Privacy and data protection policy

IWIM is a global non-profit organisation, advancing equity within the natural resources sector. We believe in a diverse, equitable and inclusive industry where everyone can thrive. Our purpose is to create a responsible and sustainable mining industry and we act as an Industry Change Agent and Equity Accelerator (“IWIM’s Purpose”). IWIM is incorporated as a community interest company (C.I.C.), registered in England and Wales under company number 0615211 and having its registered office at 49 Station Road, Polegate, England, BN26 6EA.

IWIM is committed to protecting your privacy.

Introduction

This Privacy Policy (the “Policy”) outlines the information collected by IWIM from users of the IWIM website (the “Website”). This Policy only applies to the Website. The Website and this Policy may contain links to and from websites of other organisations. If you go to another website from this one, please read the privacy policy on that website if you want to know what it does with your information.

Data collection

We may collect and process the following personal information about you:

Information that you provide to us

This includes information about you that you give us by completing forms or by communicating with us, whether face-to-face, by phone, e-mail or otherwise. Such information may include: basic Personal Data (such as first name; family name; position in the company; company name; company email address; business phone number; business address; city; postcode; country), for example when you opt in to receive our newsletter.

Information that we collect or generate about you

This includes information that we request from you or you choose to make available to us through the Website or your use of the IWIM social media channels including LinkedIn, Facebook, Instagram and X, or communication facilitators such as Brevo, SurveyMonkey, and Survey Planet, and any future products specified by IWIM (collectively, the “Services”). It also includes aggregate information and statistics and information we obtain from cookies (see “Cookies” section below).

Use of your Personal Data

We may use your Personal Data to:

  • Send you electronic communications via the Services on or about:
  • newsletters, news and events concerning IWIM and its projects; and
  • opportunities to participate in activities and projects, which may from time to time include an offer from an external organisation.

We may use aggregate information and statistics for the purposes of monitoring Website usage in order to help us develop the Website and our service and may provide such aggregate information to the Services solely for these purposes.

We do not sell your data or our analytics to third parties.

Legal bases for using your Personal Data

We are entitled to use your Personal Data in the above manner because:

  • You have given your consent to send you newsletters or use cookies. You can change your email preferences and opt out at any time;
  • The use of your Personal Data as described is necessary for our legitimate business interests. This means that the reason that we are processing information is because there is a legitimate interest for IWIM to process your information to help us achieve IWIM’s purpose. Examples of where we have a legitimate interest to process your Personal Data include:
    • where you have opted to receive electronic information so that you receive our newsletter that may be useful to you. You may opt out of this as set out in the “Electronic Communications” section below; and
  • We have legal and regulatory obligations that we have to discharge;
  • We may need to in order to establish, exercise or defend our legal rights or for the purpose of legal proceedings; or
  • We may need to perform the contract we are about to enter into or have entered into with you.

Disclosure of your information to third parties

We will not share your Personal Data outside of IWIM except:

  • With third party agents or contractors that we select to carry out some functions on our behalf (for example, the providers of our electronic data storage services or mass emailing services) for the purposes of providing services to us. They include:
    • a bulk email distributor, Brevo. Where this is necessary, we may need to transfer some of your Personal Data overseas. When you subscribe to our emails your details are held securely by Brevo, who will not share your information with any third parties or contact you directly at any time. Their full Privacy Policy is available here; and
    • Online survey providers, SurveyMonkey and/or Survey Planet. If you have agreed to participate in surveys it may be necessary to transfer some of your Personal Data overseas for the provision of this service. Your details are held securely by SurveyMonkey and/or Survey Planet, who will not share your information with any third parties or contact you directly at any time. Their full Privacy Policy is available here: SurveyMonkey and here: Survey Planet.
  • To the extent required by law, court order or in response to reasonable enquiries from law enforcement agencies. This includes, for example, if we are under a duty to disclose your Personal Data in order to comply with any legal obligation, establish, exercise or defend our legal rights.

