Privacy Policy
Privacy Policy
The City of London Corporation (City Corporation) is a registered data controller in respect of processing personal data under the relevant data protection legislation. This includes the Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR) and the UK General Data Protection Regulation (UK GDPR).
This Privacy Notice explains how we use information about you and how we protect your privacy. If you have any concerns or questions about how we look after your personal information, please contact the City of London’s Data Protection Officer, also the Comptroller and City Solicitor, Michael Cogher, at information.officer@cityoflondon.gov.uk.
Please note - this Privacy Notice was updated on 22 March 2021[JS(1]
2. What is personal data?
Personal Data refers to information that makes it possible to identify you. An identifiable person is someone who can be identified, either directly or indirectly, in particular by referring to an identification number or to one or more factors that are linked to physical, physiological, mental, economic, cultural or social identity. A typical example of personal information is your name and email address.
All personal data collected will be evaluated periodically and only kept as long as necessary or in line with legal requirements.
As part of this activity, we will process personal data regarding the following:
· Name
· If you represent a business or organisation
· Your position in the business or organisation
We might collect your Personal Data from the following three sources:
· Personal Data that you provide during the registration process on the Platform, some of which are optional. If you choose to sign-in via a 3rd party authentication provider as Google Accounts, Facebook or FranceConnect, we will get this data from them. If you choose to verify your identity with a 3rd party identity provider as COW, FranceConnect or CSAM, we will get this information from them.
· Personal data that you provide when taking participative action on our platform. Every action you take on the platform (voting, posting an idea, writing a comment, answering a poll) is registered and stored. This data is also linked to your registration data (3.1), implying that the organization can link your platform profile to this participation data.
· Personal Data that we collect when you visit our platform. We (and third party processors acting on our behalf) collect information about usage of our platform for assessing the good functioning and security of the platform. To this end, we collect technical information that can identify you, such as your IP address and browser details. By using our services you agree to this data being collected.
We also gather usage data to improve our services, you can opt-out of this collection at all time from the consent manager.
4. Why do we need your personal information?
We will collect and process the following data about you:
· First and foremost, to communicate your input to the City of London Corporation with relevant context, and to draw aggregated reports of all the data collected on this platform to assist their decision-making.
· To manage the identification and authentication of users.
· To provide information about your community and/or alert you when activities on the platform may interest you. If you opt-in for specific updates, you may opt-out from updates at any time by emailing allchange@cityoflondon.gov.uk .
· To improve our services and monitor their functionalities.
The personal data is only stored and processed for the period required for the purpose of the processing. After that, the data will be deleted or anonymized.
5. How the law allows us to use your personal information
The All Change at Bank project relies on the following lawful basis to process your personal data
- you, or your legal representative, have given consent
4. Consent
· If we have consent to use your personal information for any particular reason, you have the right to remove your consent at any time. If you want to remove your consent, please contact: Allchange@cityoflondon.gov.uk
5. What rights do you have?
You have the right to view your personal data at any time, as well as the right to be informed of the use that Go Vocal makes of your personal data.
· Right to rectification, erasure and restriction of processing
You are free to decide whether or not to provide your personal data to Go Vocal. In addition, you always have the right to request Go Vocal to correct, supplement or remove your personal data. You acknowledge that a refusal to provide or a request for the erasure of personal data means that certain services can no longer be delivered. You may also request that the processing of your personal data is limited. If you choose to remove your account from the platform, the personal data that was collected about you will be removed from our servers. Some personal information about you might remain in the logging data we keep for security and legal reasons for up to 30 days.
· Right to object
You have the right to object to the processing of your personal data for serious and legitimate reasons. In addition, you always have the right to object to the use of your personal data for direct marketing purposes; in such cases, you do not have to state reasons.
· Right to data portability
You have the right to obtain the personal data you have provided to Go Vocal in a structured, typical and machine-readable form and/or have such transferred to different controllers.
· Right to withdraw consent
Insofar as the processing is based on your prior consent, you have the right to withdraw this approval.
· Automated decision-making and profiling
The processing of your personal data does not include profiling and shall also not be subjected by Go Vocal to automated decision-making.
· Right to lodge a complaint
You have the right to lodge a complaint to the Privacy authority of your country, or the Belgian Privacy Authority under which authority Go Vocal falls: Drukpersstraat 35, 1000 Brussels, Belgium, Tel +32 (0)2 274 48 00, Fax +32 (0)2 274 48 35, e-mail: contact@adp-gba.be. This does not affect relief before a civil court.
