Big Society Capital Limited respects your privacy and is committed to protecting your personal information. The General Data Protection Regulation (as it forms part of UK law by virtue of the European Union (Withdrawal) Act 2018) and the Data Protection Act 2018 (together, the DP Legislation) enhance an individual’s rights in relation to personal information about them. This privacy notice will inform you how we collect and look after your personal information in accordance with the DP Legislation and tell you about your privacy rights and how the law protects you.
Important information and who we are
This privacy notice tells you what to expect when Big Society Capital collects and processes your personal information.
It is important that you read this privacy notice together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.
Controller
Big Society Capital is the controller and responsible for your personal data (collectively referred to as ‘we’, ‘us’ or ‘our’ in this privacy notice).
Contact details
If you want to request information about our privacy policy, you can email us at privacy@bigsocietycapital.com or write to:
Head of Legal
Big Society Capital
New Fetter Place
8-10 New Fetter Lane
EC4A 1AZ
Changes to this privacy notice
We keep our privacy notice under regular review. This privacy notice was last updated on 11 March 2022 and historic versions can be obtained by contacting us.
Duty to inform us of changes
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
Third party links
This website includes links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
If you contact us via social media, the personal information you provide will remain on that platform and that platform will be the data controller. We encourage you to read the privacy notice of the relevant platform.
Legal basis for processing personal information
Under the DP Legislation, we must have a legal basis for processing your personal information. In the situations described in the next section, we process your personal information for one of the legal bases set out below.
Legitimate interest*. We may process your information where it is in our legitimate interests to do so as an organisation and without prejudicing your interests or fundamental rights and freedoms. It is in our interests to ensure that our processes and systems operate effectively and to process information to help us achieve our mission to improve the lives of people in the UK by connecting investment to charities and social enterprises that are creating social change.
Consent**. We may process your information where you give us your consent to do so. You have the right to withdraw this consent at any time by contacting us at privacy@bigsocietycapital.com.
Contract***. We may process your information to comply with terms of agreement(s) between us.
The situations where we collect data about you, what data we collect and why we collect it
Visitors to the Big Society Capital website (*)
We use Google Analytics to collect anonymised, aggregated data about visitors’ use of the website such as where the visitor came from, the browser types and versions, time zone setting and location and operating system used. We do this to find out things such as the number of visitors to the various parts of the site and to enable us to make the content useful. Further information about how Google uses this information and how you can control the information sent to Google can be found here. We do not collect any data on individuals via Google Analytics unless users have explicitly opted in to the collection of cookies. We do not make any attempt to find out the identities of the individuals visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.
Use of cookies by Big Society Capital (**)
When Big Society Capital provides services, our aim is to make them easy, useful and reliable. Where services are delivered through the internet, this sometimes involves placing cookies on your device. A cookie is a small file of letters and numbers that is downloaded onto your computer, mobile phone or other internet enabled device when you visit a website. They are widely used in order to make websites work, or work more efficiently, remember your preferences, and to provide information to the owners of the site. Cookies cannot be used to identify you personally. Read more about the individual cookies we use by clicking here.
Web forms (**)
We collect personal information (name, email, organisation) when you submit a web form on our website or via third party providers, such as the ‘contact us’ form or a form that you complete to access one of our reports. We use this data to respond to you if you have sent an enquiry, requested access to a report, requested to sign up to one of our networks or provided consent to be contacted by one of our team. This data is stored to help us gain insight and feedback on our work and helps us fulfil our role of improving the lives of people in the UK through investment with a sustainable return.
Mailing lists (**)
You can subscribe to our mailing lists to keep informed of the latest news from Big Society Capital. Once you have subscribed, we will send you newsletters and information on relevant Big Society Capital initiatives such as campaigns and events. We may also use information you provide us with on your areas of interest to help us send you material which is most relevant to you. You can change you email preferences at any time or opt-out of email communications. We use a third-party service provider, Campaign Monitor, to deliver our email updates. For more information, please see Campaign Monitor's privacy notice and cookie notice.
Open-source SITR Investment Deals database (**)
As part of GET SITR, we collect contact information of contributors to an open-source database of completed Social Investment Tax Relief (SITR) investment deals. Information about contributors is confidential and held by Big Society Capital. Data we collect on contributors comprises: name, organisation and email address. This allows us to identify contributors for data validation purposes. We may also use the information to follow-up on data a contributor has submitted as well as share insights about the data we have collected. Information is collected using Google Forms and will be stored in Google Sheets. For more information, please see Google’s privacy policy.
People who specify an interest in our Get Informed services (**)
Mentor service
If you have signed up to be a mentor, mentee or board facilitator using our Get Informed service, we will collect your contact details and personal information on your relevant experiences. As part of the matching process, we will share information you provide, as appropriate, with your corresponding mentee or mentor. Once a match is made, we will ask you to complete a survey related to your experience of the programme as well as your opinions and attitude on social investment at three months, six months and a year. This helps us to see whether Get Informed is fulfilling its purpose of improving access to, and understanding of, social investment.
