mPOWER respects your right to privacy. Any personal information you provide is only known to the mPOWER consortium and you, unless we state otherwise at the time of collecting data.
The Policy does not cover all of the personal data processing operations by mPOWER, for example data processed in connection to staff and human resourcing, which is covered by the respective policies and procedures of each partner of the mPOWER consortium.
The data controller for data collected and processed in accordance with this Policy is the University of Glasgow.
The address of the University of Glasgow is:
EU and International Team
Research Support Office
Isabella Elder Building
University of Glasgow
Any questions regarding this Policy or any other data protection issue related to the University of Glasgow should be submitted in writing to the above address or by email to Andrew.Cumbers@glasgow.ac.uk.
mPOWER is committed to human rights and social justice and respects fundamental rights to privacy and data protection accordingly.
mPOWER is also committed to disseminating the information it produces as widely as possible and wants to build a community of change that supports its work and broader struggles for social justice in which it is involved.
To meet these objectives mPOWER needs to collect and process some personal data. In accordance with these guiding principles, mPOWER limits the amount of data it collects to that which is needed to meet these objectives, and only ever uses the data that it collects for purposes that are related to those objectives.
mPOWER also engages third party service providers to help it meet its objectives. As far as possible mPOWER only uses service providers that are equally committed to protecting personal privacy.
mPOWER will never sell the personal data it collects, and does everything it can to protect that data against unauthorised access and misuse.
Data collection and processing
In order to meet its communications and community-building objectives, mPOWER collects and processes data from the following data subjects (you are the “data subject” if you fall into any of these categories):
- Web users
- Email list subscribers
- Social media users
mPOWER collects as little personal data as is possible to meet its objectives and serve the needs of its web users and supporters. This is illustrated in the following table, which shows the data collected by mPOWER and who it is collected from.
Not all the data listed below is collected systematically. For example, mPOWER staff may look at information relating to social media users who engage with the organisation on Twitter or Facebook, but does not routinely collect such information.
|Data variables||Data subjects|
|Web users||Email list subscribers||Campaign supporters||Social media users|
|Alias (if applicable)||X|
Although mPOWER does not directly collect sensitive data, some of the data its supporters provide may indicate their political views. This is obviously the case when individuals support one of mPOWER’s politically sensitive research.
Users of the mPOWER’s website and communications platforms should also be aware that the “metadata” they generate when using services may reveal their political interests. This data may be retained by their internet service provider and may be made available to law enforcement agencies. Individuals about this kind of surveillance are advised to take measures to protect their privacy by using TOR or a VPN.
mPOWER collects and processes personal data for the following specific purposes:
- To send emails about its work to its email subscribers;
- To administer its websites and monitor aggregate usage;
- To respond to communications received via its website;
- To respond to requests for information about its services from data subjects;
- To conduct surveys in relation to peer-to-peer learning;
- For related accounting and auditing purposes.
mPOWER takes all reasonable steps to ensure that personal data is treated securely and in accordance with this Policy. Unfortunately, the transmission of information via the internet is not completely secure. Although mPOWER does its best to protect personal data, it cannot guarantee the security of personal data transmitted to its websites. Any such transmission is therefore at the data subject’s own risk.
For personal data in its possession, mPOWER implements various technical and organisational measures in order to prevent unauthorised access. Wherever possible it encrypts the data it collects, transmits and stores. Access controls within the organisation limit the number of people with access to personal information to those that need it in connection with their job responsibilities or contractual obligations.
In order to meet its objectives, mPOWER works with a carefully chosen group of third party service providers to perform tasks on its behalf.
This includes the following service providers, who perform the following tasks.
|Getresponse||Manage email subscriber list|
|Clayburg Creative||Web development|
|Google Analytics||Understand usage of our websites|
mPOWER may also engage additional third-party service providers to provide services such as information technology support or work with partners on campaigns. These activities may involve access to the personal data held by TNI. In these instances we will seek to ensure as far as possible that any such data processing is carried out in accordance with this Policy. This includes conscientiously selecting service providers and only working with trusted partners.