· Exercising your rights
You can exercise your rights by contacting Go Vocal to this end, either by email to support@govocal.com, by post to Pachecolaan 34, 1000 Brussels, Belgium or by using the “Contact us” form on the Website, provided you enclose a copy of the front of your identity card. You can also email the City of London Corporation at: allchange@cityoflondon.gov.uk .
5. With whom do we share your personal data?
Citizenlab shares your personal data with City of London Corporation, as it is on their behalf of which we gather this data. Go Vocal will also share your data to the sub-processors working on our behalf. We will never sell or rent your personal data to other service providers, nor will we share your Personal Data with any service providers who are not compliant with the GDPR.
6. Where do we transfer your personal data?
We only transfer your Personal Data to service providers established outside the European Economic Area if they comply to art 44 GDPR. All US-based service providers comply to Privacy Shield, which means they have to uphold to the privacy and security standards of the GDPR even though they are based in the US.[JS(2]
7. How do we protect your personal information?
The City of London Corporation have a legal duty to make sure we or processors engaged by us hold your personal information (on paper and electronically) in a secure way, and to only make it available to those who have a right to see them. Examples of our security include:
- Encryption, meaning that information is hidden so that it cannot be read without special knowledge (such as a password).
- Pseudonymisation, meaning that we will use a different name or identifier to hide parts of your personal information from view. This means that someone outside of the City of London Corporation could work on your information for us without ever knowing it was yours
- Controlling access to systems and networks allows us to stop people who are not allowed to view your personal information from getting access to it
- Training for our staff allows us to make them aware of how to handle personal information, and how and when to report when something goes wrong[JS(3]
· Go Vocal has developed security measures which have been adjusted at the technological and organisational level to prevent the destruction, loss, falsification, changing, prohibited access or the erroneous disclosure to third parties of personal data as well as any other prohibited processing of this data. Under no circumstances can Go Vocal be held liable for any direct or indirect loss resulting from the incorrect or unlawful use of your personal data by a third party. You must at all times comply with the security instructions, including by preventing all prohibited access to your login details and password. You are solely responsible for the use made from the website on your computer, IP-address and your identification details, as well as for the confidentiality of such.
You can find more details of our Information Security expectations in the City of London’s IT Security Policy.
8. Where we store your personal data
The data that we collect from you will be transferred to, and stored at, a destination outside the European Economic Area (EEA). It will also be processed by staff operating outside the EEA who work for us or for one of our suppliers. These staff may be engaged in the fulfilment of your request, order or reservation, the processing of your payment details and the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to Our Sites; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
We will collect and store personal data on your Device using application data caches and other technology.
Certain Services include social networking, chat room or forum features. Ensure when using these features that you do not submit any personal data that you do not want to be seen, collected or used by other users.[JS(4]
9. Additional information on data collection and processing
Legal procedures
Go Vocal and the City of London Corporation, we process this data for might use the Personal Data of the User for legal purposes, for the court or legal proceedings preceding phases in the event of unlawful use of this Application or the related services. The User is aware that Go Vocal and the Organization we work with might be obliged to disclose the personal data at the request of competent government institutions for the processing of the Data. The legal basis for this processing is the acceptance of the terms and conditions (contractual basis) and given consent.
Changes to this privacy policy
The City of London Corporation and Go Vocal reserves the right to change this privacy policy at any time by notifying Users on this page. We encourage you to check this page for possible changes. The date of the last change is indicated at the bottom of the page. If a User objects to any change in the policy, the User must not continue to use this Application. Unless otherwise indicated, the valid Privacy Policy applicable at that time applies to all Personal Data that we have collected.
[JS(1]Will need to be updated
[JS(2]We will need to clarify this position if the sub-processors are based in the USA and the processing is occurring as a result of Privacy Shield then the processing is no longer lawful and the CoL would be at risk of a data breach.
In this instance it would be preferential if Citizen Lab would agree to the implementation of the EU Standard Contract Clauses for Data Protection for their sub-processors that are based in the USA as well as for the data that they will process directly.
[JS(3]Please review this section with Citzenlab to see if they apply any additional security methods or if they do not use any of the following please remove those from the list.
[JS(4]We will need to review this section once we know where the data is held geographically.