Privacy policy

Inland Waterways International (‘IWI’, ‘we’ or ‘us’) is a not-for-profit company limited by guarantee registered in England and Wales. Our registration number is 02953511 and our registered address is The Courtyard, 33 Duke Street, Trowbridge, Wiltshire, BA14 8EA, UK.

IWI takes your privacy very seriously. We are committed to complying with the principles of the UK General Data Protection regulation (UK GDPR) and to our legal duty to protect any information we collect from you. This policy explains how we collect and use personal data, whether we interact with you over the phone, face-to-face, in writing or through our website or social media, so you can remain informed and in control of your information.

It’s important that you read the full policy to understand what information we hold, how we may use it, and what your rights are. Our policy may change from time to time, so please check it regularly.

If you have any questions about this policy, please contact us by:
email: datacontroller@inlandwaterwaysinternational.org or
post: Data Controller, IWI at the registered address given above

1. WHAT INFORMATION DO WE COLLECT?

The types of personal information we collect may include:

• your name and gender
• your contact information including email address, postal address, and telephone number
• your contact preferences
• payment information such as credit/debit card or direct debit details and payment history, through the WooCommerce application within this website or as otherwise may be recorded by IWI’s Finance Officer
• records of donations
• information relating to your involvement in our campaigns and activities (including volunteer work)
• details of your professional activities, interests and preferences
• family, spouse or partner details and/or relationships with other members or supporters
• your IP address, location, browser type and information on how you interact with our website
• information about you that is publicly available
• any other information you provide to us when requested by IWI.

We do not collect or store sensitive personal data (such as information relating to health, beliefs or political affiliation), of no interest to the association in regard to its constitutional aims.

If you are a volunteer (whether specifically for IWI or if you are helping us for other reasons – for example you work for another organisation which is running an event with us), or if you are taking part in a tour organised by a third party for members, then we may collect extra information about you (e.g., references, details of emergency contacts, medical conditions etc.) as may be necessary for the said event or tour. No such information will be stored.

2. WHERE DO WE COLLECT INFORMATION FROM?

We collect information in the following ways:

Information you provide to us

We may obtain personal information from you directly, for example, when applying for a membership or to be a volunteer, when registering to receive mailings or marketing materials or other information about IWI, when you take part in an event, when you make a donation, when placing an order for goods or to participate in a tour or when you otherwise communicate with us.

Information from third parties

We sometimes receive personal data about individuals from independent third parties, such as organisations that we are affiliated with. You must have given your consent for these third parties to share your information with us, so please check their privacy notice if you have any queries.

Information from your use of our website

IWI may collect information about your use of our website, including pages you visit and how you interact with our content. For further information, see section 11 ‘Cookies and links to other sites’.

Information in the public domain

We may obtain information about you from publicly available sources, such as such as directorships listed on Companies House or newspaper or media articles.

We may also collect information from social media platforms that you use (where you have given us permission to do so), or if you interact with any of our social media.

Information we generate

We may conduct research and analytics on the information we hold, which can in turn generate personal data. See Section 4 ‘How we use your information’ below for more information about how we may generate additional information about you.

Information about children
We do not knowingly request or collect information relating to a child under the age of 18 and will not use such information for fundraising or promotional purposes unless the prior consent of a parent or guardian has been provided.

3. LEGAL BASIS FOR PROCESSING YOUR INFORMATION

Under the GDPR and UK data protection law, we are required to have a legal reason to collect, use and store your personal information. We rely upon the following legal basis to process your personal information:

• When we have your consent (for example, for marketing purposes)
• When necessary for the performance of a contract you are a party to (for example, a membership agreement)
• When necessary for compliance with our legal obligations (for example, where we are required to disclose information for tax or reporting purposes)
• Where necessary to protect your interests or that of another person (for example, if you are injured while attending one of our events); or
• Where necessary for the purpose of a legitimate interest pursued by us or a third party – except where your rights override our legitimate interest.

4. HOW WE USE YOUR INFORMATION

We will use your information to:

• fulfil orders for goods or services you have requested (whether placed online, over the phone or in person)
• create and maintain your membership with us
• invite you to events
• communicate with you, including dealing with your enquiries and requests and to help us respect your choices and preferences (e.g. if you ask not to receive marketing material, we keep a record of this in the members’ data base)
• provide you with information that you have indicated an interest in, for example information about our campaigns, volunteering, fundraising and trading activities, and how you can donate to us
• manage donations
• provide you with information on the aims and pursuits of IWI
• conduct research and perform analytics including membership satisfaction surveys
  • customise and tailor our communications so they are relevant to you
  • for marketing purposes, with your consent (see below for more information on marketing and communication preferences)
• personalise the way our website is presented when users visit it, to make improvements to our website and to ensure we provide the best service for users
• for our general administrative purposes, including maintaining the database of our members, supporters and volunteers.

We may share information with:

• hosts of the World Canal Conference
• third parties we use to help operate our business and deliver our services e.g. Stripe, PayPal, Zoom; however, under their own rules these providers do not share with us confidential information that you give them for the purpose of payment or participation in online events.

Our marketing practices

Marketing does not just mean offering things for sale, but also includes:

• news and information about our campaigns;
• IWI benefits and offers;
• volunteering opportunities and how you can help us fulfil our aims;
• appeals;
• our events, activities;
• products, services and offers (our own, and those of third parties which may interest you)
• leaving a legacy;
• taking part in projects.

IWI asks its supporters to “opt in” to receive most communications from us. This includes all our marketing communications. This means you’ll have the choice as to whether you want to receive these messages and be able to select how you want to receive them (post, phone, email). This does not mean that all messages will be available or delivered in all formats. 

You can decide not to receive communications or change how we contact you at any time by:

• contacting datacontroller@inlandwaterwaysinternational.org or
• using the ‘unsubscribe’ link in emails

Please note that the World Wide Waterways magazine is sent to all our members (unless you specifically ask us not to) and you can choose to unsubscribe from general marketing communications without giving up your subscription. However, please be aware that our member magazine pack may include advertisements.

If you have opted-in to marketing, we may contact you with information about our partners, or third-party products and services, but these communications will always come from IWI and are usually incorporated into our own marketing materials (e.g., advertisements in magazines or newsletters). The only exception is the annual World Canals Conference, held under the aegis of IWI, where successive hosts are deemed to be included in your “opt-in” choice for receiving marketing materials. If you opt in for IWI marketing materials but do not wish to be contacted by WCC hosts, we undertake to notify the hosts accordingly. We understand that your wishes may change from one WCC to the next, and will always act on your instructions.

Our research and analytics practices

We evaluate, categorise and profile personal information in order to tailor materials, services and communications (including targeted advertising) and prevent unwanted material from filling up your inbox. This also helps us understand our members, supporters and volunteers so that we can improve our organisation and carry out research.

We analyse our supporters to determine common characteristics and preferences. We do this by assessing various types of information including your interactions with us (e.g., previous responses) or demographic information (e.g. location). By grouping people together on the basis of common characteristics, we can ensure that group is provided with communications, products, and information which is most important to them. This means we aren’t wasting resources on contacting people with information which isn’t relevant to them.

You can opt out of your data being used for profiling by contacting datacontroller@inlandwaterwaysinternational.org

5. WHO WE SHARE INFORMATION WITH

IWI may share your personal information with our vendors and suppliers who we engage to process data on our behalf, and only where necessary in support of the goods, services and communications we provide to you. We require all vendors and suppliers maintain at least the same level of privacy and security standards as IWI.

Occasionally, where we partner with other organisations, we may also share information with them (for example, hosts of the World Canals Conference, or if you register to attend an event being jointly organised by IWI and another organisation). We’ll only share information when necessary and we’ll make sure to notify you first. IWI will not sell your personal data to third parties.

We also may need to disclose your information if required to do so by law or as expressly permitted under applicable data protection legislation.

6. HOW WE PROTECT YOUR INFORMATION

IWI understands that many people have concerns about the security of their data. We have appropriate organisational, security and technical measures in place to prevent personal data from being accidentally lost, or used or accessed unlawfully, eg:

• We limit access to your personal data to those who have a genuine business need to access it. Those processing your personal data will do so only in an authorised manner after GDPR training and are subject to a duty of confidentiality.
• If you interact with us online (e.g. via our website, on social media, to make an online payment to us, in surveys or event booking system) those interactions will be conducted in environments protected by SSL encryption technology.
• If you engage in an email exchange with us, whilst we cannot guarantee the security of email communications, your email correspondence will be stored securely on our email and, if appropriate, member filing systems.
• If you make a payment to us online, our third-party payment processors will securely retain and process the information they need to process your transaction, and we will never access your credit or debit card details.
• If you apply for membership, a grant, or a prize using a paper application, it will be scanned into electronic format and stored in a password and firewall protected facility, and the paper copy will be shredded.
• Data files shared by us with any third parties will be password protected.
• Before introducing any new systems or technologies relevant to the processing of your personal data, we will where necessary and appropriate undertake and complete a data protection impact assessment (DPIA) identifying any associated risks.
• When processing any special category personal data, we will anonymise or pseudonymise that data (e.g. by removing identifiers such as names and address and using URNs only) to minimise the damage that a data breach may cause.
• We limit access to your personal data to those who have a genuine business need to access it. Those processing your personal data will do so only in an authorised manner and are subject to a duty of confidentiality.
• We also have procedures to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

7. HOW WE KEEP YOUR INFORMATION UP TO DATE

It is important that we are able to keep your information as up to date as possible so that we can communicate with you and make sure that we are honouring your communication and marketing preferences. We make best efforts to periodically review the accuracy of the records of our members, supporters and volunteers and appreciate you letting us know of any changes to your contact information as soon as possible by notifying datacontroller@inlandwaterwaysinternational.org.

8. HOW LONG WE STORE YOUR INFORMATION FOR

How long we store information

We will only use and store information for so long as it is required for the purposes it was collected for. How long information will be stored for depends on the information in question and what it is being used for.  We may also be required to store data to satisfy legal requirements, for financial audit purposes or to satisfy insurance requirements. Contact data and payment data will be kept for as long as you are a member of IWI and may be kept for at least six (6) years after you cease to be a member (in line with the Statute of limitations) after which period your data may be deleted or anonymised.

If you ask us not to send you marketing emails, we may retain your email address to ensure that we don’t send marketing material to that e-mail address (though we’ll keep a record of your preference not to be emailed). We may also retain your email address for other purposes, such as for administration

We continually review what information we hold and delete or securely dispose of information that is no longer required.

Where we store information

IWI’s main operations are based in the United Kingdom, but we may store information within systems in the United Kingdom and the European Union. In some instances, data may be processed outside these regions, although the data will always be held securely, and we will take steps to ensure that any third-party organisation we engage to process data on our behalf provides an adequate level of protection in accordance with GDPR.

Under data protection laws, we can only transfer your personal data to a country outside the UK/EEA where:

• in the case of transfers subject to UK data protection law, the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) further to Article 45 of the UK GDPR.
• in the case of transfers subject to EEA data protection laws, the European Commission has decided that the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy decision’) further to Article 45 of the EU GDPR.
• there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or
• a specific exception applies under relevant data protection law.

By providing IWI with your personal information, you agree to this transfer, storing or processing at a location outside the United Kingdom and/or the European Union.

9. HOW TO ACCESS, CORRECT OR DELETE YOUR INFORMATION

We want to ensure you remain in control of your personal data. Part of this is making sure you understand your legal rights, which are as follows: 

• the right to confirmation as to whether or not we have your personal data and, if we do, to obtain a copy of the personal information we hold (this is known as a subject access request)
• the right to have your data erased (though this will not apply where it is necessary for us to continue to use the data for a lawful reason)
• the right to have inaccurate data corrected
• the right to object to/restrict your data being used for marketing or profiling

Please keep in mind that there are exceptions to the rights above and, though we will always try to respond to your satisfaction, there may be situations where we are unable to do so.

If you would like further information on your rights or wish to exercise them, please email : datacontroller@inlandwaterwaysinternational.org or write to us at: Data Controller, IWI, The Courtyard, 33 Duke Street, Trowbridge, Wiltshire, BA14 8EA. We have one (1) month to respond.

10. COMPLAINTS

If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office which regulates and enforces data protection law in the UK. Details of how to do this can be found at www.ico.org.uk