Privacy Policy

What is the purpose of this document?

Generation Global's website, the Ultimate Dialogue Adventure (the “Platform”) is operated by Tony Blair Institute, trading as Tony Blair Institute for Global Change, a company limited by guarantee registered in England and Wales registered company number 10505963. We are a "data controller". This means that we are responsible for deciding how we hold and use personal information about you. You are being provided this privacy notice because you are using our Platform. It makes you aware of how and why your personal data will be used, namely for the purposes of utilising the Platform. This notice provides you with certain information that must be provided under the General Data Protection Regulation ((EU) 2016/679) (GDPR) and the Data Protection Act 2018.

Data protection principles

We will comply with data protection law and principles, which means that your data will be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

The kind of information we hold about you

In connection with your use of the Platform, we will collect, store, and use the following categories of personal information about you:

• Contact Data: includes email address and telephone numbers for both you and your parent/guardian.
• Identity Data: includes name, email address, date of birth (so we can verify you are of an appropriate age to use the Platform) and gender.
• Participation Data: the information you provide when utilising the Platform, including responses to dialogue prompts, questions, posts on forums, etc.
• Profile Data: the information you provide when you create an account, including your home country, country of residence, the school you attend, and your preferences.
• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and other technology on the devices you use to access this website.
• Usage Data: includes information about how you use the Platform.
• Video/Audio Data: video and/or audio data which is generated by your participation in our web discussions.

How we will use information about you

We primarily rely upon consent and/or Legitimate Interest to process your personal information. Consent simply means obtaining your permission. Legitimate Interest means that using your information will help us serve a particular, valid purpose such as running this Platform in order to allow our users to communicate with young people from all over the world, learn about cultural differences and similarities, and build intercultural connections. We consider whether it is necessary to use certain information about you to deliver our goals and balance that interest against your individual interests, rights and freedoms. We also have to use certain information you provide in order to meet our legal and/or safeguarding requirements.

The table below provides further information about how your information will be collected and processed:

Purpose/Activity	Type of Data	Lawful Basis for Processing
To register you to use the Platform and to verify your age.	(a) Identity Data (b) Contact Data (c) Profile Data	Consent: We will obtain your consent for these purposes. Legitimate Interest: We will send confirmation of your registration on the Platform to your parent/guardian. Doing so is in our Legitimate Interest.
To manage our relationship with you, including: ● Notifying you about changes to our terms or privacy policy. ● Administering and moderating the Platform. ● Facilitating web discussions, some of which will take place on third party platforms. ● Communicating with you about the platform and allow other Platform users to interact with you.	(a) Identity Data (b) Contact Data (c) Profile Data	Consent: We will obtain your consent and the consent of your parent/guardian for changes related to our terms or privacy policy. The remaining purposes are in our Legitimate Interest. We may: 1. Process data based upon our legitimate interest in order to enable you to get the most out of the Platform. 2. We may also need to use this information where it is necessary to comply with our legal obligations.
To invite you to participate in a survey, assist us with research and evaluation of our Platform, help us to promote the Platform or provide us with other feedback/assistance.	(a) Identity Data (b) Contact Data (c) Profile Data (d) Usage Data	Legitimate interest: Necessary for our legitimate interests (to study how our users respond to our materials and to develop them and grow our Platform and its content). Invitations sent for this purpose will request your and your parent/guardian's additional consent to undertake the activities requested.
To administer and protect the Platform (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).	(a) Identity Data (b) Contact Data (c) Technical Data (d) Usage Data	Legitimate interest: 1. Necessary for our legitimate interests (for running our business, providing administration and IT services, and ensuring network security). 2. We may also need to use this information where it is necessary to comply with our legal obligations.
To deliver relevant Platform content and materials to you, measure the effectiveness of the content we provide to you, and to assess your dialogue skills and progress when using the Platform.	(a) Identity Data (b) Contact Data (c) Profile Data (d) Usage (e) Technical Data (f) Video/Audio Data	Legitimate interest: Necessary for our legitimate interests (to determine how our users utilise and are progressing through the Platform, how users respond to our work and whether the intended learning outcomes are being achieved, and to further develop the Platform). Consent: In the event we wished to share any video or audio recording with a third party (other than those parties who help us operate the Platform), we shall request your or your parent/guardian's consent for these purposes.
To protect the Platform's users (including to live up to our safeguarding obligations)	(a) Identity Data (b) Contact Data (c) Profile Data (d) Usage Data (e) Technical Data	Use of the data for this purpose is necessary to comply with a legal obligation and also in our Legitimate Interest.
To use data analytics to improve the Platform, products and services, communications, and user relationships and experiences.	(a) Technical Data (b) Usage Data	Legitimate interest: Necessary for our legitimate interests (to understand user experience, to keep our Platform updated and relevant, to develop our business and to inform our strategy).

