1. Who we are
Our website address is: http://peoplesvaccine.org
The People’s Vaccine Alliance is a coalition of CSOs, NGOs, activists, and health experts united in the fight for a People’s Vaccine. Frontline AIDS – a registered UK charity – provides for fiscal and legal sponsorship services to enable the People’s Vaccine Alliance to operate. Our principal activities include organising individuals and organisations within our alliance to campaign for more equitable access for COVID-19 vaccines, tests and treatments for everyone, everywhere.
The People’s Vaccine Alliance aims to collect the minimum amount of data whilst giving you the opportunity to get involved in bringing about the changes that the Alliance campaigns for. We take seriously our duty to keep your data secure and have developed this policy so that you know what we do with your data.
The People’s Vaccine Alliance is the data controller responsible for your personal information.
2. Purpose of this policy
In particular, this Policy explains:
- the kinds of personal information we collect about you;
- the means by which we obtain your personal information;
- the ways in which we use your personal information;
- the basis on which we use your personal information;
- the length of time that we keep your personal information;
- who we share your personal information with;
- how we protect your personal information; and
- where and why we transfer your personal information outside of the EU.
We may collect your personal data in your capacity as: a volunteer, employee, applicant for a job or training course, participant in our events or training sessions, business contact, or because you choose to share data with us via a form on our website (peoplesvaccine.org) (henceforth referred to as the “Site”).
You provide your personal data to us on a voluntary basis. Without providing us with your personal data, you will be unable to (as appropriate) access our events, engage in campaigns or apply for employment with us.
We may update this Policy from time to time without notice to you, so please check it regularly.
3. How and why will we use your personal data?
We may use your personal information to:
- Manage and administer our relationship with you, including providing you with services (such as enabling participation in our organisation), products and information you have requested,
- Market our services, including sending you information about our programmes, events, campaigns, and any other information, products or services that we provide. We may do this by using marketing tools, such as Facebook marketing and by using personalisation to tailor and enhance your experience of our communications;
- Administer our Site, including monitoring its use;
- Administer payments;
- Administer participation in our events;
- Administer your employment and/or volunteering application;
- Deal with enquiries and complaints made by or about you relating to the Site or us in general;
- To keep a record of donations made and actions taken by our supporters and to carry out financial management and controls, including processing financial transactions and maintain financial controls; prevent fraud, misuse of services and money laundering; enforce legal claims; and report criminal acts and comply with law enforcement agencies;
- Audit and/or administer our financial accounts and conduct other statutory reporting and regulatory compliance;
- Meet any other of our legal, regulatory and risk management obligations.
We may use some of your personal information to participate in Facebook’s Custom Audience and Lookalike Audience programs, which enable us to display adverts to both existing and prospective supporters when they visit Facebook. We may provide your email address to Facebook so they can determine whether you are a registered account holder with them. Our adverts may then appear when you access Facebook. Some of your data is sent in an encrypted format that is deleted by Facebook (a) if it does not match with a Facebook account or (b) after they confirm you are a registered account holder.
For more detailed information please see https://www.facebook.com/business/help/744354708981227 and Facebook’s data policy at https://en-gb.facebook.com/policy.php.
Using our Site
When you use our Site, you may be given the option to provide us with personal information via forms for campaigning purposes. When you provide us with personal information in this way, we only use it for the purposes stated to you at the time we collect that information, and in the contexts that you actively agree to.
4. Explaining the legal bases we rely on
The law on data protection sets out a number of different reasons for organisations to collect and process your personal data: When collecting your personal data, we will always make clear to you which data is necessary for a particular purpose. We use your personal information on the following bases:
- Personal information is processed on the basis of a data subject’s consent
- Personal information is processed on the basis of a contractual relationship
- Personal information is processed on the basis of legal obligations
- Personal information is processed on the basis of legitimate interests
We will ask for your consent to use your information if you ever share sensitive personal information with us.
(2) Contractual relationships
Most of our interactions with people are voluntary and not contractual. However, sometimes it will be necessary to process personal information so that we can enter contractual relationships with people. For example, if you apply for employment or to volunteer with us, or if you purchase something from us.
(3) Legal obligations
Sometimes we will be obliged to process your personal information due to legal obligations which are binding on us. We will only ever do so when strictly necessary.
