Ol Pejeta Conservancy Privacy and Cookies Policy

Effective: May 26, 2022

Ol Pejeta Conservancy understands that your privacy is important to you and that you care about the use of your personal data. We respect and value the privacy of our donors, visitors, employees and supporters; this privacy statement explains what personal data or information we collect from you and from people who visit our website, and how we use it.  We would encourage you to read the information below.

Who are we?

The Ol Pejeta Conservancy works to conserve wildlife, provide a sanctuary for great apes and to generate income through wildlife tourism and complementary enterprises for re-investment in conservation and communities. We are a not-for-profit organisation based in Kenya.

Ol Pejeta Conservancy UK is a Charity registered in England under charity number: 1185926. Our registered address is: Ol Pejeta Conservancy UK, Chapel and York, Unit 12, Lady Cross Business Park, Hollow Lane, Lingfield, Surrey, RH7 6PB.  Ol Pejeta Conservancy UK is a registered Data Controller (ICO registration number ZB289646). c/o Ellacotts Llp, Countryside House, 23 West Bar Street, BANBURY, Oxfordshire, OX16 9SA

Ol Pejeta Conservancy UK aims to promote, for the benefit of the public, the preservation, conservation and protection of Africa’s wildlife and natural heritage. Our activities in the UK enable us to provide Grants to support programmes and projects in Ol Pejeta Conservancy, Kenya. The two organisations work closely together to maximise the benefit to the programmes and initiatives they support, including routing data-sharing between the two organisations.

We will be referred to collectively as ‘Ol Pejeta Conservancy’, ‘we’, ‘us’ or ‘our’ throughout this policy.

What is Personal Data?

“Personal data” is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”) and the Data Protection Act 2018 (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal data means, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

What personal data or information do we collect?

We collect personal data about donors and supporters, visitors, email subscribers, volunteers, employees, contractors, trustees, individuals enquiring about our work, visitors to this website, and our suppliers.  The personal information we collect may include your name, address, email address, IP address, and information regarding what pages you access on this website and when.

How do we collect data or information from you?
We collect personal information about you when you:

• Make a donation to us directly through our website, or via a partner online platform
• Fundraise on our behalf (e.g. through taking part in an event)
• Make an enquiry via our website or via the telephone
• Attend one of our events, online or in person
• Subscribe to our newsletter or email updates
• Sign up for an account on our website
• Make a purchase via our website
• Use our website
• Sign our disclaimer form
• Enquire about volunteering or job opportunity with the organisation
• Work for or with the organisation as an employee, contractor or volunteer
• Exchange business cards with a member of the organisation
• Communicate with us via email

How is your information used?
We collect your personal data or information to operate our charity effectively and to provide you with a high-quality service.  We use your information:

• To build our relationship with you as a donor and manage your donation(s) to us
• To deliver our range of services to you
• To answer enquiries that you make prior to any donation, visit or application
• To process an application to volunteer with us
• To fulfil our obligations as a charity
• To manage the organisation of our events, both online and in person
• To promote our events on social media
• To maintain security of our IT infrastructure
• To share email updates with you, if you have subscribed to receive them.
• To share our newsletter with you, if you have subscribed to receive it.
• To share fundraising campaigns or information about our appeals with you.
• To track payments you make, or payments made to you

We believe that all these purposes are justified on the basis of our legitimate interests in running and promoting the charity, our contractual requirements to deliver services you have requested or purchased from us, and our legal obligations as a charity and responsible business.   The exception is for sending out email marketing or email fundraising activities, which we do on the basis of consent. If you would like to know more, please read below:

• Individual Donors and Supporters
• Fundraising Event Participants
• Event Attendees
• Newsletter / Email update Subscribers
• Job Applicants
• Current and Former Employees
• Current and Former Volunteers
• Suppliers
• Visitors to Ol Pejeta Conservancy, Kenya

Individual Donors or Supporters

We are grateful when you choose to support Ol Pejeta Conservancy through a donation. When you make a donation to the charity, we need to hold the following information about you:

• Name, address and contact information (email and phone)
• Demographic information such as postcode.
• Transaction data, such as donation amount
• Information as to whether the donation is linked to a specific appeal or programme
• Information as to whether you are a UK taxpayer to enable us to claim Gift Aid
• Communication preferences, including consent for SMS messages (where the original donation was made via an SMS appeal)

Note: If your donation has been made via a partner platform (e.g. Globalgiving), we may only receive personal data about you if you have agreed for the information to be shared with us, and this may be limited to your name and email address, linked to the amount you have donated.

We store your information in our CRM Systems: Beacon on secure servers hosted in the UK and Salesforce, on secure servers hosted in the EU. We also use a communications management tool, Campaign Monitor, which uses secure servers hosted in the USA. Communications with you will be stored in our email system, which we use Microsoft Office 365 to manage.

We will retain your personal data for the duration of your time supporting us. We will continue to hold your contact information where you have indicated you would like us to keep you updated about our work and until you tell us you no longer wish to receive such updates. We will also review this data every 2 years to consider deletion based on your levels of ongoing engagement with us. We will retain financial records for 6 years, following the end of the current financial year as required by UK law, for HMRC reporting purposes.

We currently use third-party online tools:

• Online fundraising and donation platforms such as Global Giving, Facebook, Crowdfunding, etc. The platform will vary for each event or fundraising activity, so please read the individual Privacy Policies based on which platform you are using

Fundraising Event Participants

When you sign up to or join us at a fundraising event either run by Ol Pejeta Conservancy or by someone else but in aid of Ol Pejeta Conservancy, we may hold the following information about you:

• Name, date of birth and contact information
• Information relating to your business activities (if relevant)
• Demographic information such as postcode, preferences and interests
• Information relating to you which helps ensure you enjoy the event, such as your dietary or access requirements and including our communications with you
• Billing and payment information
• Donation information
• Photographs of you supporting or participating in fundraising activities

We store your information in our CRM Systems: Beacon on secure servers hosted in the UK and Salesforce, on secure servers hosted in the EU. We also use a communications management tool, Campaign Monitor, which uses secure servers hosted in the USA. Communications with you will be stored in our email system, which we use Microsoft Office 365 to manage.

We may use photographs of you supporting or participating in fundraising activities as part of our email updates and social media communications.

We will retain your personal data for the duration of your time supporting us and for a period of 2 years after our last communication with you. We retain information about your donations for a period of 7 years in accordance with HMRC reporting requirements

We currently use third-party online tools:

• Online fundraising and donation platforms such as Global Giving, Facebook, Crowdfunding, etc. The platform will vary for each event or fundraising activity, so please read the individual Privacy Policies based on which platform you are using or which event you are taking part in.

Event Attendees

This applies to anyone attending one of our events in person or online.

When you attend one of our events in person, we will hold the following information about you:

• Name, and contact information
• Country of residence
• Information relating to the event organisation, such as your dietary requirements.
• Communications with you relating to the event you’re attending
• Invoice and payment information, if relevant to the event you’re attending.

When you attend one of our online events, we will hold the following information about you:

• Name and contact information
• Country of residence
• Information relating to the event organisation.
• Communications with you relating to the event you’re attending
• Invoice and payment information, if relevant to the event you’re attending

We collect this information directly from you when you book onto our event. We also hold joint events with the charity, Helping Rhinos, who host the event and manage bookings. They will share your contact information with us.

We store your information in our CRM Systems: Beacon on secure servers hosted in the UK and Salesforce, on secure servers hosted in the EU. We also use a communications management tool, Campaign Monitor, which uses secure servers hosted in the USA. Communications with you will be stored in our email system, which we use Microsoft Office 365 to manage.

We will retain information about your attendance at our event for the duration of our relationship with you whilst managing the event. We will continue to hold your contact information after the event to keep you updated about our work, and review every 2 years to consider deletion based on your levels of ongoing engagement with us. We will retain financial records for 6 years, following the end of the current financial year as required by UK law.

Helping Rhinos currently use third-party online tools:

• Eventbrite to administer the joint events we host with them. Eventbrite servers are based outside of the UK and European Economic Area (EEA), which means your personal data may be transferred internationally. Eventbrite rely on Standard Contract Clauses pre-signed by the host organisation to make this international transfer. Further details about how Eventbrite use personal data can be found here

Newsletter / e-mail Update Subscribers

As a subscriber to our newsletter or email updates, you will have opted-in to receive the newsletter or email updates, usually via our website or at the point of donating to us. We may hold the following information about you:

• Name, and email address.

