Privacy notice | Protect Black Women

This privacy notice sets out how Protect Black Women uses and protects your personal data. It is set out in sections, so you can go straight to the part you need.

Important information and who we are

This privacy notice explains how Protect Black Women collects and uses your personal data when you use this website, including any data you give us when you sign up to our newsletter or to hear about our work, make a donation or use our helpline.

Protect Black Women (PBW) is the trading name of IrisMay CIC, a community interest company. Our mission is to provide a confidential, empathic and empowering support system for Black women. Our goal is to contribute to a society where Black women are protected, respected and valued, and have the support they need to thrive.

This notice sets out our privacy practices, how we collect and use your personal information, and your rights and the choices available to you.

This website is not intended for children, and we do not knowingly collect data relating to children.

Controller

PBW is the data controller where we decide the purposes and means of processing personal information, unless we say otherwise. Our services are currently available in the UK only.

PBW is registered with the UK data protection regulator, the Information Commissioner's Office (ICO). Our registration number is to come. We have appointed a data protection officer (DPO) who is responsible for questions about this privacy notice. If you have any questions about it, including requests to exercise your legal rights, please contact the DPO using the details in Contact details:

by email: dpo@hewardmills.com
by post: 77 Farringdon Road, London EC1M 3JU
by phone: +44 20 4540 5853

This privacy notice is linked from the foot of every page of our website.

The types of personal data we collect about you

Personal data means any information about a person from which that person can be identified.

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

Identity data includes first name, last name, marital status, title, date of birth and gender.
Contact data includes the billing address you used to make a donation, your email address and telephone numbers.
Transaction data includes details of donation payments from you.
Service data is information about your use of the services we provide, for example attending our events or taking part in research, coaching or fundraising.
Marketing and communications data includes your preferences for receiving marketing from us and our third parties, and your communication preferences.
Any other information you choose to give us.

We also collect, use and share aggregated data, such as statistical or demographic data. This is not personal data, as it does not directly or indirectly reveal your identity.

How your personal data is collected

We collect data from and about you in different ways, including through your contact with us. You may give us your personal data by filling in online forms, or by writing to us by post or email, phoning us or otherwise. This includes personal data you provide when you:

apply for our services;
subscribe to our publications;
ask for marketing to be sent to you;
attend an event we organise; or
give us feedback or contact us.

Contact and transaction data is collected from payment providers such as Ko-fi.

How we use your personal data

Legal basis

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following:

Legitimate interests: where it is necessary to run our organisation and pursue our legitimate interests.
Legal obligation: where it is necessary to comply with a legal obligation we are subject to. We will name the obligation when we rely on this basis.
Consent: only where you have actively agreed to us using your personal data for a specific purpose, for example when you subscribe to our newsletter.
Performance of a contract with you: where we need to perform a contract we are about to enter into, or have entered into, with you.

Purposes for which we will use your personal data

The table below sets out the ways we plan to use your personal data, and the legal bases we rely on to do so. Where we rely on legitimate interests, we say what they are.

How we use your personal data and our legal basis
Purpose	Type of data	Legal basis
To manage our relationship with you, including telling you about changes to our terms or this notice, dealing with your requests, complaints and queries, and sending you service updates	Identity, contact, profile, marketing and communications	Performance of a contract with you; to comply with a legal obligation; our legitimate interests (keeping our records up to date and managing our relationship with you)
To check eligibility for helpline support	Identity	Our legitimate interests
To process your donation	Identity, contact, transaction, marketing and communications	Our legitimate interests
To carry out research through surveys you choose to take part in	Identity, contact	Our legitimate interests (to understand how people use our services, and to improve and develop them)
To protect our legal rights and meet our legal and regulatory obligations, for example sharing data with relevant authorities such as law enforcement or tax authorities, in connection with legal proceedings, to prevent or detect crime, or to support people who may be at risk	To be confirmed	Legal obligation; our legitimate interest in meeting our legal and regulatory obligations effectively. If we process special categories of personal data: substantial public interest, or your explicit consent, which we will ask for if we rely on it

Direct marketing

You will receive marketing from us if you have asked us for information or taken part in our services, and you have not opted out of receiving it.

