About the Healthy Cities for Adolescents (hereafter ‘the HCA’) programme
Healthy Cities for Adolescents (HCA) is Fondation Botnar’s flagship initiative to create cities fit for young people.
Introduction
At Heathy Cities for Adolescents (hereafter ‘the HCA’), We are committed to protecting your personal data. This privacy policy sets out how We collect and use the personal information (“personal data”) you provide Us with directly or through use of our website (www. healthy-cities.org) (“Website”) and tells you about your privacy rights and how the law protects you.
Who we are
Ecorys UK delivers the HCA phase II programme (HCA-II) on behalf of the Swiss philanthropic organisation Fondation Botnar. For the purposes of the UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and any updating legislation from time to time, we are the Data Controller of information provided by customers. Our address is Ecorys UK, Albert House Quay Place, 92-93 Edward St, Birmingham B1 2RA (“Ecorys UK”, ”We”, ”Our”, “Us”).
Where we obtain your personal data
The table below sets out how Ecorys UK obtains your personal data.
| If you are… | And you are… | We obtain your personal data through… |
|---|---|---|
| A visitor to the HCA programme website | Browsing the HCA programme’s website for information | The cookies on the website |
| A visitor to the HCA programme website | Signing up to the HCA programme mailing list | The information that you provide when completing the mailing list registration form on the website |
| Working in an applicant organisation (organisations applying for funds under the HCA-II programme) | Submitting an application for the HCA-II programme | The information that you provide when completing and the application form through the means stipulated by Ecorys for each specific call. |
| Working in a participant organisation (organisations leading or part of the consortium for the delivery of a project funded under the HCA-II programme) | Submitting reports and requests required as part of the monitoring process | The information that you provide when submitting your reports to Ecorys |
| A participant in HCA-II programme activities | Taking part in in any of the activities funded under the HCA-II programme and delivered by participant organisations between June 2022 and December 2026 | No personal information will be collected or transferred to Ecorys |
| A participant in HCA-II programme activities | Taking part in in any of the activities funded under the HCA-II programme and being approached by our Global Learning Partner to provide feedback for Monitoring and Evaluation purposes. | No personal information will be collected or transferred to Ecorys |
The types of personal information we collect
If you sign up to the mailing list on the website or if you work in applicant organisation, Ecorys will collect and process the following personal data:
- First name
- Last name
- Contact details
- Role within the organisation
Purposes for which we will use and share your personal data
We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
Ecorys may share anonymised enquiry and registration data and anonymised aggregated data with Fondation Botnar and Ecorys’ internal stakeholders.
Note that Ecorys may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact Ecorys through the Contact us Form on this site of you need details about the specific legal ground we are relying on to process your personal data, where more than one ground has been set out in the table below.
| Purpose/Activity | Type of data | Lawful basis for processing including basis of legitimate interest | Organisations that we may share this data with |
|---|---|---|---|
| To register your interest in the HCA programme and to provide you with information about it; and to process your application for funding | (a) Identity (b) Contact |
Where the processing is necessary for the performance of a task in the public interest or for the organisation’s official functions to support Fondation Botnar in the delivery of the HCA-II programme. | None |
| To distribute funding and monitor how funding is used | (a) Identity (b) Contact (d) Role in the organisation (d) Financial information |
Where the processing is necessary for the performance of a task in the public interest or for the organisation’s official functions to support Fondation Botnar in the delivery of the HCA-II programme | None |
| To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy policy (b) Asking you to leave a review or take a survey | (a) Identity (b) Contact |
(a) Necessary to comply with a legal obligation (b) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services) | None |
| To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) | (a) Identity (b) Contact (c) Technical |
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation | None |
| To use data analytics to improve our website, products/services, marketing, customer relationships and experiences | (a) Technical (b) Usage |
Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy, to provide you with optimised content and allow you to get the best experience whilst browsing) | Not applicable |
We also collect, use, and share anonymised Aggregated Data such as statistical or demographic data for any purpose, related to the HCA programme. Anonymised Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
Organisation details, where collected, are used for monitoring and evaluation and statistical purposes. If we need to contact you, we will do so using the contact details you have provided. Ecorys collects country of origin information for reporting and statistical purposes and to contact you within your own country.
Use of sub-processors
Your personal information will not be used/shared beyond the sub-processors listed below for any other purpose without your specific consent.
Below we have outlined organisations that act as a sub-processors on behalf of Ecorys. These are organisations that hold, store, or process data on behalf of Ecorys and are GDPR compliant.
Use of cookies
As you interact with our website, we will automatically collect personal data by using cookies, server logs and other similar technologies. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.
Our website uses first-party and third-party cookies for several purposes. First-party cookies are mostly necessary for the website to function the right way, and they do not collect any of your personally identifiable data.
The third-party cookies used on our website are mainly for understanding how the website performs, how you interact with our website, keeping our services secure, and providing you with a better and improved user experience and help speed up your future interactions with our website.
For more information on our use of cookies and how to disable cookies go to our Cookies policy refer to Section 10. Enabling/disabling and deleting cookies.
How long we will keep your information
Ecorys will keep the personal data you provide for a period of seven (7) years upon the end of the programme’s lifecycle. This is the term that applies to all records which it may need for audits or recoveries. The first year of the HCA-II programme runs from June 2022 until the end of December 2026, therefore we will keep your data until December 2033.
Third-party links
The HCA programme website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our websites, we encourage you to read the privacy policy of every website you visit.
Data protection rights
We are committed to the security of customer information and we have security procedures in place to protect personal data from the accidental loss, misuse, unauthorised access, alteration or disclosure of information under the HCA-II management control.
You have the right to ask for a copy of the information we hold on you, and the right to ask us to correct any inaccuracies in that information.
In some situations, you have the right to require us to restrict the processing of your personal information. You can require us to restrict processing in the following circumstances:
- We are processing your personal data unlawfully and you do not want us to delete the information but restrict it instead.
- You are concerned that the information we hold about you is inaccurate. You can ask us to restrict the information until we are able to determine whether the information is accurate or inaccurate.
- We no longer need the information for the purposes for which we collected it, but they are needed by you for the establishment, exercise, or defence of legal claims.
- You have objected to the processing (see below) and we need to decide whether the legitimate interests under which we have to process the information override your fundamental rights.
- You think we are processing your personal information unlawfully, but do not want the information deleted.
You have the right to object to our processing your personal information for the following purposes.
- Processing for the purposes of direct marketing.
- Processing for the purposes of automated decision making and/or individual profiling.
In certain circumstances you have the right to require that Ecorys securely deletes or destroys your personal information (the ‘right to be forgotten’).
In certain circumstances you also have the right to data portability, that is the right to request and receive a copy of your information in a structured, commonly used and machine-readable format, along with the right to ask us to send that information to another organisation.
In order to exercise any of your rights under the Data Protection Act 2018 / UK GDPR, please contact us at [email protected].
Right to lodge a complaint
If you have concerns about how we have used your personal information, you also have the right to complain to a privacy regulator.
We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance at [email protected] providing your full name, address and postcode and the email address which you would have originally used.
Complaints about how we process your personal information can be considered by the UK data protection regulator, the Information Commissioner’s Office (ICO). The ICO can be contacted using the following details:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
UNITED KINGDOM
Website: www.ico.org.uk
Email: [email protected]
If you live in a country or territory located in the European Union (EU) or European Economic Area (EEA), and you think that some, or all, of the issues you are concerned about have taken place in your country of residence, you can complain to your national data protection regulator. For contact details of national data protection regulators in the EU and EEA, please refer to the European Data Protection Board website.