Caribou Digital Privacy Policy

Overview

This policy provides details on how Caribou Digital (UK) Limited (“Company”; “we”) may collect, store, use, and share user (“you”; “your”) information, which may include personal data or confidential or commercially sensitive information. 

Caribou Digital (UK) is a Limited Company registered in England and Wales with registered number 09241564 and registered offices at 56 Echo Barn Lane, Wrecclesham, Farnham, Surrey, GU10 4NF. We are committed to protecting and respecting your privacy.

Caribou Digital is registered as a data controller in the Data Protection Register of the UK Information Commissioner’s Office (ICO) with registration number ZB053921, and a registered data processor of the Kenya Office of the Data Protection Commissioner with registration number 325-018A-98DD.

We conduct a range of activities that may result in the collection, processing, and storage of personal data, including:

  • Primary research, such as interviews or surveys
  • Fund management and grant administration
  • Learning partnerships and impact evaluations

This policy is written to comply with both the General Data Protection Regulation (EU 2016/679), (“GDPR”) and the UK Data Protection Act 2018 (“UK GDPR”).

Type of information we collect about you and how it is collected

We may collect personal data including your name, email address, postal address, and landline or mobile number. We may collect this personal data when:

  • You participate in a research study, including interviews, focus groups, or surveys, and provide personal information as part of that study.
  • You apply for a grant or other funding award through a program we manage with a client. 
  • You participate in, access, or sign up to any of our services, including social media, our websites, our newsletters, or our events.
  • You otherwise correspond with us.

We rarely, if ever, ask about special category data, such as race, religion, or sexual orientation. If we do need to collect special category data in order to fulfill a contractual obligation, we will seek your consent and state the purpose of doing so. Participants in our primary research studies are typically anonymous or pseudo-anonymous, with no personal information associated with your responses or information shared as part of the research. If we do need to collect personal information (for example, your name and signature as part of a media release waiver granting us permission to use a photo or video), it will be decoupled from your responses to prevent any reasonable possibility of making those responses identifiable. 

Applicants to grant or other funding awards that we manage may be subject to due diligence. As part of this process we may obtain additional information in connection to key stakeholders listed in your application (board members, shareholders, senior management, and key project personnel). This additional information may be gathered from the internet and/or third-party due diligence software, or requested from you directly. This information will only be used for due diligence checks.  

Such applicants may also be required to share information about your business. For example, when applying for an Innovation Fund grant via the Portal, we may collect information including the name and type of your business and its address, as well as company policies, shareholder information, and financial records. Some of this information, including your project ideas, may be confidential information or commercially sensitive. While this information does not fall under the remit of GDPR or UK GDPR, we will protect the confidentiality of your information in accordance with our normal procedures and legal requirements. We will not use it for any purposes other than those set out in this policy.

Visitors to our website and other online properties should know that we use cookies and collect IP addresses to analyze our website traffic. This information may be shared with a third party, such as a digital media agency or analytics partner.

When you sign up for our newsletter, we collect your name and email address. We collect this information directly from you when you provide it to us by filling in the “Sign up to our newsletter” form on our website.

When you contact us via email, WhatsApp, or other forms of digital communications, records of your correspondence (including your email address) will be held by the Company.

How we use your information and why we can use it

We collect and process data, including personal data,  in the following ways:

  • For research participants, we analyze the information provided in response to surveys, interviews, and other research methods in order to derive insights or deepen our understanding of important issues. In the rare cases when personal information is collected along with responses (see above), we use that information only to confirm consent, provide incentives/ rewards, or other administrative acts. 
  • For applicants to grants or other funding rewards, we use the information you share in multiple ways, including: 
    • To  review and assess your application, complete eligibility checks and due diligence, enter into grant-making contracts, and for internal administration and grant support.
    • For statistical information, reporting, and evaluations. This includes analyzing the data for research purposes and to incorporate it into our databases for general research and analysis purposes. Anonymized aggregated data may be shared with external companies for analysis for monitoring and evaluation purposes. 
    • To assess the effectiveness and success of the funding application and grant-making process or the efficacy of communications campaigns.
    • To comply with compliance and audit-related activities.
    • To comply with the contractual obligations with the client sponsor of the program.
    • To comply with our legal obligations including detection of fraud, anti-money laundering, and sanctions checks. 
  • For visitors to our websites or those that otherwise access our services, we use the information you provide 
    • To facilitate events (face to face, virtual, or hybrid) you have indicated you may attend.
    • To send you newsletters, promotional materials, information on events, or other communications that you have consented to receive.

