L2 Foundry Privacy Policy 

Introduction
L2 Foundry is committed to safeguarding the privacy and personal data of its staff, volunteers, partners, clients, and the wider communities it serves. This policy sets out how we collect, process, and protect personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. All individuals connected to L2 Foundry have the right to understand how their data is used, stored, and protected.

Purpose of the Policy

This policy ensures that L2 Foundry:

• Complies with applicable data protection laws.

• Protects the rights of its staff, volunteers, partners, and clients.

• Is transparent about how personal data is collected, stored, and processed.

• Takes steps to prevent data breaches and violations of data protection laws.

• Collects and analyses data to holistically support the rise of women’s sport, sharing anonymised information where appropriate to drive data-led change in an emerging industry.

Scope

This policy applies to:

• All staff, volunteers, and directors of L2 Foundry.

• All personal data processed by L2 Foundry, including (but not limited to) data relating to clients, staff, volunteers, third-party partners, and individuals who interact with L2 Foundry’s women’s sport and community groups and initiatives.

Key Principles of Data Protection

In accordance with the UK GDPR, L2 Foundry abides by the following principles:

• Lawfulness, Fairness, and Transparency: Personal data is processed lawfully, fairly, and transparently.

• Purpose Limitation: Data is collected for specified, legitimate purposes and is not further processed in ways incompatible with those purposes.

• Data Minimisation: Only data necessary for the stated purposes is collected and processed.

• Accuracy: Personal data is accurate and kept up to date. Any inaccuracies are corrected or deleted promptly.

• Storage Limitation: Personal data is retained only for as long as necessary for the specified purposes.

• Integrity and Confidentiality: Data is processed with appropriate security measures to protect against unauthorised or unlawful processing, accidental loss, destruction, or damage.

Personal Data Collected

L2 Foundry may collect and process the following personal data:

• Staff and Volunteers: Contact details, emergency contact information, background checks (where required), and other role-related details.

• Clients and Partners: Names, contact information, relevant business details, and additional information needed for project collaboration or service delivery.

• Women’s Sport Data Collection: A broad range of information—such as demographics, engagement metrics, participation figures, and other forms of feedback—aimed at understanding and holistically supporting the rise of women’s sport. This data helps to highlight an emerging field that relies on data-driven insights historically not captured.

• Other Third Parties: Contact and organisational details for communication and collaboration purposes.

Legal Basis for Processing Data

L2 Foundry processes personal data under the following legal bases:

• Consent: Individuals provide explicit consent for the processing of their data.

• Contractual Obligation: Processing is necessary to fulfil contractual obligations with staff, volunteers, or clients.

• Legal Obligation: Processing is required to comply with UK legal requirements.

• Legitimate Interests: Processing is necessary for the legitimate interests of L2 Foundry, including data analysis to support women’s sport, provided these are not overridden by individuals’ rights and freedoms.

Data Protection Rights

Under the UK GDPR, individuals have the following rights regarding their personal data:

• Right to be Informed: The right to know how their data is collected and used.

• Right of Access: The right to request and receive a copy of their personal data.

• Right to Rectification: The right to request corrections to inaccurate or incomplete data.

• Right to Erasure: The right to request the deletion of their data, subject to legal or contractual constraints.

• Right to Restrict Processing: The right to request limited processing of their data in certain circumstances.

• Right to Data Portability: The right to request that their data be transferred to another organisation in a structured, commonly used format.

• Right to Object: The right to object to the processing of their data, including for direct marketing.

• Rights Related to Automated Decision-Making: The right to challenge decisions made solely by automated means that significantly affect them.

Requests related to these rights should be directed to the Data Protection Officers (DPO) at L2 Foundry: Louise McGing or Leah Godfrey who will respond within one month. 

Data Security

L2 Foundry takes appropriate technical and organisational measures to protect personal data, including:

• Secure Storage: Data is stored securely, in both physical and digital formats, including password-protected systems and secure cloud platforms.

• Access Control: Only authorised staff, volunteers, or partners have access to personal data, based on their roles and responsibilities.

• Data Breach Response: In the event of a data breach, L2 Foundry will take prompt action to contain the issue, notify affected individuals if necessary, and inform the Information Commissioner’s Office (ICO) within 72 hours if legally required.

Data Retention

L2 Foundry will retain personal data only for as long as necessary for the purposes for which it was collected, in accordance with legal and regulatory requirements. Data is periodically reviewed, and any that is no longer needed is securely deleted or anonymised. 

Data Sharing

L2 Foundry does not share personal data with third parties unless:

• The individual or organisation has given explicit consent.

• It is required by law or legal processes.

• It is necessary to fulfil contractual obligations or legitimate interests, such as collaborating with partners to advance women’s sport, in which case anonymised data may be shared to maintain privacy.

Where data is shared, L2 Foundry ensures that third parties comply with relevant data protection laws and maintain adequate safeguards.

Third-Party Processors

L2 Foundry may use third-party service providers (e.g., cloud storage, analytics platforms) to process personal data. Contracts with these processors include data protection clauses to uphold individuals’ rights.

Staff and Volunteer Responsibilities

All staff, interns and volunteers at L2 Foundry are responsible for:

• Keeping passwords and access credentials secure.

• Sharing personal data only when necessary and appropriately authorised.

• Reporting any data breaches or security concerns immediately to the DPO.

Data Protection Officer (DPO)

L2 Foundry has appointed a Data Protection Officers Leah Godfrey & Louise McGing who are responsible for:

• Overseeing data protection compliance and best practices.

• Handling queries or concerns related to personal data.

Contact: Leah Godfrey at leah@l2foundry.com or Louise McGing at louise@l2foundry.com 

Breach Notification

Should a data breach pose a risk to individuals’ rights and freedoms, L2 Foundry will:

• Notify the ICO within 72 hours.

• Inform affected individuals, if required.

Last Policy Update: 10 January 2024