Privacy Notice

Introduction

This privacy notice describes how Impact 100 London (“Impact 100”) collects and uses your personal information in connection with your use of its website (https://www.impact100london.org/) and related activities. This privacy notice is not intended to override any other privacy notice we provide you in other specific circumstances.

Impact 100 may change this notice at any time by making an updated version available on the website, or by contacting you directly. If you have any questions about this privacy notice or how we treat your personal information, please contact us using one of the following methods:
Privacy@impact100london.org

1. Personal Information We Collect
Personal information is any information about you from which you can be directly or indirectly identified. We may collect the following personal information in connection with your use of our website and related activities: Information You Submit We may process personal information provided by you:
* At the time of registering for and using our mailing lists, including information that you provide by filling in forms on the website such as your name and email address or contact details; and
* When making an enquiry or requesting further services. Device Information We may collect and process information about the device you use to access our website or related services, including:
* IP addresses;
* Preferences;
* Web pages you visited prior to coming to our website; and
* Information about your browser such as browser type and version, operating system, internet service provider, preference settings, unique device IDs, and language and other regional settings

Newsletter Interaction Data
We may collect usage data about you whenever you interact with Impact 100’s newsletters, such as:
* The date and time you accessed the newsletter;
* What pages are viewed from the newsletter; and
* Metrics related to the deliverability of the newsletter and other electronic communications

Information from Third Party Sources
From time to time we may obtain information about you from third-party sources, such as social media platforms and third-party data providers. We take steps to ensure that such third parties are legally or contractually permitted to disclose such information to us.

2. How We Use Personal Information
We may use your personal information, information you provide to use through the website, and information about how you interact with the website in the following ways:
USE OF INFORMATION
TYPE OF INFORMATION
LEGAL BASIS
To deliver the services and information offered through the website
* Submitted information
* Device information
* Cookies Necessary for performance of our contract with you to provide our services
To audit data showing the number of users that have accessed the website and how they are using it
* Device information
* Cookies Consent To audit data showing the number of users that have accessed the newsletter and how they are using it
* Submitted information
* Newsletter interaction information
* Device information
* Cookies Consent To develop and improve the website
* Submitted information
* Device information
* Aggregated data
* Cookies
To further our legitimate interest in improving our services and the website
To meet legal requirements including complying with court orders, valid discovery requests, and other appropriate legal mechanisms
* Submitted information
* Newsletter interaction information
* Device information
* Cookies
* Aggregated data
Necessary to comply with a legal obligation
To provide information to representatives and advisors, including lawyers and accountants, to help us comply with legal, accounting or security requirements
* Submitted information
* Newsletter interaction information
* Device information
* Cookies
* Aggregated data
Necessary to comply with a legal obligation
To provide any information or services requested by you, including our newsletter and event information
* Submitted information
* Device information
* Cookies

Consent
Please note that where our legal basis for processing is consent you can withdraw your consent at any time by contact us using the details at the start of this notice. This includes unsubscribing from our mailing list.

3. Cookies and other Tracking Technology
Cookies are text files which are stored on your computer or other device when you visit our website. They allow us to distinguish you from other users, which helps us to provide you with a positive experience when you browse our website. Cookies also provide us with information which helps us improve the website. You can find a full list of the types of cookies and other tracking technology we use in Schedule 1.
It is possible to switch off cookies by setting your browser preferences. Please note that turning off cookies may result in a loss of functionality when using our website.

4. Information Sharing
As a general rule, we do not share your personal information with third parties other than to the extent it is necessary for Impact 100’s operations, in accordance with the purposes for which we use your personal data and the lawful basis for doing so. Accordingly, your personal information may be shared with the following third parties:
* IT Service Providers: To provide the website it is necessary for us to engage external IT service providers to help administer the website and host our servers. Your information will be transferred to the external IT service providers who will handle the information only as necessary to perform technical services.
* Other Professionals: in order to provide some of our services, we may require the input of third parties such as lawyers, accountants and financial advisers. This may require the disclosure to such third parties of your contact details and other personal data about you which is relevant to the services they provide. Your information will be transferred to such professionals only as is necessary for the performance of their services.
* Law Enforcement Agencies: we may disclose your personal information to third parties such as law enforcement agencies if we believe disclosure is necessary or appropriate in our legitimate interests to prevent harm or loss, or in connection with an investigation of suspected or actual illegal activity, or when we are required to do so by applicable law.

5. Transfer of Personal Information Outside the EEA
Some of the third parties listed in section 5 may be located in jurisdictions outside of the EEA, and we may transfer your personal information to them. In such cases, these jurisdictions or recipients may be less protective of your personal information than the applicable laws in the EEA require.
We will make these transfers on the basis that either:
* the European Commission has made an ‘adequacy decision’ in relation to the jurisdiction where the recipient is located;
* we have implemented ‘appropriate safeguards’, for example, the European Commission approved Standard Contractual Clauses with the recipient; or
* in the absence of an adequacy decision and where it is not possible to implement appropriate safeguards, we have another lawful basis for doing so.

