About This Privacy Policy

This policy sets out how we will use and share the information that you give us. This policy describes your relationship with Constructing Change. The General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) describe how organisations must collect, handle, process, and store personal information. We comply with both the UK GDPR and, where there are differences, the DPA 2018 will apply.

These rules apply regardless of whether data is stored electronically, on paper, or on other materials. To comply with the law, personal information must be collected and used fairly, stored safely, and not disclosed unlawfully. UK GDPR is underpinned by eight important principles. These state that personal data must:

• Be processed fairly and lawfully
• Be obtained only for specific, lawful purposes
• Be adequate, relevant, and not excessive
• Be accurate and kept up to date
• Not be held for any longer than is necessary
• Be processed in accordance with the rights of the data subjects
• Be protected in appropriate ways
• Not be transferred outside the European Economic Area unless that country or territory also ensures an adequate level of protection

We take these responsibilities seriously; this document describes our approach to data protection.

Who We Are

Constructing Change is an independent initiative focused on driving positive change in the construction industry. Our contact details are: info@constructing-change.com. Constructing Change operates in England and is registered with the Information Commissioner’s Office….Reg no

What Personal Data We Collect

We may collect and process the following types of personal data:

1. Contact details (name, email address, phone number, postal address)
2. Job title and organisation details
3. Information you provide when registering for events or initiatives
4. Correspondence and communication records
5. Website usage data (such as IP addresses, cookies, and analytics data)
6. Any other information you provide voluntarily through surveys or feedback forms

How We Use Your Personal Data

We process personal data to:

• Communicate with you regarding our initiatives, events, and updates
• Manage memberships, partnerships, and event registrations
• Improve our website and services
• Conduct research and evaluate the impact of our activities
• Comply with legal and regulatory obligations
• Maintain security and prevent fraudulent activity

Legal Basis for Processing

We process personal data based on one or more of the following legal grounds:

• Consent: When you provide explicit consent (e.g., subscribing to newsletters)
• Contractual Obligation: When processing is necessary to fulfil a contract
• Legal Obligation: When we must comply with the law
• Legitimate Interests: When processing is necessary for our operational interests, provided it does not override your rights

How We Share Your Personal Data

We do not sell your personal data. However, we may share it with trusted third parties, including:

• Service providers who assist in managing our website, email communications, and analytics
• Event partners and speakers involved in Constructing Change activities
• Regulatory authorities if required by law

7. All third parties must comply with UK GDPR requirements and implement appropriate security measures.

Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy. Once it is no longer needed, we securely delete or anonymise the data.

Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate or incomplete data
• Request deletion (right to be forgotten)
• Restrict processing
• Data portability (where applicable)
• Object to processing
• Withdraw consent (where processing is based on consent)

8. To exercise your rights, please contact us at [Insert Contact Email]. We will respond within one month as required by law.

Cookies and Website Tracking

Security Measures

We implement technical and organisational measures to protect personal data from unauthorised access, loss, or misuse. These include:

• Secure website hosting and data storage
• Encryption and access controls
• Regular security assessments and staff training

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in regulations or our practices. Updates will be posted on our website with the latest revision date.

Contact Information

If you have any questions or concerns about this Privacy Policy or our data protection practices, please contact us at: [Constructing Change Contact Details]

9. Last Updated: [Insert Date]

Purpose and Legal Basis for Processing Data

We will only use your personal data for the purposes for which we collected it and as you would reasonably expect your data to be processed and only where there is a lawful basis for such processing, for example:

