Privacy Policy

This document sets out the ‘Privacy Policy’ for the use of our website at www.gcdandi.com (“Website“). Please read this Privacy Policy carefully as it informs you what we do with your personal information.

For the purpose of this Privacy Policy and applicable data protection legislation, the data controller and the organisation responsible for your personal information is General Counsel for Diversity & Investment (“GCD&I“, “us” or “we“).

It is important to point out that we may amend this Privacy Policy from time to time. Changes to this Privacy Policy will come into effect immediately upon such changes being published. Please visit this page if you want to stay up to date, as we will post any changes here.

What information we collect and how we collect it

We collect personal information in the following ways from your use of the Website.

Some personal information is collected automatically via cookies, in line with your cookie settings and preferences. This information may include log data such as your device’s IP address, browser type, the web page visited before you came to the Website, information you search for on the Website, identification numbers associated with your devices, your mobile carrier, system configuration information and other interactions with the Website. If you would like to find out more about cookies, including how we use them and what choices are available, please see our Cookie Policy.
If you contact us via the Website’s “Contact Us” function, we will collect any information that you voluntarily provide to us, for example your name, contact details and other information which you may choose to provide to us. The information provided to us may constitute special categories of personal data to the extent that it includes information on your political or religious beliefs, ethnicity, health, sexual orientation or any other special category of personal data (as set out in data protection law in the UK) that you disclose within the content of your correspondence with us. If you voluntarily provide us with any special category information then you consent to us using that information for the purposes set out in and in accordance with this Privacy Policy.

The type and amount of personal information we collect depends on how you use the Website.

If you do not want us to collect any of the information described in this section, please do not use the Website or contact us.

How we use your information

We collect and use your personal information for a number of reasons, including:

to ensure that we can respond to any queries and contact you if you request us to do so;
to improve your experience when using the Website;
to administer the Website for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
to ensure the effective operation of software and IT services procured by us (including disaster recovery); and
for other reasons which we may explicitly inform you of from time to time.

Legal bases for using your personal information

There are a number of ways that we are lawfully able to process your personal information. We have set these out below.

Where using your personal information is in our legitimate interests

We may use your personal information where it is in our interests to do so, and those interests aren’t outweighed by any potential prejudice to you. We believe that our use of your personal information is within a number of our legitimate interests, including but not limited to:

furthering GCD&I’s objective of promoting equity, diversity and inclusion across the legal sector;
to protect the rights of GCD&I;
ensuring that the Website runs smoothly; and
keeping our systems secure and preventing unauthorised access or cyberattacks.

We do not think that any of the above activities prejudice you in any way. However, you have the right to object to us processing your personal information on this basis. You can do so by contacting us at mary.mullally@gcdandi.com.

Where you give us your consent to use your personal information

We may use your personal information where you have specifically consented. If we would like you to consent to any way in which we use your personal information, we will provide you with information so that you understand what it is you are consenting to and are able to make a free, specific and informed decision.

If you give opt-in consent, we may contact you by email, phone or post to give you further information about GCD&I’s work and ways in which you can support us.

You have the right to withdraw your consent to any activities for which you have previously consented. You can do so at any time by contacting us at mary.mullally@gcdandi.com.

Where processing is necessary for us to carry out our legal obligations

There may be legal obligations that we need to comply with and we may use your personal information when we need to in order to comply with these legal obligations.

Who we share your personal information with

We do not disclose your personal information to anyone outside of GCD&I except:

GCD&I Partners: GCD&I is a group representing the in-house legal functions of a number of major corporations who have come together to support increasing meaningful diversity and inclusion across the legal profession. We may share your personal information with our stakeholders, including our partners and our Board to facilitate the goals of the initiative.
D&I Working Groups: where we have your permission (for example if you agree to provide information for an initiative, such as Social Mobility Support Programmes, it will be disclosed to the relevant Working Group).
Service Providers: third party service providers and professional advisors who perform functions on our behalf (including external consultants and professional advisors such as lawyers, auditors and accountants).
Tax, audit, or other authorities: we may share your personal information with tax, audit or other authorities where necessary.
Compliance with law: we may share your personal information with third parties to comply with legal or regulatory requirements.
Other parties in connection with a corporate transaction: in the event that GCD&I merges with or is acquired by another business or company in the future, we may share your personal information with the new owners of the business or company.

How your personal information will be stored

Your personal information will be kept by GCD&I, in the UK, in a secure environment. We care about protecting your information, which is why we put in place appropriate measures designed to prevent unauthorised access to, and misuse of, your personal information.

We do this by having in place a range of appropriate technical and organisational measures, including [security measures on our servers, restricted access controls and encryption programmes].

How we store and transfer your personal information internationally

We want to make sure that your personal information is stored and transferred in a way which complies with our legal obligations under data protection legislation. We will therefore only transfer personal information outside of the United Kingdom where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to your personal information, for example:

by transferring your personal information to a country where there has been a finding of adequacy, or
by way of a data transfer agreement with a third party, incorporating standard contractual clauses.

How long we keep your personal information

We will not keep your personal information for longer than is necessary for the purposes for which we collect it unless we believe the law or other regulation requires us to preserve it (for example, because of a request by a tax authority).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.

Your rights and how to contact us

You have various rights in relation to the personal information which we hold about you.

You have the right to withdraw consent or object to our processing of your personal information. You also have the right to seek access to your personal information and, in certain circumstances, you have the right to erasure, rectification or restriction of our processing. Find out more about your rights here.

In relation to certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal information. Subject certain exceptions, we will respond to you within one month from either: (i) the date that we have confirmed your identity; or (ii) where we do not need to do this because we already have this information, from the date we received your request.s

You also have the right to lodge a complaint with your local supervisory authority which is the Information Commissioner’s Office in the UK. You can contact them in the following ways:

Phone: 0303 123 1113
Email: casework@ico.org.uk
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

If you would like to exercise any of these rights, or withdraw your consent to the processing of your personal information (where consent is our legal basis for processing your personal information), please contact us on mary.mullally@gcdandi.com. Please note that we may keep a record of your communications to help us resolve any issues which you raise.