We store your information in our CRM Systems: Beacon on secure servers hosted in the UK and Salesforce, on secure servers hosted in the EU. We also use a communications management tool, Campaign Monitor, which uses secure servers hosted in the USA, which means your personal data is transferred to the USA

We will continue to send you the newsletter or email updates until you unsubscribe. If you do unsubscribe, we will retain minimal personal data about you (name and email) within Campaign Monitor to manage our suppression list. The suppression list allows us to check we are not marketing to people who have opted-out or withdrawn consent. We will cross check this list with other records we may hold for you in Beacon CRM or in Salesforce, to ensure your current preferences are recorded consistently across the data systems.

Job Applicants

When you apply for a job with us, we hold the following information about you:

• Name, date of birth and contact information.
• Information relating to your qualifications and experience
• Demographic information such as postcode, education, marital status
• References where we take them up
• Information and documents relating to the review, interview and selection process, including communications with you.

We use Google Drive to store our documents and Microsoft Office 365 to manage our communications with you and our stakeholders, and your information will be stored within those systems. Google uses secure servers in Europe and in the USA, so your personal data may be transferred outside of the UK and EEA. We will retain your personal data for the duration of the selection process. Successful applicants’ personal data is transferred to their employee file. The information relating to the interview and selection process for unsuccessful candidates will be held for 6 months after the interview date and then securely destroyed.

If you are applying for a role with Ol Pejeta Conservancy UK, we may share your data with Edelweiss HR, who provide us with expert HR and recruitment advice, if they are involved in the interview and selection process.

Current and Former Employees

When you work for Ol Pejeta Conservancy, we hold the following information about you:

• Name, date of birth and contact information
• Information relating to your qualifications and experience
• National insurance number and Unique Tax Reference (UTR) for UK employees
• KRA Number, NSSF Number, and NHIF Number for employees in Kenya.
• Demographic information, such as postcode and marital status
• Information and documents relating to your performance and supervision as an employee of the charity
• Information about your emergency contact
• Health information
• Financial information, such as bank details, salary and pension scheme
• Identification documents, such as passport, to help us arrange travel for work on your behalf.
• Your image (on CCTV for Kenyan-based staff)

We use Google Drive to store our documents and Microsoft Office 365 to manage our communications with you and our stakeholders, and your information will be stored within those systems. Google uses secure servers in Europe and in the USA, so your personal data may be transferred outside of the UK and EEA. We will retain your personal data for the duration of your relationship with us as an employee, and for a period of 7 years after any such relationship ends in line with UK employment law.  We retain financial information for 6 years after the end of the current financial year, in line with UK accounting requirements.

UK employees

We will share your information with HMRC, our payroll service provider and our pension provider. In addition, we receive support from Edelweiss HR and there are circumstances when we may need to share your personal data to receive their expert advice, for example, interviewing candidates, performance and appraisal processes or disciplinary procedures.

Kenyan employees

We will share your information with the Kenyan Revenue Authority. Your information will also be stored in a hard copy personnel stored under lock and key in our offices on the Conservancy

Current and Former Volunteers

We also work with amazing Volunteers who provide Ol Pejeta Conservancy with invaluable support. When you apply to be or are a Volunteer for us, we may hold the following information about you:

• Name and contact information (email).
• Information relating to your experience and relevant skills
• Communications with you relating to your volunteering activities

We use Google Drive to store our documents and Microsoft Office 365 to manage our communications with you and our stakeholders, and your information will be stored within those systems. Google uses secure servers in Europe and in the USA, so your personal data may be transferred outside of the UK and EEA.

We will retain your personal data for the duration of your time as a Volunteer with us, and for a period of 6 years after you are no longer wish to / are available to volunteer for us.

Suppliers

When you work with the charity as a supplier, we may hold the following information about you:

• Name and business contact information.
• Information relating to your business activities
• Information and documents relating to the services or products you offer, including our communications with you.
• Financial information, such as invoices, payments and bank details.

We use Google Drive to store our documents and Microsoft Office 365 to manage our communications with you, and your information will be stored within those systems. Google uses secure servers in Europe and in the USA, so your personal data may be transferred outside of the UK and EEA.

We will retain your information for the duration of our relationship with you and for 2 years after the last purchase we made with you.  We retain financial information for 6 years after the end of the current financial year, in line with accounting requirements.

Visitors to Ol Pejeta Conservancy, Kenya

We welcome visitors from all over the world at Ol Pejeta Conservancy in Kenya. When you visit us, we will collect the following information about you:

• Name, address and contact information
• Country of Residence
• Booking and visit details, such as arrival and departure dates, location on the Conservancy
• Your image, captured via our security cameras (CCTV)
• Photographs of you, if you are happy for our employees to take your photograph
• Information relating to donations made by you whilst visiting us
• Communications preferences, if you want to receive information about us and our work.

We use an Online Ticketing and Booking System to manage bookings to the Conservancy; secure servers are based in the UK.

We store your information in our CRM Systems: Beacon on secure servers hosted in the UK and Salesforce, on secure servers hosted in the EU. We also use a communications management tool, Campaign Monitor, which uses secure servers hosted in the USA, so your personal data may be transferred outside of the UK and EEA

We use Google Drive to store our documents and Microsoft Office 365 to manage our communications with you and our stakeholders, and your information will be stored within those systems. Google uses secure servers in Europe and in the USA, so your personal data may be transferred outside of the UK and EEA.

Ol Pejeta Employees on the Conservancy may ask for your permission to take your photo while you are involved in activities during your visit. We may use these images on our website, social media accounts such as Facebook, Twitter and Instagram to depict the impact of our conservation efforts. If you would like your image erased, then you can request us to do so and the images will be deleted immediately.

Children’s Personal Information

A child, or children’s information, may sometimes be collected via the activities outlined above, or our membership scheme, events, Junior Ranger Programme or other activities appealing to children. Where possible, we seek consent from the child’s parent or guardian before collecting information on children.

Our goal is to ensure that all personal information on children is collected in a secure and safe manner. If you would like us to delete any data on your child or children, you can ask us to delete it and we will do immediately.

Who has access to your information?

We limit access to your personal data to those Employees, Volunteers and third-party processors (see below) who have a legitimate need to know and ensure that they are aware of their duty of confidentiality.

We do not sell or rent your personal data or information to any third party or share your information with third parties for their marketing purposes.

In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

We may pass information about you to other parties as required to provide requested services to you.  For example, we will need to provide information to the venue where we host in person events to manage your dietary requirements.

We may pass your information on to third party service providers for the purposes of completing a task or providing services to you on our behalf. However, we disclose only the personal information necessary to deliver that service and have a contract in place that requires them to keep your information secure and not to use it for other purposes.

We currently use third-party service providers in the following areas of our business:

If any of your personal data are shared with a third party, as described above, we will take steps to ensure that your personal data are handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law, as described above.

Ol Pejeta Conservancy, Kenya and Ol Pejeta Conservancy UK work closely together, so much of the personal data is available to teams in both organisations where they need it to be able to perform their role effectively. The funds raised through Ol Pejeta Conservancy UK directly benefit the programmes run on Ol Pejeta Conservancy in Kenya and there is a data sharing agreement in place between the two organisations to facilitate the transfer of personal data between the two entities. Sharing data this way reduces duplication of effort and ensures that we can co-ordinate our communications with our donors and other stakeholders.

Transfers outside of the UK and European Economic Area

We may store or transfer some or all of your personal data in countries that are outside of the UK and are not part of the European Economic Area (the “EEA” consists of all EU member states, plus Norway, Iceland, and Liechtenstein). These are known as “third countries” and may not have data protection laws that are as strong as those in the UK and/or the EEA. This means that we will take additional steps in order to ensure that your personal data are treated just as safely and securely as they would be within the UK and under our Data Protection Legislation as follows:

• We share your data with external third parties, as detailed in the table above, that are based outside of the UK & EEA. The following safeguards are applied to such transfers:
  • We will only transfer your personal data to third countries whose levels of data protection are deemed ‘adequate’ by the European Commission. More information is available from the European Commission.
  • We use specific contracts with external third parties that are approved by the European Commission for the transfer of personal data to third countries. These contracts require the same levels of personal data protection that would apply under the Data Protection Legislation. More information is available from the European Commission.
  • Where we transfer your data to a third party based in the US additional steps have been taken to ensure your personal data will be treated as securely and safely as it would be in the UK and under the GDPR. We have signed Data Processing Agreements with our data processors based on model contract clauses provided by the European Commission (also known as ‘standard contract clauses’), which impose suitable data protection standards on a contractual basis.
• We collect, store and process data in compliance with the Data Protection Act for data collected in Kenya and or relating to Kenyan data subjects. All Ol Pejeta Conservancy employees with access to personal data are provided with data protection training, so they are aware of their responsibilities to keep personal data safe and secure.

Please contact us using the contact details provided below for further information about the particular data protection mechanisms used when transferring your personal data to a third country.

What are my rights?

Under Data Protection Legislation, you have the following rights, which we will always work to uphold:

• The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the contact details provided at the end of this policy.
• The right to access the personal data we hold about you. The section “How Can I Access My Personal Data?” will tell you how to do this.
• The right to have your personal data rectified if any of your personal data held by us are inaccurate or incomplete. Please contact us using the contact details provided at the end of this policy.
• The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we hold, in certain circumstances. Please contact us using the contact details provided at the end of this policy to find out more.
• The right to restrict (i.e. prevent) the processing of your personal data.
• The right to object to us using your personal data for a particular purpose or purposes.
• The right to withdraw consent. This means that, if we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
• The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data are processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
• Rights relating to automated decision-making and profiling. We do not use your personal data in this way.

For more information about our use of your personal data or exercising your rights as outlined above, please contact using the contact details provided at the end of this policy.

It is important that your personal data are kept accurate and up-to-date. If any of the personal data we hold about you change, please keep us informed for as long as we have those data.

Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.

If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves, however, so please contact us first using the contact details provided at the end of this policy.

How can I update my information?

The accuracy of your information is important to us.  If you change your contact details or if you want to update any of the information we hold on you, you can email us at: dataprotection@olpejetaconservancy.org or by post at: Ol Pejeta Conservancy UK, Chapel and York, Unit 12, Lady Cross Business Park, Hollow Lane, Lingfield, Surrey, RH7 6PB.

How Can I Access My Personal Data?

If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.

All subject access requests can be made in writing, either via email or via the postal addresses shown below, or verbally, either in person or on the phone.

There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.

We will respond to your subject access request within one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data, within that time. In some cases, however, particularly if your request is more complex, more time may be required, up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

You also have the right to lodge a complaint about our processing of your personal data with the UK’s Information Commissioner’s Office and or the Office of the Data Protection Commissioner

Keeping your data secure

The security of your personal data is essential to us, and to protect your data, we take a number of important measures, including the following:

• Limiting access to your personal data to those employees, volunteers and third-party processors with a legitimate need to know and ensuring that they are subject to duties of confidentiality.
• Procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data) including notifying you and/or the Information Commissioner’s Office where we are legally required to do so.
• Adhering to our policies and processes including, physical security, back-up, encryption, access control and password protocols.

Contacting us via email

We use Transport Layer Security (TLS) to encrypt and protect email traffic in line with government standards. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit.

We protect against encrypted attachments, attachments with scripts, and anomalous attachments types. We identify links behind shortened URLs, scan linked images, and monitor links from untrusted domains

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

Cookie Information for Visitors to our Website

What are Cookies?

Cookies are small text files that are placed on your computer by websites that you visit.  They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

How do we use Cookies?

Cookies provide information about individuals’ usage of the website, which may identify you as the same individual even if we do not know your name, we can identify location, IP address and device information. As such, we make sure you have a choice about the cookies that are placed on your device for our statistical purposes by Google Analytics, which help us to understand more about the ways in which people use our website. We would appreciate it if you opt-in to accept these cookies when the website asks you, as it will help us to improve it over time.

What Cookies do we use?

We use first-party cookies (Cookies set by Ol Pejeta Conservancy) and third-party cookies (cookies set by other providers, e.g. analytics providers such as Google).

Most web browsers allow some control of most cookies through the browser settings.  To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.aboutcookies.org or www.allaboutcookies.org.

Links to other websites

Our website may contain links to other websites run by other organisations. This privacy policy applies only to our website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our website.

In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third-party site and recommend that you check the policy of that third party site.

How Do I Contact You?

To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details for the attention of:

Data Protection Lead: Philippa Beach or Kirstin Johnson
Email address:dataprotection@olpejetaconservancy.org
Postal address: Ol Pejeta Conservancy UK, Chapel and York, Unit 12, Lady Cross Business Park, Hollow Lane, Lingfield, Surrey, RH7 6PB. c/o Ellacotts Llp, Countryside House, 23 West Bar Street, BANBURY, Oxfordshire, OX16 9SA

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated on:

26 May 2022.