Board members
If, when you sign up to the Get Informed mailing list, you indicate that you are a board member interested in learning about or taking on social investment, we will ask your opinion on matters related to social investment. This helps us see whether Get Informed is fulfilling its purpose in improving access to, and understanding of, social investment.
Case study participants (**)
If you agree to take part in a case study for us, or provide us with your media assets (e.g., images, video) for the website, we will retain your personal information along with the case study, both in our files as well as on our website. We will always seek your permission to display your personal information on our website.
Research (*)
As part of our wider mission to increase awareness and understanding of the social impact investment market across the UK, we occasionally conduct brand tracking research via online questionnaires aimed at our stakeholders and industry contacts anonymously through third parties. Where we use a third party, we share your email address specifically for the purpose of the research only. The research is to help us bring the wider knowledge of the social impact market to the forefront, and thereby make it more accessible to those interested in it. We do not benefit financially from performing this role.
Journalists, media professionals, service providers, clients and partners (*)
If you are one of our partners, service providers, clients or another professional we have worked with, such as our media contacts, we will retain your personal details for future contact unless you advise us otherwise.
Big Society Capital or our client investment prospects and recipients (*, **, ***)
If we are in contact with you in relation to Big Society Capital or our clients investing into, or alongside, your organisation, we will use the information you give us for administration and analysis and possibly for research. The majority of the information will not include personal information. However, we may collect certain categories of personal information. We will collect contact details and job titles for you and other staff members at your organisation in order to contact you about the application or for due diligence. We may also use these details in the future to contact you about initiatives which we think will be of interest to you, such as surveys related to Big Society Capital’s work, invitations to Big Society Capital events, invitations to partner with Big Society Capital on investment initiatives or fund management opportunities and to feature in our case studies. If we are in contact with you for an investment opportunity, as part of our due diligence on the investment, the personal information we may also collect includes CVs, biographies, salary information and references for key people in your organisation. The majority of this will be information which you, or someone at your organisation, give(s) us. In some cases, it will come from third parties such as when we seek references. We may also collect some information from publicly available sources such as Companies House or your organisation’s website.
If we collected your personal information for the purpose of investment to be made by our clients, we may share it with our clients’ fund manager, advisers, Board and investment committee for the purpose of assessing or monitoring the investment.
We may give copies of all or some of this information to individuals and organisations we consult when assessing applications, conducting due diligence, administering and monitoring investments and evaluating processes and impacts and our systems and controls. These organisations may include accountants, our shareholders, insurers, the Financial Conduct Authority and organisations or groups involved in delivering our investments. We may share your contact details and job title with third parties who want to get in touch with us about investing in or partnering with you. We may make public aggregated, anonymised data as part of our research, impact reporting and engagement work.
As a regulated firm, we are required to conduct due diligence on organisations in which we invest for the purposes of preventing financial crime. In order to fulfil our obligations, we are required to verify the organisation’s identity and conduct certain background screening. This may include verifying the identity of the organisation's shareholders, beneficial owners, management, directors or officers and/or other relevant information. To assist us with the verification and screening process, contact details you provide will be disclosed to credit reference and fraud prevention agencies which may keep a record of that information. If we need to conduct this due diligence using any of the personal information you have provided us with, you will be provided with further information prior to us doing so.
Job applicants (*, **)
If you apply for a job, we will ask for certain information in order to progress your application, assess your suitability for the role you have applied for and fulfil legal or regulatory requirements. The information will only be shared with our People and Talent team and the relevant hiring manager(s).
If you send us a speculative application, we will direct you to our careers page and the online platform called Be Applied where you can submit expressions of interest, and delete your speculative application received by e-mail. If you submit an expression of interest through our partner system, Be Applied (privacy policy), your data may be retained in the system for up to two years, unless you inform us otherwise. We will access the system when new roles come-up and review the submitted expressions of interest to see if there is a matching candidate. We also occasionally refer candidates to other social sector organisations – we would always seek your consent prior to forwarding your details to any third party.
We will ask for your contact details to contact you about your application. We will also ask for your CV and a covering letter to assess your suitability for the role. If you apply to us for a job through a recruitment agency, we will receive your contact details, CV and covering letter from them.
If you are shortlisted for a role, we will ask for you to provide proof of your identify so we can check that you have the right to work in the UK. As part of the assessment process you may be asked to attend an interview, where we might take interview notes, and to complete tests.
If we make a conditional offer of employment, we will ask you for information so that we can carry out pre-employment checks. We process this information to seek assurance as to your trustworthiness, integrity and reliability. You will therefore be asked to provide proof of your qualifications and referee contact details. Your referee details will be kept on file if you are offered employment. In order to set up your employee record you will also be asked to provide bank details and emergency contact details. In order to comply with Financial Conduct Authority regulations, you will also be asked to declare any business or other interests you have.
If we do not make you an offer of employment, we may still keep your data on our system or our external system – Be Applied, for up to two years unless you inform us otherwise.
