Privacy notice

Our Sites allow you to interact with Policy in Practice in many ways, including but not limited to:

• Contacting us for further information by phone or email
• Subscribing to Policy in Practice email communications highlighting information about our news, publications, research, webinars and events
• Clicking the links to register for our events
• Clicking the links to access our free Benefit Calculator
• Responding to advertised vacancies at Policy in Practice

If you wish to interact with us in any of the ways described above, you will need to provide us with some additional personal information so that we can liaise with you in order to deal with your request or query, or so that we can provide the service you wish to use. If you do choose to provide us with your personal information, it may include:

• Details of your visits to the Sites already described above, such as traffic and location data
• The reason for your contact, which may be an enquiry or a request
• Information you provide when you phone, email and/or subscribe to our email communications, which may include your name, email address and employment details (including but not limited to your job title and the name of your organisation)
• Information you provide when you use our Benefit Calculator
• Your contact and marketing preferences, if you explicitly consent to future contact or marketing
• If you agree to take a survey or interact with us in various other ways – demographic information and information about subjects that may interest you
• Information necessary and relevant to a job application or query, such as personal information provided in a cover letter and CV
• Information necessary for legal or regulatory compliance and/or
• If you publicly post about us, or communicate directly with us, on a social media website, we may collect and process the data contained in such posts or in your public profile for the purpose of addressing any customer service requests you may have

Policy in Practice offers a free online Benefit Calculator service to help people understand what support they are eligible for. It is accessible via www.betteroffcalculator.co.uk and via www.gov.uk/benefits-calculators and may also be available via mobile applications published by Policy in Practice. This service is regularly reviewed by government.

Users are asked for dates of birth and postcode information in order to ensure the results of the calculation are accurate and correctly tailored to the individual user.

Users can choose to register, also for free, to access an enhanced ‘premium’ version of the calculator that allows them to save their calculation. Premium users are advised that we will store their calculation, which may include potentially sensitive personal information such as household composition, dates of birth of family members and financial details.

This notice includes full details of how we process personal data under both free and free premium scenarios and advises individuals who register for the premium version of the Calculator of their rights under GDPR, and how to exercise them.

The GDPR requires one or more lawful bases to use your personal information. We consider the bases listed below to be relevant:

• Where you have provided your consent for us to use your personal information in a certain way.For example, we will ask for your explicit consent to send you marketing material by email. We will also ask for your agreement to allow your personal information (including sensitive personal information) to be stored on our database if you register for and wish to save calculations from the free premium Better Off Calculator)
• Where necessary so that we can comply with a legal obligation to which we are subject
• Where necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering a contract (for example, to allow you to participate in an event for which you have registered)
• Where there is a legitimate interest for Policy in Practice to do so if it is reasonably necessary to achieve our or others’ legitimate interests (as long as that processing is fair, balanced and does not unduly impact your rights).

‘Legitimate Interests’ means our interests in conducting and managing our business. For example, we have an interest in making sure our marketing is relevant for you, so we may process your information to send you marketing that is tailored to your interests.

It can also apply to processing that is in your interests as well. For example, we may process your information to protect you against fraud when transacting on our website, and to ensure our websites and systems are secure.

When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you, both positive and negative, and your rights under data protection legislation. Our legitimate interests do not automatically override your interests; we will not use your personal information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

If you have any concerns about our processing, you have the right to object to processing that is based on our legitimate interests. For more information on your rights, please see below.

Your personal information may be made available to third parties (within or outside Policy in Practice) providing relevant services under contract to Policy in Practice, such as marketing agencies, customer service companies, advisers, auditors and compliance managers, IT hosting and IT maintenance providers. These companies may use information about you to perform their services on our behalf and for no other purpose.

We may disclose specific information upon lawful request by government authorities, law enforcement and regulatory authorities where required or permitted by law and for tax or other purposes.

The Sites include links to third party websites and some of your personal information from your browsing session may be transferred to such third party websites (please see our Cookies Policy for more information). Third parties we work with include but are not limited to:

• Active Campaign: for email marketing and marketing automation activity
• WordPress: This website is built with and is running WordPress. It is hosted in Amazon Web Service’s UK data centre
• LogMeIn: to deliver our webinars, via GoToWebinar, and our online meetings, via GoToMeeting
• Eventbrite: to manage ticketing and registration of our in-person events
• Survey Monkey: to create, send and analyse surveys
• Pipedrive: to manage our sales processes
• Zapier: to connect our apps and automate our digital processes
• Olark: to supply and support our real time live chat with customers

We will not sell your personal data to any third party other than as part of any restructuring or sale of Policy in Practice.

