Privacy Notice
The Foundation for International Law for the Environment and File Foundation (collectively 'FILE', 'we', 'us' and 'our') respects your privacy and is committed to protecting your Personal Data. This Privacy Notice will inform you as to how we look after your information when you interact with us and tell you about your privacy rights and how the law protects you.
This Privacy Notice applies to information we need to collect, organise, store, transmit, and otherwise process or use ('Process') about donors, grantees, suppliers, contacts and all other persons about whom FILE holds information. This information includes any data that relates to an identified or identifiable person or makes a person identifiable ('Personal Data'), such as names, addresses, electronic device information (e.g., device IDs and IP addresses), other identifiers, health information, and financial information.
This Privacy Notice provides information on how FILE collects and Processes your Personal Data when (a) you visit filefoundation.org ('Website'), (b) you enquire about or apply for a funding grant (please note we do not accept unsolicited funding requests), provide a service to us, or engage with us by phone, email or other means with respect to any other subject matter ('Services') and/or (c) you apply for a job with us, either through the Website or through third-party recruitment service providers and online recruitment services.
References to applicable data protection laws in this Privacy Notice include the EU General Data Protection Regulation (EU GDPR) and UK General Data Protection Regulation (UK GDPR) as well as other applicable laws that govern the Processing and privacy of Personal Data.
For supplemental information regarding our data collection, use and sharing practices when you interact directly with us, such as through applying for a job, developing and executing a grant proposal or engaging with FILE on projects, please contact us by emailing us at info@filefoundation.org.
The Website is not intended for children, and we do not knowingly collect data relating to children.
Important information and who we are
The Website is owned and maintained by the Foundation for International Law for the Environment, a Stichting established in the Netherlands (RSIN: 859230818) located at Zuid Hollandlaan 7, 2596 AL Den Haag, Netherlands. File Foundation is a company limited by guarantee incorporated and registered in England and Wales with company number 12736023 whose registered office is at Runway East London Bridge, 18 Crucifix Lane, London, England, SE1 3JW. Subject to the nature of the individual inquiry or relationships, the above-mentioned entities are the Controllers responsible for the Personal Data Processed in accordance with this Privacy Notice. 'You' means the individual to whom the Personal Data relates.
2. The data we collect about you
We may Process different kinds of Personal Data about you including:
Identity Data, such as name, title, place and date of birth, passport details and other identification information;
Contact Data, such as email address, telephone numbers and physical address;
Financial Data, including credit card and bank account or payment details;
Technical Data, such as your IP address, location data, device data, or a cookie ID;
Usage Data, including data which tells us how often you access our Website, how long you spend on specific parts of the website and the activities you undertake when visiting; and
Communications Data, including whether you have consented to receive newsletters or similar communications from us, and your preferences regarding the same.
When you apply for a job with FILE we may Process the following Personal Data in addition to the above:
Recruitment Data such as social media postings, employment and education history, skills, location and other CV information, background checks, current job title/employer; and
Demographic Data, such as marriage status, nationality, age and education status.
When you apply for a grant with FILE we may Process the following Personal Data in addition to the above:
Transaction Data such as grant documentation, grant outcomes, a record of funds received by you from us and related information; and
Financial Data including tax data.
In limited circumstances we may Process special categories of Personal Data about you. Special category Personal Data includes details about your race, ethnicity, religious beliefs, political opinions, trade union membership, as well as genetic data, biometric data, health data or sex life or sexual orientation data. For example, we may Process data about your health as part of our recruitment processes. Where we Process special categories of data, we will Process this data under the correct lawful basis and conditions for Processing, as required under applicable data protection legislation, and we will only use your Personal Data when the law allows us to. Note that we will not use this type of special category Personal Data to select potential candidates for FILE roles.
We may also collect non-Personal Data that does not directly or indirectly reveal your identity or directly relate to an identified individual, such as statistics or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from Personal Data. For example, we may aggregate Personal Data to calculate the percentage of users accessing a specific Website feature or the demographics of grant applicants.
We use different methods to collect data about you. Primarily this is where you provide us with Personal Data directly, for example through your interaction with our Website or when you correspond with us, for example, to enquire about our activities. We also automatically collect certain types of Personal Data when you visit our Website, and we may collect Personal Data from third parties.
