Privacy notice

Post:  Institute of Conservation (Icon), FBC Clerkenwell, 40 Bowling Green Lane, London EC1R 0NE, UK

Telephone: 020 3142 6799

Email: [email protected]

We collect and process personal data only where necessary to deliver our services, support our charitable and professional objectives, meet regulatory requirements, and operate the organisation effectively. Depending on the activity, we rely on one or more lawful bases under United Kingdom General Data Protection Regulation (UK GDPR).

Membership, Professional Assessment and CPD

Data required to administer membership applications, renewals and member services; manage professional accreditation and continuing professional development (CPD), maintain professional registers and directories, complaints and professional standards processes.

Data types we may collect

• Name and contact details
• Personal preferences such as title and pronouns
• Membership information
• Financial records
• Qualifications, training and employment history
• Assessment submissions, portfolios and CPD records
• Accreditation and assessment outcomes
• Assessor and quality assurance records
• Appeals and complaints records
• Reasonable adjustment information and, where necessary, special category data

Events and training

Data required to organise and deliver conferences, events, training, webinars and learning activities; to manage bookings, registrations and attendance, and communicate information relating to events and learning activities

Data types we may collect

• Name and contact details
• Financial records
• Organisation and job title
• Registration and attendance records
• Accessibility, dietary and adjustment requirements where necessary
• Photographs, video recordings and related media content

Apprenticeship assessment

Data required to administer, deliver and quality assure apprenticeship assessment; comply with regulatory requirements; manage certification, appeals, complaints, malpractice investigations, and external quality assurance activities.

Data types we may collect

• Name and contact details
• Apprentice, employer and training provider information
• Assessment evidence, submissions and records
• Assessment outcomes and certification records
• Appeals, complaints and quality assurance records
• Reasonable adjustment and special category data where required

Marketing, communication and digital services

Data required to communicate with members, subscribers and stakeholders; distribute newsletters, publications and service updates; respond to enquiries; promote events, services, campaigns and charitable objectives, and manage websites, online resources and digital engagement activities.

• Data types we may collect
• Name and contact details
• Communication preferences
• Subscription records
• Enquiry records
• Website usage information
• Technical data such as IP addresses or online identifiers

Research activities

Data required to conduct research, surveys and consultations; produce reports, statistics and sector insights, and to support policy development and advancement of professional practice. Where possible research outputs are anonymised or aggregated so that individuals cannot be identified.

Data types we may collect

• Survey and consultation responses
• Research participant information
• Demographic information
• Membership and service usage data
• Statistical and analytical data

Fundraising, Donations and Supporter Engagement

Data required to administer donations, grants, sponsorships, Gift Aid claims, fundraising activities, legacy giving enquiries and supporter communications.

Data types we may collect

• Name and contact details
• Donation and payment records
• Gift Aid declarations
• Funding applications and correspondence
• Records of supporter engagement
• Information relating to legacy giving intentions where voluntarily provided

People management

Data is collected to recruit, engage and manage employees, volunteers, interns, assessors, trustees and contractors; to administer contracts, payroll and expenses; manage performance, training and professional development, and to ensure health, safety and wellbeing.

Data types we may collect

• Name and contact details
• Recruitment and employment records
• Qualifications and experience
• Payroll and payment information
• Bank details
• Passport / right to work evidence
• Performance and training records
• Emergency contact details
• Health or other special category data where required
• Criminal conviction or DBS information where required for a particular role, activity or legal requirement

Governance, Finance and Regulatory Compliance

Data is collected to meet legal, regulatory, financial and governance obligations; maintain accurate financial and organisational records; conduct audits and assurance activities; prevent fraud and manage risk, and to investigate complaints and support legal proceedings where necessary.

Data types we may collect

• Trustee and governance records
• Financial and payment records
• Audit records
• Compliance and regulatory information
• Identity and contact information
• Correspondence

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

Your right of access
You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.

Your right to rectification
You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.

Your right to erasure
You have the right to ask us to delete your personal information. Read more about the right to erasure.

Your right to restriction of processing
You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.

Your right to object to processing
You have the right to object to the processing of your personal data. Read more about the right to object to processing.

Your right to data portability
You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.

Your right to withdraw consent
When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

Automated decision-making
We do not use personal information to make solely automated decisions that have legal or similarly significant effects on individuals.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

We collect and process personal data only where necessary to deliver our services, support our charitable and professional objectives, meet regulatory requirements, and operate the organisation effectively. Depending on the activity, we rely on one or more lawful bases under UK GDPR.

Membership, Professional Assessment and CPD

Contract
Administering membership applications, renewals, subscriptions and member benefits, and delivering services associated with membership and professional accreditation.

Legitimate Interests
Icon processes personal information under the lawful basis of legitimate interests where this is necessary to administer membership and professional services, maintain professional standards, registers and accreditation schemes, support CPD activities, respond to enquiries, and operate these services effectively. Personal data may be shared with carefully selected third parties, assessors, volunteers, professional advisers, technology providers and other organisations where this is necessary to deliver services, administer programmes, or support the efficient operation of these activities. Such processing is limited to what is necessary, is proportionate to individuals' reasonable expectations, and is undertaken with appropriate safeguards to protect personal data and individual rights. Individuals have the right to object to processing carried out under legitimate interests.