You will be asked to provide equal opportunities information. This is not mandatory information – if you do not provide it, it will not affect your application. This information will not be made available to any staff outside of our recruitment team, including hiring managers, in a way which can identify you. Any information you do provide, will be used only to produce and monitor equal opportunities statistics.
Given the nature of our business, for certain roles, we require a candidate who is made a conditional offer of employment to complete a fitness and propriety questionnaire and to disclose their criminal record history before starting employment and annually during employment. In some cases, we are required to carry out these checks (for example, for regulated roles); in all cases we carry out the checks in accordance with applicable law. If we need to conduct these checks, you will be provided with further information prior to us doing so.
Our shareholders and funders (***)
If you are a representative of one of our shareholders or funders, we may be occasionally communicating with you about share subscriptions or funding. In order to perform our contractual obligations, we may need to process the details of our shareholder and funder representatives in order to communicate important information and notifications to them. Your contact information will be stored securely and deleted if an updated contact is provided.
Interactions with Big Society Capital employees and registering for Big Society Capital events (*)
If you meet an employee of Big Society Capital, for example, at an event, and give them your contact details, they will keep this information and may store this information on our customer relationship management system in order to contact you in the future about topics which might be of interest to you. They will also share this information with other staff members at Big Society Capital and occasionally, they will pass it on to third parties who they think you would be interested to hear from. Similarly, we will sometimes receive your contact details from a third party who thinks you would be interested in hearing from us.
When you register to attend seminars, training or other events that we organise or which relate to campaigns or other initiatives which we co-ordinate, both in person and online, we may ask you to provide contact information (such as name, email address and telephone number), biographical information (such as job title, employer and short credentials) and other relevant information (including communication preferences, meal preferences, dietary and accessibility requirements, guests’ names and feedback). Where we organise events in partnership with other organisations, we may share the contact, biographical and other relevant information you provide to us with such partnership organisations for purposes of event management. We will use such information only where it is appropriate and relevant to our business relationship with you and where we have a lawful reason to do so.
When you visit our office, we may share your personal data with the office reception and security staff in order to allow you access to our office. The reception and security staff will not share your personal details with any third parties.
Accessing Big Society Capital community initiatives (**)
Big Society Capital facilitates a number of impact investing community initiatives – such as ImpactVC and the Blended Finance Community of Practice. If you submit a membership form or details for your profile to our community initiatives or access their resources we will process your personal data in order to manage your membership of the community initiative and/or use of resources. If you consent we will share your details with other members of the community initiative. Our community initiatives use third party service providers to manage platforms, resources and community. Through engaging with Big Society Capital community initiatives your personal data will be used by those third party service providers in line with their own privacy policies.
Attending Big Society Capital events online (**)
When you attend a recorded online event hosted by us and agree to your personal data being disclosed, the recording of the event will be stored on the Zoom (or other software provider) database and will be accessible to Big Society Capital employees. The recording will not be shared with any external parties, except as may be otherwise notified to you prior to the event.
Using the ImpactVC platform and resources (**)
If you submit a membership form or details for your profile to our ImpactVC platform or access any ImpactVC resources we will process your personal data in order to manage your membership of ImpactVC and/or use of ImpactVC resources. If you consent we will share your details with other members of the ImpactVC community. ImpactVC uses third party service providers to manage the platform, resources and community. Through engaging with the ImpactVC platform your personal data will be used by those third party service providers in line with their own privacy policies.
Regulatory/similar purposes (*)
When we need to meet our compliance, regulatory or other legal obligations we may collect, process and store personal data such as identification, contact and professional information.
Procuring services from us
As a client, if you are procuring services from us, we will collect and process personal data from you (name, organisation, email address). This personal data will only be used to the extent necessarily to deliver the agreed service, and it will not be passed on to Third parties or processed in any other way.
Sharing your data with third parties
We use third party service providers for parts of our website, IT systems and when we communicate digitally with you. Sometimes they will process the personal information which you provide us with.
As part of our market building role, we also periodically commission research to be carried out by third parties on our behalf. We may, therefore, occasionally be sharing your personal data with the companies we engage to conduct the research being commissioned.
We may need to share information with third parties such as regulatory and/or tax authorities, governmental/law enforcement agencies and courts where we are required and authorised to do so under applicable law/regulation. Such third parties may also process the information you provide to us and may transfer your data outside of the UK (please contact privacy@bigsocietycapital.com if you require further information).
Transferring data to other countries
We, or our third-party providers, may transfer the personal information we collect about you to countries outside the UK, on the basis that anyone to whom we pass it protects it in accordance with applicable laws and sufficient safeguards are put in place for these transfers. We are in the process of ensuring that, in the event that we transfer information to countries outside the UK, your personal information receives an adequate level of protection in a way that is consistent with and which respects the UK laws. Please contact us at privacy@bigsocietycapital.com if you require further information on this.
Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at privacy@bigsocietycapital.com.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Data Security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Your rights
Under certain circumstances, by law you have the right to:
- Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
Complaints or queries
If you have any questions about this Privacy Notice or want to submit a written complaint about how we handle your personal information, please contact us via privacy@bigsocietycapital.com. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.