3. How we use your Personal Data
We will only use your Personal Data for the purpose for which we collected it, which may include the following:
As a visitor to the Website;
To register you as a new contact;
To evaluate applications and candidate suitability for roles;
To communicate with you, including to respond to your enquiries and fulfil your requests;
To carry out our obligations and enforce our rights arising from any agreements entered into between you and us;
To review whistleblowing reports submitted by you;
To make decisions about approving and funding grants and appointing operational suppliers;
To Process and deliver any grant, contract or investment document, and related analysis and/or reports, including managing payments, fees and charges and to collect and recover money owed to us;
To process grant applications including to perform sanctions checks as part of due diligence;
To manage your relationship with us;
To enable you to complete a survey;
To administer our Website and conduct internal operations, including for troubleshooting, data analysis, testing, research, statistical, and survey purposes;
To improve our Website's functionality, our Services, or our partner relationships;
To recommend information or Services which may be of interest to you;
To notify you about changes to our Website or activities;
To communicate with you generally, for example, regarding events, or via newsletters;
To protect our Website, employees, or operations; and
To comply with legal and regulatory obligations.
We may use non-Personal Data for any business purpose.
As part of our recruitment activities, we use automated systems to screen job applicants' right to work in the territory in which they are applying to work. This process is carried out without human involvement and may result in a decision affecting your application.
Where we use automated decision-making in this way, you have the right to request human intervention in the decision, express your point of view, and contest the decision. If you wish to exercise any of these rights, please contact us.
Except as set out above, we do not make decisions about you that produce legal effects concerning you or that similarly significantly affect you on a solely automated basis.
4. Legal basis for Processing
We Process your Personal Data:
where we need to perform the contract we are about to enter into or have entered into with you or your organisation;
for the purposes of legitimate interest pursued by us (or those of a third party), and your interests and fundamental rights do not override those interests; or
in order to comply with a legal and regulatory obligation to which we are subject;
where Processing is necessary to protect the vital interests of the data subject or another natural person;
for the establishment, exercise or defence of legal claims; and
for a recognised legitimate interest, namely to respond to a request from another organisation that needs the Personal Data for the purposes of carrying out its task in the public interest or exercising its official authority.
Generally, we do not rely on consent as a legal basis for Processing your Personal Data although we will get your consent before sending you communications, such as e-newsletters, to you via email or text message. You have the right to withdraw consent to communications at any time by contacting us.
Where our Processing is based on the legitimate interest grounds described above, those legitimate interests are:
collecting Personal Data to provide a smooth and efficient relationship experience;
ensuring you receive updated information on our activities;
defining types of users of the Services and keeping our Website updated and relevant;
Pursuing our (public benefit) purpose;
providing and developing the Services you have requested; and
conducting our own research.
5. Opting Out
You can ask us to stop sending you newsletters or similar communications at any time by following the opt-out links on any communications sent to you.
Where you opt out of receiving these communications, this will not apply to Personal Data provided to us as a result of a relevant Service.
6. If You Fail to Provide Personal Data
Where we need to collect Personal Data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with funding). In this case, we may have to cancel any relevant contract you have with us, but we will notify you if this is the case at the time.
7. Change of Purpose
We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the Processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may Process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
8. How we share your Personal Data
The Personal Data you provide to us may be shared with third-party companies, agents, contractors, service providers or affiliated companies if this is necessary to provide you with our Services, respond to your enquiries or for any of the purposes described in this Privacy Notice. In particular, we may share your Personal Data with providers of cloud hosting and infrastructure, operational and advisory services, backup and recovery services, IT support services, and finance and accounting services.
We require all third parties to respect the security of your Personal Data and to treat it in accordance with applicable data protection laws. Except for Squarespace, who may use certain Personal Data for the purposes set out below, we do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to Process your Personal Data for specified purposes and in accordance with our instructions.
We may also share your Personal Data with:
law enforcement agencies, other governmental agencies or third parties if we are required by law to do so; and
other business entities should we plan to merge with or be acquired by that business entity, or if we undergo a re-organisation with that entity.
We may additionally share your Personal Data with Squarespace which provides web hosting services to us, including information about your browser, network, and device, web pages you visited prior to coming to this website and your IP address for Website analytics purposes. Squarespace collects Personal Data in accordance with its privacy policy, which can be found on its website.
9. International Data Transfer
Your Personal Data may be transferred to, stored and Processed in various countries, including those that are not regarded as ensuring an adequate level of protection for Personal Data under UK or European Union law or by the UK government or European Commission. This includes the USA. We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.
10. Your legal rights
You have the following rights under data protection laws in relation to your Personal Data:
to request access to or a copy of Personal Data which we hold about you;
to request erasure of your Personal Data if certain conditions apply;
to rectification of your Personal Data, if the information we are holding is inaccurate or incomplete;
to withdraw consent to our Processing of your Personal Data (to the extent such Processing is based on previously obtained consent);
to ask us to stop or start sending you communications;
to request the transfer of your Personal Data to you or to a third party;
to request the restriction of Processing of your Personal Data;
and to object to your Personal Data being Processed in certain circumstances.
Any request from you for access to/a copy of your Personal Data must be in writing and we will endeavour to respond to legitimate requests within one month of receipt or within such other time as specified by applicable data protection legislation. We will comply with our legal obligations as regards your rights as a data subject.
