Investment Privacy Notice.
Introduction
Global Innovation Fund (“GIF”, “we”, “our”, “us”) is committed to protecting and respecting your privacy.
We invest in the development, rigorous testing, and scaling of innovations targeted at improving the lives of the world’s poorest people. We use personal information in the course of our investments (whether through grant funding or investment into a company or project). This includes information about the senior leadership team of a prospective or current investee (a company or organisation), key individuals (for example, experts) involved in a particular project, and even beneficiaries of our investments. We refer to these individuals as Investee People.
If you are GIF staff, or if you work with us in another way (for example, as an external reviewer under a contract), then please note that the Staff Privacy Notice will apply to the processing of your personal information. This can be requested from: [email protected].
The purpose of this notice is to give Investee People information about:
- what personal information we collect
- sources of personal information
- how we use your personal information (and the legal grounds for our use)
- who we share your personal information with
- when and where we transfer your personal information internationally
- how we keep your personal information safe
- how long we keep your personal information
- your rights in respect of your personal information
- who we are and how to get in touch.
This notice sets out the basis on which we will process your personal information. Please read this notice carefully so that you understand your rights in relation to your personal information.
This notice may be updated from time to time. We will post any revised notice on our website and will make reasonable efforts to provide you with a revised notice if we make any substantial updates. It is important you read this notice, so that you are aware of how and why we are using your personal information.
For information about who we are and how to get in touch with us, see section 9 at the end of this notice.
- What personal information we collect
When we use the phrase personal information in this notice, we mean any information that relates to you or could be used to identify you. At its simplest, this could be your name and your job title. Personal information will also include any information provided in background checks that we run on you, as well as any feedback about you that we receive in relation to an investment.
As part of the assessment process, the personal information we collect includes (but is not restricted to):
- Personal details: name, contact details (address, email addresses, phone numbers), gender, and passports (if we run a background check – see below for more information about these checks).
- Relevant expertise: records of education and experience which are relevant to the investment.
- Relationship with applicant: role or job title at the applicant, contract (if an independent contractor), years of service with the applicant, salary information (if relevant to the investment).
- Information from background checks: information provided by third party agencies who run background checks in relation to fraud, sanctions and politically exposed people. We run these checks depending on the circumstances, but can be run on key shareholders or funders, directors or trustees, key partners, and senior leadership staff of applicants.
- Opinions and findings of external assessors: opinions from external experts we use to assess the potential for applicants.
- Information provided by applicants: applicants may provide additional information in support of their case for the potential investment. This may include information about the diversity of the applicant’s staff, for example.
During the administration of our investments, the personal information that we collect and use includes (but is not restricted to):
- The personal information identified in the paragraph above in relation to successful applicants.
- Reports from investees: any personal information provided in reports from investees, for example an update about the staffing for a particular project tied to an investment.
- Information about any incidents: In the rare case of an incident arising with an investment (for example, allegations of fraud or other misconduct), the investee may provide us with information that includes the personal information of those individuals involved.
- Promotional material: any personal information (for example, photographs and testimonials from beneficiaries) provided by an investee to GIF.
Certain types of personal information are sensitive and need more protection. For example, information about your race or ethnic origins, political opinions, sex life or sexual orientation, religious beliefs, health information, biometric and genetic data. There are also special rules about the use of criminal information (information about criminal convictions or allegations about criminal convictions).
We will not usually collect these types of personal information about you. We will only process these types of personal information about you if we have a valid reason for doing so and only if the law allows us to do so. One example is that we may receive this information in response to background checks on a member of the senior leadership team of an applicant. We consider it is necessary to carry out such background checks to protect the public against dishonesty, seriously improper conduct or mismanagement of a body or association.
Please note that the provision of certain personal information to us is necessary for us to assess whether or not we will make or continue to make an investment. If an applicant or investee does not to provide us with this personal information, we may not be able to proceed with the investment.
