This Privacy Policy gives an overview of the types of personal information the Westminster Foundation for Democracy Limited (WFD) collects, how we routinely use it and who we may share it with. Within this policy we also explain the security measures we take to protect personal information and how you can contact us to answer any questions you might have about our privacy practices.

This policy particularly applies to information we collect about the following:

• visitors to our website or other sites we operate;
• online and in-person activity or event participants;
• people who email us or contact WFD in other ways;
• people who make enquiries about WFD’s programmes, events, and activities;
• people who contacts us in relation to information requests, complaints and general queries;
• job applicants and current and former staff; and
• consultants, experts, or the staff of our partners and suppliers.

WFD is committed to protecting the privacy and confidentiality of personal information and to maintaining physical, electronic, and procedural safeguards to protect personal information in our care.

WFD is the Data Controller for the purposes of applicable law for any personal information you give WFD.

1. Key principles of good data privacy

Within WFD, we will endeavour to comply with six privacy principles at all times.

These are:

1. Personal data should be fairly and lawfully processed and should be done so in a transparent manner, ensuring that you are aware of both what data we are processing and why.
2. Personal data should be processed for limited purposes and the purpose must be specified.
3. Personal data shall be adequate, relevant and not excessive, meaning we will only collect as much as we need to carry out our essential processing.
4. Personal data should be accurate and up to date: if it is not, we will correct it within 1 month of receiving the request to correct.
5. Personal data should not be kept longer than necessary. To ensure this we observe an information retention policy.
6. Personal data must be secure. WFD has in place appropriate technical and organisational measures to prevent accidental or deliberate loss, destruction or damage.

2. How you can contact us

If you have any questions or concerns regarding our Privacy Policy or our processing of your personal information, you can email us at gdpr@wfd.org or write to us at the following address:

The Data Protection Officer

Westminster Foundation for Democracy

Clive House, 70 Petty France

London, SW1H 9EX

United Kingdom

 3. Notification of changes to this policy

 This privacy policy may change from time to time.  Please visit this website section periodically to keep up to date with the changes in our Privacy Policy.  We will notify you about significant changes by sending a notice to your primary email address, if you have agreed to receive email marketing messages from us, or by placing a prominent notice on our website.

 4. Information we routinely collect

 4.1. Information collected about visitors to our Website

 When someone visits www.wfd.org or our online applications hosted by our supplier, Knack Inc, we collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. We collect this information in a way which does not identify anyone. We do not make any attempt to find out the identities of those who visit our website.

If we do want to collect personally identifiable information through our website, we will be transparent about this, by means of an information notice at the point of collection of the data. We will make it clear when we collect personal information and will explain what we intend to do with it.

4.2 Information collected by automated means

We collect certain information by automated means when you visit our sites, such as how many users visit our sites and the pages they access. By collecting this information, we learn how to best tailor the sites to our visitors. We collect this information through various means such as “cookies,” “web beacons” and IP addresses, as explained below.

Cookies are bits of text that are placed on your computer’s hard drive when you visit certain websites. Cookies are useful because they allow a website to recognise a user’s device for example, whether you have visited us before or if you are a new visitor.  Cookies may also enhance your online experience by saving your preferences. You can choose to refuse cookies or tell your browser to let you know each time that a website tries to set a cookie. For detailed information on the cookies we use and the purposes for which we use them see our Cookie Policy.

 4.3 Information we collect when you use the search function and social media integrations

We may use Google Analytics or similar tools to monitor search activity. No user-specific data is collected. These reports collate, for example, how many users visited our sites, what pages have been browsed, and the geographic location of the users. The information collected through the use of analytics may include, for example, your IP address, the website from which you visited us, the type of device you used and your search query that led you to the sites. Your IP address is masked on our systems and will only be used on a need-to-know basis to resolve technical issues, to administer our sites and to understand visitor preferences.

WFD’s website may use social media features and widgets (such as “like” and “share” buttons or widgets ) known as SM Features. These are provided and operated by third party companies such as Facebook or Twitter. They are either hosted by a third party or hosted directly on our website. SM Features may collect information such as the page you are visiting on our website and your IP address, and may set cookies to enable the SM Feature to function properly.

If you are logged into your account with the third-party company, then the third party may be able to link information about your visit to and your use of WFD’s website, to your social media account with them. Similarly, your interactions with the SM Features may be recorded by the third party. In addition, the third-party company may send us information in line with their policies, such as your name, profile picture, gender, friend lists and any other information you have chosen to make available. You can manage the sharing of information and opt out from targeted marketing via your privacy settings for the third-party social media platform.

