Privacy policy

1. Introduction

The ITSCI Organisation (“ITSCI”, “we”, “us”, or “our”), acting as the Secretariat of the ITSCI Programme, is committed to protecting and respecting your privacy.

The ITSCI Organisation is a company limited by guarantee incorporated in England and Wales, registered at 128 City Road, London, United Kingdom, EC1V 2NX (company number 17032057).

This Privacy Policy explains how we collect, use, process and safeguard personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (UK), and the EU General Data Protection Regulation (EU GDPR) when you:

  • Visit our website: itsci.org (including any sub-pages)
  • Contact us by email, telephone, post, or via our online contact form
  • Sign up to receive our newsletter or other communications
  • Follow or message us via our social media channels
  • Attend a webinar, event or meeting that we host

If you are an ITSCI Programme Participant or applicant or a donor, a separate privacy notice applies to you. Please contact us at [email protected] to request the relevant notice.

2. Data Controller

The ITSCI Organisation, as Secretariat of the ITSCI Programme, is the data controller of your personal data.

Contact details:
Email: [email protected]
Address: 128 City Road, London, United Kingdom, EC1V 2NX
Data Protection Officer (DPO): The ITSCI Communications and Policy officer which can be contacted via the above details or at [email protected]

3. Personal Data We Collect

We may collect and process the following categories of personal data:

3.1  Information You Provide

When you contact us or sign up for communications, you may provide:

  • Identity data: Name, job title, organisation or company name
  • Contact data: email address, telephone number, postal address
  • Communication content: Information submitted via contact forms or correspondence
  • Communication preferences: Whether you wish to receive our newsletter or other communications

3.2  Date we collect Automatically

When you visit our website, our systems automatically collect certain technical data. This may include:

  • IP address
  • Browser type and version
  • Device and operating system
  • Website usage data (pages visited, time spent on pages, links clicked)
  • Approximate geographic location derived from IP address (country or city level only)

Our website uses cookies and similar technologies to:

  • Ensure website functionality
  • Analyse usage and performance
  • Improve user experience

You can manage cookie preferences through your browser settings: https://www.itsci.org/cookie-policy-uk/

3.3  Programme and Professional Data

We may process your data, via the third party Mailchimp (Rocket Science Group), for sending you newsletters and emails with updates on the ITSCI Programme related topics (“newsletter data”). This data may include your name, email address and company details, as well as information recorded by Mailchimp about the timing, frequency and pattern of your use of this service. You will have provided us with your profile details when registering for the newsletter service typically on our website or occasionally through our normal business operations. This data may be processed for sending you the requested regular newsletters and for optimising our editing and delivery. Occasionally the newsletters may include marketing of our products and services. The legal basis for this processing is our legitimate interests, namely the dissemination of relevant news and information to stakeholders. You will always have the ability to simply unsubscribe from our communications.

We may process your data for sending you press releases (“press data”). This data may include your name, email address, company details and job position. You or your company will have provided this information to us in the normal course of our business operations. This data may be processed for sending you press releases for publication. The legal basis for this processing is our legitimate interests in promoting our work representing the tin industry and ensuring tin industry stakeholders are aware of significant Programme developments.

We may process your personal data in connection with your registration for and attendance at ITSCI webinars (“webinar data”). This data may include your name, email address,company details, job title and any information you provide during registration or participation (such as questions submitted or feedback provided), as well as technical data relating to your attendance (such as login information, duration of attendance and engagement metrics). This information may be collected directly from you when you register for or participate in an ITSCI webinar, typically via our website or a third-party event management platform. This data may be processed for the purposes of administering and delivering webinars, communicating with you about the event, providing you with relevant materials or follow-up information, improving the quality and delivery of future webinars, and, where appropriate, informing you about related ITSCI activities, publications or events. The legal basis for this processing is our legitimate interests, namely the effective organisation and delivery of webinars and the dissemination of relevant information to tin industry stakeholders. Where required by law, we will obtain your consent before sending you marketing communications, and you will always have the ability to opt out of such communications.

