Privacy Policy

1. Definitions

In this Privacy Policy the following definitions are used:

  • “Data” means all personal data (as defined by the UK GDPR and EU GDPR) that you submit to IV Hub through this Website.

  • “Cookies” are small files stored on your device to improve your browsing experience and track website usage.

  • “Data Protection Laws” refers to all applicable data protection and privacy legislation in force, including but not limited to the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

  • “Website” refers to the website that you are currently using, impactvaluationhub.org, and any sub-domains of this site unless expressly excluded by their own terms and conditions.

  • “User,” “you,” “your” means any individual accessing or using our website and is not either 1. employed by IV Hub and acting in the course of their employment or 2. engaged as a consultant or otherwise providing services to IV Hub and accessing the website in connection with the provision of such services.

  • “IV Hub,” “we,” “our,” “us” refers to the data controller:

IV Hub
LCVS
151 Dale Street
Liverpool, L2 2AH
United Kingdom

Email: hello@impactvaluationhub.org
Website: www.impactvaluationhub.org

2. Scope of This Privacy Policy

This Privacy Policy applies solely to your use of this Website and the personal data collected through it. It does not apply to any third-party websites that may be linked from our website. We encourage you to read the privacy policies of any external websites before submitting any personal data.

For the purposes of Data Protection Laws, IV Hub is the data controller, responsible for determining the purposes and means of processing your personal data.

3. What Data We Collect

We may collect, store, and use the following types of personal data:

  • Full name

  • Email address

  • Phone number

  • Job title and profession

  • Organisation and region

  • IP address and browser type

  • Financial details (e.g., payment information)

  • Comments, uploads (including images and documents), and associated metadata

  • Technical data from website usage (e.g., device and browser information, referral data)

We do not collect special category data (e.g., race, religion, political beliefs, health data) unless explicitly provided and with your clear consent.

Our Website is not intended for children under the age of 16, and we do not knowingly collect personal data from children without parental consent.

We use Google Analytics with IP anonymisation enabled. Data collected is used solely for internal insights and is not shared with advertisers or used for profiling or automated decision-making.

4. How We Collect Your Data

We collect personal data in the following ways:

a) Data that is given to us by you:

  • When filling out forms (e.g., newsletter signups, membership, contact)

  • Through correspondence by email, phone, post, or in-person at events

  • When creating an account or completing a transaction

  • When submitting comments, images, or other content

  • When you use our services

b) Data collected automatically:

  • IP address and device/browser information

  • Website usage through cookies and analytics tools (e.g., Google Analytics)

  • Metadata from comments or uploaded content (e.g., EXIF from images)

Spam detection and security monitoring systems

5. Legal Basis for Processing

We rely on the following lawful bases for processing your personal data under the UK/EU GDPR:

Purpose of Processing

Email marketing

Account and membership management

Payment processing

Website analytics and performance

Service improvement and internal record keeping

Responding to inquiries

Legal Basis

Consent or soft opt-in (PECR compliant)

Contractual necessity

Contractual necessity and legal obligation

Legitimate interest

Legitimate interest

Legitimate interest or consent

Where we rely on legitimate interest, we ensure it does not override your fundamental rights and freedoms. A Legitimate Interest Assessment (LIA) has been conducted where required.

6. Marketing Communications

We may send marketing communications if:

  • You have explicitly opted in (consent)

  • You are an existing contact, and our communications are relevant and infrequent (soft opt-in, as allowed under PECR)

 

You can withdraw your consent or opt out at any time by:

We do not sell or share your data for third-party marketing purposes.

7. Who We Share Your Data With

We do not sell or rent your personal data. We only share it where necessary and with appropriate safeguards:

  • Regional networks or partners – only where you’ve provided direct consent

  • Service providers – such as website hosts, payment processors, CRM platforms, email service providers, and accounting systems

  • Security tools – such as anti-spam and security monitoring services

  • Legal obligations – where required by law, regulation, or court order

All third-party processors are required to handle your data securely and in accordance with Data Protection Laws.

8. Data Security

We implement robust technical and organisational security measures, including:

  • SSL/TLS encryption for data in transit

  • Secure data storage with restricted access

  • Password protection and user access controls

  • Staff training and internal data handling protocols

  • Regular audits and system reviews

If you suspect a data breach, contact us immediately at hello@impactvaluationhub.org.

9. Cookies

We use cookies and similar technologies for:

  • Website functionality and performance

  • Understanding visitor behaviour (via Google Analytics)

  • Saving user preferences

  • Email tracking (e.g., Mailchimp)

Types of Cookies We Use:

  • Essential Cookies – required for the operation of the Website

  • Analytical Cookies – help us understand user behaviour

  • Functionality Cookies – remember choices you make

You can manage your cookie preferences via your browser settings.

10. International Data Transfers

Some of our service providers are based outside the UK/EU (e.g., Mailchimp, Google). In these cases, we ensure adequate safeguards are in place, such as:

  • Standard Contractual Clauses (SCCs) approved by the UK/EU

  • UK International Data Transfer Agreement (IDTA)

  • Data Privacy Framework (where applicable)

These measures ensure your data is protected to the same standard as under UK/EU law.

11. Data Retention

We only keep your data for as long as necessary to fulfil the purpose it was collected for, including:

  • While you have an account or active engagement with us

  • To comply with legal, accounting, or reporting obligations

  • Until you request deletion (subject to legal exceptions)

Some data may remain in secure backups for a limited time.

When data is no longer needed, it is securely deleted or anonymised.

12. Your Data Protection Rights

You have the following rights under the UK/EU GDPR:

  • Right of access – request a copy of your data

  • Right to rectification – correct inaccurate or incomplete data

  • Right to erasure – ask for data to be deleted

  • Right to restrict processing – limit how we use your data

  • Right to data portability – request your data in a usable format

  • Right to object – particularly to marketing or legitimate interest uses

  • Right to withdraw consent – at any time

To exercise these rights, email us at hello@impactvaluationhub.org.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. However, it may limit your ability to use certain features or services.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.

13. External Links

Our website may contain links to third-party sites. We are not responsible for their privacy practices or content. You are encouraged to read their policies before submitting any personal data.

14. Business Transfers

In the event of a merger, acquisition, or business restructure, your data may be transferred to a successor organisation. Any such transfer will be carried out in compliance with Data Protection Laws and this policy.

15. Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. Any disputes arising shall be subject to the exclusive jurisdiction of the courts of England and Wales.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal or operational changes. We will notify users of material updates via the Website or email. Continued use of our website indicates your acceptance of any changes.

Questions or Concerns?