IPA Privacy Notice
Introduction
This privacy notice for Innovations for Poverty Action. (“IPA”, “‘we”, “us”, or “our”), describes how and why we collect, store, use, and/or share (‘process’) personal data when you use our engage with us or use our services.
We respect your privacy and are committed to protecting your personal data. This notice explains how we use, store and share the information we collect about you, how you can exercise your rights in respect of that information and the procedures that we have in place to safeguard your privacy.
We keep this notice under review and will reflect any updates or changes to practice within this notice (to reflect changes in operations and the way we process your information). This notice was last updated on 19 December 2024.
What personal information will we collect?
Personal data means any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means. It does not include information where the identity has been removed and is consequently anonymous.
Innovations for Poverty Action may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
- Identity and contact data: includes first name, last name, email address, home address of geolocation data and telephone numbers. We may collect this information from you when you contact us or when you request services from us or are making a donation.
- Technical and usage data: includes information we obtain from your device or browser (such as IP address, your login data, version and device identifiers, time zone setting and location, browser plug-in types and versions and operating system) as well as how you use our website and services.
- Project Information and donations: Data that we need if you are involved in a research project or receive our services: including additional information relating to your use of the services or role in the project. We collect this when you use the service or take part in a project. We will also collect information about donations you have made to IPA.
- Information collected when you contact us: includes information in emails and other communications with us, or call recordings when you phone us. This may include the different types of content (e.g. photographs, articles, comments) you send to us when contacting us, or through social media accounts with third parties, or any other information that you want to share with us.
- Information about your preferences: This includes information such as relevant subjects/areas of interest that you voluntarily provide to help us provide relevant information to you.
- Job application information: If you apply for a job with us, we will also collect your application data, which includes your contact information (including name, postal address, email address and phone number), job history, curriculum vitae, contact details of your referees and any other personal data you choose to submit along with your application when applying for a job.
- Sensitive personal data: As well as information about your gender and contact information, we may also collect information about your ethnic group, socioeconomic background and disability. This processing is only carried out with your explicit consent where required, or where we have a lawful basis for the processing.
How we will collect information
Innovations for Poverty Action collects the above-mentioned information using surveys, forms, email, physical requests, cookies, subscribe to the newsletter, fill out a form, JWT and web tokens.
When you send email or other communications to Innovation for Poverty Action, we may retain those communications in order to process your enquiries, respond to your requests and improve our services. When you access our services, our servers automatically record information that your browser sends whenever you visit our website.
How we use collected information?
We may rely on more than one lawful basis for processing your personal data depending on the context of the processing activity. We will use personal data for the following purposes:
Where it is necessary to fulfil Innovations for Poverty Action’s legitimate interests, such as:
- For monitoring and enabling access of our IT systems for compliance with our policies, diversity monitoring and labour risk prevention
- Monitoring access to IPA premises and use of the Organisation’s IT systems, including telephone, email, voicemail, internet and other communications taking place in the workplace, and to verify and maintain the quality, safety, and performance of our products and services, including product and service testing, research, and development and efforts to monitor and prevent the spread of communicable diseases in the workplace.
- To receive and process donations received from third parties
- To plan and host events
- To respond to your requests for information and enquiries and to send communications with relevant operational information that may impact research projects undertaken by IPA
- To send communications including details funding opportunities to our network of researchers
- To evaluate and improve the success of our marketing and promotional efforts
For activities carried out under our legitimate interests we make sure our legitimate interest does not override your privacy rights as required under applicable legislation.
Where we have obtained your consent to process your personal data, such as:
- To send periodic emails and newsletters that you have requested from us
- To collect your information as part of a research project and for the delivery of any agreed benefits for participating in studies
- To publicly publish case studies
- To record meetings, events and workshops through video, audio or transcription
- To identify website usage trends through our use of cookies. For further information please refer to our website cookie policy.
Where we rely on your consent you may withdraw your consent at any time and may request access to your personal data in our possession. No consent shall be sought, given or accepted in any circumstance that may engender direct or indirect propagation of atrocities, hate, child rights violation, criminal acts and anti-social conducts.
Where it is necessary to fulfill contractual obligations or for taking steps to enter into a contract, such as:
- Conducting surveys and assisting with intervention activities at the request of a third party for research projects
- For recruitment activities and assessing applications for job roles at IPA
- For the management and administration of insurance and benefits programmes
- For the management of compensation, benefits, and employment-related expenses, including payroll processing, managing salaries and expenses, managing corporate credit cards and expense reimbursements, as well as administering equity, compensation and bonus programmes
Where it is necessary to fulfill a legal obligation, such as:
- To comply with laws and to respond to and comply with requests from the government, regulators and other third parties with legal authority
- To investigate, detect and prevent fraud or crime and carry out related risk assessments for anti-terrorism and anti-money laundering purposes
- Managing and administering legally mandated insurance and benefits programmes
- Fulfilling health and safety requirements including preventative or occupational medicine, to assess the working capacity of our staff
How long will we keep personal information?
We will only keep your personal data for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).
When we have no ongoing legitimate business need to process your personal data, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.
If you would like to request deletion of your personal data, please contact us using the contact details provided in the ‘Contacting Us’ section of this notice.
