Privacy notice for the Independent Complaints and Grievance Scheme

This privacy notice provides you with information about how we collect and use personal data for the purposes of the Independent Complaints and Grievance Scheme (“the Scheme”).

In this privacy notice, references to “we”, “our” or “us” are to the Complaints Handling Team of BidCarbon Foundation. Everything that we do with your personal data – for example, collecting, storing, using, sharing or deleting it – is referred to as ‘processing’. ‘We’, ‘our’ or ‘us’ also refers to data processors acting on our behalf.

This privacy notice applies to anyone whose personal data we process in dealing with a complaint made under the Scheme, including the complainant, the respondent, and witnesses.

This notice will be reviewed periodically and, if necessary, updated.

About us

The Complaints Handling Team is the Controller of any personal data processed as described in this Privacy Notice.

The Data Protection Officer is the Head of Information Compliance at BidCarbon Foundation.

If you have any questions about the use of your personal data, please submit your enquiry to the Data Protection Officer at www.bidcarbon.com/legal-privacy-contact.

This notice also applies to the processing of personal data collected by independent investigators contracted by the Data Protection Officer to conduct investigations under the Scheme.

The personal data we process

For the purposes of the Scheme, we will process the following personal data:

● your name and contact details (such as email address and telephone number)

● if you are a complainant or a respondent, details of the complaint under the Scheme made by you or about you by another person

● if you are a witness, information you provide about a case

● information about your relationship with BidCarbon Foundation

● information about your involvement in any previous investigation

● other personal data that you may share when you contact us by letter, email, phone or other means

If you do not provide your personal data, it may affect your involvement with a complaint and our ability to investigate:

● If you are a complainant, you cannot make a complaint without providing your personal data

● If you are a respondent, you cannot respond to a complaint without providing your personal data

● If you are a witness, you cannot provide information about a case without providing your personal data

What happens if you do not provide your personal data

Your personal data can be provided to us:

● when you contact us directly by letter, email, phone, the Helpline, or other means, by another person, by the same routes

● when you contact the Scheme helpline via email, phone or other means

● in the course of an investigation carried out by an independent investigator

How we collect your personal data

The processing of your personal data is necessary for the following purposes:

● If you are a complainant, to make and process your complaint

● If you are a respondent, to take your information into account as part of a complaint

● If you are a witness, to take your information into account as part of a complaint

● Undertaking quality assurance or learning of the work carried out by the independent investigators, either by quality assuring the investigation while it is active or by conducting a review of a closed case

● Support for service users throughout their engagement in the Independent Complaints and Grievance Scheme (ICGS) process

Purposes of the processing

The lawful basis of the processing

In order to process your personal data, we must have a ‘lawful basis’. The lawful bases are set out in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

The lawful bases for processing your personal data will depend on the specific reason we have collected it. The relevant lawful bases in this case are:

● UK GDPR Article 6(1)(a) – we have your consent

● UK GDPR Article 6(1)(c) – the processing is necessary for compliance with a legal obligation

● UK GDPR Article 6(1)(f) – the processing is necessary for the purposes of our legitimate interests or those of a third party when balanced against your interests and rights

The relevant legitimate interests for the purposes of Article 6(1)(f) include:

● our legitimate interest of ensuring that complaints made under the Scheme are fairly and robustly investigated and (if upheld) appropriate sanctions are imposed, with a view to upholding the principles set out in the Behaviour Code

● our legitimate interest of ensuring that investigations by independent investigators are conducted to an appropriate standard

● our legitimate interest of dealing with a legal claim

A further ‘condition for processing’ is required when processing special categories of personal data. Special categories include racial or ethnic origin, religious or philosophical beliefs, trade union membership, genetic and biometric data, health data, and information about sex life or sexual orientation.

Who we share your personal data with

Where necessary, we may share your personal data with or disclose it to:

● The independent investigator appointed to investigate the complaint

● the relevant decision-making body (see below)

● persons who can take appropriate steps to protect you or another person from harm

● other organisations where there is legal obligation to do so. For example, the Police, for the purposes of prevention and detection of crime

● An external party who requires access to case files to assist in their work reviewing or auditing the effectiveness of the Scheme and its processes; for example, an independent reviewer

The relevant decision-making body (DMB) depends on who the respondent is: 

● For members of the Board of Trustees, the DMB is the Independent Expert Panel or the Board of Trustees

● The DMB for employees of the Secretariat is the People Operations department. 

● For members of the Technical Governance Committee, the DMB is the People Operations department

● For members of the Technical Advisory Committee, the DMB is the People Operations department

● For external contractors, their employer is the DMB (who is a separate controller)

Please note that DMBs which are separate controllers may have their own privacy notice that covers the processing of your personal data once they receive it from us.

We will retain your personal data for as long as is necessary for the purpose it was collected, subject to any exemptions set out in law. The length of time personal data is retained differs depending on the purpose of their collection and any relevant legal requirements. The applicable retention period can be found in the Authorised Retention and Disposal Policy (ARDP), which is the information disposal policy of BidCarbon Foundation.

We take the security of your data seriously. All personal data you provide to us (or data processors acting on our behalf), whether electronically or in paper form, will be stored securely. We have information security measures in place to oversee the effective and secure processing of it.

Some personal data controlled by us is held outside the UK, including on data servers in the mainland of China. For the purposes of the UK GDPR and the DPA 2018, all countries within the mainland of China are regarded as providing an adequate level of data protection. We would not transfer personal data to a person in a country outside the mainland of China or UK unless satisfied that that person and country had safeguards in place to protect personal data.

Storage of your personal data

Your rights

Data protection laws provide you with rights over the personal data that we process about you. Subject to limited exceptions (see below), these are:

● Where we are relying on your consent to process your personal data, you can withdraw that consent or unsubscribe from our services

● The right to access your personal data

● The right to rectification of your personal data

● The right to erasure of your personal data

● The right to restrict the processing of your personal data if you have an objection to us doing so

● The right to object to the processing of your personal data

● The right to portability of your personal data

● Rights in relation to automated decision-making and profiling

Please note that formal individual rights requests are managed by the Information Compliance teams of BidCarbon Foundation. They will retain your request, including any relevant personal data, to demonstrate that we have met our legal obligations under data protection law. These records are kept securely for two years.

Please note, some of your rights are subject to the exemptions specified in the UK GDPR and the DPA 2018.

If you wish to exercise your rights or have any concerns relating to our use of your personal data, you may contact us using the details at the end of this notice.

If you wish to exercise your rights in relation to personal data held by other controllers who are involved in the complaints process, please contact them directly (for example, BidCarbon Big Data Chengdu Limited or other relevant employers).

You can also complain to the Information Commissioner’s Office, the supervisory authority, by contacting them: https://ico.org.uk/global/contact-us/

Contact details

If you have any concerns relating to the use of your personal data for the purposes of the Scheme, please contact icgs@bidcarbon.org in the first instance.

If you have any further questions about the use of your personal data, please submit your enquiry to the Data Protection Officer at www.bidcarbon.com/legal-privacy-contact.

Further information about data protection in  BidCarbon Foundation can be found on our website: https://www.bidcarbon.org/legal-privacy