Under both GDPR and UK GDPR, the lawful bases we rely on for processing this information are:

  • Your consent. You are able to remove your consent at any time. You can do this by contacting info@CaribouDigital.net with a request to delete your personal information. You can unsubscribe from our email newsletter at any time.
  •  We have a contractual obligation.
  •  We have a legal obligation.
  •  We have a legitimate interest.

How we store your information and for how long

For research 

Information that is shared with us by research participants is saved in our secure Google Workspace cloud environment, where we compartmentalize and restrict access to only those individuals actively working on that project. We may also use 3rd-party services to process the information, including, for example, a translation tool or a transcription tool. 

Because the vast majority of the information we collect for research is anonymous, we do not enforce standard deletion timelines. If we do need to collect any personal information as part of our research activities, we store that information separate from any response data, and will delete it after 12 months. The exception to this rule is documentation around consent to participate or media waivers; we continue to maintain these records for auditability purposes.

 For grant or other funding programs 

  • We use 3rd-party services, such as Submittable, which are designed for fund program management, including receiving and storing applications and enabling communications with applicants. Applicants’ data is securely stored within the 3rd-party service’s platform, with access restricted to only those individuals actively managing the program and applications. We may download the data and store it on an encrypted cloud workspace. 
  • While the exact timeline for data storage will vary based on the program and client requirements, we generally delete personal data after 12 months.

For our email newsletter:

  • Data submitted in our signup form, including your email address, is stored in Mailchimp, the platform we use for newsletter management. Learn more about Mailchimp’s privacy practices.

For our website and other online properties:

  • Visitors accessing our websites will share anonymous browsing information captured and stored in Google Analytics. Clients, partners, or other visitors accessing password-protected areas of our online property(ies) will have their credentials stored and managed with a 3rd-party service, for example, WordPress, Metabase, or Auth0. 

Who we share your information with

In general, we will not share your personal information without obtaining your consent unless:

  • We have to disclose or share it in order to comply with our legal obligations, including audit, fraud prevention, anti-money laundering, and sanctions.
  • We need to share it for a legal contract with you.
  • It is necessary to protect our rights, property, or safety of our employees or others.

For grant or other funding programs

In accordance with our contractual obligations, information may be shared with the client or sponsor of the funding program. For detailed information on a specific funding program and its client, please contact us at the email address below. 

Applicants who are shortlisted, and those who make it to the final stage of the evaluation, will have their applications reviewed by panels of experts and judges.

By submitting an application via the Portal, you consent to the terms and conditions set out by the Portal owner, Submittable Holdings, Inc., 101 E. Front St, Suite #500, Missoula, MT, 59802. We are not responsible or liable for data collected or processed by Sumittable. Learn more about Submittable’s privacy policy and Submittable’s approach to GDPR.

Access to your information, portability, correction and erasure

You have the right to request a copy of the information that we hold about you. You can also request that we transfer your personal data to another organization. If you would like a copy of some or all of your personal information, or to request a data transfer to another organization, please email or write to us at the address below.

We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove (erase) any personal information.

You also have the right to ask us to restrict the processing and/or object to the processing  of your personal information in certain circumstances. 

How to contact us or make a complaint 

Questions, comments, or requests concerning this privacy policy or data protection matters are welcome and should be addressed to us at:

Caribou Digital UK Ltd, 56 Echo Barn Lane, Wrecclesham, Farnham, Surrey, GU10 4NF

Email: info@cariboudigital.net

You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data. The ICO’s address is:            

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk