Privacy Policy

1 General Information

This privacy policy explains:

• How we collect your information
• Why we  are allowed to process your information
• What purpose we are processing it for
• Whether there are other recipients of your personal information
• Whether we intend to transfer it to another country, and
• How we decide how long to store it.

2 Contact information

Extinction Rebellion UK is the controller for the personal information we process, unless otherwise stated.

You can contact us by email here: dataprotection@rebellion.earth

Please start the subject line: ‘Data Protection’.

3 How do we get information?

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• You are a Rebel and have signed up.
• You subscribe to our e-newsletter.
• You wish to attend, or have attended, an event or training.
• You have donated to us or applied to volunteer with us.

We may also receive personal information indirectly, in the following circumstances:

• You have given another Rebel or one of our volunteers permission to provide information about you in specified circumstances, for example as an emergency contact or for a reference.
• We may review publicly available documents about individuals, and contacts at organisations, with whom we interact or may interact.

In some circumstances, we process some special category personal data and criminal  offence/conviction data.

4 What purpose are we processing it for?

We will process your data for the purpose of:

• Raising awareness about the climate and ecological emergencies
• Communicating in relation to ongoing Rebel activity; and associated correspondence
• Facilitating Rebel activity nationally and in local, regional and affinity groups
• Providing training and assistance to Rebels
• Keeping in touch with relevant news and related correspondence
• Promoting, or managing events
• Volunteer related matters
• Promoting the purposes of our organisation, including but not limited to managing our infrastructure and fundraising
• Other legitimate interests, including but not limited to using emergency contact numbers
• Sharing information in the public interest

Fundraising

We process personal data in order to raise funds, from both Rebels and others, to enable Rebel activity to continue, when we have the relevant individual’s consent or we are otherwise allowed to.

We may use your email address and phone number to link to Facebook or other social media sites to identify other users of those sites we believe may be interested in XR UK. We may then show them XR UK content. No data we hold about you is retained by the social media site. You can opt out of this use of your data via the social media sites you use.

We may also do more detailed research to determine whether an individual could be a potential major supporter and what aspects of our work might be of particular interest to them. To do this, we may use publicly available information from third party sources such as Google, Companies House, trade press and published biographies. The type of information we collect can include:

• career overview
• gift capacity
• areas of interest
• history of giving to us and others
• how the individual is connected with us and others
• public information on any philanthropic activities.

In order to identify these people we may screen our database and we may also use more detailed research to help us to understand more about the people we engage with, their connection to us and their interests.

We may also carry out research using publicly available information to identify individuals who may have an affinity to our cause, but with whom we are not already in touch. This research helps us to understand how to engage with those individuals most helpfully and effectively.

We are careful to ensure that the information we process is not excessive or intrusive.  Under data protection legislation, you have the right to object to your data being processed in this way.  You can do this by contacting dataprotection@rebellion.earth

Arrestee and Legal support

We may obtain contact details, names, and other information and identifiers about protestors, members of the public and the police present at protests in order to:

• enable us to contact anyone arrested to offer advice and support.
• help make sure that protesters, who are subject to police action or violence, have access to evidence that may be of value to defend their rights to protest, take action against the police and support their defence.

The personal data involved may be provided by the individual or provided by legal observers or others present at a protest from their personal observation, or it may be from other publicly accessible resources (like social and other media).

We also process personal data in the form of:

• name and contact information for those people we train as legal observers and/or continue to support  XR UK to enable us to keep in touch.
• names, phone numbers, and email addresses and any other personal information provided by people contacting us by email or over the phone.

This processing is either on the basis of consent, our legitimate interests  and activities as an organisation in supporting individual protesters, or to assist in the establishment, exercise or defence of legal claims.

Where appropriate, we may share the personal data referred to in this section in the following ways:

• with solicitors representing protesters.
• with protesters representing themselves.
• with individuals supporting protesters at police stations.
• with other groups, like Green and Black Cross (GBC), offering support to protesters.

Where possible, we try to ensure there is consent to the sharing of personal data from the key protester (e.g. the arrestee) but, in some cases, the sharing of relevant personal information about the arrestee or about other people present at the protest is based on one of the other justifications set out above.

5  What is our lawful justification for the processing?

Ordinary personal data

Where we process ordinary personal data, we rely on one of the justifications below.

Consent

In many cases, especially when we are dealing with Rebels or others who use our services, we will clearly ask for and rely on your consent to the processing of your personal information, for example when you provide information in an online form. Where we rely on your consent, you can withdraw it at any time by contacting us at dataprotection@rebellion.earth  If you do that, this will normally mean that we will no longer process your personal information going forward, unless we have another lawful justification for the processing.

Legitimate interests

Sometimes, particularly when it is not practicable to obtain consent, our processing is necessary for the purposes of legitimate interests pursued by us or a third party, as connecting people to our cause is instrumental in meeting our political and philosophical objectives as a not-for-profit movement; but we will never rely on this justification when those interests are overridden by your rights and interests in relation to your data. As explained in the section below, you have the right to object to processing based on this justification.