Consent
We have your permission after providing all the relevant information. All your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Special category data
Where we process special category personal data, such as health information provided in connection with a reasonable adjustment, we also identify an appropriate condition under Article 9 of UK GDPR. Where applicable, we rely on explicit consent.

Events and training

Consent
We have your permission after providing all the relevant information. All your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Legitimate interests
Organising and delivering events, training, conferences, workshops and other learning activities; communicating with participants before and after activities; managing bookings, attendance and evaluation records; and improving the quality, accessibility and relevance of future activities. We only use personal information that is relevant and necessary for these purposes and apply appropriate safeguards to protect individuals’ rights and privacy.

Apprenticeship assessment

Contract
Delivering apprenticeship assessment services, arranging and conducting assessments, communicating with apprentices, employers and training providers, maintaining assessment records, and fulfilling contractual and regulatory requirements.

Legal Obligation
Meeting legal and regulatory requirements relating to apprenticeship assessment, record keeping, quality assurance, equality, safeguarding, complaints and appeals.

Legitimate Interests
Administering and quality assuring apprenticeship assessment effectively, maintaining accurate assessment records, supporting appeals and complaints processes, and ensuring the integrity, fairness and quality of Icon’s assessment activities. We only use personal information that is relevant and necessary for these purposes and apply appropriate safeguards to protect individuals’ rights and privacy.

Special category data
Where we process special category personal data, such as health information provided in connection with a reasonable adjustment, we also identify an appropriate condition under Article 9 of UK GDPR. Where applicable, we rely on explicit consent.

Marketing, communication and digital services

Consent
We have your permission after providing all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Legitimate Interests
Communicating with members, supporters, volunteers, donors and other stakeholders about Icon’s services, activities, membership, accreditation, events, training opportunities, professional resources, consultations, fundraising activities and charitable objectives. This helps keep individuals informed and engaged with the conservation profession and supports Icon’s charitable mission. We only use personal information where necessary, provide options to manage communication preferences, and respect individuals’ rights, including the right to object to direct marketing communications.

Research activities

Consent
We have your permission after providing all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Legitimate Interests
Undertaking research, surveys, evaluations and consultations to support Icon’s charitable objectives, policy development and the advancement of conservation practice. This helps improve understanding of sector needs, informs evidence-based decision-making and supports the development of services, guidance and advocacy for the conservation profession. We only use personal information where necessary and apply appropriate safeguards to protect individuals’ privacy and rights.

Special category data
Where we process special category personal data, such as health information provided in connection with a reasonable adjustment, we also identify an appropriate condition under Article 9 of UK GDPR. Where applicable, we rely on explicit consent.

Fundraising, Donations and Supporter Engagement

Consent
We have your permission after providing all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Legal Obligation
Complying with financial, tax, charity law and Gift Aid requirements, including maintaining appropriate donation and accounting records.

Legitimate Interests
Icon processes personal information under the lawful basis of legitimate interests where this is necessary to secure financial support for its charitable objects and the advancement of conservation practice. This includes administering donations, grants, sponsorships, legacies and fundraising activities; maintaining records of donors, supporters and funding applicants; communicating about funding opportunities, charitable impact and fundraising campaigns; and managing relationships with individuals, trusts, foundations, corporate partners and other stakeholders. Personal data may be shared with payment processors, fundraising platforms, professional advisers and other service providers where this is necessary to administer donations, funding agreements or related services. Such processing is limited to what is necessary, is proportionate to individuals' reasonable expectations, and is undertaken with appropriate safeguards to protect personal data and individual rights. Individuals have the right to object to processing carried out under legitimate interests.

Contract (where relevant)
We process personal information where this is necessary to administer funding agreements, sponsorship arrangements, grant programmes, donations and other activities where a contractual relationship exists.

People management

Contract
We have to collect or use the information so we can enter or carry out a contract with you. All your data protection rights may apply except the right to object.

Legal obligation
We have to collect or use your information so we can comply with the law. All your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Legitimate interests:
Icon processes personal information under the lawful basis of legitimate interests where this is necessary to recruit employees, volunteers, contractors, trustees, assessors and other individuals who support our charitable and professional activities. This includes receiving and reviewing applications, assessing qualifications, skills and experience, arranging interviews, communicating with candidates, obtaining references and maintaining recruitment records. This processing helps Icon identify suitable candidates, appoint appropriately qualified individuals and maintain organisational effectiveness. Applicants would reasonably expect their personal information to be used for these purposes when applying for a role. We only collect information that is relevant and necessary to the recruitment process, restrict access to those involved in recruitment decisions, and apply appropriate security measures to protect personal data. Recruitment records for unsuccessful applicants are retained only for a limited period. We have assessed that the benefits of this processing outweigh any limited impact on individual privacy and do not override candidates' rights and freedoms.

