Privacy Policy

We are the Data Protection Foundation, CIC (the "DPF") and we exist to support consumers to assert their data rights. We do this through education, research and seeking legal redress. We are a non-profit community interest company and a company limited by guarantee (UK registered company number 12820041). Our registered offices are at Third Floor, 1 New Fetter Lane, London, United Kingdom, EC4A 1AN.

We campaign for and believe that you have the right to control the use of your personal information, and that your privacy must be respected. That is why we strictly limit the collection and processing of your personal data. We will not use personal data that you provide to us in a manner inconsistent with the purposes for which you provided it to us. Our website address is: https://dataprotectionfoundation.org.

We respect your rights over your personal data. We have designed this website to preserve your privacy and to act in strict accordance with the relevant laws, including the Privacy and Electronic Communications Regulations (2003), the General Data Protection Regulation and the UK's Data Protection Act (2018).

The Data Protection Foundation, CIC is the data controller for data processing in accordance with this policy and is registered with the Information Commissioner as a data controller (registration number C1470293).

If you have any questions about this Policy, our data processing practices, or your rights, you can contact us (details provided below). Set out below is an explanation of the purposes for which we collect and use, or "process" your data and the legal basis for this in accordance with applicable data protection laws.

We process personal data for the following purposes:

We take the security of your information very seriously. We employ physical, electronic, and organisational security measures to protect the information that we collect about you from access by unauthorised persons and against unlawful processing, accidental loss, destruction, and damage. For instance, we use SSL certificates on this website.

Although we do our best to protect personal data, information transmitted over the internet remains vulnerable to unauthorized access – for this reason, the transmission of any personal data to our website or via email to us is therefore at the data subjects' own risk.

We do not retain your personal data for longer than is necessary to achieve the purposes for which your data is processed. We keep your data as long as is necessary in connection with the purpose it is collected for. We do not keep data longer than required in connection with that purpose. We will delete the information we hold about you as soon as we no longer need it or, where actionable, at your request (see "Your rights" section below). For further specific information about our retention policies, please contact us.

If we process your personal data for the purposes outlined above, you have the following rights:

• The right to be informed as to whether we hold data about you;
• The right of access to that information;
• The right to have inaccurate data about you corrected;
• The right to have your data deleted;
• The right to opt out of particular data processing operations;
• The right to receive your data in a form that makes it "portable";
• The right to object to our processing of your data;
• The right to receive an explanation about any automated decision-making and/or profiling about you and to challenge those decisions where appropriate.

You can withdraw your decision to become a member of the DPF at any time by emailing hello@dataprotectionfoundation.org.

You can also contact us to opt-out of or withdraw your consent to data processing we undertake, however in some cases we may need to retain data where it is kept in compliance with a legal obligation (e.g. records of donations must be kept).

Relevant supervisory authority names and contact details are listed here. The Data Protection Authority in the United Kingdom is the Information Commissioner's Office (ICO). If you need any further information about your rights or want to lodge a concern or complaint, you may contact the ICO here.

If you have a query regarding this Policy, or if you would like to exercise your rights as a data subject, please contact hello@dataprotectionfoundation.org.

We keep this Policy under regular review and will place any updates on this page. This Policy was last updated on 20 March 2024.

We are headquartered in the United Kingdom and the data we collect is process and stored within the UK and EU in accordance with applicable data protection laws. The UK currently remains subject to EU data protection laws, however as the UK has now left the EU, it may become subject to additional requirements around transfers of data into and out of the UK. Should this eventuate, these requirements will be met by us and this Policy will be updated accordingly.