Dialogue Earth Privacy Notice

1. Summary

● We only collect personal data we need for our work;
● We do not sell your data;
● You have rights over your data, including access, correction, and deletion;
● We use trusted third parties for services like payroll, newsletters, and surveys;
● Contact us at [email protected] for any data questions.

2. Introduction

This privacy notice explains how Dialogue Earth (“we”, “us”) collects, uses, shares, and protects personal data. It applies to everyone we interact with, including staff, volunteers, funders, partners, website users, and others.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This notice combines our employment and public-facing privacy notices.

3. Who We Are

Dialogue Earth is a UK-based non-profit organisation which publishes journalism and media covering a range of climate and sustainability topics.

We are the “data controller,” which means we decide how and why your personal data is used.

● Address: Dialogue Earth, 15 Printing House Yard, Perseverance Works, London E2 7PR, UK;
● Email: [email protected];
● Telephone: +44 (0)7542 525 859.

4. The Personal Information We Collect and Use

We collect and use personal data for the following purposes:

4.1 Staff, Contractors, and Volunteers

We collect and use personal information for the recruitment, administration, and management of our staff, contractors, and volunteers.

We collect different types and amounts of personal information depending on your relationship with us. For example, we collect more information about salaried staff compared to contractors and volunteers, as appropriate for each role. Not all of the information listed below is collected for every individual:

● Contact details (e.g. name, address, telephone number, personal email address);
● Date of birth;
● National Insurance number;
● Gender (voluntary);
● Marital status (voluntary);
● Copies of passports or other photo ID;
● Emergency contact or next of kin details;
● Employment history (e.g. job applications, CVs, employment references);
● Education history and qualifications;
● Right to work information (e.g. passports, visas);
● Criminal record declarations or DBS checks (if applicable);
● Security clearance details (if applicable);
● Performance records (e.g. appraisals, complaints, disciplinary procedures);
● Training history and development needs;
● Grievance records;
● Staff photos (for the website);
● IT monitoring data (if applicable);
● Political, conflict of interest, or gift declarations (if applicable);
● CCTV/audio (if on monitored premises).

We use this data to:

● Assess applications;
● Communicate with candidates and employees;
● Comply with employment laws;
● Manage employment or volunteer relationships;
● Monitor performance and training needs;
● Support equal opportunity and inclusion initiatives (where relevant);
● Maintain appropriate records to support good governance.

For trustees and some staff, certain personal information (such as name and contact details) is shared with the Charity Commission and Companies House as required by law. This information may be published on public registers in line with statutory requirements.

4.2 Salaries, Contractor Payments, and Pensions

We collect and use personal information to manage salaries, contractor payments, and pensions. The types of information we collect depend on your role and contractual relationship with us. For example, we collect more information for salaried staff than for contractors, as appropriate. Not all of the information listed below is collected for every individual:

● Job role and employment contract details (e.g. start and end dates, salary, changes to employment terms);
● Time worked (e.g. timesheets);
● Expense, overtime, or other payments received;
● Records of leave taken (e.g. annual leave, sick leave, special leave);
● Maternity, paternity, shared parental, and adoption leave and pay;
● Bank account details;
● Payroll records and payment history;
● Pension scheme details;
● Tax status and National Insurance numbers.

We use this data to:

● Pay salaries and other entitlements;
● Administer payroll, pensions, and benefits;
● Process expenses, overtime, and leave;
● Comply with tax, pension, and other legal obligations as an employer.

4.3 Health and Wellbeing

We collect and use personal data to support the health and wellbeing of our staff, contractors, and volunteers. This includes:

● Voluntarily disclosed health information (e.g. long-term conditions, allergies, medication);
● Occupational health referrals and assessments;
● Fit notes or statements of fitness for work from GPs or hospitals;
● Records of sickness absence or return-to-work interviews;
● Accident or incident reports at work;
● Requests for and records of access needs or reasonable adjustments.

We use this data to:

● Fulfil our duty of care to you as a staff member, contractor, or volunteer;
● Support your health, safety, and wellbeing while working with us;
● Make reasonable adjustments or provide support where needed;
● Comply with health and safety and employment law;
● Only use this information with your explicit consent, where appropriate.

4. 4 Website Users and Public Services

(i) Visitors to Our Websites

When someone visits our website dialogue.earth, we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

(ii) Use of Cookies by Dialogue Earth

You can read more about our use of cookies in our Cookie Policy here.