Purpose/Activity	Type of Data	Lawful Basis for Processing
To register you as a new user/member	(a) Identity, (b) Contact information	(a) Provide our services to you in our legitimate interest, (b) Performance of a contract with you, (c) With your consent
To provide our website services and membership services	(a) Identity, (b) Contact information	(a) Provide our services to you in our legitimate interest, (b) Performance of a contract with you, (c) With your consent
To provide the services you request, including events, conferences, training, CPD opportunities, and other related services and information	(a) Identity, (b) Contact, (c) Financial, (d) Transaction, (e) Marketing and Communications	(a) Provide our services to you in our legitimate interest, (b) Performance of a contract with you and to collect payments and fees, (c) With your consent
To fulfil your request, including sending your email and job application details to third parties	(a) Identity, (b) Contact, (c) Personal information provided by you	(a) Provide our services to you in our legitimate interest, (b) Performance of a contract with you, (c) With your consent
To process requests and provide the information and services you request, including managing payments, fees, and charges, and to collect and recover money owed to us	(a) Identity, (b) Contact, (c) Financial, (d) Transaction, (e) Marketing and Communications	(a) Provide our services to you in our legitimate interest, (b) Performance of a contract with you and to collect payments and fees, (c) With your consent
To manage our ongoing relationship with you, including notifying you about changes to our terms, products, services, or privacy policy, and to maintain our records	(a) Identity, (b) Contact, (c) Profile, (d) Marketing and Communications	(a) Performance of a contract with you, (b) Necessary to comply with a legal obligation, (c) Necessary for our legitimate interests to keep our records updated and study how customers use our products/services
To administer and protect our business and our site (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data)	(a) Identity, (b) Contact, (c) Technical	(a) Necessary for our legitimate interests for running our business, provision of administration and IT services, network security, to prevent fraud, and in the context of a business reorganisation or group restructuring exercise, (b) Necessary to comply with a legal obligation
To deliver relevant content and advertisements to you and measure and understand the effectiveness of our advertising	(a) Identity, (b) Contact, (c) Profile, (d) Usage, (e) Marketing and Communications, (f) Technical	Necessary for our legitimate interests to study how customers use our products/services, to develop them, to grow our business, and to inform our marketing strategy
To use data analytics to improve our website, products/services, marketing, customer relationships, and experiences	(a) Technical, (b) Usage	Necessary for our legitimate interests to define types of customers for our products and services, to keep our site updated and relevant, to develop our business, and to inform our marketing strategy
To make suggestions and recommendations to you about goods or services that may be of interest to you	(a) Identity, (b) Contact, (c) Technical, (d) Usage, (e) Profile	Necessary for our legitimate interests to develop our products/services and grow our business

 

Our Commitment to Your Privacy

Constructing Change is committed to protecting your privacy and handling your personal data securely and responsibly. This policy explains how we collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (GDPR) (2018) and other relevant data protection laws.

Information We Collect

We may collect and process the following types of personal data:

• Contact Information – Name, email address, phone number, and postal address.
• Service Details – Information related to services you have used, event attendance, or inquiries.
• Payment & Transaction Data – When purchasing services, we may collect billing details and payment history.
• Employment & Application Data – If you apply for a role or volunteer opportunity, we may collect your employment history, training, and qualifications.

We collect data when you:

• Register on our website or subscribe to updates.
• Provide details when creating an online profile.
• Contact us about our services or events.
• Attend an event and opt in to receiving communications.

How We Use Your Data

We will only use your personal data when we have a legal basis to do so. These include:

• Contractual necessity – To provide services you have requested.
• Legitimate interests – To improve our services and maintain engagement.
• Legal obligation – When required by law or regulatory authorities.
• Consent – When you explicitly agree to receive marketing communications.

Your data may be used to:

• Respond to inquiries and provide services.
• Manage our relationship with you, including customer support.
• Send important updates about events, services, and policy changes.
• Improve our services through feedback and analysis.
• Send marketing communications (only with your explicit consent).

Marketing and Communication Preferences

We will only send marketing communications if:

• You have contacted us, requested information, or used our services.
• You have explicitly opted in at the point of data entry.
• You have attended an event and agreed to receive updates.
• You have not opted out of receiving marketing communications.

We never share your personal data with third parties for marketing purposes unless you have given explicit consent. You can update your preferences or opt out anytime by contacting us.