(4) Legitimate interests
Applicable law allows personal information to be collected and used if it is reasonably necessary for our legitimate activities (as long as its use is fair, balanced and does not unduly impact individuals’ rights). We will rely on this ground to process your personal data when it is not practical or appropriate to ask for consent.
When we use your personal information, we will consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that are not unduly intrusive or unfair in other ways.
Our use of legitimate interest includes the following:
We may analyse your previous support of the People’s Vaccine Alliance in order to offer relevant ways of supporting the Alliance in the future.
To help identify businesses who may wish to support the People’s Vaccine Alliance, we may send emails to individuals where relevant to their job, for instance people working in Corporate Social Responsibility.
5. When we collect your personal information
We may collect your personal information in the following circumstances:
(1) When you give it to us DIRECTLY
You may give us your personal data in various ways, including when you apply to join our organisation as a member or supporter, when you share it via a form on the Site, when you participate in our events, when you apply for employment with us, when you apply to volunteer with us, when you share information about our work on Facebook, Twitter, Instagram, Youtube and/or via email, when you contact us by email or post, and/or when you donate money to us.
(2) When you give it to us INDIRECTLY
Your information may be shared with us by others including our strategic partners, organisation members, business contacts, sponsors and supporters of our organisation and services (eg via fundraising sites like JustGiving).
(3) When you access the People’s Vaccine Alliance’s social media
We might also obtain your personal data through your use of social media such as WhatsApp, Twitter, Instagram or Facebook, when you follow us or otherwise interact with us on these platforms, or depending on your settings or the privacy policies of these social media and messaging services. To change your settings on these services, please refer to their privacy notices, which will tell you how to do this.
(4) When you give permission to OTHER ORGANISATIONS to share it or it is AVAILABLE PUBLICLY
We may combine information you provide to us with information available from external publicly available sources. Depending on your privacy settings for social media services, we may also access information from those accounts or services. We use this information to gain a better understanding of our audience and to improve our communications, network facilitation, training and fundraising activities.
We may also gather information if your activities relate to our work – for instance, if you are a public figure such as a Member of Parliament or you represent an organisation which we work with or which is related to one of our campaigns we may gather information about you in order to inform our campaigning and make decisions – for instance, whether we engage with you to seek your support for our work, ask your constituents to write to you, or choose to work you in another way.
6. What information do we collect?
We only collect personal data relevant to the type of interaction you have with the People’s Vaccine Alliance.
We may collect, store and use the following kinds of personal data:
- your name and contact details, including physical address, telephone number and e-mail address, and social media identity
- financial information, such as payment-related information, including bank details or debit/credit card details
- the information you add when choosing “get involved” via a form on the Site
- other personal information we receive in the course of providing services to you, including details of why you have decided to contact us/participate in one of our events, details of events you have attended and your contributions during event sessions, details of topics/areas of interest to you, responses to forms or surveys you have completed, equal opportunities monitoring information and information about any health and disability-related requirements
- marketing information, including information about the services you use, services and products of interest to you or any marketing and/or communication preferences you give; and/or any other information shared with us as per paragraph 1 above.
Do we process special categories of personal information?
Applicable law recognises certain categories of personal information as sensitive and therefore requiring more protection, including health information, ethnicity, religious beliefs, sexuality, and political opinions. We only collect “sensitive personal data” about our supporters, e.g. health status, where there is a clear and specific reason for doing so, such as sharing your experience with COVID-19 for the purpose of campaigning.
Clear notices will be provided on forms so that it is clear what information we need and why we need it.
7. Children’s data
Our services are not aimed at children and we require people to declare themselves to be 18 or over to share their stories with us and to access our campaigns and events. Hence we do not knowingly process data of any person under the age of 18. If we come to discover or have reason to believe, that you are under 18 and we are holding your personal information, we will delete that information within a reasonable period and withhold our services accordingly.
8. Data sharing
We will only use your information within the People’s Vaccine Alliance for the purposes for which it was obtained. We will not, under any circumstances, share or sell your personal data with any third party for their own marketing purposes, and you will not receive marketing from any other companies, charities or other organisations as a result of giving your details to us.