4. How We Use Your Personal Data

We only use your personal data for the purposes set out below:

  • To operate and maintain our Website
  • To respond to enquiries and communications
  • To administer and support the ITSCI Programme
  • To manage stakeholder engagement and reporting
  • To improve our Website and services
  • To send our newsletter or updates where you have signed up. You can unsubscribe at any time using the link in any email or by contacting us.
  • To invite you to events or activities relevant to your enquiries, only where we reasonably consider you would expect to hear from us. You can opt out at any time.
  • To comply with legal, regulatory, and governance obligations
  • To ensure integrity and transparency of responsible mineral supply chains

We will not use your personal data for any purpose that is incompatible with the purposes listed above without informing you and, where required, obtaining your consent.

5. Sharing Your Personal Data

We do not sell, rent or trade your personal data. We may share it only in the limited circumstances described below:

Recipient Reason for sharing
IT systems providers

We use third-party platforms for email, website hosting, analytics and newsletter distribution (e.g. Mailchimp, website host).  We use Google Analytics (including Google Analytics 4), a web analytics service provided by Google LLC. Our website uses the Monster Insights plugin to integrate Google Analytics with our WordPress website. Google Analytics uses cookies and similar technologies to collect information about how visitors use our website, such as pages visited, traffic sources, device information, and session duration. This information helps us understand website usage and improve site performance.

Data collected through Google Analytics may include IP addresses, which are anonymised where configured. We process this data under our legitimate interests (Article 6(1)(f) UK GDPR and EU GDPR), namely, to analyse and improve the performance and security of our website.
Professional advisers Lawyers, accountants or insurers where necessary for the running of the organisation and where they are subject to confidentiality obligations.
Regulatory bodies or law enforcement Where required by law or court order, or to protect the rights, property or safety of the Organisation, our staff or others.
Other parties with your consent Where you have specifically agreed to us sharing your data with a named third party.

All third parties are required to respect the security of personal data and process it in accordance with the law.

6. International Data Transfers

Some of our third-party service providers are based outside the UK or the European Economic Area (EEA), or process personal data using infrastructure located outside the UK or the EEA. Where this results in a transfer of personal data outside the UK or the EU, we ensure that appropriate safeguards are in place in accordance with UK GDPR and EU GDPR requirements.

These safeguards may include:

  • UK-approved International Data Transfer Agreements (IDTAs)
  • EU Standard Contractual Clauses (SCCs), where the EU GDPR applies
  • Standard contractual clauses with the UK addendum, where applicable
  • Transfers to countries that have been deemed to provide an adequate level of data protection by the UK government and/or the European Commission

7. Lawful Bases for Processing

Under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), we rely on the following lawful bases for processing personal data:

  • Legitimate interests (Article 6(1)(f)): Where processing is necessary to operate the ITSCI Programme, engage with stakeholders, and maintain our website.
  • Consent (Article 6(1)(a)): Where you have given your consent, including to receive communications from us or to the use of cookies.
  • Contractual necessity (Article 6(1)(b)): Where processing is necessary for the performance of a contract with you or for participation in the ITSCI Programme.
  • Legal obligation (Article 6(1)(c)): Where processing is necessary for compliance with applicable legal and regulatory obligations.

8. Data Retention

We retain personal data only for as long as necessary to:

  • Fulfil the purposes for which it was collected
  • Comply with legal, contractual, or regulatory requirements
  • Support accountability and transparency in ITSCI Programme operations

Retention periods are determined based on the type and sensitivity of the data. At the end of the applicable retention period, your data will be securely deleted or anonymised.

9. Your Rights Under UK and EU GDPR

Under UK data protection law (and EU GDPR if you are based in the EU), you have the following rights in relation to your personal data:

  • Right of access: you can ask for a copy of the personal data we hold about you
  • Right to rectification: you can ask us to correct any inaccurate or incomplete data we hold about you
  • Right to erasure (“right to be forgotten”): you can ask us to delete your personal data in certain circumstances, for example where it is no longer necessary for the purpose it was collected.
  • Right to restrict processing: You can ask us to restrict our use of your data in certain circumstances, for example while you contest its accuracy.
  • Right to object: you can object to our processing of your data based on legitimate interests.
  • Right to data portability: Where we process your data on the basis of consent or contract, and by automated means, you can ask us to provide it in a structured, machine-readable format.
  • Right to withdraw consent: where our processing is based on your consent, you can withdraw it at any time. This will not affect the lawfulness of any processing carried out before withdrawal.