6. Your Rights Users of the website have certain rights in relation to the personal information we hold about them. Depending on the circumstances, these may include the right to:
* request access to your personal information and obtain a copy of the information we hold about you;
* correct your personal information that we hold where it is incomplete or inaccurate;
* have your personal information erased where there is no good reason for us continuing to use or retain it;
* request that your personal information is used only for restricted purposes;
* object to your personal information being processed if the lawful basis for processing your personal information is either our or a third party’s legitimate interests, or in the public interest;
* require certain of your personal information to be transferred to you or a third party;
* at any time withdraw your consent to us processing your personal information where we rely on it as the legal basis for doing so; and
* lodge a complaint with the relevant data protection authority in your jurisdiction (for example, the Information Commissioner’s Office in the United Kingdom). If you wish to exercise any of these rights, please contact us using the details at the start of this notice.

7. Data Retention
We keep your personal information only for so long as is necessary for the purposes for which we collected it. When assessing what retention period is appropriate for your personal data, we take into consideration: * the requirements of our business and the services provided;
* any statutory or legal obligations;
* the purposes for which we originally collected the personal data;
* the lawful grounds on which we based our processing;
* the types of personal data we have collected;
* the amount and categories of your personal data; and
* whether the purpose of the processing could reasonably be fulfilled by other means.

Schedule 1
How We Use Cookies and Other Tracking Technologies
Our website uses a variety of cookies or other tracking technologies:
* Session cookies: these are stored temporarily on your device whilst you browse our website and are deleted from your device when you finish browsing.
* Persistent cookies: these are stored on your device after you have finished browsing our website so that we can remember your preferences when you visit our website in the future.
* Web Beacons: web beacons are single pixel gifs that are placed in every email to subscribers which enable us to track how an email performed and what actions subscribers took.
First party cookies are set by us; third party cookies are set by a third party’s website. For further details on cookies please visit http://www.allaboutcookies.org where you can find comprehensive information on Cookie restriction and blocking for a wide variety of browsers.
Cookies We Use
Functional and Required Cookies
NAME
TYPE
PURPOSE
EXPIRY
Crumb
Cookie
Prevents cross-site request forgery, an attack vector that tricks a browser into taking unwanted action in an application when someone’s logged in (“CSRF”)
Session
siteUserCrumb
Cookie
Prevents cross-site request forgery (CSRF) for logged in site users 3 years
RecentRedirect
Cookie
Prevents redirect loops if a site has custom URL redirects. Redirect loops are bad for SEO
30 minutes
CART
Cookie
Shows when a visitor adds a product to their cart
2 weeks
hasCart
Cookie
Tells Squarespace that the visitor has a cart
2 weeks
Locked
Cookie
Prevents the password-protected screen from displaying if a visitor enters the correct site-wide password
Session
SiteUserInfo
Cookie
Identifies a visitor who logs into a customer account
3 years
SiteUserSecureAuthToken
Cookie
Authenticates a visitor who logs into a customer account
3 years
Commerce-checkout-state
sessionstorage
Stores state of checkout while the visitor is completing their order in PayPal
Session
squarespace-popup-overlay
Localstorage
Prevents the Promotional Pop-Up from displaying if a visitor dismisses it
Persistent
squarespace-announcement-bar
Localstorage
Prevents the Announcement Bar from displaying if a visitor dismisses it
Persistent
ss_sd
Cookie
Ensures that visitors on the Squarespace 5 platform remain authenticated during their sessions
Session
Test
Cookie
Investigates if the browser supports cookies and prevents errors
Session
squarespace-likes
Localstorage
Shows when you've already "liked" a blog post
Persistent
CHECKOUT_WEBSITE
Cookie
Identifies the correct site for checkout when Checkout on Your Domain is disabled
Session

Analytics and Performance Cookies
NAME
TYPE
PURPOSE
EXPIRY
ss_cid
Cookie
Identifies unique visitors and tracks a visitor’s sessions on a site 2 years
ss_cvr
Cookie
Identifies unique visitors and tracks a visitor’s sessions on a site 2 years
ss_cvisit
Cookie
Identifies unique visitors and tracks a visitor’s sessions on a site 30 minutes
ss_cvt
Cookie
Identifies unique visitors and tracks a visitor’s sessions on a site 30 minutes
ss_cpvisit
Cookie
Identifies unique visitors and tracks a visitor’s sessions on a site 2 years
ss_cookieAllowed
Cookie
Remembers if a visitor agreed to placing Analytics cookies on their browser if a site is restricting the placement of cookies 30 days

2

PRIVILEGED & CONFIDENTIAL
3 December 2019