Introduction

We respect your privacy and are committed to protecting your personal data. We appreciate the trust you place in us when sharing your personal data. The security of that data is very important to us.

This privacy policy aims to provide you with information about how we collect, use and protect your personal data when you visit our websites. It also explains your rights over your personal data and how you can exercise those rights. It is important that you read this privacy policy so that you are fully aware of how and why we are using your personal data.

This privacy policy specifically applies to the way British Institute of Learning Disabilities (BILD) and its affiliates (together known as “The BILD Group”) use personal data through your interactions with us through our websites:

• www.bild.org.uk
• www.bildact.org.uk
• www.restraintreductionnetwork.org

Our websites are not aimed at children and we do not knowingly collect personal data of children.

Who we are

Professor Gerry Simon set up the British Institute of Learning Disabilities (BILD) in 1971 because he was convinced there could be better support in the community for people with disabilities. We have been championing the human rights of people with disabilities ever since.

We work to develop the skills and culture necessary to understand people’s needs and improve their quality of life. Our approach applies a rigorous evidence base, broad expertise and long-standing experience to find and enable both short and long-term solutions that bring about lasting change.

This privacy policy deals with the way the BILD group processes the personal data of website users. The BILD group includes:

• The British Institute of Learning Disabilities (charity number: 1019663; company number: 02804429)
• Bild Association of Certified Training (charity number: 1190461; company number: 11721648)
• Bild Restraint Reduction Network (charity number: 1187984; company number 11741006)

For the purposes of data protection law, each charity within the BILD group is a controller of personal data (the person or organisation that is in charge of the way that it uses your personal data). Each charity is registered with the Information Commissioner’s Office (ICO):

Controller	ICO Registration number
The British Institute of Learning Disabilities	Z7398551
Bild Association of Certified Training	ZA927737
Bild Restraint Reduction Network	ZA927822

Within this privacy policy, we refer to the BILD group as “BILD”, “we”, “us” or “our"

Collection and use of personal data

When we refer to personal data, we mean any information that relates to you that may (either on its own or in combination with other information) identify you.

We may collect and use different kinds of personal data about you when you visit or interact with us through our websites:

Identity and Contact Data: such as title and name, email address, telephone number and postal address.

Biographical Data: information about you such as your job title, company name, business sector, career history, qualifications and references, dietary requirements and other information such as access needs.

Transaction Data: if you make a purchase, we will store details of your payment information, details of the products you have purchased from us, and information relating to delivery.

Technical Data: such as internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
In addition, and in order to ensure that each visitor to any of our websites can use and navigate the site effectively, we collect the following through Google Analytics: time of visit, pages visited, and time spent on each page of the webpages, referring site details (such as the URL a user came through to arrive at this site), type of web browser, type of operating system (OS), Flash version, JavaScript support, screen resolution, and screen colour processing ability and network location .

Profile Data: If you become a member on our website, we will process information about your account, including your username and password, your interests, preferences, feedback and survey responses.

Usage Data includes information about how you use our website, for example how long you spend on a given page.

Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

Certain types of personal data are considered by data protection law as more sensitive than others. Known as ‘special category personal data’, this relates to information about your health, racial or ethnic origin, details of sexual life, sexual orientation, religious beliefs, political opinions, trade union membership, or any genetic or biometric data that is used to identify you.

Occasionally, we may process special category personal data, for example when running an event we collect information about dietary requirements, which may include information about health (allergies) or religion or philosophical beliefs (if connected to your dietary requirements). We only process this type of information where it is necessary and lawful for us to do so. We do not process information about criminal offences and convictions.

Failure to provide your personal data

Where we need to collect personal data by law or in order to perform a contract we have with you and you fail to provide that data when requested, we may not be able to meet our legal obligations or perform the contract we have entered or are trying to enter into with you. For example, failure to provide the requested personal data when placing an order on our website may mean that we are unable to fulfil your order.

How we collect your personal data

We use different methods to collect data from and about you including through:

Direct interactions: We collect personal data that you provide to us, this includes information you provide when you communicate with us (e.g. to contact us or give us feedback), sign up for our email mailing list, place an order, or when you register an account with us.

Automated technologies or interactions: As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns, as explained above. We collect this personal data by using cookies. Please see our cookie policy [LINK] for further details.

Third parties or publicly available sources: We will receive personal data about you from various third parties, including:

Analytics: We may receive technical data from analytics providers such as Google;

• Transactions: If you place an order with us, we will receive data from payment and delivery providers (e.g. to confirm you have paid for your order so we can prepare to send these out to you).

• Contact: If you sign up to our mailing list, we may also receive information from mailing service providers, such as Mailchimp.

Why we process your personal data and our legal bases for doing so

When we collect, use and store your personal data, we will only do so where the law allows us to. Data protection law requires us to have a legal basis for processing your personal data. Depending on the purposes for which we use your data, one or more of the legal bases listed below may be relevant:

• The processing is necessary to perform our obligations under a contract (for example, when you make an order via our website).
• The processing is necessary for compliance with a legal obligation (for example, we pass on details of people involved in fraud or other criminal activity to law enforcement agencies).
• The processing is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests (for example, this may include responding to your queries, carrying out work to improve our website, and carrying out some marketing activities).

We may also rely on “consent” as a legal basis for processing your personal data in limited circumstances. In particular, where you sign up to receive marketing communications from us by email.

In the table below, we set out further information about why we process your personal data and the legal reasons we rely on to do so.

Purpose / Activity	Type of personal data concerned	Lawful basis for processing
To set up a membership account for you on our website	Identity informationContact informationProfile data	Necessary for performance of a contract with you
To process your online orders, including managing delivery, communicating with you about open orders, and collecting and recovering money owed to us	Identity informationContact informationTransaction data	Necessary for performance of a contract with you   Necessary for our legitimate interests (to recover debts due to us)
To manage our relationship with you, including responding to your queries and requests	Identity informationContact information Profile data	Compliance with our legal obligations   Legitimate interests (to follow up with you to ensure requested information meets your needs and to identify further requirements)
To enable you to sign up to our mailing list and receive marketing emails from us	Identity informationContact information Profile dataMarketing data	Consent
To administer and manage our business and this website	Identity informationContact informationTechnical data	Necessary for our legitimate interests (to ensuring our website functions properly, managing IT services and ensuring network security, preventing fraud, running our business effectively, and in the context of reorganisation or restructuring of our business)   Necessary to comply with our legal obligations
To use data analytics and other automated technology to improve our website, products, marketing, customer relationships and experiences	Technical dataUsage data	Necessary for our legitimate interests (to help understand our customer base in order to enhance our product offering, to keep our website updated and working well, to personalise your experience on our website, and to help inform our marketing strategy)
To arrange access to training courses and accreditation programs run by us	Identity dataContact dataBiographical information	Necessary for performance of a contract with you   Consent and explicit consent (in relation to special category personal data)

Disclosures of your personal data

In certain circumstances we may pass your personal data to third parties. We will never pass your personal data unless you have allowed us to do so or we are allowed or required to do so by law. For example, we may share your personal data with:

• Any charity within the BILD group (please see section 2 of this privacy policy for more information).
• Service providers who provide IT, system administration including learning management systems and customer relationship management systems, payment processing, website analytics, logistics, or other services.
• Professional advisers including lawyers, bankers, auditors and insurers.
• HM Revenue & Customs, regulators and other authorities who require reporting of processing activities in certain circumstances.
• Third parties that support us in organising events, preparing case studies, and similar activities connected with our charitable objectives.
• If we sell all or part of our business operations to another organisation, your personal data may be disclosed to the prospective seller or buyer.
• If BILD merges with or is acquired by another charity, your personal data will be transferred to the new owner.

Data retention

In general, we will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for.

Sometimes, however, we may be required to retain your personal data for longer for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may also retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

We continually review what information we hold and will securely delete or anonymise personal data which is no longer required. For further information about how long we store your personal data, please contact us.

Where we store your personal data

Most of your personal data is stored in the UK, however sometimes we need to share your personal data with other organisations operating outside the UK. Whenever we transfer your personal data outside of the UK, we meet the UK GDPR requirements by ensuring that any personal data transferred outside the UK continues to be protected as if it were being held in the UK. We do this by:

• Wherever possible, only transferring to countries with an adequacy decision. This means that these countries provide the same level or a higher level of protection to personal data as we do in the UK.
• If the countries your personal data is being transferred to does not have an adequacy decision, we use one of the safeguarding measures available under data protection law. This includes use of standard contractual clauses[, and the UK-US data bridge]. Where necessary, we also put in place additional measures to protect your personal data such encryption (TLS) and pseudonymisation.

If you would like more information about how we protect your personal data if it is transferred outside the UK please contact [email protected].

Your rights

Data protection law provides individuals with various legal rights, which may be exercised in certain circumstances. You have the following legal rights over your personal data:

• The right of access (commonly referred to as a “subject access request” or “SAR”): This right enables you to obtain a copy of the personal data we hold about you as well as other information about how we are processing your personal data.
• The right to rectification: This right enables you to require us to correct the personal data we hold about you if it is inaccurate or incomplete.
• The right to erasure (also known as the right to be forgotten): In certain circumstances, you have the right to request that personal information we hold about you is erased (such as where we no longer need your personal data for the purpose it was originally collected for).
• The right to restrict processing of your personal data: You may ask us to restrict the use of your personal data in certain circumstances (such as where you believe your personal data is incorrect and we need to verify the accurate of the personal data we hold)
• The right to object: You may object to our processing of your personal data in certain circumstances, such as where we are processing your personal data on the basis of “legitimate interests”. Please note, you always have the right to object to processing of your personal data for direct marketing purposes.
• The right to data portability: This right allows you to request that we transfer your personal data to you or another third party in a commonly used, machine-readable format. Please note, this right only applies to automated information that you initially provided consent for us to use or where we used the information to perform a contract with you.
• The right to withdraw consent: Where we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time, and may do so by contacting us via [Insert email address]. If you decide to withdraw your consent, that does not mean that our use of your personal data before you withdrew your consent is against the law.

Please note, some of your legal rights are subject to safeguards, limitations or exemptions.

If you wish to exercise your rights, please contact us via [email protected] or use the contact information below and we will respond within the time limits set out in data protection law.

Contact us

Any comments, questions or suggestions about this privacy policy or our handling of your personal data should be emailed to [email protected]

Alternatively, you can contact us using the following postal address or telephone numbers:

GDPR Compliance, BILD, 97, Vincent Drive, Edgbaston, Birmingham, B15 2SQ, United Kingdom

Telephone: +44 (0)121 415 6960 or Fax: +44 (0) 121 415 6999. Our telephone switchboard is open 9am–5pm GMT, Monday to Friday.

Complaints

You have the right to make a complaint at any time to the ICO if you are not satisfied with the way we have handled your personal data (www.ico.org.uk).

We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance using the details above.

Changes to this privacy policy

This privacy policy was published on 29 September 2023. We will update and change this privacy policy from time to time to reflect changes to the way we handle your personal data or changing legal requirements. Whenever you visit our website or place an order with us, please check back so that you are aware of any changes.