Compliance with a legal obligation

There are some cases where we are required by law to collect certain personal information.

Vital interests

In very rare cases, generally if it is a life or death situation, we may need to rely on the lawful justification that the processing is necessary to protect your or another person’s vital interests.

Special category data

Special category data is information about a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, physical or mental health, and sex life and sexual orientation. Because of its sensitivity or potential sensitivity, there are tighter rules that apply to its processing. There are also tighter rules around criminal offence data. We will only ask for/process such information if we need to do so, and if, in addition to one of the justifications above, we also have one of the lawful justifications set out below.

Explicit consent

Where we rely on this, we will clearly ask for and rely on your explicit consent to the processing of your personal data for specified purposes, and, as in the case of ordinary personal data, you can withdraw your consent at any time by contacting us at dataprotection@rebellion.earth

Processing by not-for-profit movement

This permits processing by us as a not for profit movement with political and philosophical aims in the course of our legitimate activities.

Establishment, exercise or defence or legal claims

This is one of the lawful justifications for, for example, the processing undertaken as part of our Arrest Watch Support Services.

6 Your Data Protection rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can read more about this on the ICO website here.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this on the ICO website here.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances. You can read more about this on the ICO website here.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this on the ICO website here.

Your right to object to processing

You have the right to object to processing, if we are able to process your information because the process forms part of our legitimate interests. You can read more about this on the ICO website here.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent; or under, or in talks about, entering into a contract; and if the processing is automated. You can read more about this on the ICO website here.

You are not required to pay any charge for exercising your rights. We have one month to respond to you.

Please contact us at dataprotection@rebellion.earth if you wish to make a request.

7 Sharing your information

We share appropriate personal data within Extinction Rebellion UK, including local, regional and affinity groups that are part of Extinction Rebellion UK. We also share appropriate personal data with affiliated and sister groups that are not part of Extinction Rebellion UK. This includes information relating to Rebels and people who have expressed an interest in Extinction Rebellion UK and/or any affiliated or sister groups, to enable them to contact you, by methods you have agreed, about their activities. Where these groups are not part of Extinction Rebellion UK, they receive that data as controllers and are responsible for complying with their obligations in relation to that information.

We will not share your information with any third party commercial organisation, nor with any organisation other than those referred to above, for the purposes of direct marketing.

We use data processors who are third parties who provide elements of services for us.

These include organisations which

• Provide IT infrastructure, software and services to us, to enable us to store and manage your information, communicate with you and enable Rebels to communicate with each other; and
• Manage the provision of goods and services to us.

We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Where we contract with third parties for the processing of your data, these may be located outside the EU (e.g. in the USA). When this is the case, we ensure the contracts we have in place with those third parties meet the requirements of  data protection law.

In some circumstances we are legally obliged to share information. For example, under a court order (where we have considered we have a lawful basis on which to share the information and document our decision making).

Arrest Watch Services

From time to time, we may provide services in conjunction with organisations such as Green and Black Cross, and in those circumstances, we are joint controllers with them and their privacy notices also apply.

8 Links to other websites

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

9 How long we keep your personal data

We will only keep your personal data for as long as necessary for the particular purpose for which we process that data.

10 Your right to complain

We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact us at dataprotection@rebellion.earth

If you are unhappy with our response, you have the right to make a complaint about the way we process your personal information to the ICO as the UK supervisory authority. Please follow this link for more information.

11 Changes to this Privacy Policy

We keep our privacy policy under regular review to make sure it is up to date and accurate.

12 Visitors to our website

Analytics

When you visit extinctionrebellion.uk, we use third-party services, including Google Analytics, to collect standard internet log information and details of behaviour patterns. We do this to find out such things as the number of visitors to the various parts of the site. This information is only processed in a way that does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

If we do collect personal data through our website, we’ll be upfront about this. We’ll make it clear when we collect personal information and we’ll explain what we intend to do with it.

Cookies

We collect information about how you use our website using cookies and similar technology. This includes your viewing history, IP addresses, device identifiers and information about how long you have stayed on certain pages or what pages you have clicked on.

You can find more detailed information about this in our Cookie Policy.  We also log and use information about any service errors or interruptions that you have experienced in order to help us create fixes and to make technical improvements to our website.

Search engine

Search queries and results on our website are logged anonymously to help us improve our website and search functionality. No identifiable personal information is collected by us.

Purpose and legal basis for processing

The purpose for implementing the above is to maintain and monitor the performance of our website and to constantly look to improve the site and the services it offers to our users. The legal basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests. 

What are your rights?

As we are processing your personal data for our legitimate interests as stated above, you have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.

For more information on your rights, please see the ICO website: ‘Your rights as an individual’.

13 Automated decision-making or profiling

We do not use automated decision making. As we explain above in the section on fundraising, we may occasionally profile your data for the purposes set out there.

---

Parts of this privacy notice have been derived from the original by Green and Black Cross. It is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 License