You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
11. How long we keep Personal Data
We will only keep the information we collect about you for as long as required for the purposes set out above or as required to comply with any legal obligations to which we are subject.
This will involve us periodically reviewing our files to check that information is accurate, up-to-date and still required.
Where we are permitted to send you direct communications we may retain your contact information necessary for this purpose, for as long as you do not unsubscribe from receiving the same from us. If you opt out from communications, we will retain your information to enable us to respect your wishes to not be contacted for the purposes for which we send such communications.
12. Cookies
When you interact with the Website, certain information about your use of the Website is automatically collected. This information includes your domain name and host for Internet access; the Internet address of the website from which you came; the date and time of your access; your computer’s IP address and information about its operating system, browser and host; the date and time you access the Website and the pages you visit. Much of this information is collected through cookies, web beacons, and other tracking technologies, as well as through your web browser or device (e.g., IP address, MAC address, browser version, etc.). The tracking technologies employed when you use our Website may be first party or third-party. We use cookies for the following purposes:
Strictly Necessary: These cookies are required for core Website functionality such as security, network management, and accessibility. You may disable these by changing your browser settings to disable cookies, entirely but this may affect how the Website operates.
Performance/Analytics: We use these cookies to analyse how the Website is accessed, used or is performing. We use this information to maintain, operate and continually improve the Website. We may also obtain information from our e-mail newsletters, to learn whether you opened or forwarded the newsletter or clicked on any of the content. This information tells us about our newsletters’ effectiveness and helps us ensure that we’re delivering information that you find interesting.
If you do not want to receive cookies, you may set your browser to reject them. However, if you turn cookies off, you may not have access to some of the Website’s services and features. We also may allow third parties to issue cookies, pixels, web beacons and other tracking technologies on our Website to help us compile aggregated statistics regarding the operations of our Website. You can learn more about ad serving companies and the options available to limit their collection and use of your information by visiting the websites for the Network Advertising Initiative and the European Interactive Digital Advertising Initiative. Similarly, you can learn about your options to opt-out of mobile app tracking by certain advertising networks through your device settings and by resetting the advertiser ID on your Apple or Android device.
Because an industry-standard Do-Not-Track protocol has not yet been established, our information collection practices on our Website will continue to operate as described in this Privacy Notice regardless of any “Do Not Track” signals that may be sent by certain browsers. However, you may refuse to accept cookies in order to prevent tracking activities.
13. Security
We are committed to trying to ensure that your information is secure. In order to prevent unauthorised access or disclosure, we use reasonable physical, electronic and managerial procedures intended to safeguard and secure the information we collect online.
Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. As a result, while we strive to protect your personal data, we cannot ensure or warrant the security of any information you transmit, and you do so at your own risk. You can report network abuse and any risk of security violations to us by contacting us.
14. Links to Other Sites
Our Website may contain links to other websites, plug-ins and applications, such as social media buttons e.g. to LinkedIn. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. Once you link to another website from our Website you are subject to the terms and conditions of that website, including, but not limited to, its internet privacy notice and practices, so we encourage you to read the Privacy Notice of every website you visit.
While we try to link only to websites that share our high standards and respect for privacy, we are not responsible for the content, security, or privacy practices employed by other websites and a link does not constitute an endorsement of that website.
15. Complaints
Questions, comments and requests regarding this Privacy Notice are welcomed and should be addressed to info@filefoundation.org.
We may provide you with a complaint form so that you can provide details about the circumstances of your complaint. This will also enable us to investigate as efficiently as possible. When we receive your complaint, we will:
acknowledge receipt within 30 days of receiving it;
without undue delay, take appropriate steps to investigate your complaint, including making appropriate enquiries with you or any other persons involved to properly understand the issue;
keep you informed of the progress of your complaint; and
without undue delay, tell you the outcome of your complaint once we have considered it.
If we are unable to resolve your complaint to your satisfaction, you also have the right to make a complaint to the applicable data protection authority, being the Information Commissioner's Office (www.ico.org.uk) if you are located in the UK, the Autoriteit Persoonsgegevens (www.autoriteitpersoonsgegevens.nl) if you are located in the Netherlands, or your local supervisory authority if you are elsewhere in the EU (you can check your local supervisory authority here https://edpb.europa.eu/about-edpb/about-edpb/members_en). We would, however, appreciate the chance to deal with your concerns before you approach such an authority so please contact us in the first instance.
16. Changes to This Privacy Notice and Your Duty to Inform Us of Changes
Any changes we make to our policy in the future will be posted on this page without notice to you. We may email you to notify you about any material changes, but please check back frequently to see any updates or changes to this Privacy Notice.
We aim to ensure that the information we hold about you is accurate at all times. To assist us in ensuring that your information is up to date, do let us know if any of your personal details change at the following email address: info@filefoundation.org