This policy sets out how we obtain, store and use personal information. It confirms CSIE’s commitment to protect the privacy of those who engage with us and to process and store personal information in a manner which meets the requirements of the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR).

For information on how we store and use personal information from survey responses, please see our CSIE Survey Privacy Statement at bit.ly/CSIEspp.

We obtain and keep personal information about:

  • CSIE trustees, employees and volunteers;
  • job applicants and previous employees and trustees;
  • supporters, funders and potential funders;
  • colleagues with whom we have worked, or who we plan to work with;
  • parents, teachers, education practitioners and others who:
    • contact CSIE with queries, recommendations or other comments;
    • opt in to receiving CSIE newsletters;
    • purchase (or, if free, request) CSIE resources;
    • participate in CSIE conferences, training and other events;
    • request CSIE services, for example equality audits or workshops.

In most situations we have received this information directly from the person concerned. Occasionally this information may reach us from elsewhere, as for example references for employees from their previous employers, or contact details for conference participants from their colleagues.

The personal information we keep may include:

  • full name;
  • contact details (email or postal address, telephone number[s];
  • bank details (for example for CSIE staff or Friends of CSIE);
  • details of school or local authority relevant to the communication;
  • details about a specific child or children that the communication refers to;
  • personal details provided as part of a job application;
  • Information provided to us as part of a survey, eg demographic information.

Why we collect and process personal information

We collect and process personal information in order to enable CSIE to carry out its work, as required.

In addition under GDPR, CSIE is required to articulate the lawful basis on which it may collect, process and share personal information.

  • We ensure we have consent where this is required.
  • We only collect personal information if we have a contractual or legal obligation to do so.
  • We collect, procees and share personal information only in cases where we have a legitimate or vital interest to do so.

How we use personal information

We use personal information to help deliver CSIE’s overall aim of promoting equality in education. More specifically, we may use personal information to:

  • carry out regular monitoring and evaluation of our work;
  • analyse our services and their demographic reach;
  • work towards service improvement;
  • engage in work towards ongoing projects or research;
  • send newsletters, seasonal communications or other current information about developments at CSIE or about equality in education;
  • comply with our legal obligations;
  • assist with any complaints and dispute resolution.


Sharing personal information with third parties
CSIE staff and Trustees are bound by a Non-Disclosure Agreement which everyone signs on joining CSIE, and which forms a contractual obligation for CSIE employees. We do not share personal information with any third parties, except where this is necessary to carry out the above activities. Currently, personal information held by us is only shared with the provider of computer software and servers on which our data is stored. We would also have to disclose personal information if we were under a legal obligation to do so.

Security
CSIE stores personal information on paper, digitally, on cloud-based systems provided by Microsoft and Google and backed up, encrypted, on external hard drives which are kept securely locked.

Microsoft typically stores and processes data in a primary storage location in the customer’s region (e.g., United Kingdom) or in the United States. Microsoft also frequently backs up to a data centre in a different region. CSIE cannot therefore guarantee where our data is stored or processed. For further details regarding how Microsoft manages personal data please read Microsoft’s own Privacy Statement (https://privacy.microsoft.com/en-gb/privacystatement).

Google has many servers all over the world, and while it is likely that our data is held within our nearest server (Dublin), this cannot be guaranteed.

Any paper copies of personal information kept by CSIE are securely stored in a locked filing cabinet in a locked unit of a secure self-storage site.

How long we keep personal information for
We keep personal information for as long as is necessary for the purposes stated above, or longer if we have a legal obligation to do so (for example we have to keep previous employees’ records for 6 years after they have left CSIE). If we receive a request to remove an individual’s personal information from our systems, we do this provided that there is no legal obligation for us to keep it.

Your rights

  • You can ask what personal information CSIE holds about you and request a copy. You can also request to receive this information in particular formats, for example a format that can be read by a computer.
  • If the personal information we hold about you is incorrect, you can ask for it to be corrected.
  • You can ask for your personal information to be deleted, or for it no longer to be processed.
  • You can unsubscribe from our newsletters at any time, or withdraw your consent for us to keep or process your personal information.

Exercising these rights is subject to certain restrictions under data protection legislation. For further information about these rights, please write to admin@csie.org.uk or The Park Centre, Daventry Road, Bristol BS4 1DQ.

Links to other websites

Our website contains links to other sites. CSIE is not responsible for the data protection and privacy practices within any of these other sites. We encourage you to be aware of this when you leave our site and to read the data protection and privacy statements on other websites. This statement applies solely to our website.

Further information or complaints

For further information on any of the above, or if you want to express a complaint about how CSIE has handled your personal information, please contact CSIE, in the first instance, at the email or postal address given above. You also have the right to lodge a complaint with the Information Commissioner’s Office (www.ico.org.uk).


This policy is subject to review and may change from time to time.

This policy is reviewed annually by the CSIE Council of Trustees.

Policy approved by Trustees: July 2018

Policy last reviewed: September 2024

Next review due: June 2025