Third-party marketing

We will ask for your express consent before we share your personal data with any third party for their own marketing. We do not currently carry out any third-party marketing.

Opting out of marketing

You can ask us to stop sending you marketing at any time, by following the opt-out link in any marketing email or by contacting us. If you opt out, you will still receive messages that are essential to the services you use, for example updates to our terms or checks that your contact details are correct.

Cookies

For more information about the cookies we use, please read our cookie policy.

Disclosures of your personal data

We may share your personal data where it is lawful to do so, for example where we have a legitimate reason. We may share your information with:

our third-party service providers, including Ko-fi, which manages our donation payments, the providers of our IT systems and hosting, and providers who help us communicate with you, such as by sending emails;
our professional advisers, such as legal advisers;
relevant public authorities, including law enforcement; and
anyone you have agreed we may share your information with, or asked us to share it with.

We require all third parties to respect the security of your personal data and to treat it in line with the law. We do not allow our service providers to use your personal data for their own purposes, and only allow them to process it for specified purposes and in line with our instructions.

International transfers

Sometimes your information may be sent to, accessed from or stored in places outside the United Kingdom. Whenever your information is transferred outside the UK, we make sure that appropriate safeguards are in place and that the transfer meets the legal requirements that apply.

Data security

We have put appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed without authorisation, altered or disclosed. We apply a range of technical, physical and organisational measures to keep your information safe, and we work with our service providers to make sure an appropriate level of security is in place.

We also limit access to your personal data to the people who need to know it. They are subject to a duty of confidentiality.

Data retention

We only keep your personal data for as long as is reasonably necessary for the purposes we collected it for, including to meet any legal, regulatory, tax, accounting or reporting requirements. We may keep your personal data for longer if there is a complaint, or if we reasonably believe there is a prospect of legal action about our relationship with you. For more information about how long we keep data, please email dpo@hewardmills.com.

Your legal rights

Under UK data protection law, you have rights that include the right to:

Request access to your personal data (known as a data subject access request). This lets you receive a copy of the personal data we hold about you and check that we are processing it lawfully.
Request correction of your personal data. This lets you have any incomplete or inaccurate data we hold about you corrected, though we may need to check the accuracy of the new data you give us.
Request erasure of your personal data. This lets you ask us to delete or remove personal data where there is no good reason for us to keep processing it, where you have successfully objected to processing, where we may have processed it unlawfully, or where UK law requires us to erase it. We may not always be able to agree to erasure for specific legal reasons, which we will explain at the time of your request.
Object to processing where we rely on a legitimate interest, if you feel it affects your fundamental rights and freedoms in your particular situation.
Request restriction of the processing of your personal data.
Request transfer of your personal data (known as data portability), so that we provide your personal data to you, or to a third party you choose, in a structured, commonly used, machine-readable format.

Where you have given us consent to use your personal information for any of these purposes, you can withdraw that consent at any time. You can also opt out of any marketing we send you at any time.

Automated decision-making

We do not make automated decisions or profile you when you contact us or use our services.

Contact details

To make a data protection rights request, please contact our data protection officer at dpo@hewardmills.com. You will not have to pay a fee to access your personal data or to exercise any of your other rights. However, we may charge a reasonable fee, or refuse to comply, if a request is clearly unfounded, repetitive or excessive.

We may need to confirm your identity to make sure we are responding to the right person, and we will let you know if we do. We aim to respond within one month, and will tell you if we cannot.

Raising concerns and complaints

If you have any concerns about how we process your personal information, we would like the chance to resolve them, so please contact us first by emailing dpo@hewardmills.com.

If you feel your complaint has not been dealt with, you can also complain to the ICO. Find out how to complain to the ICO.

Changes to this privacy notice

We may update this privacy notice from time to time in response to legal, technical or organisational changes. If we make any substantial changes to how we process your personal data, we will tell you in the most appropriate way.

Third-party links

This website may include links to other websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.