Sharing your personal information
We may disclose your personal data to:
- Other third-party suppliers, business partners and sub-contractors for business administration, support, processing, services, or IT purposes
- A third party who has purchased or merged with our organization, in which case personal data held by us, about you, will be transferred to that third party to carry on our business
- Our regulators, law enforcement or fraud prevention agencies, as well as our legal advisers, courts, the police and any other authorized bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory or legal matters
- Tax bodies or agencies to comply with our legal and regulatory obligations.; and/or
- A third party if we believe disclosure is necessary or appropriate to perform the agreement we have entered into with you, or to protect the rights, property, or safety of IPA’s staff, customers, or others.
We do not sell, trade or rent your personal identification information to others. We may share generic aggregated demographic information not linked to any personal identification information regarding visitors and users of our website with our business partners, trusted affiliates and advertisers for the purposes listed above.
How we protect your information
We aim to protect your personal data through a system of organizational and technical security measures.
We have taken reasonable steps to help protect the information we collect from loss, misuse, unauthorized access, disclosure, alteration, and destruction. These include training and awareness programmes for all staff and appropriate technical measures such as encryption of laptops, enforcement of strong password controls and virus and malware detection. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a legitimate business need to know.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
You should be aware, however, that no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect the security of your information and are constantly reviewing and enhancing our information security measures, we cannot guarantee absolute security. IPA, therefore, accepts no liability for any damage or loss, however caused, in connection with transmission over the Internet or electronic storage.
International transfers of information
We may transfer your personal data to countries outside the country in which it was collected where we are legally permitted to do so, and the laws in these countries may not offer the same level of protection for personal data. This could be for employment and general administrative purposes, or necessary for you to fulfil your role such as for the administration of research projects.
If we transfer personal data to third countries, we will do so in a lawful way and may rely on:
- An adequacy decision, which says that the recipient country provides an adequate level of protection of personal data
- Approval from the relevant Supervisory Authority
- Appropriate safeguards to protect the personal data (for example, approved standard contractual clauses or international data transfer agreement)
- A lawful exception to the rules relating to overseas information transfers (for example, the transfer is necessary to perform a contract with you, which is in your interests)
Rights
You may have certain rights in relation to your personal data under applicable privacy laws depending on your location and where your personal data is being processed. We have summarized these rights which may be applicable in whole or in part below:
| Right | Description |
|---|---|
| To be informed | A right to be informed about the personal data we hold about you. |
| Of access | A right to access the personal data we hold about you. |
| To rectification | A right to require us to rectify any inaccurate personal data we hold about you. |
| To erasure | A right to ask us to delete the personal data we hold about you. This right could apply where (for example):
If you request us to delete your information, we will retain minimum personal data to document these requests and thereby avoid using your personal data for any other purpose. |
| To restrict processing | In certain circumstances, a right to restrict our processing of the personal data we hold about you. This right could apply where (for example):
|
| To data portability | In certain circumstances, a right to receive the personal data you have given us, in a structured, commonly used and machine-readable format. You also have the right to require us to transfer this personal data to another organisation, at your request. |
| To object | A right to object to our processing of the personal data we hold about you where our lawful basis is for the purpose of our legitimate interests, unless we are able to demonstrate, on balance, legitimate grounds for continuing to process the personal data which override your rights, or which are for the establishment, exercise or defence of legal claims. |
| In relation to automated decision-making and profiling | A right for you not to be subject to a decision based solely on an automated process, including profiling, which produces legal effects concerning you or similarly significantly affects you. |
| To withdraw | A right to withdraw your consent, where we are relying on it to use your personal data (for example, to provide you with brochures and newsletters). |
| To complain | You have the right to make a complaint to the applicable data privacy supervisory authority. |
None of these rights are absolute and there may be circumstances in which we are required or permitted under applicable law not to fulfil your request. Only you or an authorized agent (that you authorize to act on your behalf), may make a verifiable request related to your personal data.
Any verifiable request (including those to delete data) must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal data or an authorized representative (such as by requiring you to provide a signed written authorization that the agent is authorized to make a request on your behalf).
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with personal data if we cannot verify your identity or authority to make the request and confirm the personal data relates to you.
If you would like to contact us with any queries or comments, request further information or exercise any of your available rights set out above, please send an email to DPO@poverty-action.org.
All requests will be dealt with wherever possible within one month of receipt, or within 3 months in the case of complex or multiple requests. We will retain records of data subject requests from 1 year following the completion of the request.
Links to third party sites
The IPA website may contain links to other websites owned and operated by third parties. These links are provided for your information and convenience only and are not an endorsement by IPA of the content of such linked websites or third parties.
The information that we collect from you will become available to these websites if you click the link to the websites. These linked websites are neither under our control nor our responsibility. IPA, therefore, makes no warranties or representations, express or implied about the safety of such linked websites, the third parties they are owned and operated by, and the suitability or quality of information contained on them.
This Privacy Policy does not apply to these websites, thus, if you decide to access these linked third-party websites and/or make use of the information contained on them, you do so entirely at your own risk. IPA accepts no liability for any damage or loss, however caused, in connection with accessing, the use of or reliance on any information, material, products or services contained on or accessed through any such linked website. We advise that you contact those websites directly for information on their privacy policy, security, data collection and distribution policies.
Contacting Us
If you have any questions about this notice, including any requests to exercise your rights, please contact us at:
Email: DPO@poverty-action.org
You have the right to make a complaint at any time for data privacy issues to the Supervisory Authority in the relevant jurisdiction. We would, however, appreciate the chance to deal with your concerns, so please contact us in the first instance.