Our website may include social media features (such as sharing buttons or embedded feeds). These features may collect your IP address and which page you are visiting, and may set a cookie to enable the feature to function properly. Your interactions with these features are governed by the privacy policy of the company providing them.

(iii) Social Media

If you interact with us via our official social media accounts (e.g. by following, commenting, messaging, or sharing our content), your personal data may be processed by both Dialogue Earth and the relevant social media platform, in accordance with their respective privacy policies.

(iv) Search Engine

Our website uses WordPress’s built-in search feature. Search queries are processed only to deliver relevant results and are not stored in a way that identifies you personally. Standard server logs may record search terms as part of anonymous traffic data for security and performance monitoring.

We may also use Google Analytics 4 (GA4) to analyse aggregated search behaviour on our site, in order to improve our content and navigation. If search terms are logged, they are recorded in an anonymised form and are not linked to your IP address, cookies, or any other personally identifiable information. GA4 automatically deletes search-related event data after 2 months.

For more information about how we use cookies or analytics, please see our Cookies Policy.

(v) Newsletter

We use a third-party provider, Mailchimp, to deliver our bi-weekly or monthly e-newsletters. If you sign up for our newsletter, we collect and store your email address (and name, if provided) for this purpose. Your data is processed by Mailchimp on our behalf. We gather statistics around email opening and clicks using industry-standard technologies to help us monitor and improve our newsletter.

Our lawful basis for processing your data is your consent, which you can withdraw at any time by clicking the “unsubscribe” link in any newsletter, or by contacting us at [email protected]. You have the right to access, correct, or erase your newsletter data at any time.

We retain your subscription data until you unsubscribe, or after 2 years of inactivity. Mailchimp may process your data outside the UK/EU, and we ensure appropriate safeguards are in place. For more information, please see Mailchimp’s Privacy Notice.

(vi) Hosting

Our website, dialogue.earth, is hosted by Amazon Web Services (AWS) and managed on our behalf by a web hosting support provider. Personal data stored on our website’s servers may include information you provide through forms, newsletter sign-ups, and other interactions with our site. This data is owned and controlled by Dialogue Earth and is held for the purpose of operating and maintaining our websites. Neither AWS nor our web hosting support provider access, analyse, use, share, or sell your personal data, except as required to provide hosting and support services under our instructions.

AWS may process or store data outside the UK/EU. We ensure that appropriate safeguards, such as Standard Contractual Clauses or adequacy decisions, are in place to protect your information. AWS uses industry-standard security measures, and Dialogue Earth also takes steps to keep your data secure.

Our lawful basis for storing this data is our legitimate interest in providing a functional and secure website. We retain data in accordance with our data retention policy (see the Data Retention section below).

For more information, please see AWS’s Privacy Notice. If you have any questions or wish to exercise your data rights, please contact us at [email protected].

4.5 Funders

We collect and use personal data relating to our funders and funding organisations to manage our funding relationships, fulfil reporting obligations, and ensure transparency in our operations. This may include:

● Contact details of individuals at funding organisations (e.g. name, business address, email, phone number);
● Details of funding agreements or contracts;
● Correspondence and reports relating to the funded project or partnership.

We use this information to:

● Communicate about funding and project delivery;
● Manage funding agreements and process payments;
● Meet our legal, regulatory, and reporting obligations (for example, to demonstrate how funds are used).

We retain funder information for as long as necessary to manage our relationship and comply with legal and regulatory requirements. We do not share funder information publicly unless required by law or with your explicit consent.

4.6 Readership Survey Participants

We use SurveyMonkey to deliver our annual readership survey. Participation is entirely voluntary. If you choose to take part, we may collect your survey responses, IP address (to help limit multiple responses), and any other information you choose to provide. We do not collect your name or contact details unless you voluntarily include them in your response.

Our lawful basis for processing this data is your consent, which you provide by choosing to participate in the survey. We analyse survey responses to improve our services and may share general, anonymous trends and feedback with our partners and funders. Any information shared with third parties will be fully anonymised and cannot be used to identify you.

Survey data is stored securely by SurveyMonkey and by Dialogue Earth for up to 2 years, after which it is deleted. SurveyMonkey may process data outside the UK/EU, and we ensure that appropriate safeguards (such as Standard Contractual Clauses) are in place.

You have the right to withdraw your response or request deletion of your survey data at any time by contacting us at [email protected]. For more information, please see SurveyMonkey’s Privacy Notice.

4.7 People Who Use Dialogue Earth Services

When you request a service from Dialogue Earth – such as subscribing to our newsletters or taking part in surveys – we collect and use your personal data only for the purpose of delivering that service and related improvements (for example, seeking feedback).

We do not use your data for unrelated purposes or share it for marketing. Your data is stored securely and retained in line with our Data Retention Policy.

For more information about how we handle your data when you subscribe to our newsletter or participate in surveys, please see the dedicated sections of this policy: Newsletter: Section 4.4(v) and Readership Survey Participants: Section 4.6.

4.8 Event Photography and Media

We take photographs and videos at events we organise or support, which may include images where individuals can be identified. These images are used to document and promote our activities, engage our community, and support our mission, and may be shared with project partners (for example, as part of project reporting or collaborative initiatives). Occasionally, selected images may also be used for external purposes such as publicity, reporting to funders, or sharing on our website or social media.

Photographs are stored securely on internal servers and retained only as long as necessary for the stated purposes. We do not share identifiable images with third parties without consent, unless required by law or as part of agreed project reporting to partners.

We rely on our legitimate interests as the lawful basis for processing these images, ensuring that this does not override your rights and freedoms. For invite-only events (such as workshops or private meetings), we will seek your explicit consent to use photographs or videos featuring you, either in advance of the event or at the time of attendance. This ensures you have full control over how your images are used.

For public events that are open to anyone and where attendance is unrestricted, your participation is taken as implied consent to use photographs and videos that include you. We make reasonable efforts to inform attendees that photography and filming will take place and how the images may be used. If you prefer not to be photographed or featured, please inform us at the event or contact us afterwards to discuss your preferences.

Where images focus on identifiable individuals, or are intended for external publication or publicity, we take extra care to respect your privacy and will seek explicit consent where appropriate. You have the right to withdraw your consent at any time, and we will promptly remove or stop using your images upon request, subject to any legal or contractual restrictions.

For more information about your rights regarding images and how we process them, please contact us at [email protected].

4.9 Editorial and Journalistic Use of Personal Data

As a news organisation, Dialogue Earth processes and publishes personal data, including images and other media, for journalistic and editorial purposes. This includes photographs and videos that may feature individuals in public or private settings, sourced from reputable agencies (such as Alamy), commissioned professional photographers, or used under Creative Commons licences.

We process this data in accordance with the UK GDPR, Data Protection Act 2018, and the ICO’s Data Protection and Journalism Code. We may rely on the journalistic exemption where publication is in the public interest. We carefully balance the public’s right to know with individuals’ privacy rights and document our decision-making processes in line with legal and regulatory requirements.

Where required, agencies or photographers are responsible for obtaining any necessary permissions or releases for identifiable individuals. We use images for editorial purposes such as reporting, analysis, and public interest communication. If we intend to use images for promotional or publicity purposes beyond editorial use, and individuals are clearly identifiable, we will seek explicit consent wherever possible.

If you have concerns about our use of personal data, including images published on our website, or wish to request removal or correction, please contact us at [email protected].

4.10 Suppliers, Contractors, and Service Providers

We collect and use personal information relating to our suppliers, contractors, service providers, collaborators, and platform users to manage our business relationships, support our operations, and fulfil contracts. This may include:

● Contact details (e.g. name, business address, email, phone number);
● Bank or payment details;
● Copies of signed contracts or agreements;
● Invoices and payment records;
● Correspondence relating to services provided;
● Information stored on business management platforms (e.g. Salesforce, Fibery) to maintain institutional memory and support project delivery;
● Information about authors, staff, influencers, and collaborators whose identities we share or who participate in joint initiatives.

We use this information to:

● Enter into and manage contracts for goods and services;
● Process payments and maintain financial records;
● Communicate about services, projects, and collaborations;
● Maintain records and institutional knowledge securely;
● Connect contacts or make professional recommendations where appropriate;
● Comply with legal and regulatory obligations (e.g. tax, audit).

The lawful basis for processing this data is primarily:

● Contract (to fulfil our agreements);
● Legal obligation (for financial and regulatory compliance);
● Legitimate interests (to manage and improve our business operations, maintain institutional memory, and facilitate professional networking), provided this does not override your rights and freedoms.

Where we connect contacts or make recommendations without prior consent, we rely on legitimate interests, balancing our organisational needs with individuals’ privacy rights. If you have concerns about how your data is used in this way, please contact us at [email protected].

For processing relating to authors, staff, influencers, or collaborators whose identities we share publicly or via social media, we use legitimate interests and, where required, obtain explicit consent, especially for promotional or publicity purposes.

We do not sell personal data to third parties. All information is stored securely, and access is limited to authorised personnel.

We retain supplier, collaborator, and platform user information only as long as necessary to manage our relationships and comply with legal requirements.

4.11 Specialist Advisors and Consultants

We may share personal data with specialist advisors and consultants, including employment lawyers and external HR consultants, to obtain professional advice and support on employment, legal, and human resources matters.

Legal advice provided by solicitors is subject to legal professional privilege, which means it is confidential and protected. However, advice from external HR consultants or other non-legal specialists may not have the same legal protections and could be subject to disclosure in specific legal or regulatory contexts, such as employment tribunal proceedings or subject access requests.

We ensure that any personal data shared with these advisors is limited to what is necessary and handled securely in accordance with data protection laws.

4.12 Meeting Recordings

We may occasionally record internal meetings or project-related discussions to support accurate minute-taking, aid project documentation, or improve internal communication. These recordings may capture personal data such as:

● Names, voices, and video of participants;
● Contributions made during meetings;
● References to roles, projects, or responsibilities.

We use this information to:

● Produce accurate minutes or project records;
● Support internal accountability and project delivery;
● Maintain a record of discussions where appropriate.

Recordings are only retained until the minutes are finalised and approved (typically within 1 month), after which they are securely deleted. Access to recordings is limited to authorised staff and project leads, and recordings are only made where necessary and appropriate.

We will inform participants if a meeting is being recorded. Recordings containing sensitive or special category data are treated with enhanced confidentiality. 

5. Lawful Bases for Processing Personal Data

We only process personal data where we have a lawful basis under UK GDPR. These include:

● Contract – to enter into or carry out contracts (e.g. employment, volunteering, donor agreements);
● Legal obligation – to meet legal duties (e.g. tax, employment law, health and safety);
● Legitimate interests – to support our operations and governance, unless outweighed by individual rights;
● Consent – for optional activities such as newsletters, readership surveys, and voluntary data disclosures;
● Vital interests – to protect someone’s life in an emergency (e.g. using emergency contact information).

For more detail on how we apply these lawful bases to specific activities, please see the Appendix at the end of this notice.

6. Where We Get Your Information

We collect personal information from a variety of sources, depending on your relationship with Dialogue Earth. These include:

● You directly;
● Employment agencies;
● Referees;
● Educational institutions;
● Government departments (e.g. HMRC);
● Health providers;
● Pension administrators;
● Partner organisations;
● Suppliers, contractors, and service providers (including landlords and professional advisors);
● Photographers, media agencies, and content providers;
● Public sources (e.g. LinkedIn, company websites);
● Data processors and online tools;
● Funders and funding organisations.

Not all of these sources apply to every individual, and we only collect information relevant to your relationship with us.

7. Who We Share Your Data With

We may share your personal data with:

● HMRC, the Charity Commission, Companies House, and other regulators (to comply with legal obligations);
● Pension and payroll providers (e.g. Xero, Aviva, for payroll and benefits administration);
● Health and wellbeing providers (e.g. occupational health professionals, employee assistance helpline, for supporting staff/volunteer wellbeing);
● HR software providers (e.g. Natural HR, for HR management and administration);
● Benefits scheme providers (e.g. Cycle to Work scheme administrators, other employee benefit providers);
● CRM and contact management systems (e.g. Salesforce, Trello, Fibery, for managing funder and partner relationships);
● IT and infrastructure providers (e.g. AWS, Microsoft, Google, for secure hosting and communication);
● Communication providers (e.g. Mailchimp, for newsletters);
● Survey platforms (e.g. SurveyMonkey, for feedback and research);
● Social media platforms (e.g. Twitter/X, WeChat, Facebook, LinkedIn, Instagram, for managing our official accounts and sharing content);
● Partner institutions (e.g. universities, NGOs and CSOs involved in joint projects, under data sharing agreements);
● Suppliers, contractors, and service providers (e.g. for facilities, IT, property leases, or other business operations);
● Landlords or property managers (for managing leases or tenancy agreements);
● Media agencies, photographers, or content providers (for commissioned editorial content or images);
● Professional advisors (e.g. accountants, auditors, legal advisors);
● Domain and DNS providers (e.g. GoDaddy, for domain registration and management);
● IT support providers (for technical support and maintenance, including access to internal servers and storage);
● Cloud storage and server management providers (e.g. Synology, for NAS/cloud management);
● Device management providers (e.g. Jamf, Kandji, for secure management and monitoring of staff laptops and devices);
● Specialist advisors and consultants (e.g. employment lawyers and external HR consultants, for professional advice and support on employment, legal, and HR matters);
● Funders and funding organisations (for reporting, compliance, and partnership management, where required by funding agreements).

