Privacy policy

This privacy notice tells you what to expect us to do with your personal information when you make contact with us or use one of our services.

• Who we are
• How do we get information
• Why do we need your data?
• Your right of access
• Your right to rectification

• Your right to erasure
• Your right to restriction of processing
• Your right to object to processing
• Your right to data portability
• Sharing your information

• Analytics
• Cookies
• Purpose and legal basis for processing
• Security and performance
• Changes to this privacy notice

Who are we

Global Action Plan is the controller for the personal information we process, unless otherwise stated. You can contact us by email at [email protected], phone (0204 566 9904) or via our postal address:

Global Action Plan
The Leather Market,
Lafone House
11-13 Weston Street
London
SE1 3ER

How do we get information?

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• You have made an enquiry to us
• You have signed up to the Transform our World / Global Action Plan Education site
• You have signed up as a member of our review committee
• You wish to attend, or have attended, an event
• You subscribe to our e-newsletter
• You are representing your organisation

We may also hold some personal data if it has been shared with us by a partner organisation with your consent, such as for a case study or news item.

Why do we need your data?

We also collect data in order to:

• gather feedback to improve our services, for example our email alerts
• respond to any feedback you send us, if you’ve asked us to
• send email alerts to users who request them
• allow you to favourite resources
• monitor use of the site to identify security threats
• report to our funders on how the site is being used

Where we do collect personal data through our website, we’ll be upfront about this. We’ll make it clear when we collect personal information and we’ll explain what we intend to do with it.

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can read more about this right here.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this right here.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances. You can read more about this right here.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here.
 

Your right to object to processing

You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests. You can read more about this right here.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. You can read more about this right here.

You are not required to pay any charge for exercising your rights. We have one month to respond to you. Please contact us at [email protected] if you wish to make a request.

Sharing your information

We will not share your information with any third parties for the purposes of direct marketing. We may at times share aggregated data with our programme partners, but we will never include your personal data unless we have your specific consent.

Where you sign up to a programme through our partners, they may provide aggregated data back to us, but this will not include your personal data without your specific consent. Where we provide links to websites or programmes of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they will not do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Analytics

When you visit transform-our-world.org / globalactionplaneducation.org.uk, we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. his information is only processed in a way that does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

We do this to help:

• make sure the site is meeting the needs of its users
• make improvements, for example improving site search
• find out such things as the number of visitors to the various parts of the site
  

Cookies

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

• PHP session cookie: this stores the unique session id. This allows us to record that you are signed in to the site to gain full site functionality
• Analytics (Google): These cookies are used to collect information about how visitors use our website. We use the information to compile reports and to help us improve the website. The cookies collect information in an anonymous form, including the number of visitors to the website, how visitors found our site and the pages they visited. Read Google's overview of privacy and safeguarding data
• We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf. For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.
• Setting reminder: This cookie records your responses to the request to use cookies to ensure that you don’t have to give permission each time you visit.

You can delete cookies through your web browser if you no longer want them to be recorded.

Purpose and legal basis for processing

The purpose for implementing the above is to maintain and monitor the performance of our website and to constantly look to improve the site and the services it offers to our users. The legal basis we rely on to process your personal data is article 6(1)(f) of the GDPR, which allows us to process personal data when its necessary for the purposes of our legitimate interests.

Security and performance

We host our website in Microsoft Azure in the UK and keep traffic information for 12 months. Google Analytics data may be transferred outside the EEA, but this cannot be used to personally identify you.

Changes to this privacy notice

We keep our privacy notice under regular review to make sure it is up to date and accurate. This policy was last updated in August 2025.