PICNIC Investment respects your privacy and is committed to protecting your personal information. The EU General Data Protection Regulation and the Data Protection Act 2018 (the DP Legislation) enhance an individual’s rights in relation to personal information about them. This privacy notice will inform you how we collect and look after your personal information in accordance with the DP Legislation and tell you about your privacy rights and how the law protects you.
This privacy notice tells you what to expect when PICNIC Investment collects and processes your personal information.
It is important that you read this privacy notice together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.
PICNIC Investment is the controller and responsible for your personal data (collectively referred to as ‘we’, ‘us’ or ‘our’ in this privacy notice).
Changes to this privacy notice
We keep our privacy notice under regular review. This privacy notice was last updated on 20 August 2019 and historic versions can be obtained by contacting us.
Duty to inform us of changes
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
Third party links
This website includes links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
If you contact us via social media, the personal information you provide will remain on that platform and that platform will be the data controller. We encourage you to read the privacy notice of the relevant platform.
LEGAL BASIS FOR PROCESSING PERSONAL INFORMATION
Under the DP Legislation, we must have a legal basis for processing your personal information. In the situations described in the next section, we process your personal information for one of the legal bases set out below.
Legitimate interests: We may process your information where it is in our legitimate interests to do so as an organisation and without prejudicing your interests or fundamental rights and freedoms.
Consent: We may process your information where you give us your consent to do so. You have the right to withdraw this consent at any time by contacting Us via our contact page.
All personally identifiable information (e.g. names, addresses, e-mails and telephone numbers) provided to Us is processed and secured in accordance with the principles of General Data Protection Regulation and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office and our registration number is ZA504503.
THE SITUATIONS WHERE WE COLLECT DATA ABOUT YOU, WHAT DATA WE COLLECT AND WHY WE COLLECT IT
Visitors to PICNIC Investment website
When someone visits our website, we use a third party service provider, Google Analytics, to collect anonymised, aggregated data about visitors’ use of the website such as where the visitor came from, the browser types and versions, time zone setting and location and operating system used. We do this to find out things such as the number of visitors to the various parts of the site and to enable us to make the content useful. Further information about how Google uses this information and how you can control the information sent to Google can be found at https://support.google.com/analytics/answer/6004245?hl=en
We do not make any attempt to find out the identities of the individuals visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.
If we are in contact with you in relation to PICNIC Investment investing into, or alongside, your organisation, we will use the information you give us for administration and analysis and possibly for research. The majority of the information will not include personal information. However we may collect certain categories of personal information. We will collect contact details and job titles for you and other staff members at your organisation in order to contact you about the application or for due diligence. We may also use these details in the future to contact you about initiatives which we think will be of interest to you, such as surveys related to PICNIC Investment ’s work, invitations to PICNIC Investment events, or to feature in our case studies.
If we are in contact with you for an investment opportunity, as part of our due diligence on the investment, the personal information we may also collect includes CVs, biographies, salary information and references for key people in your organisation. The majority of this will be information which you, or someone at your organisation, give(s) us. In some cases it will come from third parties such as when we seek references. We may also collect some information from publicly available sources such as Companies House or your organisation’s website.
We may give copies of all or some of this information to other organisations (such as Access – the Foundation for Social Investment, our parent company Finance For Sustainability, professional advisers and third-party contractors) when assessing applications, conducting due diligence, administering and monitoring investments and evaluating processes and impacts and our systems and controls. We may make public aggregated, anonymised data as part of our research, impact reporting and engagement work.
We do not collect or compile personally identifying information for dissemination or sale to external parties for marketing purposes. If you give your consent, we may occasionally use your personal information to let you know about programmes which may benefit your organisation and these mailouts may be administered by third parties.
Otherwise, it is our policy to disclose information to third parties only if explicitly required to do so by United Kingdom Law or where your consent has been obtained.
Interactions with PICNIC Investment employees
If you meet an employee of PICNIC Investment, for example, at an event, and give them your contact details they will keep this information in order to contact you in the future about topics which might be of interest to you. They will also share this information with other staff members at PICNIC Investment and its parent company Finance For Sustainability, and occasionally they will pass it on to third parties who they think you would be interested to hear from. Similarly, we will sometimes receive your contact details from a third party who thinks you would be interested in hearing from us.
When PICNIC Investment provides services, our aim is to make them easy, useful and reliable. Where services are delivered on the internet, this sometimes involves placing small amounts of information on your device. For example, computer, mobile device or tablet. These include small files known as cookies.
Cookies cannot be used to identify you personally.
These small files known as cookies are used to improve services for you.
- Enabling a service to recognise your device so you don’t have to give the same information several times during one task
- Recognising that you may already have given a username and password so you don’t need to do it for every web page requested
- Measuring how many people are using services, so they can be made easier to use and there’s enough capacity to ensure they are fast
Analysing anonymised data to help us understand how people interact with the website and compile a record of this usage information. This helps us to improve and develop the way the website works, for example, by determining whether website visitors can find information easily.
A session cookie is written the first time a user visits the site. The cookie will be updated on subsequent visits. It is used internally by various modules/systems to improve efficiency and provide constant values throughout the user’s visit.
PICNIC Investment may also use website analytics tools provided by Google, Inc. (“Google”), known as Google Analytics. Google serves cookies through this website (_ga, _gid and occasionally others) and collects anonymised, aggregated data about visitors’ use of the website. The data Google collects enables PICNIC Investment to understand aggregated visitor activity across the website and how we may improve our website. This data does not enable any visitor to be personally identified, and includes:
- Where a visitor came from (search engine, search keyword, link)
- Each user’s amount of visits, and time of the first visit, previous visit and the current visit
- Checks approximately how long you stay on site: when a visit starts, and approximately ends
- Lastly they track the visitors movements around the site, so they change as each page is loaded
It is important to note that additionally, cookies may be written by 3rd party video providers (e.g. YouTube, Vimeo etc.) and 3rd party websites accessed via hyperlinks from our website when that content is viewed.
Cookies and consequent data processing’s carried out by such 3rd parties are regulated by their own privacy/cookie policies.
No specific cookies are written when documents are downloaded or forms are submitted, but these actions are recorded by Google Analytics cookies.
You can disable cookies through your web browser. Here are some external links with instructions on how to disable cookies for each of the main web browsers. Please note that these links are not the work of PICNIC Investment.
TRANSFERRING DATA TO OTHER COUNTRIES
We, or our third party providers, will not transfer the personal information we collect about you to any other country.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Details of retention periods for different aspects of your personal data are available in our retention policy which you can request from us by contacting Us via our contact page.
CHANGE OF PURPOSE
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact Us via our contact page.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Under certain circumstances, by law you have the right to:
- Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
COMPLAINTS OR QUERIES
If you have any questions about this Privacy Notice, or want to submit a written complaint about how we handle your personal information, please contact Us via our contact page. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.