Your interactions with these SM Features are governed by the privacy policy of the third-party company providing them. For more information about the data practices of these third-party companies, and to find out more about what personal information is collected about you and how the third party uses such personal information, please refer to their privacy policy directly.

4.4 Information collected by third-party linked sites

 WFD’s website may contain links to third party websites over which we have no control. We are not responsible for the privacy practices or the content of such websites. We encourage you to read the privacy policies of any linked third-party websites you visit as their privacy policy and practices may differ from ours.

 5. Personal data that we may ask you to provide

5.1 Email and correspondence

You may choose to provide personal information (such as your name, address, telephone number, and email address) on our website or other sites we operate. Here are the ways you may provide the information and the types of information you may submit:

If you communicate with us through the “contact us” page on our sites, we may ask you for information such as your name, email address and telephone number so we can respond to your questions and comments.

Any email sent to us, including any attachments, is monitored for malicious content and retained using our IT platform operated by Microsoft Inc.

When we receive an information request, such as a Freedom of Information Request, comments, compliments, or complaints, we may generate a file. This normally contains the identity of the requester or complainant.

WFD will only use the personal information collected to process the matter and to check on the level of service provided. We do compile and publish Freedom of Information responses but not in a form which identifies anyone.

Personal information contained in these files will be kept in line with WFD’s document retention guidelines. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

WFD may, from time to time, share information about WFD's work, including but not limited to a newsletter, with those individuals or organisations who have previously contacted WFD. We will stop sharing such communications if requested to do so. 

 5.2 Partners and suppliers

WFD routinely exchanges business critical information, such as contact names, phone numbers, and email addresses of our partners and suppliers. This information is collected, held on our IT platform, operated by Microsoft Inc, and where necessary shared, for the purposes of:

• routine communication;
• communication generally about WFD and its work and other possible service delivery opportunities;
• due diligence purposes;
• internal and donor reporting; 
• evaluation and feedback on the supplier or partner's performance; and
• collection or delivery of goods and services.

The relevant Grant Agreement or Contract for Services will set out the legal arrangements for the processing of personal data on or by the expert or consultant.

Personal information related to the staff of partners or suppliers may be accessible across WFD’s network of offices around the world and sponsored political party offices in the UK and/or shared with third parties, including but not limited to the Foreign, Commonwealth and Development Office and our donors within or outside the UK.

 5.3 Associates, experts or consultants

Individuals who wish to be considered for an expert assignment or consultancy opportunity with WFD as an associate or expert will be asked to provide personal information. This information is collected, held on our IT platform operated by Microsoft Inc., our online recruitment and HR information system managed by a third-party processor, People Apps Limited, or in some cases on a platform hosted by our supplier, Knack Inc., and where necessary shared, for the purposes of:

• communication about an assignment;
• communication generally about WFD and its work and other possible assignments;
• due diligence purposes;
• payment;
• internal and donor reporting;
• evaluation and feedback on the associate or expert's performance;
• travel management;
• safety and security; and
• delivery of services.

Associates and experts may be commissioned to provide their expertise to support WFD's regional or country programmes or the WFD-hosted Centre of Expertise on Democratic Governance and Elections. 

The registration form, which includes a due diligence questionnaire for associates or experts and consultants explains why information will be collected and with whom it may be shared. The relevant associate or consultancy agreement will set out the legal arrangements for the processing of personal data on or by the expert or consultant.

Personal information related to experts or consultants may be accessible across WFD’s network of offices around the world and sponsored political party offices in the UK and/or shared with third parties, including but not limited to the Foreign, Commonwealth and Development Office and our donors within or outside the UK.

5.4 Election observers 

Individuals who wish to be considered for participation in an election observation mission with WFD as Long-Term Observer (LTO) or a Short-Term Observer (STO) will be asked to provide personal information. This information is collected, held on our IT platform operated by Microsoft Inc. and where necessary shared, for the purposes of: 

• communication about a proposed election observation mission;
• communication generally about WFD and its work and other possible assignments;
• due diligence purposes;
• payment;
• internal and donor reporting;
• evaluation and feedback on the observer's performance; 
• travel management;
• safety and security; and 
• delivery of observation tasks.

The application form, which includes a due diligence questionnaire, for election observers explains why information will be collected and with whom it may be shared. The relevant LTO or STO agreement will set out the legal arrangements for the processing of personal data on or by the election observer. 

Personal information related to election observers may be shared with third parties, including but not limited to the Organisation for Security & Cooperation in Europe (OSCE) and the Foreign, Commonwealth and Development Office. 