Special category data
Where we process special category personal data in connection with employment or other people-management activities, we rely on an appropriate condition under Article 9 of UK GDPR and, where required, the Data Protection Act 2018.

Governance, Finance and Regulatory Compliance

Contract
Collecting and using personal information where necessary to enter into, administer and fulfil contracts with members, employees, contractors, consultants, suppliers, funders and other individuals or organisations. This includes managing payments, delivering services, administering grants and funding agreements, and meeting contractual obligations.

Legal Obligation
We have to collect or use your information so we can comply with the law. All your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Legitimate Interests
Maintaining effective governance and financial management; managing organisational risk; preventing, detecting and investigating fraud, misconduct and other improper activity; maintaining appropriate audit trails and records; supporting decision-making and organisational oversight; and protecting Icon’s legal, financial and organisational interests. We only use personal information that is relevant and necessary for these purposes and apply appropriate safeguards to protect individuals’ rights and privacy.

Icon's services are primarily aimed at adults. However, we may collect personal information relating to children and young people where they participate in events, training, educational activities, outreach programmes or other activities delivered by or on behalf of Icon. We only collect information that is necessary for these purposes and, where appropriate, obtain consent from a parent, guardian or other responsible adult. We take additional care when handling children's personal information and apply appropriate safeguards to protect their privacy and welfare.

We collect personal information from:

• Assessors
• Directly from you
• Employers
• Previous employers
• Publicly available sources
• Referees
• Schools, colleges, universities or other education organisations
• Training providers

Data processors

JS2 Ltd: This data processor does the following activities for us: They provide accounting and financial management services, including processing payment, payroll, financial and supplier information on behalf of the Institute of Conservation.

Pixl8: This data processor does the following activities for us: Pixl8 provides and supports our CRM system, processing personal information on our behalf to manage membership, events, communications and related services.

OneFile: This data processor does the following activities for us: OneFile provides and supports our e-portfolio and assessment system, processing personal information on our behalf to administer professional accreditation, assessment submissions, assessor activities and quality assurance processes.

Microsoft Teams and Zoom: This data processor does the following activities for us: Microsoft Teams and Zoom provide online meeting, webinar and event platforms, processing personal information on our behalf to facilitate meetings, training, assessments, events and communications.

Stripe and GoCardless: This data processor does the following activities for us: Stripe and GoCardless provide payment processing services, processing personal information on our behalf to collect membership fees, event bookings, donations and other payments.

Microsoft 365: This data processor does the following activities for us: Microsoft 365 provides email, document management, cloud storage, collaboration and productivity services, processing personal information on our behalf to support the administration and delivery of our activities and services.

Others we share personal information with

• Professional advisors
• Legal bodies or authorities
• Relevant regulatory authorities
• External auditors or inspectors
• Organisations we’re legally obliged to share personal information with
• Publicly on our website, social media or other marketing and information media
• Current employers

Icon only retains personal data for as long as it is necessary. Icon typically adheres to the following retention periods.

Apprenticeship assessment
Assessment and quality assurance records are retained for a minimum of 7 years following completion of the apprenticeship, or longer where required to meet regulatory, legal, audit, appeals, complaints, or malpractice investigation requirements. Records are securely destroyed when no longer required.

Events and training
For up to 7 years after the event. After this period, limited archival information may be retained where necessary to record attendance at previous events.

Fundraising and donor records
Retained for up to 7 years after the last financial transaction or engagement, unless a longer period is required for financial, legal or tax purposes.

Governance, Finance and Regulatory Compliance
Finance records are retained for 7 years from the end of the relevant financial year.

Marketing, communication and digital services
Until consent is withdrawn or an individual objects to receiving communications, and for up to 3 years thereafter to maintain suppression lists where required. Website and analytics data are retained in accordance with our cookie settings and retention periods, typically no longer than 26 months.

Membership, Professional Assessment and CPD
Full membership records are retained for the duration of membership and for up to 7 years after membership ceases. After this period, limited archival information may be retained where necessary to maintain a record of historic membership, professional accreditation, qualifications, awards or other legitimate organisational interests.

People management
Recruitment records for unsuccessful candidates are retained for up to 12 months after completion of the recruitment process. Employee records are retained for the duration of employment and up to 7 years after employment ends (2 years for proof of the right to work in the UK), unless a longer retention period is required by law.

Research activities
For 5 years following completion of research activity. Reports will be retained indefinitely.

Some of our service providers may process personal information outside the UK. Where personal information is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with UK data protection law. These may include UK adequacy regulations, the International Data Transfer Agreement (IDTA), the UK International Data Transfer Addendum, or other approved transfer mechanisms. You can contact us using the details above if you would like further information about the safeguards that apply to your personal information.

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: [email protected]

Post: Institute of Conservation (Icon), FBC Clerkenwell, 40 Bowling Green Lane, London EC1R 0NE

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. 

The ICO’s address

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint