Privacy Policy SOCIAL BUSINESS TRUST Privacy policy We are committed to protecting the privacy of your personal data and we summarise here our policies regarding the collection, use and transfer of your personal data, the security measures we employ to protect such data and your rights and choices with regard to access or use of such data. We therefore ask you to read this privacy statement carefully. Information about us Social Business Trust’s (SBT) mission is to support high growth potential social enterprises to scale-up their impact. We do that by investing cash grants and professional support from our world-class corporate partners in a carefully selected portfolio of social enterprises. Social Business Trust is a registered charity (registration number 1136151) and our main trading address is Room S9/10, 2nd Floor, West Wing, Somerset House, London, WC2R 1LA For any questions on data protection at Social Business Trust contact us at: [email protected] How do we collect information? We obtain personal information from you when you use our website, enquire about our activities, register with us, provide your consent to receive our newsletter, send or receive an email, call us, ask a question, become a volunteer, apply for a position at SBT, become an employee of SBT, attend a Social Business Trust event or otherwise provide us with personal information. These interactions may occur online, in person or over the phone. We may also receive information about you from third parties such as our corporate partners, providing volunteers’ information, and from individuals or third party organisations who share our interests and may introduce you to us. We may obtain information from you where we interact with you outside our website, for example if you follow us or we follow you on social media, or if we connect with you via a third party. We may collect publicly available information found in places such as Companies House, information published in articles, annual reports, newsletters or LinkedIn. What information do we collect? We only collect information that’s necessary to support our mission. The personal information we collect might include name, employer, job title, email address, postal address, and telephone number. We record your requests for information and feedback we receive from you. We may also take photographs or videos during Social Business Trust events and collect technical information relating to your use of our website, including your browser type or the Internet Protocol (IP) address used to connect your computer to the Internet. We collect personal information about our employees through the application and recruitment process, either directly from candidates or sometimes from an employment agency or background check provider. We may sometimes collect additional information from third parties including former employers, credit reference agencies and/or other background credit agencies and the Disclosure and Barring Service. We will collect additional personal information in the course of job-related activities throughout the period of our employees working for us. We want to ensure that your personal information is accurate and up to date. If any of the information that you have provided us with changes, for example if you change your name, email address, or if you wish to cancel your subscription to our newsletter, please let us know by clicking the “unsubscribe” link in any newsletter, emailing us at [email protected] We also gather general information about the use of our website, such as which pages users visit most often. We may also track which pages users visit when they click on links in emails or social media posts. Wherever possible we use aggregated or anonymous information which does not identify individual visitors to our website. Refer to paragraph 8 for information on how long we retain your data. Legal basis for processing We collect your information for the purposes of fulfilling our mission and to deliver our services. The lawful bases we rely on to process your information are: Legitimate interest: The processing is necessary to fulfil the charitable purposes of Social Business Trust, but not where our interests are overridden by your interests or rights Consent: You have told us you are happy for us to process your personal information for a specific purpose, for example to receive our newsletter Performance of a contract: We must process your personal information to perform a contract to which you are a party. If you fail to provide this information we may be unable to perform the contract Legal obligation: We may need to process and disclose your personal information to comply with a legal obligation How do we use this information? We will use your personal information: to promote the aims of Social Business Trust and to keep you informed about our activities, events and achievements to respond to your requests about becoming a volunteer with us and manage your volunteering activities to explore and respond to professional partnership requests and opportunities to provide you with services, products or information you have requested to manage any recruitment or job-related activities for our employees and candidates to SBT positions to maintain a summary of your history with us to obtain feedback on our services from you for administration purposes to notify you about changes to our services and as part of our efforts to keep our website safe and secure If you do not want us to use your personal information in this way, please let us know at any time by emailing us at [email protected] Who has access to your information? SBT may distribute the personal information that you submit to us, both internally within our company and to the group of corporate partners and the social enterprises we support (details of which can be found on our website) as necessary for purposes related to our mission. We may also use this information to help us manage programs and services that may be of interest to you. We may need to provide your information to our contractors, publishers, IT specialists, auditors, event organisers and suppliers who provide services on our behalf, to the extent necessary to enable you to receive those services. We will share employees’ personal information with third parties where required by law, where it is necessary to administer the working relationship with employees or where we have another legitimate interest in doing so. These disclosures may involve transferring your personal information overseas and to countries outside the European Economic Area, which do not have similarly strict data privacy laws, for example when using services providers with servers located in the USA. How do we protect personal information? We use our best efforts to ensure that data is accurate, complete, current and reliable for its intended use. We use appropriate technical and organisational measures and safeguards to help protect your personal data from unauthorised access, misuse, alteration or loss. To the extent that we share personal data with social enterprises, business partners or third parties it will be for the purpose of our mission and we will request that they properly protect the security and confidentiality of such information and otherwise process such data in accordance with applicable law. In addition, we limit access to SBT employees’ personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. How long do we keep your information for? We retain your personal information for no longer than necessary for the purposes set out in this privacy notice and to fulfil our legal obligations. Where minimum retention periods are required, for example by HMRC for tax purposes, we will retain your information for the statutory minimum period. Your Rights You have the right to obtain access to your personal data; to have it updated or corrected if it is inaccurate or incomplete; to request that we restrict its processing or remove your data entirely from our system. You have a right to seek the erasure of your data (often referred to as the ‘right to be forgotten’). You may wish to exercise this right for any reason. You should note that we are entitled to and reserve the right to retain your data for statistical purposes. You have a right to prevent us from processing your data for the purposes of marketing. If you would like us to stop using your personal data for this purpose, or if you would like to exercise any of your rights above, please let us know using the contact details shown above. We will act in accordance with your instructions as soon as reasonably possible. We are obliged to request proof of identity before access to your personal information is given. If you have any concerns about how we handle your personal data, please contact us so that we can resolve the issue, when possible. You also have the right to lodge a complaint with the supervisory authority, the Information Commissioner’s Office, at www.ico.org.uk. Information about Our Use of Cookies ‘Cookies’ are small pieces of information stored on the hard drive of a user’s computer which contain information about the user. The information is used to track a visitor’s use of the website and to compile statistical reports on website activity. Our website uses cookies to distinguish you from other users of our website. This helps us improve our website. By continuing to browse the site, you are agreeing to our use of cookies. We may store information about your user preferences using cookies which we can access when you visit our website in the future. We do this to help enhance your interaction with our website. If you want to delete any cookies that are already on your computer, please refer to instructions for your file management software to locate the file or directory that stores cookies. You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our site. Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies may include analytical/performance cookies or targeting cookies. Cookies We use cookies to improve our services and your experience when using our website. This helps us to ensure that the website functions in accordance with your expectations. A "cookie" is a text file that websites send to a visitor’s computer or other Internet-connected device to uniquely identify the visitor’s browser or to store information or settings on the device. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie. Cookies are useful because they allow a website to recognize a visitor’s device and to target the content displayed to the visitor’s interests. You do not need to allow cookies to use our website. Note, however, that enabling cookies will be required for some parts of our website to work and may also allow for a more tailored use of our website. We use cookies to (i) customise and improve your visit to our website; (ii) deliver content tailored to your interests and the manner in which you browse our website; and (iii) manage our website and other aspects of our business. Strictly necessary cookies do not require your consent. For functional, analytics and marketing advertising cookies, we request your consent before placing them on your device. By continuing to use the website, you acknowledge that you accept these terms. If you wish to change your cookie preferences, you can delete, block or disable cookies by activating the settings on your browser. Please see below for more information on how to manage cookies through your browser: InternetExplorer Firefox GoogleChrome Safari Please note that disabling these cookies will affect the functionality of our website and may prevent you from being able to access certain features on our website We would like to use the following cookies on our website: Strictly necessary cookies These cookies are necessary for our website to work, and enable you to move around our website and use its services and features. Disabling these cookies will encumber our websites' performance and may make these services and features unavailable. Strictly necessary cookies are used to collect session ID and authentication data. These are session cookies, which expire when you close your browser session. Functional/preference cookies Functional cookies allow our website to help maintain your session and remember the choices you made in order to provide functionality for your benefit. Functional cookies are used to collect information about preferences indicated during your visit. For example, functional session cookies allow the sites to remember settings specific to you which ultimately improves your web experience. Functional cookies also include persistent cookies which are used to remember your preferences when you subsequently visit. Statistical/analytics cookies Analytic cookies are used to gather statistics about your use of the sites in order to improve the performance and design of our services. For these purposes, analytic cookies collect information about your device type, operating system type, browser type, domain, other system settings, IP address, referring URLs, information on actions taken on the sites and the dates