‘Speak up’ Privacy Notice

When you use the 'Speak Up' web portal you are contacting a service which is provided for Oxfam GB by an independent organisation (Clue), who will respect your privacy in how they work with your information, as indicated in their privacy notice applicable for the web portal itself. In law, Oxfam GB is ultimately responsible for how your information is used (the 'Data Controller').

If you choose, you can report a concern through the ‘Speak Up’ process anonymously. Whether anonymous or not, the concern you raise and the information you are willing to share will be passed on to specialist teams within Oxfam GB for investigation, action and resolution. The information you submit will be treated confidentially and where the law or the investigation requires information to be shared, this will be done sensitively.

This privacy notice explains what personal information we in Oxfam GB collect, why and how we collect it, and what we do with it during the ‘Speak Up’ process.

The personal information we collect depends on the concern raised and the steps needed to investigate, action and resolve the concern. It may include:

• Your name and contact details, as the person who raises the concern. It will not be shared if you wish it to remain confidential.
• Your relationship to Oxfam and associated information, for instance, details of job role and manager, the program participated in, whether you were campaigning, volunteering, or supporting us.
• The name and contact details of individuals involved, such as the subject of your concern, or witnesses, and their relationship to Oxfam.
• The context of concern being raised, depending upon the nature of the allegation or concern, this could include a description of behaviour, activities in relation to Oxfam, location and time of incident, or other data which is relevant to the allegation or concern.

As any concern can be raised through the ‘Speak Up’ process this list is not exhaustive. This may include 'sensitive' data if it is relevant, such as race, ethnic origin, trade union membership, philosophy, or religion, sexual life or orientation, health or financial information relating to individuals. For instance, typically a safeguarding case will reveal sexual orientation data, and an anti-corruption one may reveal financial details.

If you are not anonymous, we process your name and contact details in order that we can:

• Gather further information regarding your concern;
• Update you regarding the way in which we are dealing with it;
• Make referrals if appropriate to other services or organisations.

You do not need to share your name or details with Oxfam GB, you can raise a concern anonymously – except for countries where anonymous reporting is prohibited by law. It may improve our investigation if we can have additional information from you. Indeed, in some situations, the actions we can take are limited if the concern is raised anonymously. If you provide your details we will be able to feedback to you, as far as we are able, the actions taken to resolve your concern. Note that you are free to remain anonymous or to ask that your name is not shared with anyone.

We process the other information regarding your concern to:

• What we may need to investigate or follow upon;
• Take appropriate action where necessary to address your concern;
• Identify misconduct, illegal acts, or protect those with whom we work.

We use this information for one of these reasons:

• Depending on the circumstance it may be a legal requirement for us to prevent and detect crime or misuse of our systems, protect those with whom we work, or need to detect or prevent unlawful acts or dishonesty;
• In addition, we believe we have a legitimate interest to investigate in order to protect those we work with and our organisational values;
• Where the data which we are working with is particularly sensitive, also called special category data, there is a substantial public interest that we detect and prevent unlawful acts or dishonesty.

This personal information will not be used for unsolicited newsletters or direct marketing.

It is important that the data we hold about you is accurate and current. Please keep us informed of any information updates that are necessary during or after the investigation.

Data will be collected using the following methods:

• Via online forms;
• Via follow-up using phone, email or other mechanisms, from the specialist teams in Oxfam such as anti-corruption, human relations (HR), legal and safeguarding.

Once Oxfam has received your concern, we will ensure that your personal data is treated with the highest integrity. Your concern will only be seen by appropriate parties involved in the investigation of the concern, ensuring the full confidentiality of your report and personal data. Oxfam will assign your concern to an investigator, who will correspond with you throughout the process. Dependent on the outcome of your concern, other parties also bound by strict data protection law may need to be informed. For instance, if a vulnerable person like a child may be in danger, we will inform the police to protect that child.

All information you give us will be stored securely in Oxfam GB offices and IT systems, as well as our contracted suppliers’ IT systems. This includes cloud-based systems administered by IT providers which are designed for managing sensitive data. Clue provides the system which we use for capturing and managing your concerns.

Your data will be shared with teams in Oxfam GB responsible for investigations, for example anti-corruption, HR, legal and safeguarding. Outside of the Oxfam confederation, your data will only be shared in an anonymous way unless required by law (e.g. with regulators, public authorities, or law enforcement) or to prevent or detect crime or dishonesty.

With your consent data may be shared with therapeutic services or other agency to provide support to you.

In some cases, Oxfam GB may transfer your personal data, including special categories of personal data, to Oxfam Affiliates when the investigation involves Oxfam staff who are managed outside Oxfam GB. The same data protection regulation applies to European Oxfam affiliates. Where Oxfam affiliates or suppliers are outside the EEA, the transfer of data will occur under the protections of the European Commission's standard contractual clauses. You can ask to see a copy of these clauses.

We only retain your information for as long as is necessary for us, and use it as described above or to comply with our legal obligations.

Our retention schedule provides more detail on how long we retain different types of information.

Here is Oxfam Great Britain's full privacy notice. If you have further questions or comments concerning your privacy, if you wish to access your personal data held about you, delete, or update information we hold about you, please contact Oxfam Great Britain’s Data Protection Officer at privacy@oxfam.org.uk or at this address:

Data Protection Officer
Oxfam Great Britain
Ground Floor
John Smith Court
John Smith Drive
Oxford Business Park
Oxford
OX4 2JY

You also have rights to see, update and – depending on the rights of others – restrict or refuse the use of your data. If you wish to exercise any of these rights, at any time and at no cost, please contact our whistleblowing hotline or Oxfam’s Data Protection Officer.

In many countries, you have a right to lodge a complaint with a data protection authority if you have concerns about how Oxfam Great Britain processes your personal data. If in doubt, reach Oxfam's Data protection Officer, or the British regulator, or your national data protection regulator if you have one. Regarding the British regulator, more information can be found on their website at ico.org.uk, or you can write to them at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF