Privacy Notice

Introduction

This privacy notice (the “Privacy Notice“) describes why and how The Pipeline collects and uses your personal data. This Privacy Notice provides information about your rights as a user of our services as well as a user of our website.

The Pipeline is aware of its legal obligations in relation to your personal data and we are committed to processing your data securely and transparently. This privacy notice sets out the types of personal data that we collect and process about you, how we use that information, for how long we keep it and other relevant information about your data.

Who we are

MK-LF partnership t/a The Pipeline is a controller of your personal data meaning that we determine the purposes for processing your personal data and the way in which it should be processed.

For some of our processing activities, we may act as joint controller with your employer (our “Client“). Where this is the case, we determine why and how we process any of your personal data where we have collected it through a survey you have completed asking questions about diversity and inclusion. In all cases where we are acting as joint controller, all your rights remain the same and we will have entered into an agreement with our Client which clearly sets out the roles and responsibilities of us and our Client.

Our contact details are as follows:

MK-LF Partnership t/a The Pipeline
Victory House, 1st Floor,
99-101 Regent Street,
London W1B 4EZ

Email: admin@execpipeline.com

The contact details of our Clients will be made available to you separately. If you have any questions about whether we act as a joint controller in respect of your data, please contact us using the email address provide above.

Data protection principles

In relation to your personal data, we will:

process it fairly, lawfully and in a clear, transparent way;
collect your data only for specified and specific purposes;
only collect the minimum information we need to meet the purpose;
only use it in the way that we have told you about;
ensure it is correct and up to date;
keep your data for only as long as we need it; and
process it securely, reducing the risk of it being lost or stolen.

What data we collect about you

Personal data means any information capable of identifying an individual. It does not include anonymised data.

We may process certain types of personal data about you as follows:

1. For the purpose of providing leadership programmes and bespoke consulting to our Client:

Identity Data which may include your first name, last name, title, and gender.
Contact Data which may include company and personal e-mail address and telephone numbers.

2. For the purpose of providing diagnostic tools to our Clients:

Survey Data which may include personal data in response to a diagnostic questionnaire collected via The Pipeline’s Genie diagnostic tool (the “GENIE Diagnostic Tool“).

3. From your use of our website:

Technical Data which may include internet protocol addresses, browser type and version, browser plug-in types and versions, time zone operating system and platform and other technology on the devices you use to access the Site.
Usage Data which may include information about how you use our website, products and services.

We may also process anonymised aggregated data from your personal data. As this data does not reveal your identity it is not in itself personal data. If we link the aggregated data with your personal data so that you can be identified from it, then it is treated as personal data.

Where we are required to collect personal data by law, or under the terms of the contract between us and you, if you do not provide us with that data when requested, we may not be able to perform the contract (for example, to deliver services to you). If you don’t provide us with the requested data, we may have to cancel or postpone delivery of services to you. If we do, we will notify you at that time.

Why we process your data

There are six lawful reasons for processing personal data, however, we only rely on four legal bases to process information. These are:

You give consent for us to process your data; or
It is necessary for us to carry out the processing in order to fulfil a contractual obligation with you; or
There is a legal or regulatory obligation on us which requires us to carry out the processing; or
It is in our legitimate interest to carry out the processing.

More specific details about what data we process, the reason we process it and the lawful basis for doing so are provided in the Addendum to this Privacy Notice.

How we collect your data

We collect personal data about you through a variety of different methods including:

1. Direct Interactions:

You may provide personal data by communicating with us by post, phone, email, or otherwise, including when you:
- are nominated as a participant on our programmes by your organisation;
- request information on products and services or marketing material to be sent to you;
- sign up to attending our Alumni or other networking events; or
- accept the invitation from your organisation to complete a diagnostic questionnaire using the GENIE Tool.

2. Automated technologies or interactions:

As you use our site, we may automatically collect Technical Data about your equipment, browsing actions and usage patterns. We collect this data by using cookies, server logs and similar technologies. Please see our Cookie Policy on our website for more information: execpipeline.com

3. Third parties or publicly available sources:

We may receive personal data about you from various third parties and public sources. We may use Identity and Contact Data from publicly available sources such as LinkedIn or Companies House.

Sensitive / Special categories of data

We collect the following categories of “sensitive” (also known as “special”) personal data as part of our GENIE Tool:

ethnicity;
disability;
and sexual orientation.

We must process special categories of data in accordance with more stringent guidelines. Most commonly, we will process special categories of data when you have given explicit consent to the processing. However, we may also process these special categories of personal data where:

the processing is required to carry out our legal obligations
there are reasons of substantial public interest that require us to carry out the processing; or
you have already made the data public.

Special categories of personal data collected through the GENIE Tool are subject to the following basic processing activities:

The raw responses are pseudonymised, anonymised and aggregated by The Pipeline
The pseudonymised and anonymised responses are analysed by The Pipeline; and
The pseudonymised, anonymised and aggregated responses are used to create a tailored report for the relevant Client. This report includes details on the role and development of specific groups of employees within their organisation and the likely need for future change and improvement.

Where we may ask for your consent to allow us to process certain particularly sensitive data, you will have full control over your decision to give or withhold consent and there will be no consequences where consent is withheld. Consent, once given, may be withdrawn at any time by contacting us using the email address provided above. There will be no consequences where consent is withdrawn.

Sharing your data

Your personal data will be shared within The Pipeline where it is necessary for our staff to undertake their duties in provision of services to you or the Client. We also share some of your data with the following third parties:

Our IT suppliers who assist us with providing our services to our Clients. This includes:

- Survey Monkey: our supplier who provides the survey for the GENIE Tool – see privacy notice at www.surveymonkey.com/mp/legal/privacy-policy/; and

- Paperless Post: our supplier who provides us with mailing list management service. See their privacy policy at www.paperlesspost.com/privacy-policy#vendors-and-service-providers.
- Data Consulting: our supplier who helps us to build our dashboard. Visit their website here: http://www.dataconsulting.co.uk/

As your personal data will be stored on our IT infrastructure it will also be shared with our data processors who provide email, and document management and storage services to us. We currently use Microsoft SharePoint for this hosting service. See their privacy policy at https://privacy.microsoft.com/en-gb/privacystatement

We may also share your personal data with third parties as part of a company sale or restructure, or for other reasons to comply with a legal obligation upon us. We will update this Privacy Notice where we appoint any additional third party processors who we share your personal data with.

As your personal data is stored on our IT infrastructure, and shared with our data processors who provide email, and document management or storage service or mail management services to us, it may be transferred and stored securely outside the United Kingdom or European Economic Area. Where this is the case, we or they will impose contractual obligations on the recipients of that data to protect your information to the standard required in the UK or EEA (as applicable). We or they may also require the recipient to subscribe to international frameworks intended to enable secure data sharing. In the case of transfers by us, we may also transfer your information where: (i) the transfer is to a country deemed by the UK Secretary of State or European Commission to provide adequate protection of your information; (ii) where you have consented to the transfer (to the extent permitted by applicable data protection legislation); or (iii) where such transfer is otherwise permissible under data protection legislation.

Protecting your personal data

We are aware of the requirement to ensure your data is protected against accidental loss or disclosure, destruction and abuse. We are implementing processes to guard against such and comply with Cyber Security Essentials Guidelines.

In line with data protection principles, we only keep your data for as long as necessary.

We will retain your personal information for as long as it’s required for any of the purposes described above (e.g. for as long as you are a user of our services and for the duration of our relationship with you)
We will retain personal information for which you have given consent for a period of seven years
We will retain pseudonymised/anonymised data from our diagnostics for a period of three years

Your rights in relation to your data

The law on data protection gives you certain rights in relation to the data we hold on you. These are:

The right to be informed: this means that we must tell you how we use your data, and this is the purpose of this Privacy Notice.
The right of access: you have the right to access the data that we hold on you. To do so, you should make a subject access request to our email provided above.
The right for any inaccuracies to be corrected: if any data that we hold about you is incomplete or inaccurate, you can require us to correct it but emailing us with details of inaccuracy and desired change.
The right to have information deleted: if you would like us to stop processing your personal data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it.
The right to restrict the processing of the data: if, for example, you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct.
The right to portability: you may request that we support you in transferring any personal data that we hold on you for your own purposes.
The right to object to the inclusion of any information: you have the right to object to the way we use your data where we are using it for our legitimate interests.
The right to regulate any automated decision-making and profiling of personal data: you have a right not to be subject to automated decision making in way that adversely affects you. We do not carry out automated decision making in respect of your personal data.

Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, withdrawing your consent will not affect the lawfulness of the processing conducted before withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.

If you wish to exercise any of the rights explained above, please contact the details set out above.

How to complain

We hope that you won’t ever need to, but if you do want to complain about our use of personal data, please send an email with the details of your complaint to admin@execpipeline.com. We will look into and respond to any complaints we receive as soon as possible.

You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work or the country in which an alleged infringement of data protection law has occurred within the EU. The Information Commissioner’s Office (“ICO”) is the UK data protection regulator/supervisory authority. For further information on your rights and how to complain to the ICO, please refer to the ICO website. We strive to meet the highest standards when collecting and using personal information. Complaints are taken very seriously, and data subjects are encouraged to bring any issues to our attention.

We recognise that transparency is an ongoing responsibility, so we will keep this Privacy Notice under regular review.

This Privacy Notice, Version Number: 2.0 was last updated in June 2022.

ADDENDUM – the data we hold and basis for processing

Data	Purpose	Legal Basis
Identity Data	To process and deliver your services.	Contract Legitimate interests* Consent
Technical and Usage Data	To use data analytics to improve our website, products/services, marketing, customer relationships and experiences.	Legitimate interests*
Contact Data	To allow programme joining instructions to be sent to delegates. To contact you about changes to our products and services. To send details of products and services that you have requested via the website. To provide thought leadership pieces on topics relating to gender equality. To maintain contact for purposes of group networking.	Legitimate interests*
Survey Data	To create confidential Client Reports on diversity and inclusion considerations within the relevant Client’s Business	Consent

* Where we rely on legitimate interests, those legitimate interests are: (i) to ensure that our matters are well-managed; (ii) to measure the impact of particular factors such as education or ethnicity on experience and barriers in the workplace; (iii) to protect our business interests; (iv) to evaluate, develop or improve our services; or (v) to keep our clients informed about relevant services.