Global Legal Action Network Privacy Notice

The Global Legal Action Network (GLAN)  takes the privacy of our employees, beneficiaries, supporters and volunteers very seriously.

GLAN is committed to protecting and respecting your personal information. GLAN is a registered charitable incorporated organisation in England and Wales (registered charity number 1167733), and a registered Charity in Ireland.

For the purposes of this notice: Controller 1, GLAN (UK), is a Charitable Incorporated Organisation (CIO) registered in London. GLAN UK is governed by a Board of Trustees. Controller 2, GLAN (Ireland), is a registered entity with a Board of Directors, those Directors are from the Senior Leadership Team of GLAN UK. Decisions made on behalf of GLAN are made by Controller 1. Data systems contracted to GLAN, such as IT systems, are contracted to Controller 1.

​This policy sets out the basis on which we will process any personal information that we may collect about you as a visitor to our website or premises or as one of our clients, supporters or partners. If we collect your data, we want you to know exactly what we are using it for and to be reassured that we are keeping it securely. If you have a specific query about your data, please send it to info@glanlaw.org and we would be happy to advise you.

UK and EU GDPR Regimes

The UK and EU GDPR regimes are closely aligned in principle but diverge in implementation, especially when it comes to international data transfers—a nuance that creates both operational and legal complexity for organisations working across jurisdictions.

Our contact details

Controller 1:

Name: Global Legal Action Network (GLAN)
Address: 57-60 Lincoln’s Inn Fields, London, WC2A 3LJ, United Kingdom.

Controller 2:

Name: Global Legal Action Network (GLAN)
Address: Irish Centre for Human Rights, University Road, County Galway, Ireland.

Scope of this policy

This policy applies to visitors of our website or premises, our clients, supporters and partners. GLAN has a separate Privacy Notice for Recruitment and Employees.

Your rights 

Under data protection law, you have rights including:

• Your right of access – You have the right to ask us for copies of your personal information.
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact GLAN’s Data Protection Officer direct on trawiczszczerbo@glanlaw.org if you wish to make a request.

The type of personal information that we collect about you 

• Supporters and fundraisers

If you donate to GLAN, sign up to an event or complete a form on the website, we may gather your data. This may include your name, postal address, email address and telephone number, date of birth, payment card details, information about your relationship with GLAN (including your donation history and feedback you have provided to GLAN); information about your professional role, background and interests.

As you sign up to GLAN, we obtain your explicit consent to process data to fulfil the activity you have signed up for or expressed an interest in. Consent is the lawful basis under Article 6(1)(a) UK GDPR.

GLAN will not use your personal information/data for marketing purposes if you have indicated that you do not wish to be contacted. You can change your preferences at any time by contacting us, or by unsubscribing via the unsubscribe option on email newsletters.  

We may need to share your information/data with our partners and associated stakeholders for the purposes of fulfilling the activity you have signed up for or expressed an interest in.  

If you visit our website it will automatically connect some information about you and your visit, including the Internet protocol (IP) address used to connect your device to the Internet and some other information such as your browser type and version and the pages on our site that you visit. As is common with almost all professional websites, our website uses cookies, which are tiny files that are downloaded to your computer to improve your experience. They help us to improve our website and to deliver a better and more personalised service. The type of cookies that are downloaded can be found here. You should also know that we gather general information/data about the use of our website such as which pages are visited the most. We may use this information/data to make improvements to our website. Wherever possible, information/data is anonymised to prevent the identification of individual visitors to our website.

If you exchange emails, telephone conversations or other electronic communications with our employees and other staff members, our information technology systems may record details of those conversations, sometimes including their content.

From time to time, where you have not provided consent, GLAN will use the Article 6(1)(f) UK GDPR lawful basis ‘legitimate interests’. This means that we can process your personal information if we have a genuine and legitimate reason and we are not harming any of your rights and interests. Before doing this, we will carefully consider and balance any potential impact on you and your rights. One example of this may include direct marketing for an area of work related to the initial activity you signed up to.

Supporter information is stored on our secure database, Salesforce.

• Parties involved in our legal casework

For parties involved in our legal casework we may need to process your data to  progress our casework  or to comply with our legal and regulatory obligations and bring and defend legal claims. Our legal basis for the processing of data for legal casework is Performance of a contract.

GLAN does not deliver legal services directly to clients. Instead:

• In the UK, legal services are provided through Bindmans LLP (www.bindmans.com)
• In Ireland, legal work is undertaken by KOD Lyons LLP (kodlyons.ie)
• In the Caribbean, our work is carried out by Justice Chambers (justiciachambers.com)

GLAN maintains formal agreements with each of these partner organisations. Guidance to clients is issued via client care correspondence from the respective legal entities.

Any casework-related documentation handled by GLAN is securely stored within our legal case management platform, Leap.

Whilst we do not proactively seek to collate and process special category data, we accept that special category data may be shared with us during the course of our casework.

If you exchange emails, telephone conversations or other electronic communications with our employees and other staff members, our information technology systems may record details of those conversations, sometimes including their content.

