Please read this policy carefully to understand how we collect, use and store your personal data.
The Humanitarian Leadership Academy (the 'Academy') is part of the Save the Children Fund - a charity registered in England and Wales (213890) and Scotland (SC039570), and a registered company limited by guarantee (178159). Registered office 1 St John’s Lane, London, EC1M 4AR.
We refer to ourselves throughout this policy as ‘Save the Children’ or ‘we'.
The Data Protection Officer
Save the Children
1 St John's Lane
Why do we collect and process personal data?
We process personal data to provide our Kaya learning platform and for the legitimate interest of furthering our mission to enable people around the world to prepare for and respond to crises in their own countries.
We may use your personal data:
- To facilitate effective access to the Kaya platform and the learning products hosted on the platform;
- To provide you with information, products or services that you have requested from us
- To carry out our obligations arising from any contracts entered into by you and us;
- For administrative purposes or internal record keeping
- To seek your views or comments on the services we provide;
- To notify you of changes to our services;
- To invite you to participate in voluntary surveys or research
- To analyse and improve the content and operation of our platform
- To analyse and improve our internal business purposes, and to produce analysis and anonymised reports
- To create a profile of your interests and preferences so that we can contact you with information relevant to you
- Where we are required by law to disclose or otherwise use your information and
- To send you communications which you have requested or consented to, and that may be of interest to you. These may include information about our activities and promotion of our other platforms, products, and services.
You agree that any information you provide to us about yourself upon registration or at any time is true. Please see our Terms and Conditions of Use for more information.
How do we collect your personal data?
We collect your personal data in a number of ways:
You register on Kaya
When you register on our Kaya platform, you will be asked to provide us with personal and employment information such as name, age (as a range), email address, country location, the organisation you work for and other similar information. We will use this information to allow you to use the Kaya platform, including to register for courses.
If you express interest in, or register for, a course, we will record details related to that course including whether you start and/or complete the course, the scores you achieve in assessments, certificates and badges you earn, your responses to evaluation and feedback surveys, and other information relating to your participation in learning. We will use this information for the management and provision of courses.
As well as the information you provide when registering, you will have the opportunity to provide additional data such as interests, profile picture, or additional contact details through your profile. Contributions made through the site, for example through chat sessions or discussion forums, may be stored on the site (and visible by other users).
Where we use your data on the basis of your consent, you can withdraw that consent at any time.
Your employer registers you on Kaya or asks us to register you:
If your employer creates an account, or adds you to Kaya, or asks us to register you, they will share certain personal and employment information with us such as name, email address, employee number or other identifiers, and job role. We will use this information to allow you to use the Kaya platform, including to register for courses, and to record your learning.
If you then express interest in, or register for, a course, we will record details related to that course including whether you start and/or complete the course, the scores you achieve in assessments, certificates and badges you earn, your responses to evaluation and feedback surveys, and other information relating to your participation in learning. If your employer administers the course you undertake, they will use this information for the management of that course.
We collect information about use of our platform
We also obtain information about how you use our platform. This information will identify you individually only where it is necessary to do so. In particular, if you visit our platform we may record information about:
- the areas of the platform you visit
- the amount of time you spend on Kaya
- whether you are new to Kaya, or have visited it before
- how you came to our Kaya – for example, through an email link
- the type of device and browser you use.
Who may have access to your personal data?
We will not sell or rent your information to third parties and we will not share your information with third parties for marketing purposes. We will only share your details with third parties (who are not service providers working at our direction) as indicated in this Policy or if you have consented or we have another legal basis to do so.
Your personal data may be disclosed to third parties in the following circumstances:
Registration and Course participation
If you register for the Kaya platform, your chosen name will be visible to other users of the Kaya platform through any in-course discussions..
If you access an online course through Kaya that was created by a third party provider, we may share data with that provider (e.g. your enrolment on that course, profile information, the total number of people who started and/or completed the course over a given time). This data may include information about the gender, age or location of the people who start and/or complete the course.
If you join an instructor-led training (e.g. face-to-face or webinar) given by a third party organisation, we will provide the third party organisation with basic personal information so that they can provide that course (which may require them to contact you), as well as any additional data you provide when you join that course. Your profile will be visible to the third party organisation’s course trainer.
As part of a course given by a third party provider, you may be asked to provide personal information about yourself. Where you provide that information, you understand that we will provide that information to the third party provider in order to facilitate provision of the course.
If you join a course that is administered by a third party, they will be able to access your personal information directly, as part of the standard reporting provided on who has accessed a course and the progress they have made in it.
