ILM (“us / we”) staff, its Directors and corporate partners, respect the privacy of every person who visits or subscribes to our website or training (“you”) and we are committed to ensuring a safe experience. This privacy statement outlines the personal data we may collect about you and how we may process it. This privacy statement also tells you about your rights to control this data.
Responsibility for your data
ILM is subject to the General Data Protection Regulation and the Data Protection Act 2018. We are registered with the Information Commissioners Office as a Data Controller (ZA154905).
Why we collect data:
We collect, store and process personal data for the following purposes:
- Enquiries to ILM.
- Services we provide to our customers via our membership offer (for example, to send postal training course materials, to allow opt-in to our text messaging service, or to enable us to share training resources with members).
- Staff and consultants related information (for example for payroll and HR records).
- Delivering and maintaining our training and skills development services.
- Potential participants on our training events as well as those who have attended.
- We will only collect data we need to give you a better experience; to improve and deliver our services to you; and to meet our responsibilities to you.
How we use personal data:
Please note that legacymanagement.org.uk (“this site”) might contain links to external sites or services from third parties. This privacy statement does not cover the activities of such third parties. You should consult those third party sites’ privacy policies for information on how your data is used by them. ILM does not share any personal contact details to any organisation and will not do so in future without asking you for a specific opt-in to that scheme.
What personal data do we collect?
- Attendees on our webinars and training events: we collect personal data such as name, contact details, job title, organisation, email address for the purposes of fulfilling our services.
- We collect personal data such as your name, organisation and email address in order to reply to your query. This information may be used in conjunction with information we hold against any services that you have signed up for (such as but not limited to, those listed above) where it is appropriate to helpfully reply to your enquiry. This information is used to administer and deliver to you the support you have requested, to operate our sites efficiently and improve our service to you, and to retain records of our business transactions and communications..
Trading in personal data
Some of your personal data may be collected and processed with the intention of providing it to other named organisations who may need to process your data (for example, when registering for CICLA or a revision class, which is run in collaboration with the University of Law). Your personal data will not ever be shared with a third party organisation who is not an ILM data processor, nor will any of our corporate partners contact you directly without your consent.
Public forums, message boards and blogs
Our site may sometimes use message boards on blogs and users can participate in these facilities. Any information that is disclosed in these areas becomes public information and you should always be careful when deciding to disclose your personal information.
Our legal process for processing personal data
Under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, organisations are required to have a legal basis for processing personal data. The legal bases we use for processing data are:
- Legitimate interests for the purposes of fulfilling our activities and the provision of our services (ie via our newsletter and other communications).
- Contractual basis for the purposes of fulfilling our obligations to the University of Law or other training delivery partner.
- Consent when people opt into further mailing lists or groups.
We will only send you further information about the partners involved in delivering our specific services, if you have actively participated in a training session with that partner, or if you receive our newsletter where such information may be shared with you. Individuals signed up to receiving newsletters, can withdraw their consent at any point by contacting us, or the relevant partner organisation concerned.
How long do we keep data?
- Personal data that you have submitted as part of an enquiry to us is archived after one calendar year except where they result in a purchase in which case they are retained longer as part of our financial records
- Lapsed or cancelled memberships and all associated data is stored but not used and will be deleted after one calendar year (to allow for intended renewals).
- Unless you are an active ILM member, or you consent to hearing from us about our services, we will not store and retain your personal data beyond the above timeframes.
- If you are an active ILM member we will retain your personal data for as long as you remain at this status.
Collection of personal data
Our primary goal in collecting personal data from you is to give you a fulfilling membership experience whilst allowing us to provide services and features that most likely meet your needs. We only collect personal data from you through data inputted through enquiry forms (if submitted), newsletter subscriptions (if joined) and site usage data. We do give you the option to access our sites’ homepages without subscribing or registering or disclosing your personal data.
Under the GDPR and the Data Protection Act 2018, you have the following rights:
- Right to be informed. This Policy provides you with information in relation to how your data is processed. This ensures that we are transparent about what we will do with the information you supply to us.
- Right to object to the processing that is likely to cause you damage or distress. Where you challenge the accuracy or lawful processing of your information, we will consider this.
- Right to receive an electronic copy of any information you have consented to us holding. You can ask us to provide you with the personal data about you we hold, securely and in a readable format. This is called a subject access request and we will need to verify your identity before giving such information.
- Right to object. We will ensure that we have the right consents in place for sending you information. You can unsubscribe from our mailings and remove your details at any time. If you wish to stop receiving communications from us, you will be able to do so by contacting our Data Protection Officer (email@example.com)
- Rights related to automated decision making. If there is additional profiling based on the information we hold, then you can object to us making decisions about you based on such processing.
You can make a request at any point by email to firstname.lastname@example.org. We will respond to a request within one month of receipt. However, where a request is received to erase data, we may not be able to delete all data (for example where data is linked to financial transactions that must be kept for a set period of time under financial regulations).
Data storage and transfers
Your personal data is stored on ILM secure platforms only. If we share your personal data with any named service provider in the course of providing you with our services, those third parties are also required to process your data in accordance with contracts which comply with current data-protection legislation.
We may disclose your personal data to other third parties, including, without limitation, governmental or State institutions or regulatory authorities, where necessary in order to exercise or defend legal rights or where required by law. We may transfer, sell or assign any of the information described in this policy to third parties as a result of a sale, merger, consolidation, change of control, transfer of assets or reorganisation of our business.
Confidentiality and security of your personal data
We are committed to keeping the data you provide us secure and will take reasonable precautions to protect your personal data from loss, misuse or alteration. The transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features described above to try to prevent unauthorised access.
All our employees, contractors and data processors (i.e. those who process your personal data on our behalf, for the purposes listed above), who have access to, and are associated with the processing of your personal data, are obliged to keep the information confidential and not use it for any other purpose than to carry out the services they are performing for us in line with the standards set out in the GDPR.