Privacy notice

2. The personal data we collect and how we use it

What data we collect

360Giving is known as the ‘data controller’ of the personal data you provide to us. We collect basic personal data about you when you interact with us, in person, when you visit our websites, subscribe to our newsletter or join our forum, attend one of our events or otherwise contact us by telephone, email or post. We also collect your personal data when you subsequently update it, or communicate with us.

We may also collect your personal data when this is provided to us by a third party, who you have given permission to pass on your details. We may also collect your personal data in the form of your IP address through website cookies or email tracking technologies, as well as from publicly available sources (such as your organisation’s website).

The basic information we collect directly from you typically includes: your name, email address, telephone number, job title and organisation (if applicable).

We also collect personal data about job applicants, and current and former employees, workers, contractors and volunteers. The full details of this processing are documented in separate privacy notices made available when required to the individuals concerned.

How we use your data

We collect and process personal data for the following reasons;

• To fulfil your request or to enable us to provide you with a more personalised service.
• To fulfil a contract or where we are required to do this by law or other regulations.
• To provide you with information about our work or our activities. For individuals this information is provided by email newsletter with your consent because you subscribed to receive updates via our website.

We also collect and process your data in connection to specific activities which
allow us to pursue our charitable mission when it is in our legitimate interests to do
this and when these interests do not override your rights. These specific activities
include;

• Providing information to our professional contacts about our work or our activities via email newsletter.
• Holding learning and engagement events.
• Responding to enquiries and providing technical helpdesk support for organisations wanting to publish open grants data.
• Running competitions to stimulate the use of open grants data.
• Providing online community forum and website.
• Providing online tools to support the exploration and publication of open grants data.
• Preventing fraud and maintaining the security of our systems.
• Data analytics to monitor the use and performance of our websites.

‘Legitimate interests’ are one of the lawful reasons we can process your personal information. This means we can process your personal information if we have a genuine and legitimate reason and we are not harming any of your rights and interests. When we process your personal information for our legitimate interests, we will consider and balance any potential impact on you and your rights.

If you would like to change the way you hear from us or no longer wish to receive communications from us please contact us using the form below.

You can unsubscribe from our newsletter or marketing communications at any time by clicking the unsubscribe link at the bottom of these emails.

We do not process your data using automated decision making or profiling.

3. Sharing your personal data

We will never sell, rent or trade your personal information to other organisations.

We do use a number of data processors in order to deliver our services and may share your personal information with third parties in the following situations:

• If you have agreed that we can share your personal data.
• When we are obliged to by law, for purposes of national security, taxation and criminal investigations.
• If we run an event in partnership with other named organisations your details may need to be shared. In these cases we will be clear what will happen to your data when you register.
• With service providers providing online platforms on our behalf. For example, these include cloud-based databases, website hosting, cloud storage, forum management and email services.
• When we use other companies or professionals to provide services on our behalf. For example our helpdesk support assisting organisations who want to publish open grants data, and consultants who provide financial, training, data analysis, website design or communications services.

We have data processing agreements in place with organisations that process personal data on our behalf, to ensure that the processing meets all the requirements of data protection law.

The following is a non-exhaustive list of our third party data processors:

• Open Data Services Co-operative
  Provide ongoing technical support to organisations publishing or preparing to publish open grants data, managing data tools on behalf of 360Giving, supporting with documenting and governance of the 360Giving Standard. Their privacy policy can be found here.
• Airtable
  Platform to host the Resource Library. Their privacy policy can be found here.
• Applied
  Platform to administer job applications. Their privacy policy can be found here.
• Discourse
  Provide the platform for 360Giving forum. Their privacy policy can be found here.
• Eventbrite
  Provide event management and ticketing services for 360Giving events. Their privacy policy can be found here.
• Google Analytics
  Provide website analytics for some 360Giving websites. Their privacy policy can be found here.
• Google Cloud Services
  Provide email and cloud file storage services. Their privacy policy can be found here.
• Mailchimp
  Provide email services for maintaining email lists and sending of our newsletter and ad-hoc communications. Mailchimp service deploy cookies and similar tracking technologies (like web beacons or pixels) which collect data from recipients of emails sent via the service. The details of this processing is described in their Cookie Statement. Their privacy policy can be found here.
• Mythic Beasts
  Providing hosting services software for the 360Giving tools. Their privacy policy can be found here.
• Matomo
  Provide website analytics for some 360Giving websites. Their privacy policy can be found here.
• ReadTheDocs
  Provide web hosting for 360Giving documentation websites. Their privacy policy can be found here.
• Salesforce
  Provide contact management to store and manage professional contact details. Their privacy policy can be found here.
• WP Engine
  Provide hosting for the 360Giving website. Their privacy policy can be found here.
• Xero
  Provide accounting software. Their privacy policy can be found here.
• Zoom
  Provide event management and ticketing services for 360Giving online events. Their privacy policy can be found here.

4. How we store and secure your personal data

We are committed to keeping your data secure. We use security technologies and procedures to help protect your personal information from unauthorised access and use.

We are based in the UK and when possible process and store data within the UK or European Economic Area (EEA).

Some organisations which provide data processing services to us are based outside of the UK or EEA. In these cases we have taken all reasonable steps to ensure that your data is treated securely and in accordance with our privacy policy.

This includes entering into standard contractual clauses, ensuring data is being transferred to countries that have been identified as providing adequate protection for EEA data.

5. Retention of your personal data

We hold your information only as long as it is needed for each purpose for which is is collected, in line with our privacy policy. On a regular basis we will review the data we hold to ensure that its use is necessary and proportionate. If you request that we have no further contact with you, we may need to keep some basic information in order to avoid sending you unwanted communications in the future or accidentally duplicating information.

6. Our websites

We are responsible for this website and its contents. We also operate the following websites.

GrantNav: http://grantnav.threesixtygiving.org
GrantNav help: https://help.grantnav.threesixtygiving.org/
360Insights: https://insights.threesixtygiving.org
360GrantVis: https://grantvis.threesixtygiving.org/
Covid-19 Grants Tracker: https://covidtracker.threesixtygiving.org/
Cost of Living Tracker: https://col.threesixtygiving.org/
Covid-19 analysis: https://covidresearch.threesixtygiving.org/
Data Quality Tool: https://dataquality.threesixtygiving.org
Data Quality Dashboard: https://qualitydashboard.threesixtygiving.org/
360Giving Forum: https://forum.threesixtygiving.org
Publisher guidance and documentation: http://standard.threesixtygiving.org
Resource Library: https://resources.threesixtygiving.org/
UKGrantmaking: https://www.ukgrantmaking.org/

Further details about how these websites process personal data and use cookies can be found on each website.

How we use cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site.

Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookie if you prefer. This may prevent you from taking full advantage of the website.

For details of how we use cookies on this website see our Cookie Policy.

Understanding server behaviour and identifying and being alerted to software errors

We collect data about your visits to the website in server logs. This is for the purpose of debugging network issues, monitoring server usage, and identifying malicious usage. When an error occurs on our sites, we record details about the visit that caused it.

Personal data we collect:

• Your IP address (a unique string of characters that identifies each computer using the Internet Protocol to communicate over a network)
• User agent (information about the Operating System and browser that you use)
• Referrer (what page you arrived at one of our web pages from)

We do not use this data to personally identify individuals, but it is possible that it could be used to do so, particularly if combined with other datasets.

This server data is kept indefinitely.

Links to other websites

Our websites may contain links to other websites of interest. However, once you have used these links to leave our sites, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

7. Your rights

Contact us if you would like a copy of the information held on you or if you believe that any information we are holding on you is incorrect or incomplete. You can change the way you hear from us or withdraw your permission for us to process your personal data at any time by contacting us.

You have the following rights concerning this data:

• Transparency over how we use your personal information (right to be
  informed), which is the purpose of this privacy notice.
• Request a copy of the information we hold about you, which will be provided
  to you within one month (right of access).
• Update or amend the information we hold about you if it is wrong (right of
  rectification).
• Ask us to stop using your information (right to restrict processing).
• Ask us to remove your personal information from our records (right to be
  ‘forgotten’).
• Object to the processing of your information for marketing purposes (right to
  object).
• Obtain and reuse your personal data for your own purposes (right to data
  portability).
• Not be subject to a decision when it is based on automated processing
  (automated decision making and profiling).

Note that the right to be forgotten and to restrict processing are balanced against our legitimate interests. Where relevant, you need to provide information to re-identify yourself from our pseudonymised data, see Article 11.

Our supervisory authority is the ICO in the UK. You have the right to lodge a complaint with them.

8. How to contact us

Please contact us through our contact form or write to

360Giving
c/o Sayer Vincent
110 Golden Lane
London
EC1Y 0TG

If you would like to:

• Change the way you hear from us or no longer wish to receive communications from us
• Ask questions about anything in this privacy notice
• Inform us that you think that your personal data has been misused or mishandled