental Health, Virginia Woolf Building, 22 Kingsway, London, WC2B 6LE. You can also make a complaint to the data protection supervisory authority, the Information Commissioner’s Office, https://ico.org.uk.
Subject access requests
Individuals have the right to make a subject access request. If an individual makes a subject access request, the Charity will tell him/her:
- whether or not his/her data is processed and if so why, the categories of personal data concerned and the source of the data if it is not collected from the individual;
- to whom his/her data is or may be disclosed, including to recipients located outside the European Economic Area (EEA) and the safeguards that apply to such transfers;
- for how long his/her personal data is stored (or how that period is decided);
- his/her rights to rectification or erasure of data, or to restrict or object to processing;
- his/her right to complain to the Information Commissioner if he/she thinks the Charity has failed to comply with his/her data protection rights; and
- whether or not the Charity carries out automated decision-making and the logic involved in any such decision-making.
The Charity will also provide the individual with a copy of the personal data undergoing processing. This will normally be in electronic form if the individual has made a request electronically, unless he/she agrees otherwise.
If the individual wants additional copies, the Charity will charge a fee, which will be based on the administrative cost to the Charity of providing the additional copies.
If you wish to activate any of these rights, or to raise a complaint on how we have handled your personal data, you can contact our office at email@example.com. In some cases, the Charity may need to ask for proof of identification before the request can be processed. The Charity will inform the individual if it needs to verify his/her identity and the documents it requires. The Charity will normally respond to a request within a period of one month from the date it is received. In some cases, such as where the Charity processes large amounts of the individual’s data, it may respond within three months of the date the request is received. The Charity will write to the individual within one month of receiving the original request to tell him/her if this is the case.
If a subject access request is manifestly unfounded or excessive, the Charity is not obliged to comply with it. Alternatively, the Charity can agree to respond but will charge a fee, which will be based on the administrative cost of responding to the request. A subject access request is likely to be manifestly unfounded or excessive where it repeats a request to which the Charity has already responded. If an individual submits a request that is unfounded or excessive, the Charity will notify him/her that this is the case and whether or not it will respond to it.
Money and Mental Health uses reasonable administrative, technical, personnel and physical measures to safeguard personal information in its possession against loss, theft and unauthorised use or modification. While we strive to protect your personal information, you will understand that we cannot guarantee the security of any information transmitted to us over the internet. Therefore, please do not submit personal information to us online unless you accept the security risks of doing so.
Modifications and changes to this Privacy Notice
This Privacy Notice was last updated in May 2018. Any changes made to this Privacy Notice will be updated on our website and you will be notified by email if necessary and appropriate.