Data Retention & Security

We store personal data securely and only keep it for as long as necessary:

• Service-related data – Retained for up to seven years for record-keeping and legal compliance.
• Marketing data – Stored until you opt out or request deletion.
• Employment applications – Retained for up to 12 months unless otherwise agreed.

We implement strict security measures to protect your personal data from unauthorised access, alteration, or disclosure. Only authorised personnel can access your data.

Third-Party Sharing & International Transfers

We may share your data with trusted third parties who help us deliver our services, such as:

• Payment processors (for transactions).
• Email marketing providers (for newsletters).
• Event management platforms (for ticketing and registrations).

If your data is transferred outside the UK/EU, we ensure appropriate safeguards, such as Standard Contractual Clauses (SCCs), are in place to protect your rights.

Your Rights Under GDPR

You have the right to:

• Access your personal data.
• Correct inaccurate or incomplete data.
• Request deletion of your data (“right to be forgotten”).
• Restrict or object to how we process your data.
• Request data transfer to another service provider.
• Withdraw consent for marketing or other purposes.

For more details, visit the ICO Guide to GDPR Individual Rights.

How to Access or Manage Your Data

To exercise your rights, update preferences, or request data deletion, you can:

📩 Email us at info@constructing-change.com
🌍 Visit our website and submit a request
📞 Call us for assistance

We aim to respond within one month, but complex requests may take longer. In such cases, we will keep you updated.

Legal Obligations and Disclosure

We may be legally required to disclose your personal information without prior notification when:

• Required by law or regulatory authorities.
• Connected to ongoing or potential legal proceedings.
• Necessary to prevent fraud or security risks.
• Ordered by a court or regulatory body

Updates to This Policy

We may update this Privacy Policy from time to time. Any significant changes will be communicated via our website or directly to you if required.

For any questions about this policy or your personal data, contact our Data Protection Officer at info@constructing-change.com

Sharing Your Personal Data

At Constructing Change, we may share your personal data with carefully selected third parties to support the services we provide. This is done securely and in compliance with data protection laws.

Who We Share Your Data With

We may share your data with:

• Service Providers – IT and system administration providers that help us maintain our platforms.
• Social Media Platforms – Such as LinkedIn, Facebook, and Instagram for engagement and marketing.
• Professional Advisors – Including legal, banking, auditing, and insurance professionals for compliance, fraud prevention, and financial services.
• Regulatory Authorities – HM Revenue & Customs, regulators, and other authorities in the UK and relevant jurisdictions that require reporting in specific cases.
• Business Transfers – In the event of a business sale, transfer, or merger, data may be shared as part of asset restructuring.

Additionally, if you attend one of our events (e.g., conferences, training sessions, or CPD programs) and explicitly consent, we may share your details with:

• Event sponsors and media partners.
• Exhibitors and attendees.
• Other relevant third parties that align with our mission.

How We Protect Your Data When Sharing

We require all third parties to handle your data securely and in line with GDPR regulations. They may only process your personal data for specific purposes and under our instructions.

We never sell your data, and any sharing is done transparently with your privacy in mind.

For more information on third-party data sharing, contact us at info@constructing-change.com

Data Security

We have implemented robust security measures to protect your personal data from accidental loss, unauthorised access, misuse, alteration, or disclosure. Access to your personal data is strictly limited to employees, agents, contractors, and third parties who need it to fulfil their roles. They are required to process your data according to our instructions and are bound by confidentiality obligations.

In the event of a data breach, we will notify the relevant authorities within 24 hours and inform affected individuals within 72 hours.

Please note, our website may contain links to third-party websites, plug-ins, and applications. Clicking on these links or enabling connections may allow third parties to collect or share data about you. We do not control these external sites and are not responsible for their privacy policies. We recommend reviewing the privacy notices of any websites you visit once you leave our site.

If you have any concerns or queries about how we handle your data, please contact us.