Registration through a third party portal
If you join Kaya through a third party organisations' portal, they will be able to access your personal information and learning history and will also be able to assign specific courses to you for your completion. You can join a portal by either using the third party organisation's branded login page, through the organisation's Single-Sign-On Solution (SSO), or on request to a portal administrator.
Please note that some third party providers are based in countries outside of the European Union whose laws may not provide the same level of data protection.
When joining a course or a portal that is administered by a third party, the third party’s involvement will be made clear and if you are already registered on Kaya you will have the option to continue using Kaya without joining that course or portal..
Registration by a third party
If a third party (such as your employer) provides us with your details in order that we can register you on a particular course we may share some further information relating to your progress and completion of that particular course
We may disclose your personal data if we are requested or required to do so by a regulator or law enforcement, or in the course of legal proceedings, or in order to enforce or apply our rights (including in relation to our website or other applicable terms and conditions) or to protect Save the Children, for example in cases of suspected fraud, or in order to comply with any other applicable legal obligation
Site management and analytics
We contract with various third parties to provide site management or data analysis services that help ensure the platform provides a high-quality experience. These third parties are:
Learning Pool (https://learningpool.com/), Derry, UK – provision of data analysis services
Catalyst IT EU (https://catalyst-eu.net), Brighton UK – hosting, maintenance and development of the Kaya platform.
Technovatio Limited (Gamotecha) (https://www.gamoteca.com/)- provision of plug-in services
All our third party suppliers are contractually obliged to abide by UK law in the processing and storage of your data, which includes compliance with the Data Protection Act 2018 and the UK General Data Protection Regulation.
We also make use of tracking and analysis tools from Google (http://analytics.google.com) as described below, as well as Hotjar.
Retention of your personal data
We will hold your personal data on our systems in accordance with our retention policies and for as long as is necessary for the relevant activity or as long as is set out in any relevant agreement you enter into with us.
How do we protect your personal data?
We take appropriate physical, electronic and managerial measures to ensure that we keep your information secure, accurate and up to date, and that we only keep it as long as is reasonable and necessary.
Your rights and choices
Under UK data protection law, you have certain rights over personal data that we hold about you. These rights are summarised below. Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances.
You can assert your rights, raise a concern, or make a complaint about how we process your personal data by contacting our Data Protection Officer. It will assist us, if you explain your request or concern and describe the personal data you are referencing as specifically as possible. In order to action your request, we may need to request further information or request that you provide proof of identity.
Your rights in relation to our processing of your personal data, include:
- Right to object to the processing of your data - you have the right to object to our processing of your personal data in certain circumstances. If you object, please explain your objection and the reason for it.
- Right to have inaccurate or incomplete personal data corrected or completed - if you believe our records of your personal data are inaccurate or incomplete, you have the right to ask us to correct or complete those records.
- Right to restrict processing – in certain circumstances, you have the right to ask us to stop making active use of the personal data that we retain in our records about you, if there is disagreement about its accuracy or legitimate usage.
- Right of erasure - in certain circumstances, you have the right to request that we delete your personal data from our records.
- Right of access - you can write to us to ask for confirmation of what information we hold relating to you and to request a copy of that information. Provided we are satisfied that you are entitled to see the information requested and we have successfully confirmed your identity, we will provide you with your personal data subject to any exceptions that apply.
- Right to receive your personal data in a portable format – in limited circumstances, where we are processing information you provided to us because you gave us your consent or because it is necessary for the performance of a contract and the processing is carried out by automated means, you may ask us to provide it to you in a portable format.
If you are not happy with how we have handled your request or complaint, you can contact the Office of the Information Commissioner, which oversees the protection of personal data in the UK.
Alternatively, you may choose to contact the Information Commissioner directly about your complaint, regardless of whether you have raised it with us first.
Why are we allowed to process your personal data?
- the Data Protection Act 2018
- the Privacy and Electronic Communications (EC Directive) Regulations 2003
- UK General Data Protection Regulation
Generally, our processing of your personal data as described in this policy is allowed by these laws based on one or more lawful grounds, including:
Where you have provided your consent to us using your personal data in a certain way. For example, we only use your information to send you marketing communications by email or text with your consent.
Where the processing is reasonably necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering a contract.
Where the processing is reasonably necessary to comply with a legal obligation to which we are subject. For example, we may rely on this basis where we are obliged to share your personal data with a regulator.
Where the processing is reasonably necessary for the purpose of a legitimate interest pursued by us or a third party and your privacy rights do not override the legitimate interest. Our “legitimate interests” include pursuing the aims and ideals of Save the Children through advocating and campaigning for the welfare of children, supporting children and families through our work in the UK and globally, and fundraising through direct marketing campaigns, emergency appeals, special events and our retail shops. However, "legitimate interests" can also include your interests, such as when you have requested information from us, and those of third parties.
