Data Privacy Notice

Introduction

The Duke of Edinburgh’s International Award Malta Foundation (the “Foundation”, “we”, or “us”) is registered in Malta with registration number LPF-171.

We are committed to keeping your personal information safe and meeting our responsibilities under privacy law.   This Privacy Notice describes how we collect and use personal information about people the Foundation engages and works within our existing network, and those that visit our digital sites (including but not limited to our website – www.intawardmt, the Online Record Book and the Award Community). This includes, but is not limited to, personal information relating to our prospect and licensed Operators, participants, volunteers, and supporters.

For those visiting our digital sites, we will ask you to consent to our use of cookies in accordance with the terms of this Privacy Notice. More information on the cookies on our websites can be found in our Cookie Policy here.

If you have any questions regarding your personal information, please contact us using the Contact Details set out in section 10 below.

  1. The type of personal information we collect
  2. Where we get your personal information
  3. Why we collect and use your personal information and our lawful bases
  4. How we use and disclose personal information
  5. International data transfers
  6. How we store and retain your personal information
  7. Your rights
  8. Complaints
  9. Other websites
  10. Contact Details
  11. Updates to this

1. The type of personal information we collect

1.1.   Personal information is any information that relates to an individual. It does not include information where the identity of the individual has been fully and effectively removed (anonymous data).

1.2. Under data protection legislation, certain personal information is considered more ‘sensitive’ (e.g., information relating to race, religion, political affiliation, and health). This is also known as ‘special category data’. In certain circumstances, the Foundation may collect special category data about individuals. For example, you may be asked to provide information on your ethnic origin when registering for the Online Record Book or when completing a research survey (though you are not obliged to do so).

2. Where we get your personal information

2.1.     The Foundation generally collects personal information directly from the relevant individual or their authorised intermediaries, for example when you sign up to one of our services or otherwise engage with us.

2.2.   We may also collect personal information about you via a third party (rather than from you directly), for example when you have provided your consent for this information to be shared with us. When we do so, we will ensure that the subject of the information has been made aware of this action.

2.3.   We may collect personal details about you that are available from public sources, such as from social networks (depending on your settings or the privacy policies for sites and services), company websites, political and property registers, and news archives. We may use data services agencies to collect this information.

2.4.   We have set out further details about what personal information we collect and why in Section 3 below.

3. Why we collect and use your personal information and our lawful bases

3.1.     The Foundation generally collects personal information in order to manage, administer, record and support the delivery of the Duke of Edinburgh’s International Award (the “Award”). Information is also collected to keep employees at National Award Operators and at the Foundation, volunteers, supporters, and participants informed about Award activities and events.

3.2.   Below we have outlined the different processes where personal information is collected, what type of personal information is collected, how this information is obtained and processed, the purpose for collecting the information and on what lawful basis:

Process What How Purpose/Why Lawful basis
Training courses & recording of delegate information • First Name
• Last Name
• Email Address
• Associated organisation
• Previous Award training experience
Online booking form via Microsoft Forms or JotFormTo monitor the number of individuals who have completed online courses to ensure Operator is adhering to its licence requirement and that it is invoiced correctly.

To facilitate invoicing for paid training opportunities

To pass information onto trainers so they can address delegates by name and keep an attendance register.

To issue training certificates to individuals.

We have a legitimate interest to effectively deliver training courses and the Award as a whole.
Award Community
• First Name
• Last Name
• Email Address
• Optional profile information (additional general statement including work experience or interesting
hobbies)
Self-registration form on the
Award Community site.
To access information and communications to support the delivery of the Award.
To access the self-paced online training courses. To maintain a record of online training that has been completed by adults in the Award.
We have a legitimate interest to effectively deliver the Award.
Online Record Book (ORB) – Participants
Required
• First Name
• Last Name
• Email Address
• Date of Birth
• Address
• Parent/guardian’s name and email
• Details of participants’
Award record and achievements.

Optional
• Gender
• Nationality
• Employment
status
• Profile picture
• Profile questions (these vary between Operators)

System information
• Various background system information (such as mobile software version, error crash reports, a record of pages viewed).

Self-registration form on the ORB.The ORB profile needs to be identifiable to the person whose profile it is and so name and email is required. Awards have age limits for participation and including date of birth can help manage this.

System information can be used for auditing purposes, for analysis to help improvements or to identify and fix errors.

To maintain a record of
Participants in the

Award and Award Centres and to communicate about the Award where necessary.

Information may be used to aid programme analysis, Award Delivery, and for communication where necessary.

We have a legitimate interest to process this data in order to be able to operate the ORB.
Online Record Book (ORB) – Adults in the Award
• First Name
• Last Name
• Email Address
• Date of Birth
• Address
• Gender (optional)

System information
Various background system information (such as mobile software version, error crash reports, a record of pages viewed).

