Skip to content Skip to main menu Skip to utility menu

Privacy Policy & Cookies

Being transparent and providing accessible information to individuals about how we use personal information is a key element of the General Data Protection Regulation (GDPR). The most common way to provide this information is in a privacy notice.

Alongside this privacy notice we also provide service and project specific privacy notices that give further details on how we process your personal data.

A Data Controller is an individual or organisation that determines the purposes and means of processing personal data.

Conviction is registered as a data controller with the Information Commissioner’s Office (registration number: ZA481204).

Contact details for Conviction’s data controller are:
Lower Ground Floor,
40 Bloomsbury Way,
London, WC1A 2SE

Email: [email protected]

As a non-profit organisation, Conviction delivers services to you. In order to do this in an effective way we will need to collect and use personal information about you.

If you use a specific service, we will usually let you know how that service will use your personal information via a separate privacy notice.

The General Data Protection Regulation ensures that we comply with a series of data protection principles. These principles are there to protect you and they make sure that we:

  • Process all personal information lawfully, fairly and in a transparent manner.
  • Collect personal information for a specified, explicit and legitimate purpose.
  • Ensure that the personal information processed is adequate, relevant and limited to the purposes for which it was collected.
  • Ensure the personal information is accurate and up to date.
  • Keep your personal information for no longer than is necessary for the purpose(s) for which it was collected.
  • Keep your personal information securely using appropriate technical or organisational measures.

Services using large amount of personal or special categories of information will have their own dedicated privacy notice to tell people what information is being shared. These notices will map out how personal information flows through the service or project and how it is processed.

We will usually seek your consent prior to processing or sharing your information, however, if there is a legal reason, as outlined under the GDPR, we may not require your consent, e.g. where the disclosure is necessary for the purposes of the prevention and/or detection of crime. Where we need to disclose special category or confidential information such as medical details to other partners, we will do so only with your prior explicit consent or where we are legally required to. We may disclose information when necessary to prevent risk of harm to an individual.

We process:

  • Personal information relating to identified natural persons used to deliver services such as: Advocacy, Policy Work, Campaigning and more.
  • Special categories of information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership and data concerning health or sex life.
  • Health and wellbeing information. All organisations have a duty to improve the health of the population they serve. To help with this, we use information which you provide and consent to be used for such purposes.
  • Research and statistical data to provide intelligence about Conviction including demographic data, population projections, the economic situation, health and wellbeing information. This personal information is often pseudonymised when an identifier such as name is replaced with a unique number.

The lawful basis for processing this personal data is one or more of the following.

    • Consent: the individual has given clear consent for Conviction to process their personal data for a specific purpose.
    • Contract: the processing is necessary for a contract Conviction has with the individual.
    • Legal Obligation: the processing is necessary for Conviction to comply with the law.
    • Vital Interests: the processing is necessary to protect someone’s life.
    • Public Task: the processing is necessary for Conviction to perform a task in the public interest and has a clear basis in law.

Individual service and project specific privacy notices will include further details of the lawful basis for processing specific data sets.

To ensure that Conviction provides you with an efficient and effective service we will sometimes need to share your information between teams within statutory agencies as well as with our partner organisations that support the delivery of the service you may receive, for example:

  • NHS
  • Councils/Local Authorities
  • Police
  • Fire Service
  • HMRC
  • DWP
  • Voluntary organisations
  • Government departments and agencies
  • Regulatory bodies

We will also need to supply your information to organisations we have contracted to provide a service to you.

We will only ever share your information if we are satisfied that our partners or suppliers have sufficient measures in place to protect your information in the same way that we do.

We will never share your information for marketing purposes.

Before sharing information Conviction will ensure that:

  • Privacy Notices are completed if appropriate.
  • Technical security such as encryption and access controls are in place to keep information secure.
  • Information Sharing Agreements are completed showing the rules to be adopted by the various organisations involved in the sharing exercise.
  • Data Protection Impact Assessments are completed to assess any risks or potential negative effects.
  • Common retention periods and deletion arrangements are set for the information.
  • Subject access rights are catered for.

Your personal and sensitive data will only be stored and processed on servers based within the European Economic Area (EEA).

We will only keep your information for as long as it is required to be retained. The retention period is either dictated by law or by our discretion. Once your information is no longer needed it will be securely and confidentially destroyed. Service and project specific retention periods can be found in our service and project specific privacy notices.

You have certain rights under the General Data Protection Regulations (GDPR), these are the right:

  • to be informed via Privacy Notices such as this.
  • to withdraw your consent. If we are relying on your consent to process your data then you can remove this at any point.
  • of access to any personal information Conviction holds about yourself. To request a copy of this information you must make a subject access request in writing. You are entitled to receive a copy of your personal data within 1 calendar month of our receipt of your subject access request. If your request is complex then we can extend this period by a further two months, if we need to do this we will contact you. You can request a subject access request, either via a letter to Conviction at the address below.
  • of rectification, we must correct inaccurate or incomplete data within one month.
  • to erasure. You have the right to have your personal data erased and to prevent processing unless we have a legal obligation to process your personal information.
  • to restrict processing. You have the right to suppress processing. We can retain just enough information about you to ensure that the restriction is respected in future.
  • to data portability. We can provide you with your personal data in a structured, commonly used, machine readable form when asked.
  • to object. You can object to your personal data being used for profiling, direct marketing or research purposes.
  • in relation to automated decision making and profiling, to reduce the risk that a potentially damaging decision is taken without human intervention.

If you want to exercise any of these rights then you can do so by contacting;
Lower Ground Floor,
40 Bloomsbury. Way,
London, WC1A 2SE

Email: [email protected] 

Submit your request by eform

If using the eform we will contact you to collect proof of identity.

You can also make a request verbally, either in person to an employee or member of Conviction.  If you make a verbal request we will confirm our understanding of your request with you and confirm the address (email or postal) to which you would like a response sent.  We must also be satisfied as to your identity when making a verbal request, and as such you should be prepared to provide evidence of identity.

To ensure that we can deal with your request as efficiently as possible you will need to include your current name and address, proof of identity (a copy of your driving licence, passport or two different utility bills that display your name and address), as much detail as possible regarding your request so that we can identify any information we may hold about you, this may include your previous name and address, date of birth and what service you were involved with.

As a non-profit organisation we are required to have a Data Protection Officer who is responsible for:

  • Monitoring our compliance with the GDPR and other data protection laws. Monitoring our data protection policies, awareness-raising, training, and audits.
  • Advising Conviction in respect to their data protection obligations.
  • Provide advice and monitor the Data Protection Impact Assessment process.
  • Acts as a point of contact for the Information Commissioner’s Office (ICO) and members of public on any matter relating to Data Protection.

If you need to contact the Data Protection Officer their details are:

Ryan Jarvis
Lower Ground Floor,
40 Bloomsbury Way,
London, WC1A 2SE

Email: [email protected] 

Should you wish to report an information security incident you can use our electronic reporting tool: Report an information security incident

If you wish to make a compliment, comment or complaint about how Conviction are processing your data, then please visit send a compliment or comment or make a complaint to us.

If you are still dissatisfied with how Conviction have handled your complaint, you may contact the Information Commissioner’s Office.

The Information Commissioner
Wycliffe House
Water Lane
Phone: 08456 30 60 60


Information on the decision making process of Conviction can be found in the articles of association.

Skip to content