Current Version: 1.2

Mission Diverse CIC is committed to handling personal information lawfully, fairly, transparently and securely.

This policy explains how we collect, use, store, share and protect personal information relating to people who interact with Mission Diverse. It applies to clients, prospective clients, website visitors, training participants, current employees, former employees, workers, consultants, contractors, suppliers, partners, professional contacts and other individuals who engage or have previously engaged with us.

Information we may process

The personal information we process will depend on the nature of your relationship with us.

It may include:

• name and contact information;
• employment, professional and organisational information;
• job titles, qualifications, professional experience and credentials;
• correspondence and communications;
• contractual and payment information;
• information provided through enquiries, bookings, events, consultancy and training;
• photographs, audio recordings, video recordings and other media;
• professional biographies and profile information;
• training, attendance and participation records;
• documents, presentations, learning materials and other resources created or contributed to during work with us;
• meeting records, notes, recordings and transcripts;
• information relating to complaints, concerns, safeguarding, legal matters or contractual disputes;
• website usage, device and technical information;
• information obtained from publicly available or professional sources where lawful; and
• other information reasonably required to operate our organisation or provide our services.

We may also process special category personal data where necessary and where an appropriate lawful condition applies.

How we use personal information

We may process personal information where reasonably necessary to:

• provide consultancy, training and other services;
• manage enquiries, bookings and client relationships;
• administer contracts, payments and business arrangements;
• manage employment, consultancy, contractor and professional relationships;
• communicate with individuals and organisations;
• deliver, maintain and improve our services;
• create and maintain training, educational and professional resources;
• maintain organisational knowledge and business continuity;
• operate our website and digital systems;
• maintain appropriate operational, financial, governance and historical records;
• protect confidential information, intellectual property and other business assets;
• maintain information and cyber security;
• manage risks and safeguard individuals;
• investigate complaints, concerns, misconduct or suspected misuse where necessary;
• manage actual or anticipated legal, contractual, regulatory or insurance matters;
• obtain professional or legal advice;
• establish, exercise or defend legal rights;
• comply with legal and regulatory obligations;
• undertake reasonable quality assurance and service improvement; and
• promote or communicate information about our work where legally permitted.

We will identify an appropriate lawful basis for each processing activity.

Lawful bases

Depending on the circumstances, we may process personal information because:

• it is necessary to enter into or perform a contract;
• we are required or permitted to do so by law;
• processing is necessary for our legitimate interests or the legitimate interests of another person;
• you have given consent;
• processing is necessary to protect vital interests; or
• another lawful basis recognised under applicable data protection legislation applies.

Should an individual does not give consent, or later withdraws consent, does not necessarily mean that all processing must stop. You understand consent is one lawful basis among several. Where another lawful basis applies, we may continue to process information in accordance with that basis and applicable law.

Legitimate interests

We may rely on legitimate interests where processing is reasonably necessary for a legitimate organisational, commercial, operational or professional purpose and those interests are not overridden by the rights and interests of the individual.

Our legitimate interests may include (but limited to):

• operating, managing and developing our organisation;
• providing services to clients;
• maintaining continuity of services and organisational knowledge;
• preserving and using appropriate business records;
• protecting confidential information and intellectual property;
• safeguarding our commercial, contractual and legal interests;
• protecting clients, staff, contractors and other individuals;
• maintaining information and system security;
• managing risk;
• quality assurance and service improvement;
• maintaining appropriate evidence of business activities;
• responding to disputes, claims or regulatory matters; and
• making appropriate use of materials, resources and intellectual property created, commissioned or contributed to during employment, consultancy, contracting, training or another professional engagement.

Where we rely on legitimate interests, we may consider the purpose and importance of the processing, whether the processing is reasonably necessary, the individual’s reasonable expectations, the likely impact on them, any contractual arrangements and whether appropriate safeguards or less intrusive alternatives are available.