2. Sources of personal information
Because of the nature of our investments, we do not normally collect personal information directly from the Investee People. Most of the personal information we collect and use comes from third party sources, which we have listed below:
- Investees: the majority of your personal information is provided by potential investees during our assessment of potential investments, and the administration of successful investments.
- Publicly available sources: for example, we may review the Twitter and Linked In accounts of members of the senior leadership of potential investees.
- Background check services: as part of the due diligence process in our assessment of potential investees.
- Providers of sanctions and “politically exposed persons” screening lists.
3. How we use your personal information
Legal bases
We will only use personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
- where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. For example, GIF has a legitimate interest in processing personal information to assess the prospects of success for proposed investment projects.
- where it is necessary to comply with a legal obligation on us (for example, fraud reporting obligations and reports to the Charity Commission).
Purposes of processing
We process personal information for the following purposes:
- Assessing potential investments: we have a multi-stage assessment process which involves due diligence, internal analysis of the prospective investee and external expert input. For more about the application process, see our website.
- Administration of our investments: this includes monitoring the performance of the investees (whether through reports provided by the investees or audits), addressing any incidents which arise in relation to the investment, payment of the investment and ending the investment.
- Operations: this includes allocating charity resources, strategic planning, project management, business continuity, compilation of audit trails and other reporting tools, maintaining records relating to our activities, budgeting, financial management and reporting and communications and IT systems.
- Reporting to stakeholders: GIF is funded by a number of donors and we have reporting obligations about our use of resources, use of donor funds and the impact made by the use of donor funds.
- Compliance: complying with legal and other requirements, such as record-keeping and reporting obligations, conducting audits, compliance with government inspections and other requests from government or other public authorities, responding to legal process such as subpoenas, pursuing legal rights and remedies, defending litigation and managing any internal complaints or claims, conducting investigations and complying with internal policies and procedures.
- Promotion of GIF: this includes promotion of our investments through case studies on our website, press releases and other public releases of information, interviews with media organisations and other promotions of GIF. This also includes fundraising undertaken by GIF, for example in the development and presentation of funding proposals to potential donors (where possible, the information included in our funding proposals is anonymised).
There may be more than one purpose for which we wish to use your personal information in any particular circumstance. For example, if you are a member of the senior leadership team of an applicant we may use your personal information to assess the investment, and then we may continue to use your personal information in order to then administer that investment.
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purposes. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.
4. Who we share your personal information with
GIF operates as part of a wider group of organisations. This includes non-profit, wholly-owned subsidiaries in the US and Kenya and our UK subsidiary, GIF Growth. We share personal information within our group where necessary for the purposes set out above in section 3.
We also share personal information with the relevant investee (or prospective investee) where appropriate. For example, when we provide feedback as part of the assessment process.
We share your information with selected unaffiliated recipients. These categories of recipients include:
- Partners: these include co-investors, who might also support an applicant project;
- Reviewers/Assessors: experts who help us to assess the investment application and the prospects of success;
- Professional Advisors: accountants, auditors, lawyers, insurers, bankers, and other outside professional advisors in all of the countries in which GIF operates;
- Service Providers: companies that provide products and services to GIF, such as IT infrastructure providers and contractors we use to support our operations;
- Background check agencies: for example, credit reference agencies or Know Your Customer agencies;
- Stakeholders: our donors, that provide GIF funding for the purposes of grants and investments.
- Public and Governmental Authorities: entities that regulate or have jurisdiction over GIF (and the GIF group), such as regulatory authorities, public bodies, and judicial bodies, including to meet national security or law enforcement requirements; and
- Third Parties in Corporate Transactions: in connection with any proposed or actual reorganisation, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of GIF’s organisation (including in connection with any bankruptcy or similar proceedings).
5. When and how we transfer your personal information internationally
The information that we collect from you will be transferred to and stored at/processed in the UK, the European Economic Area (EEA), United States and, if applicable to your funding application, other relevant countries outside the above.