5.5 Participants in events or activities

 WFD will routinely collect data from participants involved in WFD-sponsored activities or events.  WFD may organise activities and events as part of its regional or country programmes, the WFD-hosted Centre of Expertise on Democratic Governance and Elections, and/or its stakeholder engagement activities. These may be held physically, in-person, or virtually using an online platform. This data will usually include the participant’s name, gender, age bracket, position title and affiliated organisation (if applicable), and often their email address. We may from time to time also ask you to disclose any disabilities. This information is collected, held on our IT platform operated by Microsoft Inc. or a platform hosted by our supplier, Knack Inc, and where necessary shared, for the purposes of:

• due diligence;
• travel management;
• reasonable adjustments to logistical arrangements for events and activities, if required;
• internal and donor monitoring and evaluation;
• internal and external audit; and
• communication generally about WFD and its work and additional possible events or activities.

Personal information related to participants in events or activities may be accessible across WFD’s network of offices around the world and sponsored political party offices in the UK and/or shared with third parties, including but not limited to the Foreign, Commonwealth and Development Office and our donors within or outside the UK.

In addition, we may also take photographs or record films of our activities or events. Sharing photographs and films of our activities helps us celebrate the successes and achievements of our team, our partners and participants in our programmes and raises awareness of our work. We will always explain why we are recording your image, how we plan to use it, and ask for your consent. We will take special care with any images of children or vulnerable adults. Any images will be retained in a secure environment and access to them will be restricted according to the ‘need to know’ principle.

 5.6 Visitors to WFD offices

When working on site at a WFD office in the UK or a partner country, either as a contractor providing delivery of goods and/or services, or visiting the site for meetings, your personal information is used only for the purpose of fulfilling the appropriate task or meeting. The exception would be in the event of an unforeseen incident or other such issue arising.

WFD must record all accident reports, asbestos reports and near miss episodes as well as data and security incidents and business continuity incidents, all of which are kept in accordance with legal requirements, either manually or in suitable, approved software.

These incidents may necessitate an internal investigation and may require the sharing of your data or sensitive personal data as well as associated documentation that is essential to the purpose of the legal requirement to the relevant authorities in the UK including (but not limited to):

• Health and safety executive;
• the Information Commissioner;
• the Police or other investigatory authorities;
• emergency services;
• legal process such as solicitors and courts;
• landlords and appointed contractors; and
• any equivalent body in a WFD location outside of the UK.

 5.7 Job applicants and current and former WFD employees

WFD uses an online recruitment and HR information system managed by a third-party processor, People Apps Limited.

During the external recruitment process, any information provided will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary. Personal information may be shared with our internal resources team, the hiring managers and the interview panel. When individuals apply to work at WFD, we will only use the information they supply to us to process their application and to monitor recruitment statistics.

You may be asked to participate in assessments, complete job-specific tests, or to attend a virtual or face-to-face interview. The information generated during the process such as completed tests and interview notes will be held by WFD.

If you are unsuccessful following assessment for the position you have applied for, we may retain your details and proactively contact you should any further suitable vacancies arise.

If a conditional offer of employment is made, we will carry out checks that ensure the candidate’s eligibility to work and identity. We will also contact the referees provided to verify the dates and job titles as detailed in your application. In addition, we will require completed monitoring questionnaires and a criminal records declaration.

Once you have taken up employment with WFD, we will compile a file relating to your employment. The information contained in this will be kept within a secure location and will only be used for purposes directly relevant to your employment. We will also require your bank details, emergency contact details and – if relevant – details about your current civil service pension scheme.

We retain de-personalised statistical information about applicants to help inform our recruitment activities, but no individuals are identifiable from that data.

Your personal information may be shared with third parties as part of your employment with WFD, including but not limited to:

• HMRC;
• Outsourced payroll providers;
• Civil Service Pension Scheme providers;
• IT software providers for the purposes of sending electronic communications to staff, e.g., staff updates for Business continuity purposes, training information and surveys sent via app technology;
• training providers;
• internal and external auditors;
• contracted legal advisers.

Once employment with WFD has ended, we will retain the file in accordance with the requirements of our data retention policy, which is based on legal requirements.

When you use our online application system, People HR, a third-party data processor provides this online service for us. Once you click ‘apply now’ you will be taken to People HR website and they will hold the information you submit, allowing WFD access to it.

You will be asked for your personal details including name and contact details. You will also be asked about your previous experience, education, and referees and for answers to questions relevant to the role you have applied for. Our recruitment team will have access to this information.

