This Privacy Notice describes how we collect and use personal information about you in accordance with the

UK Data Protection Act & General Data Protection Regulation (GDPR). In the context of this document we will either refer to you as, ‘you’ or the ‘data subject’.

Something Collective Ltd is registered with the Information Commissioners Office (registration number ZB594917).

If you have any questions about this privacy notice or our data protection practices, please contact us on the details in section 11.

In all instances, we work with (or on behalf of) another organisation (referred to as the ‘Primary Agent’ in this document) to communicate and engage with community members, collect their insight and opinions and provide information about projects relating to the built environment, public places, housing, transport, and infrastructure. This information helps Primary Agents gain insights on community opinions, sentiments and feelings and make more informed decisions as a result. It is in that capacity that we collect, process, and manage personal data.

Personal data is information that relates to an identified or identifiable individual. If it is possible to identify an individual directly from information, then that information may be personal data.

In some instances, for the purposes of the General Data Protection Regulation, we are the data processor because we process personal data on behalf of the Primary Agent and we make no decisions how and why personal data is processed. Where Something Collective acts as the data processor on behalf of the Primary Agent, the data controller (the Primary Agent) will use the information gathered for purposes specified in their privacy policy.

In all other instances, for the purposes of the General Data Protection Regulation, we are a joint data controller because we work jointly with the Primary Agent to make decisions about how and why personal data is processed. In these instances, we will process personal data in line with the policies set out in this privacy policy and the data controller (Primary Agent) will use the information gathered for purposes specified in their own privacy policy.

In all instances, we only collect and process data where necessary and to fulfil our legal responsibilities, our responsibilities to you and our responsibilities to the Primary Agent. The personal data collected is never used for any other purpose.

In all instances, it is our responsibility to make it clear who the Primary Agent is (the organisation we are working with or acting on behalf of to collect your personal data.

We may collect, use, store and erase the following kinds of personal data about you:

• Identity Data (including name, postal address, email address, phone number)

• Age group

• Ethnicity

• Employment status

• Housing status

• Your relationship to a geographical area or project

In some circumstances, we may collect Special Categories of Personal Data about you (this is defined by GDPR as your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data).

Special category data includes personal data revealing or concerning the above types of data. This data is anonymised and collected by Something Collective on behalf of the Primary Agent for statistical purposes only to ensure equality of opportunity or treatment. You are under no obligation to provide special category data and have a right to withdraw consent for it to be processed.

You should be aware that responses you might give to some questions we may ask as part of an engagement process may reveal or concern special category data and you should be aware of this when providing responses. However, we will generally only explicitly ask for and collect special category data relating to:

• Health, to understand how physical interventions in public spaces or the built environment may affect people with certain health conditions or physical or non-physical impairments.

• Racial or ethnic origin, to understand how physical interventions in public spaces or the built environment may affect people of a certain racial group or ethnic origin.

We also collect information about your opinions relating to the built environment, public places, transport, housing, and infrastructure. This information is used for qualitative and quantitative analysis and is associated with your name, email address and location (in certain circumstances). This information is used to address your specific aspirations or concerns for a project and is aggregated to provide statistical insights on broad community sentiments, aspirations and concerns about a specific project or area.

We may use your personal data for the for the following reasons:

• To carry out statistical, qualitative and quantitative analysis of opinions, insight and demographic information.

• To respond to any enquiry or communication that you make where a response is requested or required.

• To ensure we are engaging effectively with the local community, that information captured is representative of the area, and that we are providing equal opportunities for engagement. Contacting you / sending information in relation to the consultation/engagement process, where you have provided consent for this activity.

Your data may be collected in paper form or via an online form or platform.

In all instances, when you provide personal data (such as through a paper questionnaire, online form, email, or telephone) which is then processed by Something Collective, you will be asked to 'opt-in' to receiving future communications, giving you control over how your personal information is used. This information will be held for as long as your personal information is held, to ensure that your personal information is used in an appropriate manner.

You can withdraw your consent at any time by contacting dataprivacy@something-collective.com and we will delete your details from our systems.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, partners, and Primary Agent representatives, who are associated with the project/process which the data was provided for. They will only process your personal data on our instructions (and with your permission), and they are subject to a duty of confidentiality and the laws & regulations managing Personal Data.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will keep your data for so long as there is a requirement to process the data, once this requirement has ceased, either at your request or otherwise, we will delete your records from the system.

Your data will not be transferred by us to any other country.

At any point while we are in possession of, or processing your personal data, you, the data subject, have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you.

• Right of rectification – you have a right to ask for data that we hold about you that is inaccurate or incomplete to be corrected.

• Right to be forgotten – you can ask for the data we hold about you to be erased from our records. If there is no overriding legal reason to keep it.

• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.

• Right of portability – you have the right to have the data we hold about you transferred to another organisation.

• Right to object – you have the right to object to certain types of processing.

• Right to object to automated processing, including profiling – You have the right to ask for certain important computer-made decisions (including profiling) to be challenged and to ask for a human to intervene. (Please note that at this time no automated processing of Personal Identifiable Information (PII) is in operation). In the event that Something Collective refuses your request under rights of access, we will provide you with a reason as to why.

You have the right to complain as outlined in section 11 below.

In the event that you wish to make a complaint about how your personal data is being processed by Something Collective, or how your complaint has been handled, you have the right to lodge a complaint directly with Something Collective’s Data Privacy Manager, by emailing dataprivacy@somethingcollective.com or by sending written correspondence using the contact details below.

If you are not satisfied with the way that we treat your personal information, you have a right to lodge a complaint to the national supervisory authority. In the UK this is the Information Commissioners Office (ICO). The recommended method of communication to the ICO is via their website (https://ico.org.uk/).

Our details

Something Collective

Third Floor, 52 Tabernacle Street,

London, EC24 4NJ

dataprivacy@something-collective.com

Supervisory Authority

Information Commissioners Office (ICO)

Wycliffe House Water Lane Wilmslow

Cheshire SK9 5AF

https://ico.org.uk/global/contact-us/email/

https://ico.org.uk/concerns/

If you wish to exercise your rights in respect of data controlled by any Primary Agent or any of their partners, you should check their respective privacy policies for details on how to do this directly with them.