If you fail to provide personal information

• If you fail to provide information when requested, you may not be able to utilise some or all of the Platform. For example, if you do not provide your date of birth, you will not be able to create an account on the Platform.

How we use particularly sensitive personal information

• Any sensitive personal data (called “Special Category Data”, which includes information such as one's religious beliefs, health information and political views) you input into the Platform is only provided by you on a voluntary basis. By volunteering this information during your use of the Platform, you are making this information available to the users of the Platform. Except to allow users to engage in dialogue on the Platform and to live up to our safeguarding obligations, we will not otherwise utilise your Special Category Data. We encourage all users of the forum to carefully consider what information they choose to disclose about themselves.
• We will only utilise Special Category Data with your explicit consent or as part of our legitimate, not-for-profit interest to provide you with the resources contained in this Platform.

Automated decision-making

• You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

Data Sharing

Why might you share my personal information with third parties?

• We will only share your data with third parties for the purposes of administering or providing the services available via the Platform. We do not allow third parties to use your personal information for their own purposes. We will only permit them to process your personal information for specified purposes and in accordance with our instructions.
• Some third-party services will have separate privacy policies and will ask you to sign up for their policies directly. Utilising the services offered by third parties allows them to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
• We may elect to transfer certain portions of our business to a third party and that may include ownership of this Platform. Your information would only be transferred after we provide notice of the change in ownership and allow you the chance to opt-out.

Data security

• We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need-to-know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
• We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

International Data Transfer

• We share your personal data with other Tony Blair Institute offices and locations. This will involve transferring your data outside the European Economic Area (EEA). When doing so, we ensure your personal data is protected by requiring companies in our group to follow the same rules as we apply in the United Kingdom.
• Some third parties with whom we work are based outside of the EEA, so their processing of your personal data will involve a transfer of data outside the EEA.
• Whenever we transfer your personal data outside of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
  • Where we use certain service providers, we may use specific contracts provisions that give your personal data sufficient protections; and/or
  • Where providers are based in the United States, we may transfer data to them if they are part of the Privacy Shield, which requires them to provide similar protection to personal data shared between the Europe and the United States.
• Please contact us on dataprotection@institute.global if you want further information on the specific mechanism we use when transferring your personal data out of the EEA.

Data Retention

• We will retain your personal data in accordance with our internal policies and only for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
• Accounts will be deactivated 9 months after users reach the age of 18, at which point they age out of the programme.
• Except as otherwise stated in this Policy, User data will be deleted if a user's account has been deactivated for 3 years.
• Certain data about your usage of the Platform will be anonymised. Anonymised data may be kept by TBI indefinitely.
• Where we collect your personal information in reliance on your consent (for example, where you have agreed to provide the information in order to use the website), you have the right to withdraw your consent at any time. To withdraw your consent, please contact helpdesk@generation.global. Once we have received notification that you have withdrawn your consent, we will dispose of your personal data securely. In addition to relying on consent, there are circumstances where we may be required to utilise your information in order comply with legal or regulatory requirements (for example, to address a safeguarding concern). In those circumstances, we may not be able to erase your data until the legal or regulatory requirements have been satisfied.

Cookies

As you interact with our website, we may automatically collect basic technical data, browsing actions and patterns. We collect this information by using cookies, server logs and similar technologies. For further details, please see our Cookie Policy.

Rights of access, correction, erasure, and restriction - your rights in connection with personal information

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

Contact Details

Data protection contact: Tony Blair Institute's Data Protection Officer
E-mail address: dataprotection@institute.global
Postal address: PO Box 60519, London, W2 7JU

• Should you have any concerns or complaints regarding data-protection issues related to this website or the Institute generally, we ask that you provide us the opportunity to address your concerns by contacting the Institute's DPO. You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (ico.org.uk).

This policy was last updated 29 June 2020.