We may need to share your information with service providers who help us to deliver our campaigns and projects, for instance through handling responses to our Memorial Wall. These “data processors” will only act under our instruction and are subject to pre-contract scrutiny and contractual obligations containing strict data protection clauses. We do not allow these organisations to use your data for their own purposes or disclose it to other third parties without our consent and we will take all reasonable care to ensure that they keep your data secure.
Current and former employees
When you leave the Alliance, we may process your data to respond to requests for employment references.
Where legally required
We will also comply with legal requests where disclosure is required or permitted by law (for example to government bodies, statutory bodies, or law enforcement agencies for tax purposes, where it is in the public interest, or the prevention and detection of crime, subject to appropriate protection in law).
The Alliance may transfer your personal data outside the EEA. If it does so, this may occur under the protections of the European Commission’s standard contractual clauses, but will otherwise only take place where appropriate standards and safeguards are in place.
9. Data retention
In general, unless still required in connection with the purpose(s) for which it was collected and/or is processed, we remove your personal information from our records six years after the date it was collected. However, if before that date (i) your personal information is no longer required in connection with such purpose(s), (ii) we are no longer lawfully entitled to process it or (iii) you validly exercise your right of erasure, we will remove it from our records at the relevant time.
In the event that you ask us to stop sending you communications, we will keep your name on an internal suppression list to ensure that you are not contacted again.
Where you contribute material to us, e.g. user generated content or in response to a particular campaign, we will only keep your content for as long as is reasonably required for the purpose(s) for which it was submitted unless otherwise stated at the point of generation.
10. Security of and access to your personal data
We endeavour to ensure that there are appropriate and proportionate technical and organisational measures to prevent the loss, destruction, misuse, alteration, unauthorised disclosure or of access to your personal information.
Your information is only accessible by appropriately trained staff and contractors. If you wish to change how we communicate with you, or update the information we hold, then please contact us via [email protected]
We endeavour to comply with your request as soon as possible. Due to the small resource of our team, we aim for this to take place within a week.
11. How we keep your data safe
We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors.
We use external companies to collect or process personal data on our behalf. We do comprehensive checks on these companies before we work with them, and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they collect on our behalf, or have access to. We have a robust partner monitoring framework to ensure these contractual obligations are met.
These organisations – referred to as “Data Processors” also have legal liability for the way in which your data is used, providing you with additional protection.
12. Using cookies
We do not currently collect cookies on our website.
13. Your rights over your personal data
Where we rely on your consent to use your personal information, you have the right to see, update, restrict, object to the use of or withdraw that consent at any time. This includes the right to ask us to stop using your personal information for direct marketing purposes or to be unsubscribed from our email list at any time. You also have the following rights:
(1) Right to be informed – you have the right to be told how your personal information will be used. This Policy is intended to provide you with a clear and transparent description of how your personal information may be used.
(2) Right of access – you have the right to access to the personal data we hold about you, including how we first obtained your details, free of charge in most cases (this is known as a ‘Subject Access Request’).
(3) Right of rectification – the correction of your personal data when incorrect, out of date or incomplete.
(4) Right of erasure – you can ask us for your personal information to be deleted from our records. In many cases we would propose to suppress further communications with you, rather than delete it.
(5) Right to restrict processing – you have the right to ask for processing of your personal data to be restricted if there is disagreement about its accuracy or legitimate usage.
(6) Right to data portability – to the extent required by the General Data Protection Regulations (“GDPR”) where we are processing your personal information (i) under your consent, (ii) because such processing is necessary for the performance of a contract to which you are party or to take steps at your request prior to entering into a contact or (iii) by automated means, you may ask us to provide it to you – or another service provider – in a machine-readable format.
To exercise these rights, please send a description of the personal information and your request to [email protected]
Where we consider that the information with which you have provided us does not enable us to identify the personal information in question, we reserve the right to ask for (i) personal identification and/or (ii) further information.
14. Contact or make a complaint
We are not required by law to have a “Data Protection Officer” – however compliance with data protection regulation is the responsibility of the Communications and Digital Lead.
If you have any queries or concerns whatsoever about the way in which your data is being processed, or want to exercise your privacy rights, please contact us by sending an email to [email protected]
If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.
You can contact them by calling 0303 123 1113.
Or go online to www.ico.org.uk/concerns (please note we can’t be responsible for the content of external websites).
15. Policy amendments
16. Third-party websites