This Privacy Notice explains when and why we collect personal information about you, how we use it and the conditions under which we may disclose it to others. Your personal data is defined as any information that can directly or indirectly identify you. This notice also explains how we keep your data safe and secure and includes information you need to know about your rights and how to exercise them.

If you have any questions regarding our Privacy Notice and our use of your personal data or would like to exercise any of your rights, please get in touch via the following information:

If you are based outside of the UK, the complaint should be directed to the relevant Data Protection Supervisory Authority in that Country.

We are MeWe360 and for the purposes of UK Data Protection Law we are registered with the ICO under registration number ZB768277. MeWe360 is a pioneering black led organisation dedicated to supporting & promoting Black & Brown entrepreneurial & leadership talent in the UK arts and creative industries

In this Notice, ‘MeWe360’, ‘we’, ‘us’, ‘our’ means:

MeWe360 (charity registration number 1152824) with a registered address at John Morris House, 164 St John’s Hill, London, SW11 1SW.

Appendix 1 – Human Resources (employees, job applicants and trustees) 

Appendix 2 – Members  (members, applicants and alumni) 

Appendix 3 – Fundraising

Appendix 4 – Website visitors and cookies

Your contact details may be used to provide you with information about our services or our fundraising opportunities via:

• Phone

If you have provided us with your telephone number, we may contact you by phone with fundraising and marketing communication under our legitimate interest (unless you are enrolled to TPS or you told us not to do so). 

• Email, text, whatsapp or other electronic message

We will only send you fundraising and marketing communications by email, text or other electronic message if you have provided your consent or if you have been involved in a commercial transaction with us. You may opt-out of our fundraising and marketing communications at any time by clicking the unsubscribe link at the end of our e-marketing communication. Alternatively, you can let us know by using any of the contact details listed at the top of this notice.

Under data protection laws in the UK and EU, you have certain rights over the personal information that we hold about you. If you would like to exercise your rights, please get in contact with any of the details listed above. Here is a summary of the rights we think apply:

• Right to be Informed

You have the right to be informed as to how we use your data and under what lawful basis we carry out any processing. This Privacy Notice sets this information out however if you would like further information, please get in touch. 

• Right of Erasure – also known as the right to be forgotten

You may ask us to delete some or all of your information we hold about you. Sometimes where we have a legal obligation we cannot erase your personal data.

• Right to Object

You have the right to object to processing where we are using your personal information such as where it is based on legitimate interests or for direct marketing.

• Inaccurate personal information corrected

Inaccurate or incomplete information we hold about you can be corrected. The accuracy of your information is important to us and we are working on ways to make this easier for you to review and correct the information that we hold about you. If any of your information is out of date or if you are unsure of this, please get in touch through any of the contact details listed in this notice.

• Right of restriction

You have a right to restrict the processing of some or all of your personal information if there is a disagreement about its accuracy, or we are not lawfully allowed to use it.

• Right to Access your information 

You have a right to request access to a copy of your personal information that we hold about you, along with the information on what personal information we use, why we use it, who we share it with, how long we keep it for and whenever it has been used for automated decision making. You can make a request for access free of charge and proof of identity is required.

• Portability

You can ask us to provide you or a third party with some of the personal information that we hold about you. 

• Right to withdraw consent 

Where you have provided consent to our use of your data, you also have the right to withdraw that consent at any time. This means that we will stop processing your data

Where personal data is stored outside of the UK and the EEA, safeguards to protect personal data may include but are not limited to the UK Addendum used in conjunction with the EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreement (IDTAs). Such safeguards will be subject to Transfer Risk Assessments (TRAs).

This privacy notice is kept under regular review.  If we make any significant changes to the way in which we process your information, we’ll make the required changes to this Privacy Notice and will notify you so that you can raise any concerns or objections with us.  When making less impactful changes, we’ll update this notice and post a summary of the changes on our website.

This privacy notice was last updated in September 2024.

