Privacy Policy
1. Who We Are
Futerra Limited is a company registered in England & Wales (company number 04709420) with its registered office at Somerset House, Strand, London, WC2R 1LA and Futerra Solutions Union is a company registered in England and Wales (company number 1204322), with its registered office at Somerset House, Strand, London, WC2R 1LA (together "Futerra", "we", "us", "our")
We are committed to protecting your personal data and handling it responsibly. This policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it.
If you have any questions about this policy or how we handle your personal data, please contact us at DataPrivacy@wearefuterra.com.
2. What Personal Data We Collect and Why
We collect and use personal data in the following circumstances. Where we rely on consent, you can withdraw it at any time by contacting DataPrivacy@wearefuterra.com.
Contact and enquiries - via our website or otherwise.
o Data collected: Name, email, free text
o Lawful basis: Legitimate interests
o Retention: 12 months
Campaign participation - case studies, interviews, contributors
o Data collected: As set out in the relevant consent form
o Lawful basis: Consent
o Retention: Duration of the campaign, plus 6 months after it closes
Campaign and advocacy content - where participation in our campaigns involves sharing views on environmental, political or social issues
o Data collected: Name, contact details, images, written contributions, and views expressed
o Lawful basis: Explicit consent
o Retention: Duration of the campaign, plus 6 months after it closes
Events and webinars - including via third-party platforms such as Luma
o Data collected: Name, contact details
o Lawful basis: Consent or legitimate interests depending on context
o Retention: 6 months after the event
Mailing lists - where you sign up for updates
o Data collected: Name, email
o Lawful basis: Consent
o Retention: Until you unsubscribe
Suppliers and professional contacts
o Data collected: Contact and relationship details
o Lawful basis: Legitimate interests
o Retention: Duration of relationship plus 6 years
Recruitment
o Data collected: Application materials including CV
o Lawful basis: Legitimate interests; legal obligation where applicable
o Retention: 6 months for unsuccessful applicants; HR policy for employees
Where we obtain consent for a specific use of your personal data, a separate consent form or sign-up process will explain exactly what you are agreeing to and how to withdraw consent.
Where our work involves processing special category personal data - for example where a campaign participant shares views on environmental or political issues - we will rely on explicit consent as the basis for that processing under Article 9(2)(a) UK GDPR. We will always make clear at the point of collection when we are collecting this type of information and what it will be used for.
3. Cookies and Analytics
Our website is built on Squarespace, which uses cookies to enable the website to function correctly. When you visit our website, Squarespace may set cookies on your device.
We also use Google Analytics to help us understand how visitors use our website. Google Analytics collects information such as the pages you visit, the time you spend on the site, and how you arrived at the site. This information is aggregated and anonymous - we cannot use it to identify you individually.
You can opt out of Google Analytics tracking by using the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout.
For more information about how Squarespace uses cookies, please see Squarespace's cookie policy at squarespace.com. For more information about how Google uses data collected via Google Analytics, please see Google's privacy policy at policies.google.com/privacy.
You can manage or disable cookies through your browser settings. Please note that disabling cookies may affect the functionality of our website.
4. Third-Party Links
Our website and campaign materials may contain links to third-party websites. These websites have their own privacy policies, which we encourage you to review. We are not responsible for the privacy practices of those websites and this policy does not apply to them.
5. Who We Share Your Data With
We do not sell your personal data to third parties.
We may share your personal data with:
Campaign partners - organisations we work with to deliver specific campaigns or projects, where sharing your data is necessary for the delivery of that campaign and you have been informed of this at the point of collection.
Squarespace – our website platform provider, who processes data on our behalf as a data processor in order to operate and maintain our website.
Google – in connection with Google Analytics, as described above.
Professional advisers – such as lawyers or accountants, where necessary and subject to appropriate confidentiality obligations.
We will not share your personal data with any other third party without your consent, unless required to do so by law.
6. International Transfers
Squarespace and Google may transfer and process your personal data outside the United Kingdom. Where this occurs, we rely on appropriate safeguards to protect your data, including the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable.
7. Security of Your Personal Data
We take the security of your personal data seriously. We are Cyber Essentials certified and our security policies are aligned with the NCSC Cyber Essentials scheme.
The technical and organisational measures we have in place include:
Access controls - multi-factor authentication on all accounts, with single sign-on to company systems. Access follows the principle of least privilege and is managed through formal joiner, mover and leaver processes.
Passwords - passwords follow NCSC guidance, are stored in an approved password manager and are never shared.
Devices - company-managed laptops and phones are centrally managed, encrypted, firewall-protected and screen-locked, and can be locked or wiped remotely if lost or stolen.
Malware and threat protection - anti-malware is in place on all computers, with email security filtering and web filtering that blocks malicious sites.
Monitoring - all sign-ins are monitored 24/7 by a managed security monitoring service.
Data storage - personal data is stored only in approved company systems. External sharing is restricted to named recipients.
Staff training - all staff complete security and data protection training, including phishing awareness, when they join and at least annually.
All staff must report suspected security incidents or data breaches immediately. Our Data Protection Lead assesses every incident, and reportable personal data breaches are notified to the ICO within 72 hours.
8. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
Right of access – you can request a copy of the personal data we hold about you.
Right to rectification – you can ask us to correct any inaccurate or incomplete data we hold about you.
Right to erasure – you can ask us to delete your personal data in certain circumstances.
Right to restrict processing – you can ask us to limit how we use your personal data in certain circumstances.
Right to data portability – you can ask us to provide your personal data in a structured, commonly used, machine-readable format in certain circumstances.
Right to object – you can object to our processing of your personal data where we rely on legitimate interests as our lawful basis. Where we process your personal data for direct marketing purposes, you have an absolute right to object at any time.
Right to withdraw consent – where we rely on your consent to process your personal data, you can withdraw that consent at any time by contacting us at DataPrivacy@wearefuterra.com. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, please contact us at DataPrivacy@wearefuterra.com. We will respond to your request within one month.
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
We do not carry out any automated decision-making or profiling - that is, we do not use automated processes to make decisions about you that produce legal or similarly significant effects. If this changes in the future, we will update this policy accordingly.
9. Changes to This Policy
We may update this policy from time to time. The date at the top of this page will always reflect when the policy was last updated. We encourage you to review this policy periodically.