In some projects, we collaborate with partners such as universities, research institutes, or civil society organisations. Where required, we may share relevant personal data with these partners under data sharing agreements. Each organisation acts independently unless otherwise stated, and we do not currently operate under joint controller arrangements.

We only share personal data as necessary, in line with our lawful basis for processing. We never sell your personal data. Some providers may be based outside the UK – see Section 8 below for more information about international data transfers.

We review and update our list of third-party providers regularly. While this notice includes our main data processors, other platforms may occasionally be used for short-term or specialist purposes. If you would like a full list of current services or have concerns about any provider, please contact us at [email protected].

8. International Data Transfers

Some of our service providers are based outside the UK or may process data in other countries. Whenever we transfer your personal data internationally, we ensure that appropriate safeguards are in place to protect your information, including:

● UK-US Data Bridge (UK extension to the EU-US Data Privacy Framework), where the provider is certified;
● Standard Contractual Clauses (SCCs) with the UK Addendum;
● UK adequacy regulations;
● Your explicit consent when necessary.

Key examples of international data transfers include:

We regularly review the safeguards in place with our service providers to ensure your data remains protected. For more information about how each provider handles your data, please see their respective privacy policies.

A full list of our main data processors and their locations is available on request.

9. Data Processors

We use trusted third parties to process personal data on our behalf. These organisations only process your data under our instructions and in accordance with data protection law. We ensure that appropriate contracts and safeguards are in place with each provider.

Below are our main data processors, the purpose for which we use them, and where they are based:

These processors are only permitted to use your data for the purposes we specify and are required to keep your data secure.

For more information about international data transfers and the safeguards we use, please see Section 8.

10. Data Retention

We only keep personal data as long as necessary. Below are standard retention periods:

11. Your Rights

You have the following rights over your personal data:

● The right to be informed;
● The right of access;
● The right to rectification;
● The right to erasure;
● The right to restrict processing;
● The right to data portability;
● The right to object;
● Rights relating to automated decision-making and profiling (not currently used by Dialogue Earth).

You also have the right to withdraw consent where it is the lawful basis. To exercise your rights, contact: [email protected].

11.1 Submitting a Subject Access Request

If you would like to request access to the personal data we hold about you, you can do so by emailing us at [email protected] with the subject line “Subject Access Request.”

We may need to verify your identity before processing the request. We aim to respond within one calendar month. If the request is complex or involves numerous records, we may extend this timeframe and will inform you accordingly.

12. Complaints

If you are unhappy with how we handle your data, please contact us in the first instance. If you are not satisfied with our response, you can contact the Information Commissioner’s Office (ICO):

● Website: ico.org.uk/concerns;
● Phone: +44 (0)303 123 1113;
● Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, UK.

13. Data Security

We use technical and organisational safeguards, including:

● Encryption and secure servers;
● Password protection and access control;
● Staff training;
● Regular data protection reviews.

All multimedia and images are stored securely on a private, access-controlled server (NAS) managed by Dialogue Earth. Access is restricted to authorised staff, trusted IT support personnel, and, where necessary, external collaborators with limited permissions. Our NAS is managed via a Synology online account. Where Synology cloud features are used, appropriate safeguards are in place for international data transfers.

14. Changes to This Privacy Notice

We regularly review this privacy notice. Updates will be posted at: dialogue.earth/privacy.

15. Appendix: Lawful Basis by Activity

Where more than one lawful basis is listed, the basis used depends on the specific activity and relationship. For editorial and journalistic content, we may rely on the journalistic exemption as set out in UK data protection law.

Last Review: September 2025
Next Review: September 2026