Some of these countries have a lower standard of protection for personal information. Where your personal information is transferred, stored, and/or otherwise processed outside the UK or EEA in a country which does not offer an equivalent standard of protection to the UK or EEA, we will take all reasonable steps necessary to ensure that the recipient implements appropriate safeguards designed to protect your personal information. For instance:
- Privacy Shield: This is where recipients in the US confirm that they comply with the principles of the US Department of Commerce’s EU-US Privacy Shield. For more information about the EU-US Privacy Shield Framework, visit the U.S. Department of Commerce’s Privacy Shield Website.
- Standard Contractual Clauses: This is where we enter into agreements with recipients using the standard contractual clauses approved by the European Commission for the protection of your information.
Our staff also operates from around the world, from the UK to the US and beyond. We have systems, policies and training in place with our staff, which helps make sure that your information continues to be protected to a high standard. We also have in place intra-group agreements which include the Standard Contractual Clauses.
6. How we keep your personal information safe
GIF takes reasonable technical and organisational measures to safeguard your personal information against loss, theft and unauthorised use, access or modification.
We will, from time to time, host links to and from the websites of our affiliates or third parties. If you follow a link to any of these websites, these websites will have their own privacy policies and we do not accept any responsibility or liability for these policies. Please check these policies before you submit any information to those websites.
7. How long do we keep your personal information
We will keep your personal information only for as long as required in connection with the purposes for which it was collected and/or is used. For example:
- For investments, we will keep the information for 6 years following the end of the investment or 12 years if the investment documentation includes a Deed (except for background check information which will be deleted once the investment comes to an end).
- For unsuccessful applications, we will keep limited personal information for six months following the application decision (except, for example, background check information, which will be deleted following the decision to reject the application). This is to allow us to keep track of application trends.
- For incomplete applications, we will send you a reminder to complete your application and, if the application remains incomplete, we will delete all personal information three months after the reminder
We may also retain information for longer periods where we are required to do so in accordance with legal or regulatory requirements, such as tax and accounting.
In specific circumstances we may also retain your personal information for longer so that we have an accurate record of your dealings with us in the event of any complaints or challenges.
If you would like further information about this, please contact us using the details at section 9.
8. Your rights
When we use your personal information you have the right to:
- Ask us for confirmation of what personal information we hold about you, and to request access to a copy of that information. If we are satisfied that you have a right to see this personal information, and we are able to confirm your identity, we will, except where an exemption applies, provide you with this personal information.
- Request that we erase the personal information we hold about you, as far as we are legally required to do so.
- Ask that we correct any personal information that we hold about you which you believe to be inaccurate.
- Object to the processing of your personal information where we: (i) process on the basis of the legitimate interests ground; (ii) use the personal information for direct marketing; or (iii) use the personal information for research purposes.
- Ask for processing of your personal information to be restricted if there is disagreement about its accuracy or legitimate use.
There are other rights which are unlikely to apply to our use of your personal information. For example, the right to ask for the provision of your personal information in a machine-readable format (the data portability right) to either yourself or a third party, provided that the personal information in question has been provided to us by you, and is being processed by us: (i) in reliance on your consent; or (ii) because it is necessary for the performance of a contract to which you are a party; and in either instance, we are processing it using automated means.
In the event that we rely on consent as the legal basis to use your personal information, you have a right to withdraw your consent at any time.
If you have any questions about how we process your personal information, please feel free to get in touch via [email protected].
Please note that you also have the right to lodge a complaint with the relevant data protection supervisory authority. For example, in the UK this is the Information Commissioner’s Office at www.ico.org.uk/concerns.
9. Who we are and how to contact us
Global Innovation Fund is a company limited by guarantee and a registered charity established in the United Kingdom with a registered office at 8 Devonshire Square, London EC2M 4PL. Our company number is: 09223487 and our registered charity number is: 1171353.
Questions, comments and requests regarding this notice are welcomed and should be addressed to [email protected].