Policy in Practice may wish to provide you with information about news, research, analysis, publications, events, webinars or job opportunities which may be of interest to you, and may invite you to take part in market research or request feedback on our activities. We will communicate with you by email, telephone or post, depending on any preferences you give us. We will obtain your consent and provide notice of our proposed communications and advise you how you can opt-out of receiving such communications in the future, if you subsequently change your mind.

We will provide a simple means for you to unsubscribe to further marketing from us in each of the marketing emails. You can also opt-out of direct marketing activities by emailing admin@policyinpractice.co.uk, or writing to Marketing Opt Out, Policy in Practice, PUBLIC Hall, 1 Horse Guards Avenue, Westminster, London, SW1A 2HU or by calling us on 0330 088 9242. We will process that request as soon as possible.

We use a variety of security measures to maintain the safety of your personal information. Nevertheless, whilst we take efforts to safeguard your personal information in accordance with relevant laws, please be aware that the nature of the internet is such that we cannot guarantee absolutely the security of any personal information you disclose online.

We use up to date security controls to encrypt and protect email traffic. Please be aware that any emails we send or receive may not be protected in transit. We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

This Privacy Notice does not cover the links within our sites linking to other websites. We encourage you to read the privacy statements on the other websites you visit to ensure you are satisfied with the safeguards in place there to protect your personal information.

All of Policy in Practice’s software and data services are hosted on Amazon Web Services (AWS) EU West 2 data centre, located in the United Kingdom.

Our database applications, including the Better Off Calculator, are stored and backed up automatically within this secure environment.

For data processing activities related to our website and marketing services:

• Website data: Our website is hosted on WordPress, which processes data submitted through features such as contact forms or other interactive elements. WordPress employs industry standard security protocols and complies with applicable data protection regulations
• Email marketing: We use ActiveCampaign to manage our email marketing and marketing automation activities. Data submitted for newsletter subscriptions or marketing communications is securely stored and processed by ActiveCampaign, which adheres to GDPR and other relevant international data protection frameworks

Both WordPress and ActiveCampaign ensure robust security measures are in place, safeguarding data throughout all processing activities.

Under certain circumstances, you have rights under data protection laws in relation to your personal data as follows:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

• If you want us to establish the data’s accuracy.
• Where our use of the data is unlawful but you do not want us to erase it.
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
• You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

How to make a request

If you wish to exercise any of these rights, please contact us. Please address requests to:

Head of Admin Services, Policy in Practice, PUBLIC Hall, 1 Horse Guards Avenue, Westminster, London, SW1A 2HU. Alternatively you can telephone: +44 (0)330 088 9242, or email: admin@policyinpractice.co.uk.

It is Policy in Practice’s policy to ensure that all subject access requests for personal data are acknowledged within 5 working days. At the time of acknowledgement, to help us deal with the request, individuals will be asked to complete a subject access request form which can be used by the requester to clarify the information sought. However, requesters do not have to do this or use this form to exercise their rights. If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Further concerns

If you have a concern about the way we are collecting or using your personal data, if we do not address your request, or if we fail to provide you with a valid reason why we have been unable to do so, you have the right to contact the Information Commissioner’s Office to make a complaint. They can be contacted via their website https://ico.org.uk/concerns/ or by telephone 0303 123 1113.

We will keep your details on record until we have completely dealt with your request, enquiry or application and then for a reasonable period afterwards. We will then securely delete your details in accordance with data protection and other applicable legislation.

In some circumstances we will anonymise your personal data so that it can no longer be associated with you, in which case this will no longer be personal data. We may use this information indefinitely without further notice to you for research, statistical or other purposes and we may share this anonymised data with third parties for research, statistical or other purposes.

We keep this Privacy Notice under regular review. We may change it from time to time by updating this page in order to reflect changes in the law and/or our privacy practices. The date at the top of this Privacy Notice will be updated accordingly.

We encourage you to check the date of this Privacy Notice when you visit the Site for any updates or changes.

This Privacy Notice only extends to the Sites and does not, therefore, extend to your use of, provision of data to and collection of data on any website not connected to us to which you may link by using the hypertext links within this website.

The images used on this website are ethically sourced. In addition to those we commission directly from photographers we also use royalty free image libraries such as Unsplash.com. If you believe we are using an image on this website without correct accreditation please notify admin@policyinpractice.co.uk.