As far as possible, the personal data that mPOWER collects is stored within the European Economic Area and therefore processed in accordance with EU data protection law. However, because some of the partners of the mPOWER consortium work globally, there may be occasions where personal data is processed outside of this jurisdiction, for example by staff or contractors working for mPOWER from other parts of the world. In these rare instances mPOWER takes appropriate steps to ensure that the recipients of personal data are bound by a duty of confidentiality.
mPOWER retains personal data only for as long as necessary in accordance with the above purposes and applicable laws.
When personal data is no longer necessary for these purposes it is securely deleted.
For consent-based services from which the data subject can opt-out at any time such as email updates, mPOWER keeps personal data until it receives instructions to the contrary.
Tracking and cookies
mPOWER limits the information it collects from its website users and the capacity of third parties such as social media companies to track their browsing.
The mPOWER website honours do not track requests and does not use third parties to track users of its website.
The mPOWER website does not include Facebook, Twitter or Google+ buttons (these enable “likes” and/or “shares” but also allow these companies to track users across websites that install these features).
mPOWER’s internet service provider may also process traffic data to support the provision of its services.
mPOWER also collects some data in order to understand how its website is used. This data processing is primarily concerned with counting views and downloads of specific reports, articles and videos, and, if available, the geographical distribution of the views/downloads.
mPOWER also collects data on how people use its websites in order to understand the impact of its work and improve its communication and dissemination. This data processing is primarily concerned with recording the specific pages of the website that people enter and leave the site from, the sections of the website they visit, as well as the items they download.
mPOWER uses this data to report to staff, funders, its Board and partners about the impact of particular reports and workstreams (e.g report X was downloaded Y number of times and reached people in Z countries).
mPOWER also makes limited use of services provided by Google Analytics, which uses “cookies”. These are small files which are placed on web users’ computer devices to administer content for visitors to a website. For more information about cookies see allaboutcookies and EFF’s guide.
mPOWER’s use of Google analytics enables the collection of traffic data but does not allow mPOWER to identify individual users or link web usage to other personal data.
mPOWER uses social media and social networking to increase the reach and impact of its work. These applications require the use of third party service providers.
mPOWER has a Facebook page, LinkedIn page, a Twitter account and a YouTube channel.
mPOWER’s Facebook page is administered by Facebook, in accordance with Facebook’s Data Policy, and is accessible by Facebook users who have already consented to Facebook’s Data Policy.
mPOWER’s social media accounts and pages are managed by mPOWER staff members. mPOWER does not import or export information on its followers or subscribers from or to the aforementioned platforms.
mPOWER may occasionally use direct messaging over social media if it is contacted this way by individuals or organisations. mPOWER aims to delete these messages as soon as it has responded to the queries.
Data subjects rights
Individuals whose personal data is processed by mPOWER have the following rights:
- The right to be informed as to whether mPOWER holds data about them;
- The right of access that information;
- The rights to have inaccurate data corrected;
- The right to have their data deleted;
- The right to opt-out of particular data processing operations;
- The right to receive their data in a form that makes it “portable”;
- The right to object to data processing;
- The right to receive an explanation about any automated decision making and/or profiling, and to challenge those decisions where appropriate.
To make a subject access request or complaint contact Andrew.Cumbers@glasgow.ac.uk or write to
EU and International Team
Research Support Office
Isabella Elder Building
University of Glasgow
Requests can be submitted at any time. mPOWER will provide a response to any such requests in accordance with UK data protection law.
Data subjects covered by EU law may also be entitled to lodge complaints in regard to data processing or the handling of subject access requests with data protection supervisory authority in their country of residence. Relevant supervisory authority names and contact details are listed here.
Changes to the Policy
In the event that the Policy is changed at any time, the date and nature of the change will be clearly indicated in this document.
In the event that the change has a material impact on the handling of personal data, mPOWER will contact the data subjects to inform of the changes and where appropriate seek their consent.