To exercise any of these rights, please contact us at [email protected].  These rights are not absolute and may be subject to exceptions, but we will always respond to your request, within one calendar month. We will explain our reasoning if we cannot fulfil it. We will not charge a fee unless a request is manifestly unfounded or excessive.

We may need to verify your identity before processing your request. We will ask for the minimum information necessary to do so.

10. How to make a Complaint

If you are not satisfied with how we handle your personal data, we encourage you to contact us first so we can try to resolve your concern.

You also have the right to lodge a complaint with the UK supervisory authority: Information Commissioner’s Office (ICO). Website: https://www.ico.org.uk

11. Data Security

We implement appropriate technical and organisational measures to protect personal data, including safeguards against:

  • Unauthorised access
  • Loss or destruction
  • Misuse or alteration

12. Third-Party Websites

Our website may contain links to external websites. We are not responsible for the privacy practices of third-party sites.

13. ITSCI Whistleblowing Programme

The ITSCI Organisation operates a Whistleblowing Programme to support responsible mineral supply chains and enable individuals to report concerns, including potential misconduct, risks, or breaches of standards.

13.1 Purpose of Processing

Personal data submitted through the whistleblowing mechanism is processed for the purposes of:

  • Receiving and assessing reports of concerns or allegations
  • Investigating potential breaches of ITSCI Programme standards or applicable laws
  • Ensuring accountability, transparency, and responsible sourcing practices
  • Taking appropriate follow-up actions

13.2 Types of Personal Data

We may process the following personal data in connection with whistleblowing reports:

  • Identity and contact details of the reporting individual (if provided)
  • Information about the individuals or entities named in the report
  • Details of the concern or allegation
  • Supporting evidence or documentation

Reports may be made anonymously. However, providing contact details may assist in effective investigation.

13.3 Lawful Basis for Processing

Under UK GDPR, processing of whistleblowing data is based on:

  • Legal obligation (Article 6(1)(c)), where applicable
  • Legitimate interests (Article 6(1)(f)), including preventing misconduct and ensuring Programme integrity

Where special category data is involved, processing is carried out in accordance with relevant provisions of the Data Protection Act 2018.

13.4 Confidentiality

We treat whistleblowing alerts with a high level of confidentiality. Personal data will only be disclosed:

  • To authorised personnel within ITSCI
  • To relevant partners involved in investigation, where necessary
  • To competent authorities where required by law

We take reasonable steps to protect the identity of whistleblowers, subject to legal or regulatory obligations

13.5 Data Sharing and Transfers

Whistleblowing data may be shared with:

  • ITSCI Programme partners involved in investigation
  • External advisers (e.g. legal or compliance specialists)
  • Regulatory or law enforcement authorities

Where data is transferred outside the UK, appropriate safeguards (e.g. UK IDTA) will be applied.

13.6 Data Retention

Personal data related to whistleblowing reports is retained only for as long as necessary to:

  • Conduct investigations and related actions
  • Comply with legal and regulatory requirements
  • Maintain records for accountability and audit purposes

13.7 Rights of Individuals

Individuals whose personal data is processed in connection with whistleblowing have rights under UK GDPR. However, these rights may be limited where necessary to:

  • Protect the integrity of investigations
  • Safeguard the rights and freedoms of others
  • Prevent the obstruction of official or legal processes

The ITSCI whistleblowing procedure and contact details are available online at www.itsci.org/contact/. The confidential ITSCI whistleblowing address is [email protected].

14. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be published on this page with the revised effective date. Where appropriate, we will notify you directly (for example by email if you are subscribed to our newsletter).

15. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

The ITSCI Organisation, Secretariat of the ITSCI Programme
Email: [email protected]