(Freelancers, job applicants and current and former employees and  trustees)

How and when do we collect information about you?

You provide several pieces of data to us directly during the recruitment period and subsequently upon the start of your employment/engagement.

In some cases, we will collect data about you from third parties, such as employment agencies or former employers when gathering references.

What types of information is collected about you and who provides it?

We keep several categories of personal data on our employees/freelancers/job applicants/trustees and volunteers in order to carry out effective and efficient processes. We keep this data in a personnel file relating to each individual and we also hold the data within our computer systems, for example, our holiday booking system.

Specifically, depending on your type of engagement with MeWe360, we may process the following types of data:

1. personal details such as name, address, phone numbers
2. name and contact details of your next of kin
3. your photograph, your gender, marital status
4. footage of the organisation events where you may appear
5. information of any disability or other medical information you have disclosed 
6. right to work documentation
7. information gathered via the recruitment process such as that included in a CV, cover letter or application form, references from former employers, details on your education and employment history etc
8. National Insurance number, bank account details and tax codes
9. information relating to your employment with us (e.g job title, job description, salary, terms and condition of the contract, annual leave records, appraisal and performance indication, formal and informal proceedings involving you such as letters of concern and disciplinary, disciplinary and grievance proceedings. 
10. internal and external training modules undertaken
11. information on time off from work including sickness absence, family related leave etc.
12. IT equipment use including telephones and internet access
13. your biography and picture for the website (if applicable).
14. holiday leave 

We may also process special category data which includes health information, sexual orientation, race, ethnic origin, political opinion, religion, trade union membership, genetic and biometric data.

How is the information used?

We are required to use your personal data for various legal and practical purposes for the administration of your contract of employment or your volunteer/trustee agreement, without which we would be unable to employ you. Holding your personal data enables us to meet various administrative tasks, legal obligations or contractual/agreement obligations.

Lawful basis for processing

We mainly use ‘contractual obligation’ as a lawful basis for processing personal data for employees, job applicants and freelancers. We mainly use ‘legitimate interest’ for trustees.  We may also have legal obligation in order to process and share your data, for example we need to share salary information to HMRC or use some of your data to enrol a new employee on a pension scheme.

We may rely on our legitimate interest for processing activity such as keeping supervision and appraisal records; using your image, bio and videos/pictures of the organisations’ events where you may appear on our website or marketing/fundraising materials to promote the charity.

Some special categories of personal data, such as information about health or medical conditions, are processed in order to carry out employment law obligations (such as those in relation to colleagues with disabilities and for health and safety purposes). We may also process other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief for the purposes of equal opportunities monitoring.

How long do we keep your data?

We only keep your data for as long as we need it for, which will be at least for the duration of your employment/engagement with us though in some cases we will keep your data for a period of 6 years after your employment/engagement has ended. If you’ve applied for a vacancy but your application hasn’t been successful, we will keep your data only for 12 months.

Some data retention periods are set by the law. Retention periods can vary depending on why we need your data. Please get in touch by contacting us using the details above if you want to know more about the retention period.

Data is destroyed or deleted in a secure manner as soon as the retention date has passed.

Confidentiality – who do we share your data with?

Data in relation to your salary is shared with HMRC as part of our legal obligation. Data may be shared with third parties for the following reasons: for the administration of payroll, pension, HR functions (for example the online holiday booking system), administering other employee benefits (such as the Childcare Voucher Scheme) and with the building security team for the issuing of you building access pass. When sharing information with third parties, we have data sharing, processor agreements or contracts in place to ensure data is not compromised. Third parties must implement appropriate technical and organisational measures to ensure the security of your data.

(Members, applicants and alumni)

How do we collect information about you?

Information provided by yourself or a referrer during the application process, assessment and during your participation may include: your name, date of birth, gender, ethnicity, religion, sexuality, contact details (such as phone number and email address), social media handles, home address, health and accessibility information (including any disabilities or impairments along with any specific accommodations or support you may require). Additionally, we collect business information such as your business name, job title, business contact details, number of employees, financial structure and any other relevant information to help us understand your business needs.  

We may take footage of our events for marketing and communication purposes where you may appear. 

The information collected may include special category data which could include health information, sexual orientation, race, ethnic origin, political opinion, religion, trade union membership, genetic and biometric data.

How is your information used?

We may use your personal information to:

• Process your membership or order for events, offers and services to process your requests;
• Provide an appropriate service which best meets your needs;
• Provide progress reports to funders;
• Claim payments from the funders;
• Monitor and manage risk;
• Protect yourself and the general public;
• Safeguarding;
• Conduct research;
• Conduct evaluation;
• Showcase case studies on our website and social media;
• Collate anonymised or pseudonymised statistical information for funders, the charity  and delivery partners

Lawful basis for processing

We rely on legitimate interest or consent as our lawful basis for processing your personal data. 

When we process special category data or criminal records, the lawful basis is supported by additional conditions of the law. 

How long do we keep your data for?

We retain the personal data of all service users for a period of seven years post-service. After this period, personal data will be reviewed and securely destroyed. Data for winners of longstanding awards programmes may be kept for the duration of the programme to enable longitudinal tracking.

Information relating to individuals who, for any reason, do not progress into one of our services will have their personal data retained for 12 months.

Research data will be kept for ten years.

Confidentiality, data sharing and safeguarding 

• We may use legitimate interest, your consent or legal obligation to share your personal data with delivery partners/Local Authorities in order to provide you with a quality service which best suits your needs. Each organisation can act as an individual data controller of your personal information and you should read their privacy notice in addition to this one, or can act as data processors and for that reason they will process your data on our behalf. 

• Personal data is not shared with funders. Information is shared only anonymously to funders. 

• To comply with our duty of care and safeguarding, we may need to pass some information raising safeguarding concern with the authorities. In such circumstances, we apply vital interest and legitimate interest as our lawful basis. Data subjects’ rights and other UK GDPR provisions may be restricted when concerning personal data processed in these circumstances. Exceptions and exemptions are applied on a case-by-case basis. 

Information collected and why, who provides it, data retention and lawful basis

When you make a donation

Information is provided by you via a donation form on our website or via third party donation platforms. The information gathered may be: name, email address, Gift Aid sign up, company name if donation made by an organisation, donation details, reasons to engage, postal address 

This information allows us to process your donation and deal with any potential enquiry. We rely on our legitimate interest to process this data. If you agree that we can claim Gift Aid on your donations we are legally required to keep a record of the claim and your Gift Aid declaration. 

If you are donating using a third party, please also refer to the privacy notice published on their websites. 

Philanthropy 

In case of a generous donation or in order to identify potential high value supporters, we may use profiling and screening techniques. We may undertake in-house research and from time to time engage specialist agencies to gather information about you from publicly available sources, for example, Companies House, the Electoral Register, company websites, ‘rich lists’, social networks such as Linkedin, political and property registers and news archives. 

We would gather publicly available information regarding previous charity support, connection to our cause, credibility, geographical, demographic, financial soundness, career information, peer networks and other publicly-available information (e.g. age, address, listed Directorships, hobbies and interests). 

If you have already engaged with us, we may also profile information that you have provided to us during your engagement, including information such as occupation, title, details of any correspondence had with us, DOB, fundraising appeals responses, event participations with us, details of your reasons to engage with us. 

We also use publicly available sources to carry out due diligence on donors in line with the charity’s Gift Acceptance Policy and to meet money laundering regulations. 

This information also allows us to understand how likely it is that you would be interested in supporting us so that we can better tailor our communications such as telling you about the things you are likely to be interested in, letting you know of ways to fundraise with us which are relevant to you and making sure that we only talk to you about a financial level of giving that is appropriate to you. 