Transferring your Personal Data outside the EEA

The Personal Data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). Where we transfer your Personal Data outside the EEA, we will ensure that it is protected in a manner that is consistent with how your Personal Data will be protected by us in the EEA. This can be done in a number of ways, for instance:

  • The country that we send the data to might be approved by the European Commission; or
  • The recipient might have signed up to a contract based on “model contractual clauses” approved by the European Commission, obliging them to protect your Personal Data.

In other circumstances the law may permit us to otherwise transfer your Personal Data outside the EEA. In all cases, however, we will ensure that any transfer of your Personal Data is compliant with data protection law.

You can obtain more details of the protection given to your Personal Data when it is transferred outside the EEA (including a copy of the standard data protection clauses which we have entered into with recipients of your Personal Data) by contacting us in accordance with the “Contacting us” section below.

Retention of Personal Data

How long we hold your Personal Data for will vary. The retention period will be determined by various criteria including:

  • The amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data;
  • The purpose for which we are using it – we will need to keep the data for as long as is necessary for that purpose; and
  • Legal obligations – laws or regulation may set a minimum period for which we have to keep your Personal Data.

Electronic Communications

We will only send you electronic communications if you have opted to receive them when providing your Personal Data via the Services and/or by amending your profile settings on the Services. If you had opted to receive such electronic communications but no longer want us to use your Personal Data in this way, then please change your profile settings on the Services to stop them or click the “unsubscribe” button on any unwanted types of electronic communications that you receive in the future.

Cookies

The Website may use “cookies” (small pieces of information stored on your computer’s hard drive by your browser) which enable us to personalise your use of the Website. If you do not want a cookie to be stored on your hard drive you should select the appropriate options on your web browser. This will not prevent you from using most features of the Website.

Protection of Personal Data

We take reasonable precautions to ensure that any Personal Data which you provide is used only for the purposes set out in the Policy. As required by the applicable data protection laws, we have strict security procedures regarding the storage and disclosure of Personal Data to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Your Rights

You have a number of legal rights in relation to the Personal Data we hold about you. These rights include:

  • The right to request that we correct any Personal Data that we may hold about you if it is inaccurate or incomplete and the right to access the Personal Data that we hold about you;
  • The right to request for us to remove all the Personal Data that we hold about you from our records. However, please note that we require certain key information from you in order to provide you with certain services that you may require and if you ask us to remove all or part of such information you may no longer be able to use or access the website or parts of it. Additionally, there may be circumstances where you ask us to erase your Personal Data, but we are legally entitled to retain it;
  • The right to obtain information regarding the processing of your Personal Data;
  • The right to withdraw your consent to our processing of your Personal Data at any time. Please note, however, that we may still be entitled to process your Personal Data if we have another legitimate reason (other than consent) for doing so;
  • In some circumstances, the right to receive some Personal Data in a structured, commonly used and machine-readable format and/or request that we transmit those data to a third party where this is technically feasible. Please note that this right only applies to Personal Data which you have provided to us;
  • The right to object to, and the right to request that we restrict, our processing of your Personal Data in certain circumstances. Again, there may be circumstances where you object to, or ask us to restrict, our processing of your Personal Data but we are legally entitled to continue processing your Personal Data and / or to refuse that request; and
  • The right to lodge a complaint with the data protection regulator (details of which are provided below) if you think that any of your rights have been infringed by us.

You can exercise your rights by contacting us using the details set out in the “Contacting IWIM” section below. You can find out more information about your rights by contacting the Information Commissioner’s Office, or by searching their website at https://ico.org.uk/.

Contacting IWIM

If you have any questions or wish to contact us in relation to the Policy or the exercise of your rights listed above, please email the Administrator at info@internationalwim.org.

Revision of the Policy

IWIM reserves the right to update the Policy from time to time. Updates to the Policy will be posted on the Website.

Adopted on 20th June 2025