Materials, resources and intellectual property

During employment, consultancy, contracting, training or other professional engagement with Mission Diverse, individuals may create, contribute to or appear in materials including:

• training and learning resources;
• presentations;
• recorded courses;
• webinars;
• photographs;
• video and audio recordings;
• written materials;
• guidance documents;
• templates;
• methodologies;
• professional resources;
• digital content; and
• other intellectual property or business materials.

Where these materials have been created or commissioned for a legitimate organisational or commercial purpose, Mission Diverse may retain and continue to use them where we have an appropriate lawful basis and the use remains necessary and proportionate.

This may include the continued use of materials containing an individual’s name, image, voice or other identifying information where the material was created for the purpose of providing services, training, education, organisational knowledge or another legitimate business activity.

The fact that an individual’s employment, engagement or professional relationship with Mission Diverse later ends does not of itself require the destruction, withdrawal or cessation of use of material lawfully created during that relationship.

Where possible and appropriate, we may remove or update contextual information that is no longer accurate while retaining the underlying material or resource.

Business and historical records

Mission Diverse may retain records relating to its activities where reasonably necessary for operational, contractual, governance, evidential, historical, regulatory or legal purposes.

These may include correspondence, meeting notes, contracts, recordings, training records, project records, communications, decision records and other information created during the course of business.

The ending of an employment, consultancy, client or other relationship does not necessarily require the deletion of records relating to that relationship.

Information may be retained where necessary to maintain an accurate record of past events, demonstrate decisions or actions taken, meet contractual or legal obligations, protect the rights of Mission Diverse or others, or establish, exercise or defend legal claims.

Requests for deletion

Individuals may have the right to ask us to erase personal information in certain circumstances.

You understand the right to erasure is not absolute.

We may retain information where continued processing is lawful and necessary, including where:

• we remain legally required to retain it;
• it remains necessary for the purpose for which it is lawfully processed;
• there are overriding legitimate grounds for continued processing;
• it is necessary for the establishment, exercise or defence of legal claims;
• another statutory exemption or exception applies; or
• complete deletion cannot reasonably or lawfully be undertaken at that time.

We will consider requests individually and will explain our decision where required by law.

Right to object

Individuals may object to certain processing of their personal information.

Where we process information on the basis of legitimate interests and receive an objection, we will consider the individual’s particular circumstances and the reasons for the objection.

An objection does not necessarily require processing to stop.

Where permitted by law, we may continue processing if we can demonstrate compelling legitimate grounds which override the individual’s interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

The right to object to processing for direct marketing purposes is different. Where an individual objects to direct marketing, we will stop using their personal information for that purpose.

Withdrawal of consent

Where we rely specifically on consent, an individual may withdraw that consent.

Withdrawal of consent does not affect processing that took place lawfully before consent was withdrawn.

It also does not necessarily affect processing undertaken on another lawful basis.

Where information is lawfully processed on the basis of contract, legal obligation, legitimate interests or another lawful basis, we may continue that processing where appropriate.

Current and former employees, workers and contractors

We process information relating to employees, workers, consultants and contractors where necessary to administer and manage the working relationship and our organisation.

This may include information relating to:

• recruitment and appointment;
• contracts and terms of engagement;
• remuneration and payments;
• performance and development;
• training;
• absence and attendance;
• communications;
• projects and work undertaken;
• use of organisational systems;
• safeguarding and health and safety;
• compliance with policies and legal duties;
• complaints, grievances and disciplinary processes;
• investigations where necessary;
• termination of employment or engagement;
• legal and regulatory matters; and
• records reasonably required after the relationship has ended.

Some information may continue to be held following the end of an employment or professional relationship where there is an operational, contractual, regulatory, historical, evidential or legal reason to retain it.

Monitoring and organisational systems

Where necessary and proportionate, Mission Diverse may monitor or review the use of its systems, information, devices or business accounts for purposes including security, continuity, compliance, safeguarding, protection of confidential information and intellectual property, investigation of suspected misuse and protection of legal or contractual rights.

Any monitoring will be undertaken in accordance with applicable data protection law and appropriate internal policies.

Information obtained from other sources

We may receive personal information from third parties or obtain information from publicly available sources where lawful and relevant to our activities.

Sources may include:

• clients and partner organisations;
• employers or professional contacts;
• suppliers and service providers;
• publicly available professional profiles;
• regulatory or public bodies; and
• other people who provide information to us as part of a legitimate business or professional interaction.

Where required, we will provide appropriate privacy information about how that information is used.

Sharing personal information

We may share personal information where lawful, necessary and proportionate.

Recipients may include:

• authorised employees and contractors;
• clients and delivery partners where necessary;
• technology and cloud-service providers;
• professional advisers;
• accountants and auditors;
• insurers;
• banks and payment providers;
• regulators and public bodies;
• legal representatives;
• courts and tribunals;
• law enforcement agencies; and
• other organisations where disclosure is required or permitted by law.

Where another organisation processes information on our behalf, appropriate contractual and security arrangements will be used where required.

We do not sell personal information.

Special category information

We may process information relating to health, racial or ethnic origin, religious or philosophical beliefs, sexual orientation, trade union membership or other special category information where necessary and where a lawful Article 9 condition applies.

Access to this information will normally be restricted and additional safeguards applied where appropriate.

Website, cookies and digital services

When you use our website or other digital services, we may collect technical information including device, browser, usage and security information.

We may use cookies and similar technologies where necessary to operate our website and, where permitted, to understand website use, improve our digital services and support communications.

Where the law requires consent for non-essential cookies, we will seek that consent.

Artificial intelligence, transcription and digital tools

We may use appropriately selected digital tools to support administrative and operational activities, including transcription, summarisation, document management, search, workflow automation and similar functions.

Where these tools process personal information, their use will be subject to applicable data protection requirements and appropriate organisational controls.

We do not rely solely on automated systems to make significant decisions about individuals unless permitted by law and appropriate safeguards are in place.

Retention

We retain personal information for as long as reasonably necessary for the purpose for which it is held.

The period will depend on factors including:

• contractual requirements;
• legal and regulatory obligations;
• operational need;
• safeguarding;
• financial and tax requirements;
• insurance;
• limitation periods;
• anticipated or ongoing disputes;
• legal proceedings;
• historical or evidential value; and
• the need to protect the rights and interests of Mission Diverse or others.

Where information is subject to an actual or anticipated complaint, dispute, claim, investigation, legal process or regulatory matter, we may suspend normal deletion arrangements for as long as reasonably necessary.

Security

We take reasonable organisational and technical measures to protect personal information against unauthorised access, disclosure, alteration, loss, misuse or destruction.

Access is limited according to operational need and may be withdrawn or restricted where appropriate.

International transfers

Some service providers or digital systems we use may process information outside the United Kingdom.

Where an international transfer requires additional safeguards, we will use an appropriate mechanism recognised under applicable data protection law.

Your rights

Depending on the circumstances and applicable legal exemptions, individuals may have rights including:

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object; and
• rights relating to automated decision-making.

These rights are not absolute and their application depends on the circumstances and lawful basis for processing.

We may ask for information reasonably necessary to verify identity or understand the scope of a request.

Where we lawfully refuse or limit a request, we will provide the information required by applicable data protection legislation.

Complaints

If you have questions or concerns about how Mission Diverse uses personal information, or wish to exercise a data protection right, please contact us using the details provided on our website.

You also have the right to complain to the Information Commissioner’s Office.

Changes to this policy

We may amend this policy to reflect changes in law, regulatory guidance, technology, services or our organisational activities.

The current version published on our website will apply from its stated effective date.

Version	Effective Date	Amendments	Approved By
1.0	5 October 2020	Policy effective	Data Protection Officer
1.1	5 October 2020	Section added:  “Complaints”	Data Protection Officer
1.2	18 August 2026	Section added: “International transfers” section	Data Protection Officer