Job applicants and current employees will also be asked to provide equal opportunities information. This is not mandatory information – if you do not provide it, it will not affect your application or your employment status. This information will not be made available to any staff outside of our People and Culture team, including to hiring or line managers, in a way which can identify you. Any information you do provide will be used only to better understand, report on, and monitor statistical changes in our diversity and demographic representation. 

All information in relation to job applicants, current and former employees is processed under Article 6 (1) (c) of the UK GDPR and any sensitive personal data, including relating to equal opportunities, is processed and protected by enhanced technical and security measures.

Access to data and information held such as recruitment papers (written shortlisting and interview notes) will be made available to all candidates if requested.

 6. Sharing your information with third parties

 We will never sell your details. We will only share your details with third parties (who are not service providers working at our direction) as indicated in this policy or if you have consented or we have another legal basis to do so. 

We may disclose your personal information if we are requested or required to do so by a regulator or law enforcement or in order to enforce or apply our rights (including in relation to our website or other applicable terms and conditions) or to protect WFD, for example in cases of suspected fraud or defamation, or in order to comply with any other applicable legal obligation.

7. Retaining your information

 We will keep and delete your information according to our internal policies and will keep it no longer than reasonably necessary for the purposes for which we hold it, taking into account relevant legal and regulatory retention requirements (e.g., tax or health and safety requirements) and operational considerations.

 8. Lawful grounds for processing your information

 Wherever possible, WFD will make it clear to you at the point of collection the purpose of collecting the data. WFD currently processes personal data in accordance with the following legal provisions:

• the Data Protection Act 2018
• the UK GDPR

Generally, our processing of your personal information as described in this policy is allowed by these laws based on one or more lawful grounds, including:

• Where you have provided your consent to us using your personal information in a certain way. For example, where an event participant agrees that WFD may take, hold, and publish a photograph of the event in which they are visible. We also may ask for your explicit consent if you share sensitive personal information with us.
• Where the processing is reasonably necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering a contract.  For example, we may rely on this basis where you apply to work for us.
• Where the processing is reasonably necessary to comply with a legal obligation to which we are subject.  For example, we may rely on this basis where we are obliged to share your personal information with a regulator or HMRC.
• Where the processing is reasonably necessary for the purpose of a legitimate interest pursued by us or a third party and your privacy rights do not override the legitimate interest.  Our “legitimate interests” include pursuing the mission of WFD through our work to strengthen democracy around the world, communicating with you about WFD and its work (unless you have told us you do not want to hear from us), or sharing information with WFD’s existing or prospective donors. However, “legitimate interests” can also include your interests, such as when you have requested information from us, and those of third parties, such as our beneficiaries.

In any event, where we are relying on legitimate interests to process your personal information, we will consider any potential impact on you (positive or negative), your rights under data protection laws, and will not use your personal information for activities where the impact on you overrides the legitimate interests in the processing.

Where we process sensitive personal data, we will make sure that we only do so in accordance with one of the additional lawful grounds for processing that type of data, such as where we have your explicit consent or you have made that information manifestly public. Sensitive personal data may include your racial or ethnic origin, philosophical or religious beliefs, sexual preferences or practices, criminal record, membership of a political party, professional or trade association, biometric or genetic data, passwords, financial information, or health data.

 9. Information Rights

Under Article 13 of the UK General Data Protection Regulation we are obliged to provide information about your rights in relation to the data collected. You are entitled to:

• Be informed about how we use your data, (which is outlined in this privacy notice).
• Know how long we will keep your data. This will be as required by law or where stated by our retention schedule.
• Be advised of our reason for processing the data.
• Be provided with a copy of the information held, if required (this is known as a Subject Access request).
• Have any information held corrected, if what we hold is wrong.
• Withdraw your consent at any time
• Ask us to no longer process your information.
• Have data erased if no longer relevant, if not subject to overriding law.
• Complain about how we use your data to the Information Commissioners Office in the UK.
• Object to automated decision making and profiling.

10. Third Party Services 

From time to time, WFD may engage with third-party hosted or managed services to support innovation, provide additional capability or efficiency to WFDs activities in pursuit of WFD’s legitimate interests to advance its mission of democratic support. 

These third-party services will be contracted directly by WFD and will have been assessed by WFD for their compliance with the Data Protection Act 2018 and the UK GDPR prior to their implementation, and their use will not contradict any other part of this privacy policy. In line with Information Commissioners Office guidance a Data Privacy Impact Assessment (DPIA) will be carried out in each instance. 

A current list of the third-party services engaged by WFD is available on reasonable request.

This policy was last updated on 24 July 2024.