and times of your visits, as well as the country and time zone in which your device is located. Marketing/advertising cookies Marketing and advertising cookies are used to provide targeted advertisements to users based on their previous online activity. Third party cookies We partner with third parties to provide you with connections to certain social networks (such as Facebook, Twitter and LinkedIn) and to provide you with additional features (such as YouTube and Vimeo). By using our website or engaging with third-party plugins and widgets on our website, such third parties may place session or persistent cookies, or similar technologies, on your browser. These technologies may provide the third parties information about your visit so that they can present you with advertisements for our products and services which may be of interest to you. This helps us track the effectiveness of our marketing efforts. The use of these cookies is subject to such third-party’s own cookie policies linked below: [•] The cookies we use: Necessary cookies Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies. Cookie Name Used by Description Expiration x-ms-routing-name Azure Used by Azure to handle traffic during code changes. 1 Hour idsrv Identity Server framework Used by Identity Server framework to authenticate user via cookie when logging into our Platform. 2 hours idsrv.session Identity Server framework Used by Identity Server framework to ensure a user's session has not changed when logging into our Platform. 2 hours TempMember Website Set when a user first signs up for our site, but does not verify their account via email. It's used to associate the user's actions with the new user account. 12 hours TempMember_RequiresVerification Website Contains "true" if the person has recently signed up to the website but has not yet verified their account yet. 12 Hours cookieconsent_status Website Used to remember if the user has accepted our cookie policy 1 year tid Website Used by the Platform to store user session data. This includes antiforgery tokens and shopping basket data 1 month AspNetCore.Antiforgery.XXXXXX Identity Server framework Built in ASP.NET security feature. Used to prevent Cross-Site Request Forgery attacks against our sites End of session ASP.NET_SessionId Website Used for authenticating a user's session after logging in. Closes when the user exits the browser. It does not contain any personal information. End of session .AspNet.Auth Website Used for authenticating the user when logged into the Platform. 2 Hours ARRAffinity Website Tells our infrastructure which server to handle the request. It does not contain any personal information and is used only for analytical purposes. End of session MemberLoggedIn Website A binary flag which stores whether a user is logged in or not. It does not contain any personal information. End of session _stripe_sid Stripe Used by our payment provider, Stripe, in order to process payments on checkout. End of session _stripe_mid Stripe Used by our payment provider, Stripe, in order to process payments on checkout. 1 year nsr Stripe Used by our payment provider, Stripe, in order to process payments on checkout. End of session Statistic cookies Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously. Cookie Name Used by Description Expiration @@History/@@scroll|# Website Used by AppInsights to allow for monitoring of the platform database. It does not contain any personal information and is used only for analytical purposes. End of session _ga and _gid Google Analytics Used to distinguish between website users in Google Analytics. 2 years _gat Google Analytics Used to moderate calls to the Google Analytics service. It does not contain any personal information and is used only for analytical purposes. End of session ai_session and ai_user Website Tracks users as they navigate the website predominately for infrastructure performance insights. It does not contain any personal information. End of session __utma Google Analytics Stores the amount of visits of a user, the time of their first visit, the previous visit, and the current visit. It does not contain any personal information and is used only for analytical purposes. 2 years __utmz Google Analytics This performance cookie stores where a user came from (eg. search engine, search keyword, link). It does not contain any personal information and is used only for analytical purposes. 6 months __unam ShareThis Set as part of the ShareThis service and monitors "click-stream" activity, e.g. web pages viewed, navigation from page to page, time spent on each page etc. The ShareThis service only identifies a user if they have separately signed up with ShareThis for a ShareThis account and given them consent. Checks how long a user stays on a site: when a visit starts, and ends. It does not contain any personal information and is used only for analytical purposes. 14 months cc_cookie_accept Website Stores whether the user has accepted the cookie message or not. It does not contain any personal information and is used only for analytical purposes. 365 days _BEAMER_XXXXXX Beamer Tracking for what product announcement posts have been seen by the current logged in user in the manager. 1 year _plantrack Planhat Provides analytical information about the current platform user to Planhat (our CRM) in order to improve your experience working with us. 1 year Marketing cookies Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers. Cookie Name Used by Description Expiration NID Google Registers a unique ID that identifies a returning user's device. Can be used for targeted ads. It does not contain any personal information. 6 months collect Google Analytics Used to send data to Google Analytics a user's device and behaviour. It does not contain any personal information. End of session DisplayName Website Keeps track of a donors preference to show their name during a Direct Debit. End of session VISITOR_INFO1_LIVE Youtube Used by Youtube if you've embedded a Youtube video in your posts. Tries to estimate a user's bandwidth on pages with integrated Youtube videos. It does not contain any personal information. 179 days YSC Youtube Used by Youtube if you've embedded a Youtube video in your posts. Registers a unique ID to keep statistics of what videos from Youtube a user has seen. It does not contain any personal information End of session Changes to this policy Changes we may make to our privacy policy in the future will be posted on this page. Please check back periodically to see any updates or changes to our privacy policy.