Cookies Policy

At Constructing Change, we use cookies to enhance your experience on our website. This section explains what cookies are, how we use them, and how you can manage your cookie preferences.

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They allow the website to remember your preferences, improve functionality, and enhance your overall experience.

How We Use Cookies

We use cookies for several purposes, including:

• Essential Cookies: Necessary for the basic functionality of the website, such as navigation and feature use.
• Performance and Analytical Cookies: Help us understand how visitors interact with our website, so we can improve content and functionality.
• Functionality Cookies: Enable the website to remember your preferences, such as language settings or login details.
• Marketing and Advertising Cookies: Track your browsing habits and help us deliver relevant advertisements tailored to your interests.

Managing Cookies

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies if you prefer. Please note that this may prevent you from taking full advantage of certain features of our website.

As part of our commitment to transparency, we require your permission to store cookies on your device. When you visit our site, you will be presented with an option to accept our terms of use, including the storage of cookies. If you do not accept, you are free to leave our website at any time.

Consent

By using our website, you consent to our use of cookies in accordance with this Cookies Policy. If you do not accept cookies, you should either refrain from using our website or manage your cookie preferences as outlined above.

For any further questions or concerns about our use of cookies, please contact us at info@constructing-change.com

Facebook

Our website integrates features provided by Facebook, Inc. (1 Hacker Way, Menlo Park, California 94025, USA). For detailed information on how Facebook handles your data, please refer to their privacy policy here: Facebook Privacy Policy.

Facebook uses standard contractual clauses, relies on the European Commission’s adequacy decisions for certain countries, and seeks consent for data transfers to the United States and other regions where applicable.

X (formerly Twitter)

Our website integrates features from X (formerly Twitter). The operating company for X is X Corp, located at 1355 Market Street, San Francisco, CA 94103, USA. For detailed information on how X handles your data, please refer to their privacy policy.

X uses standard contractual clauses, relies on the European Commission’s adequacy decisions for certain countries, and seeks consent for data transfers to the United States and other regions where applicable.

Analysis and Advertising Tools

We use various analysis and advertising tools to enhance your experience on our website and to better understand user behaviour. These tools help us monitor traffic, improve functionality, and deliver targeted advertisements. One of the primary tools we use is Google Analytics.

Google Analytics

Google Analytics is a web analytics service provided by Google, Inc. that helps us track and analyse website traffic. It collects information about how users interact with our site, including the pages visited, the time spent on the site, and other engagement metrics. This helps us improve the content and functionality of our website.

For more information on how Google processes data, please visit Google’s Privacy Policy:

Google uses cookies to collect this information and may transfer the data to servers in the United States. Google adheres to the European Commission’s adequacy decision and complies with the EU-U.S. Privacy Shield Framework for transferring data to the United States.

Advertising and Targeting Tools

We also use various advertising tools, such as Google Ads, to deliver personalised content and ads to users based on their interests and browsing history. These tools collect data to tailor the advertisements shown to you on different platforms.

You can opt-out of personalised advertising by visiting Google’s Ads Settings. You can also manage how other companies track your activities through your browser’s privacy settings.

By using our website, you consent to the processing of your data through these tools in accordance with their privacy policies. If you have any questions or concerns, please feel free to contact us.

Legitimate Interests

Under the GDPR, we may also share certain information with third parties for non-marketing purposes, such as credit and risk assessments, fraud prevention, debt collection, and the recovery of assets. These actions are taken in line with our legitimate interests.

Contacting Us, Exercising Your Information Rights, and Complaints

If you have any questions or comments regarding this Privacy Policy, would like to exercise your information rights concerning the personal data you’ve shared with us, or wish to file a complaint, please contact Susanne Ingham at Constructing Change.

We will respond to Subject Access Requests (SARs) within 30 days. While responses to SARs are generally free, we may charge a reasonable fee for excessive or unfounded requests. We fully comply with data protection laws and will assist with any investigations or requests from the relevant authorities.