Data Protection Policy and Privacy Notice
This policy applies to all staff, trustees and volunteers of Wikimedia UK.
Introduction
Wikimedia UK is committed to protecting and respecting your privacy and your personal information. This data protection policy sets out how and why we obtain personal information, how we use it, and what steps we take to protect it. It describes the lawful basis on which we do this and your rights in respect of your data. It tells you how to get in touch if you have any further questions.
Our website policy describes what cookies we use on our website and their purpose.
Who we are
Wikimedia UK is a company limited by guarantee (number 6741827) and a registered charity (number 1144513). We are the UK chapter of the global Wikipedia movement. This policy relates to information which is obtained by Wikimedia UK and which Wikimedia UK uses.
What we do
Wikimedia UK works in partnership with organisations from the cultural and education sectors and beyond in order to unlock content, remove barriers to knowledge, develop new ways of engaging with the public and to enable learners to benefit fully from the educational potential of the Wikimedia projects.
We support the development of open knowledge in the UK, by increasing understanding and recognition of the value of open knowledge and advocating for change at an organisational, sectoral and public policy level. Our members and supporters help us do this by:
- Fundraising and donating money, services or gifts-in-kind
- Campaigning for change and engaging in public debate
- Participating in voluntary activities such as editathons.
What personal data we collect
- Membership data: this is information you give us when you join Wikimedia UK. This will include your name, address, email, telephone numbers, date of birth, and country of residence. This may also include bank details, data regarding participation in events, contributions to Wikimedia websites, membership of or affiliation to other organisations (for example, a university) and data from third party sources such as social media.
We keep this information while you are a member and for a period of three years after the date on which your membership ceases.
- Supporter data: this is information you give us when you donate time, money, services or goods to Wikimedia UK. This may include your name, aliases, address, email, telephone numbers, date of birth, bank details and country of residence. This may also include data regarding participation in events, contributions to Wikimedia websites, membership of or affiliation to other organisations (for example, a university). This information may come to us directly from you, or indirectly from third party sources such as social media or when, for example, you purchase goods or services through a third party site.
We keep this information for a period of three years from your most recent interaction with us, unless you give consent for us to hold it for longer or unless otherwise required by law.
- Volunteer data: this is information you give us when you participate in Wikimedia or partner organisations events or activities. This may include your name, aliases, address, email, telephone numbers, date of birth, bank details and country of residence. This may also include data regarding participation in events, contributions to Wikimedia websites, membership of or affiliation to other organisations (for example, a university). This information may come to us directly from you, or indirectly from third party sources such as social media or when, for example, you purchase goods or services through a third party site.
We keep this information for a period of three years from your most recent interaction with us, unless you give consent for us to hold it indefinitely.
- Contractor data: this is information you give us when you enter into a contractual relationship with us, whether as a member of staff, a supplier or in some other capacity. This data may include your name, national insurance, pension and tax details, bank details and the amount(s) you have paid to or been paid by Wikimedia UK. This may also include your address, email, telephone numbers, date of birth, and country of residence. This may also include data regarding participation in events, contributions to Wikimedia websites, membership of or affiliation to other organisations (for example, a university) and data from third party sources such as social media.
We keep this information for a period of seven years from your most recent interaction with us, unless otherwise required by law.
- Cookies: We collect information about your interactions with our website using cookies. We might also obtain your personal data through your use of social media such as Facebook, Twitter or LinkedIn. To change your settings on these services, please refer to their privacy notices, which will tell you how to do this. Our use of cookies is covered by a separate policy here.
How we use personal data
We hold and process personal data of members, supporters, volunteers and contractors. We use it as follows: Members: We use this data in order to fulfil our commitments as a membership organisation, to ensure the proper conduct of the organisation and to meet our obligations under our Articles of Association and as required by law. Supporters: We recognise that supporters have a legitimate interest in how we use their donations and that this interest persists after a donation is made. We use this data to keep a record of donations made and actions taken by our supporters, to keep supporters informed of our activities and how their donations are being used, and to solicit further support, both financial and in kind. We also use the data to record and monitor how we communicate with supporters. Volunteers: We recognise that volunteers have an ongoing and legitimate interest in our activities and that this interest persists after a contribution is made. We use this data to keep a record of donations made and actions taken by our volunteers and our communications with them, to keep volunteers informed of our activities and how their donations are being used, and to solicit further support, both financial and in kind. We also use the data to record and monitor how we communicate with volunteers. Contractors: We use contractor data for the proper administration of our contracts, to comply with existing legislation, and in the course of our normal business.
This means that the lawful basis for us processing your personal information described above will be one or more of the following:
- because it is necessary to fulfil a contract that we have in place with you; or
- because the processing is necessary for compliance with our legal obligations; or
- because we have a legitimate business interests or
- because we have your consent to keep and use the data
Where we are made aware that there is no lawful basis for keeping personal data, we will delete it.
Wikimedia UK will not, under any circumstances, share or sell your personal data with any third party for their own marketing purposes, and you will not receive marketing from any other companies, charities or other organisations as a result of giving your personal data to us.
How we govern the use of personal data
The Board of Trustees recognises its overall responsibility for ensuring that Wikimedia UK complies with its legal obligations. It reviews data systems and procedures annually to ensure compliance with the law and good practice. Day to day responsibility for data management is delegated to the CEO, who has the following responsibilities: advising the Board on data protection and related policies ensuring data security approving data protection-related statements on publicity materials and letters ensuring that staff have appropriate training in data protection and receiving and responding appropriately to data inquiries
All staff and volunteers are required to read, understand and accept any policies and procedures that relate to the personal data they may handle in the course of their work. Each member of staff, trustee and volunteer at Wikimedia UK who handles personal data will comply with the organisation's operational procedures.
Wikimedia UK has registered with the Information Commissioner's Office under the Data Protection Act. Our registration number is Z3098483.
Because confidentiality applies to a much wider range of information than GDPR, Wikimedia UK has a separate Confidentiality Policy. In the event of any conflict, this Data Protection Policy takes precedence.
Data Recording and storage
Wikimedia UK has a single database holding basic information about all donors. The back-ups are kept securely.
Wikimedia UK will regularly review its procedures for ensuring that its records remain accurate and consistent and, in particular:
- The database system is reviewed and re-designed, where necessary, to encourage and facilitate the entry of accurate data.
- Data on any individual will be held in as few places as necessary, and all staff and volunteers will be discouraged from establishing unnecessary additional data sets.
- Effective procedures are in place so that all relevant systems are updated when information about any individual changes.
- Staff and volunteers who keep more detailed information about individuals will be given additional guidance on accuracy in record keeping.
- Data will be corrected if shown to be inaccurate
Wikimedia UK stores archived paper records of clients and volunteers securely in the office.
Your Personal Data relating to any interactions with Wikimedia UK will be held on a computer within the European Economic Area, as required by our Data Protection Act registration.[1] Data you have explicitly caused to be placed on an internet-visible computer yourself, thereby giving your consent, such as comments or edits on this website or contributions to an email list, may be held on computers worldwide.
Access to data
All donors, members of staff. trustees and volunteers have the right to request access to all information stored about them. Any subject access requests will be handled by the Data Protection Officer within the required time limit.
Subject access requests must be in writing. All staff and volunteers are required to pass on anything which might be a subject access request to the Data Protection Officer without delay.
All those making a subject access request will be asked to identify any other individuals who may also hold information about them on behalf of Wikimedia UK, so that this data can be retrieved.
Where the individual making a subject access request is not personally known to the Data Protection Officer their identity will be verified before handing over any information.
The required information will be provided in permanent form unless the applicant makes a specific request to be given supervised access in person.
Wikimedia UK will provide details of information to service users who request it unless the information may cause harm to another person.
Staff have the right to access their file to ensure that information is being used fairly. If information held is inaccurate, the individual must notify the Chief Executive so that this can be amended and recorded on file.
Transparency
Wikimedia UK is committed to ensuring that in principle Data Subjects are aware that their data is being processed and
- for what purpose it is being processed;
- what types of disclosure are likely; and
- how to exercise their rights in relation to the data.
Data Subjects will generally be informed in the following ways:
- Staff: in the staff terms and conditions
- Volunteers: in the volunteer welcome/support pack
- Clients: when they request (on paper, on line or by phone) services
- Donors: as part of the process of making donations
Standard statements will be provided to staff for use on forms where data is collected.
Whenever data is collected, the number of mandatory fields will be kept to a minimum and Data Subjects will be informed which fields are mandatory and why.
Consent
Consent will normally not be sought for most processing of information about staff. Although staff details will only be disclosed for purposes unrelated to their work for Wikimedia UK (e.g. financial references) with their consent.
Information about volunteers will be made public according to their role, and consent will be sought for (a) the means of contact they prefer to be made public, and (b) any publication of information which is not essential for their role.
Information about clients will only be made public with their consent. (This includes photographs.)
‘Sensitive’ data about clients (including health information) will be held only with the knowledge and consent of the individual.
Consent should be given in writing, although for some services it is not always practicable to do so. In these cases verbal consent will always be sought to the storing and processing of data. In all cases it will be documented on the database that consent has been given.
All Data Subjects will be given the opportunity to opt out of their data being used in particular ways, such as the right to opt out of direct marketing (see below).
Wikimedia UK acknowledges that, once given, consent can be withdrawn, but not retrospectively. There may be occasions where Wikimedia UK has no choice but to retain data for a certain length of time, even though consent for using it has been withdrawn.
Direct marketing
Wikimedia UK will treat the following unsolicited direct communication with individuals as marketing:
- seeking donations and other financial support;
- promoting any Wikimedia UK services or promotional goods;
- promoting Wikimedia UK events;
- promoting membership to supporters;
- promoting sponsored events and other fundraising exercises;
- marketing on behalf of any other external company or voluntary organisation.
Whenever data is first collected which might be used for any marketing purpose, this purpose will be made clear, and the Data Subject will be given a clear opt out. If it is not possible to give a range of options, any opt-out which is exercised will apply to all Wikimedia UK marketing. Wikimedia UK does not have a policy of sharing lists, obtaining external lists or carrying out joint or reciprocal mailings.
Wikimedia UK will only carry out telephone marketing where consent has been given in advance, or the number being called has been checked against the Telephone Preference Service.
Whenever e-mail addresses are collected, any future use for marketing will be identified, and the provision of the address made optional.
Staff training and acceptance of responsibilities
All staff who have access to any kind of personal data will be given copies of all relevant policies and procedures during their induction process, including the Data Protection policy, Confidentiality policy and the operational procedures for handling personal data. All staff will be expected to adhere to all these policies and procedures.
Data Protection will be included in the induction training for all volunteers.
Wikimedia UK will provide opportunities for staff to explore Data Protection issues through training, team meetings, and supervisions.
Appendix: Privacy statement
When you request information from Wikimedia UK, sign up to any of our services or buy things from us, Wikimedia UK obtains information about you. This statement explains how we look after that information and what we do with it.
We have a legal duty under the Data Protection Act to prevent your information falling into the wrong hands. We must also ensure that the data we hold is accurate, adequate, relevant and not excessive.
Normally the only information we hold comes directly from you. Whenever we collect information from you, we will make it clear which information is required in order to provide you with the information, service or goods you need. You do not have to provide us with any additional information unless you choose to. We store your information securely on our computer system, we restrict access to those who have a need to know, and we train our staff and volunteers in handling the information securely.
If you have signed up to an event or other service we will also pass your details to the staff and volunteers providing that service. They may hold additional information about your participation in these activities.
We would also like to contact you in future to tell you about other services and events we provide, to keep you informed of what we are doing and ways in which you might like to support Wikimedia UK. You have the right to ask us not to contact you in this way. We will always aim to provide a clear method for you to opt out. You can also contact us directly at any time to tell us not to send you any future marketing material.
You have the right to a copy of all the information we hold about you (apart from a very few things which we may be obliged to withhold because they concern other people as well as you). To obtain a copy, either ask for an application form to be sent to you, or write to the Data Protection Officer at Wikimedia UK. There is a charge of £10 for a copy of your data (as permitted by law). We aim to reply as promptly as we can and, in any case, within the legal maximum of 40 days.
References
- ↑ You can view our registration via the Information Commissioner's Office website. Our Data Protection Act Registration Number is Z3098483.