We rely on our legitimate interest in order to profile and screen your information. If you would rather we did not do this, please just let us know and we will, of course, respect your wishes. Otherwise, following our initial profiling and screening, we will contact you either via phone or via e-communication if consent has been provided. During our conversation, we inform you of our processing and of your rights as data subject (which include right to object, to restrict our processing and to have your data deleted). If you are happy to engage with us, we’ll proceed with establishing our relationship with you, which will include further engagement and profiling. 

Additionally, we sometimes ask existing supporters, trustees and volunteers whether they would be prepared to open their networks up to us.  An existing supporter may tell us about an individual previously unknown to us and facilitate an introduction. In this scenario we would check that the person in question is registered on the TPS or FPS and exclude them if their details have been registered on either of these registries.  We would then advise our Trustee or existing supporter about our data responsibilities and ask them to ensure that the person they would like to introduce to us is happy for an introduction to take place.  Following the introduction, we would direct the individual to this privacy notice and confirm their marketing consent preferences before communicating with them further.  We will also share a link to our privacy notice in the footer of all of our email communications.  

How long do we keep your data for?

We keep your data as long as necessary. If you’ve made a donation, showed interest in supporting us or participated in our events we may keep your data for five years. If you are a regular donor, we may keep your data for seven years once you’ve stopped engaging with us.

Data is destroyed or deleted in a secure manner as soon as the retention date has passed. 

If you wish to know more about our data retention, please contact us using the details above.  

Confidentiality – who do we share your data with? 

Please rest assured that we will never sell your details to any third party. 

In addition, if we ever need to send data to a third party for processing for the purposes of legitimate interests (for example checking against the Telephone Preference Service, updating our records and prospect researching from publicly available sources such as the electoral roll) we will make sure the company we use has signed a data processing agreement with us or other contractual obligations, so that they are bound to take care of your data in the same way we do.  We may also share personal information with external auditors, e.g. the Charities Commission or for the audit of our accounts.

We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

If you have made a Gift Aid declaration, we may disclose the information you have provided as part of the declaration to HMRC for the purpose of reclaiming gift aid on your donation(s). We may share or disclose your personal information if we are required to do so by any law, regulation or court order.

• Website Cookies

Cookies are small text files that we place on your device to help make our website work better for you. Think of them as digital memory that helps us:

• Remember your preferences
• Make navigation smoother
• Understand how you use our site
• Deliver content that’s relevant to you

Types of Cookies We Use  

• Necessary Always Active: Necessary cookies are required to enable the basic features of this site, such as providing secure log-in or adjusting your consent preferences. These cookies do not store any personally identifiable data.
• Functional Cookies: Functional cookies help perform certain functionalities like sharing the content of the website on social media platforms, collecting feedback, and other third-party features.
• Analytics and Performance Cookies: We use these to gather information to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc. Performance cookies are used to understand and analyse the key performance indexes of the website which helps in delivering a better user experience for the visitors.

Managing Your Cookies Preferences  

On your first visit, you will see a banner requesting consent for optional cookies. You can modify your cookie preferences at any time by adjusting settings in your browser or through our [Cookie Settings](link to settings page). Essential cookies remain active as they are required for our services.

Third-Party Cookies  

We may use trusted third-party services, such as Google Analytics, to provide functionality and gather insights. These third parties may set their own cookies, which are subject to their privacy policies.

Your Rights and More Information  

Under GDPR, you have the right to access, delete, or restrict the processing of your data

• Social Media 

When you interact with us on social media platforms such as Instagram, TikTok, Facebook and X,  we may obtain information about you (for example, when you publicly tag us in an event photo). The information we receive will depend on the privacy preferences you have set on those types of platforms. Please review the privacy notice of those platforms, in addition to this one. 

• Links to other websites

Our website may contain links to other websites of interest. Once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy policy. You should exercise caution and look at the privacy policy applicable to the website in question.