Self-registration form on the ORB. • The ORB profile needs to be identifiable to that person and so name and email is required.

• Award. Operators have age limits for Award Leaders and including date of birth can help manage this.

• To enable users to manage and support their participants or Award Centres in order to deliver the Award.

• To maintain a record of adults in the Award and Award Centres.

• Information may be used to aid programme analysis, Award Delivery, and for communication where necessary

1. We have a legitimate interest to process this data in order to be able to operate the ORB.

2. If we must process the information to comply with a legal obligation on us

Licence application process & ongoing account management of licensees• First Name
• Last Name
• Email Address
• Associated organisation
Submission of a completed expression of interest or licence application form.

Submission of evidence during the licence review process.

• To send the licence agreement to the correct responsible person at the Operator.

• To send a pro-rata invoice to the correct responsible person at the Operator.

• To provide induction to the person responsible for the day-to-day coordination and operation of the Award at the Operator.

• To send communications to the correct persons at the Operator, concerning important information about Award delivery.

• To inform the Operator about its licence review.

• To arrange meetings with individuals at the Operator as part of the licence review.

• To adhere to the requirements in an Operator’s licence.

1. We have a legitimate interest to process this data in order to be able to operate the ORB.

2. If we must process the information to comply with a legal obligation on us

Supporters• First Name
• Last Name
• Email Address
• Mailing Address
• Telephone Number
(including mobile number)
• Financial Information
Friends of the Award Agreement• Send email updates and news of the work of the Award (if consent is provided to do so). Send invitations to a programme of World Fellowship events throughout the year (if consent is provided to do so).
• Send an annual report showing what our donations have been spent on.
• Provide a dedicated personal contact within the Philanthropy team.
1. Your consent. You are able to withdraw your consent at any time. You can do this by contacting us using the details provided in section 10.

2. We have a legitimate interest in promoting and furthering the aims of the Foundation and providing our supporters with information.

Website users
[www.intaward.mt]

The list provided below may vary depending on the content of the email submitted:

• First Name
• Last Name
• Email Address
• Mailing Address
• Telephone Number
(including mobile number)
• Bank Details

Email form on our website.

Payment Page on our website

• Manage enquiries and process requests accordingly.

• Process donations.

We have a legitimate interest in managing the enquiries and requests we receive, as well as processing any donations to the Foundation.
Events• Full name
• Date of birth
• Email address
• Home address
• Telephone number
• Company and job title
• Financial information
Email form on our website.

Payment Page on our website

• To manage guests who confirm attendance to the Foundation’s events.

• To market relevant events to existing supporters and/or contacts.

We have a legitimate interest to effectively run our events.
Research• Full name
• Date of birth
• Email address
Outcome research survey Satisfaction survey

Social value survey

To provide robust and plausible evidence of the Award’s impact globally.We have a legitimate interest in reviewing the impact of the Award.
AlumniThe list provided below may vary depending on whether the field is mandatory or optional.
• Full name
• Email address
• City, Country
• Postal address
• Phone number
• LinkedIn profile
• Twitter username
• Current employment information
• Date Award(s) earned and method of Award confirmation

Alumni registration process on our digital platform, hosted by Enterprise Alumni

Direct email invitation to recent Award Holders who qualify to join the digital platform.

To enable membership on our Global Award Alumni Network digital platform, so that they can connect with other Alumni members based on their location and interests.We have a legitimate interest in creating an Alumni network to enable them to connect and assist the development of the Award.

3.3.    In addition to the above, we may use your personal information:

  • to inform you of Award programme news, activities, and events. We will ask for your consent prior to sending you any marketing communications. You can unsubscribe from our email communications by following the instructions in any email that we send you, or you can withdraw your consent and request us to remove your personal information at any time by emailing us at compliance@intaward.mt;
  • Where it is necessary to comply with a legal obligation on us (for example, reporting to Law Courts, to the Commissioner of Voluntary Organisations, Insurance Agents etc)

3.4.   We do not carry out any automated decision-making using personal information which produces legal effects or otherwise significantly affects individuals.

4. How we use and disclose personal information

4.1.   The Foundation limits its use and disclosure of personal information to the purpose for which it was collected and other related purposes that would be expected by you.

4.2. The Foundation may disclose personal information with third parties, including:

  • with various organisations within the International Award Association and/or to the appropriate Award Operator responsible for administering Award delivery;
  • with contractors, suppliers, or other third parties that provide services on our behalf (such as website host providers);
  • as part of a sale, merger or acquisition, or other transfer of all or part of our assets including as part of a bankruptcy proceeding;
  • pursuant to a subpoena, court order, or other legal process or as otherwise required or requested by law, regulation, or government authority programs, or to protect our rights or the rights or safety of third parties;
  • with our professional advisors, lawyers, accountants, and auditors; or
  • with your consent or as otherwise disclosed at the time of data collection or sharing.

5. International Data Transfers

We may at times use suppliers who run their operations outside of Malta or European Economic Area (EEA). Where we do so, we take steps to ensure that your personal information is protected in accordance with appropriate safeguards, especially where the recipient country is not considered to be adequate under Maltese law. In particular, we will rely on appropriate safeguards under data protection legislation, such as standard contractual clauses approved by the Maltese Government to protect your personal information.

6. How we store and retain your personal information

6.1.     All personal data collected and processed is securely stored in the Foundation’s internal shared drives or databases including but not limited to the Customer Relationship Management (CRM) system, accounting system, Online Record Book (ORB) and SharePoint.

6.2.    The Foundation will take reasonable steps to ensure there are appropriate technical controls to protect the personal information it holds from misuse and loss and from unauthorised access, modification, or disclosure. While we seek to use appropriate organisational, technical and administrative measures to protect personal information within our organisation, unfortunately no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance using the information set out in the ‘Contact Details’ section below.

6.3.   The Foundation will only store personal information for the period of time that is necessary in light of the purposes for which we collected the persona information.

The criteria we use to determine the retention period of personal information are:

  • the respective statutory retention period;
  • our contractual and/or business relationships with you;
  • (potential) disputes; and
  • any guidelines issued by relevant regulators.

After expiration of that period, the relevant information is routinely deleted, as long as it is no longer necessary for the fulfilment of a contract, the initiation of a contract or to protect or defend our position or that of a third party. If you have any questions about our retention periods, please contact us at compliance@intaward.mt.

6.4. After the expiration of appropriate retention periods, the Foundation will take reasonable steps to destroy or permanently de-identify the relevant personal information, as long as it is no longer necessary for the fulfilment of a contract, the initiation of a contract, or to protect or defend our position or that of a third party. If you have any questions about our retention periods, please contact us at: compliance@intaward.mt.

6.5. The Foundation undertakes regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, contractors, or volunteers.

7. Your rights

 7.1. Your data protection rights under data protection law are as follows:

Your right of accessYou have the right to ask us for access to the personal information we hold about you.
Your right to rectificationYou have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasureYou have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processingYou have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processingYou have the right to object to the processing of your personal information in certain circumstances.
Your right to data portabilityYou have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
ConsentWhere we have previously obtained your consent, to withdraw that consent to processing your personal information.

7.2.    To exercise these rights, contact us using the details set out in section 10 below. You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. However, please be aware that the Foundation may be unable to provide these rights to you under certain circumstances, for example if we are legally prevented from doing so or can rely on exemptions.

8. Complaints

8.1.    If you believe that the Foundation has not complied with this Privacy Notice with respect to the handling of your personal information, please contact the Foundation using the details in section 10. The correspondence should describe in detail the nature of the enquiry or the ways in which you believe that this Notice has not been complied with. Please also send proof of identity (passport or driving licence) and proof of address (for example a utility bill).

8.2. As noted above, you may also contact the Information and Data Protection Commissioner. However, we would always appreciate the opportunity to resolve your complaint ourselves in the first instance, if possible.

9. Other websites

Our websites may contain links to other websites. Please note that when you click on one of these links, you are entering another website for which the Foundation has no responsibility (even if you access the website via a link to one of our websites). We encourage you to read the privacy notices on all such websites.

10. Contact details

10.1. Any individual who has a question or complaint about how the Foundation handles their personal information or who wishes to access or correct the personal information that the Foundation holds about them should contact:

Via email:    compliance@intaward.mt

Via post:      The Duke of Edinburgh’s International Award Malta Foundation
Avenue77 Business Centre – Level 1, Office 171
Triq in-Negozju, Zona 3, Central Business District
B’Bkara CBD301

10.2. You can also complain to the Information and Data Protection Commissioner if you are unhappy with how we have used your data using the details below:

Website:  www.idpc.org.mt

Via Post: Floor 2, Airways House, Triq Il-Kbira, Tas-Sliema SLM 1549

11. Updates to this Privacy Notice

11.1. This data privacy statement was last updated on the 19th April 2024 in line with the last EU legislation to meet the GDPR requirements. In the future, we may need to make additional changes. All additional changes will be included in the latest data privacy statement published on our website, so that you will always understand our current practices with respect to the information we gather, how we might use that information and disclosures of that information to third parties. You can tell when this privacy statement was last updated by looking at the date at the top of the statement. Any changes to our statement will become effective upon posting of the revised statement on this site. We will seek your express consent to any changes to how we use or disclose your Personal Data if requested by law but otherwise use of this site or our services following such changes constitutes your acceptance of the revised statement then in effect.