• Others

We may also collect some information from other sources. For example: 

• If we have a business relationship with the organisation that you represent, your colleagues or other contacts may give us information about you such as your contact details or details of your role in the relationship. 
• We may collect information from third party data providers or publicly available sources for anti-money-laundering, background checking or similar purposes, and to protect our organisation and comply with our legal and regulatory obligations.
• We may collect information from third party data providers or publicly available sources for fundraising purposes.

For all those we hold data on:

• We are required to protect our organisation from fraud, money-laundering, breach of confidence, theft of proprietary materials and other financial or business crimes.
• We may from time to time review information about you held in our systems – including the contents of and other information related to your email and other communications with us – for compliance and business-protection purposes as described above. This may include reviews for the purposes of disclosure of information relevant to litigation and/or reviews of records relevant to internal or external regulatory or criminal investigations. To the extent permitted by applicable law these reviews will be conducted in a reasonable and proportionate way and approved at an appropriate level of management. They may ultimately involve disclosure of your information to governmental agencies and litigation counterparties as described below. Your emails and other communications may also occasionally be accessed by persons other than the member of staff with whom they are exchanged for ordinary management purposes (for example, where necessary when a staff member is out of the office or has left GLAN).

How is your personal information/data protected?

We use a secure server when you make a donation or payment via our website and take appropriate measures to ensure that the personal information/data disclosed to us is kept secure, accurate and up to date. We will ensure that your personal information/data is kept only for as long as is necessary for the purposes which it was collected and is securely destroyed in accordance with this notice.

Do we share personal information/data with external parties?

We may pass on your information to our third-party service providers, suppliers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf.  

Examples may include:

• to trusted partners on a specific, case-by-case basis, such as organisations or lawyers on particular casework.
• to your colleagues within the organisation that you represent; 
• to service providers who host our website or other information technology systems or otherwise hold or process your information on our behalf. GLAN’s key service providers and systems are:

• MoorePay an outsourced HR support provider
• AirIT an outsourced IT provider
• Leap a legal case management system
• Salesforce a fundraising database
• Xero our finance accountancy system

A full list is available in the appendix.

• to a person who takes over our organisation and assets, or relevant parts of them.  

In exceptional circumstances: 

• to competent regulatory, prosecuting and other governmental agencies, or litigation counterparties, in any country or territory;  or 
• where we are required by law to disclose. 

When we use third parties, we disclose only the personal information that is necessary to deliver the services. Please be reassured that we will not release your information to third parties for them to use for their own direct marketing purposes unless we are required to do so by law, for example, by a court order or for the purposes of prevention of fraud or other crime.

International Transfers of Personal Data

We may transfer your personal data to countries outside the European Economic Area (EEA) and/or the UK for processing purposes. In such cases, we may rely on one or more of the exceptions under the GDPR/UK GDPR to lawfully carry out these transfers. These exceptions may include, for example, your explicit consent, the necessity of the transfer for the performance of a contract, or the establishment, exercise, or defence of legal claims.

Please note that, currently, we are not relying on formal international transfer mechanisms, such as Standard Contractual Clauses (SCCs) or an International Data Transfer Agreement (IDTA), but we are actively working towards putting such mechanisms in place to ensure that your data is protected in compliance with applicable data protection laws.

We will keep you informed about any significant changes in this regard and update this Privacy Notice accordingly.

Retention and deletion of your information 

We will delete the information that we hold about you when we no longer need it. GLAN does not retain paper files. Electronic files will be deleted using deletion tools or software.  The retention periods are as follows:

Mailing list: Ongoing, until you unsubscribe. There is a clear unsubscribe option on all mailing list communications.

Register of experts: if we have not engaged you within two years of taking your information, we will contact you periodically to seek your consent for continuing to hold your data. 

Casework: If your data is being used for the purposes of casework (for example, if we have collected information about your experiences or if you are a witness), your data will be held for the duration of the case and for a further six years after the conclusion of any legal proceedings, unless there is a public interest in retaining that data beyond six years.  The retention will be kept under review.

​How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at complaints@glanlaw.org. You can also contact GLAN’s Data Protection Officer direct on trawiczszczerbo@glanlaw.org.

You can also lodge a complaint about our processing of your personal information with:

• The  Information Commissioners Office.
• Data subjects covered by EU law may also be entitled to lodge complaints with the data protection supervisory authority in their country of residence.
• As GLAN was established in Ireland, individuals may also complain to the Irish Data Protection Commissioner.

​Contact us 

We welcome questions, comments and requests regarding this privacy statement and our processing of personal information. Please send them to info@glanlaw.org. You can also contact GLAN’s Data Protection Officer direct on trawiczszczerbo@glanlaw.org.

​Changes to this policy 

Any changes we make to this privacy statement in the future will be posted to our website www.glanlaw.org and also available if you contact us. Please check back frequently to see any changes. 

This policy will be reviewed every two years (or sooner if new legislation is introduced)