Where we process sensitive personal data (as mentioned above), we will make sure that we only do so in accordance with one of the additional lawful grounds for processing that type of data, such as where we have your explicit consent or you have made that information manifestly public.
Our knowing about changes to some of your personal data (e.g. email address) may be key to effectively communicating with you at your request. If any of your details change you can update us by e-mailing us at email@example.com. Please keep us informed of changes to your Personal Information.
What are cookies?
Cookies are small files, typically of letters and numbers, downloaded on to a device when you access certain websites or emails, including the Kaya platform. Cookies allow a website to recognise your device and provide the user with a more tailored experience within the website.
For more information, see: http://www.allaboutcookies.org/
Your cookie preferences
You can manage your cookie preferences when you visit our site by accepting all cookies or clicking on cookie settings. If you want to change your cookie preferences later, you can click the Cookies link at the bottom of our webpage to turn different types of cookies on and off. You can also choose whether or not to accept cookies via your browser’s settings (often found in your browser’s Tools or Preferences menu). You may also delete cookies from your device at any time. Please be aware that if you turn off or delete certain cookies, you may not be able to fully experience some of our website’s features.
We will store your cookie preferences for 90 days. If you return to our website at any point during this time, your preferences will be restarted from that point and last for another 90 days.
We have included a guide to how to disable cookies in your browser at the end of this policy.
First and third party cookies
First party cookies are cookies that are served directly by the website operator (Save the Children) to your device, and are often used to recognise your device when it revisits that site, and to remember your preferences as you browse the site. First party cookies are our cookies.
Third party cookies are served by a service provider on behalf of the website operator, and can be used by the service provider to recognise your device when you visit other web sites. Third party cookies are most commonly used for web site analytics or advertising purposes. There is some further information about third party cookies below.
Session cookies and persistent cookies
In addition, cookies may be either 'session cookies' or 'persistent cookies'. Your device automatically removes session cookies once you close your browser. Persistent cookies will survive on your device until an expiry date specified in the cookie itself, is reached. We use both session and persistent cookies.
Categories of cookies we use
1. Strictly necessary cookies:
These cookies are necessary for Kaya to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work
2. Functional cookies:
These cookies enable the platform to provide enhanced functionality. They may be set by us or by third party providers whose services we have added to our pages. These cookies do not store information that would allow us to identify you. If you do not allow these cookies, then some or all of these services may not function properly.
3. Performance cookies:
These cookies allow us to measure platform visitors and how they reached Kaya, so that we can improve its performance. They also help us know the most and least popular pages, how users move around Kaya, and the actions users take on the platform. These cookies typically collect unique numbers that identify your browser or device. You can refuse these cookies but we won’t be able to monitor and improve our platform’s performance.
4. Targeting cookies
These cookies may be set by our site or our advertising partners. They may be used to build a profile of your interests and help us show relevant adverts on other websites. They do not store details like your name or email address, but use unique numbers that identify your browser or device or your record in our systems. You can refuse these cookies but the adverts you see, including from possibly Save the Children, will be less tailored to you.
5. Social media cookies
These cookies enable you to share our content with your friends are networks. They are capable of tracking your browser across other sites and building a profile of your interests. This may impact what content and messages you see on other websites you visit. You can refuse these cookies but may not be able to use or see sharing tools.
6. Personalisation Cookies
These cookies enable us to personalise website content to be more specific to you. They do not store details like your name or email address, but can track the website pages you visit and the forms you complete. You can refuse these cookies but the platform content will be less tailored to you.
Website statistics analytics
Although not through cookies, we do measure the success of the emails we send – so we know what subject lines and stories people liked the most. We receive this information anonymously; we don’t share this information.
Third party cookies
You may notice some cookies that are not related to Save the Children whilst visiting Kaya. Some of our pages contain embedded content such as Youtube video, Twitter feed, Facebook likes or LinkedIn share, and you may receive cookies delivered from these websites. We do not govern the publication of third party cookies. Details of our use of Google Analytics is set out above. To understand more about their cookies and privacy statements, please visit the relevant sites.
If you do not want cookies to be stored on your PC it is possible to disable this function, though this may limit your experience of using the site.
How do I disable cookies?
Firefox cookie management: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
Chrome cookie management: https://support.google.com/chrome/answer/95647
Safari cookie management: https://support.apple.com/kb/PH19214
Other browsers have similar cookie management abilities in their preferences settings, please refer to your browser’s ‘Help’ facility.