Impetus is committed to protecting your personal data and to being transparent about how we collect, use, store and share information.

This Privacy Notice explains what personal data we collect, why we collect it, how we use it, the lawful bases we rely upon, who we share it with, how long we keep it and the rights available to individuals under UK data protection legislation.

What personal data do we collect?

We may collect and process personal data when you:

• subscribe to our newsletters or updates;
• register for an event, webinar, meeting or network organised by or involving Impetus;
• contact us by email, telephone or through our website;
• make a donation or express an interest in supporting our work;
• engage with us as a supporter, donor, prospective donor, introducer, adviser, trustee candidate, partner or professional contact;
• participate in research, surveys, consultations or case studies;
• work with us, or express an interest in working with us, in relation to our charitable activities, portfolio partners, policy work, fundraising or events; or
• visit our website.

The information we collect may include:

• name and contact details;
• job title, organisation and professional background;
  
• communication preferences;
• records of interactions with Impetus;
• event registration and attendance information;
• donation and supporter engagement information;
• publicly available professional, biographical and philanthropic information;
  information relevant to your ability and potential interest in supporting Impetus, our charitable objectives and, where relevant, our portfolio partners through donations, pro bono work, introductions, advocacy or other forms of support; and
• technical information collected through cookies and website analytics.

Information collected from public and third-party sources

In some circumstances, we obtain personal data from sources other than the individual concerned.

This may include information from external sources which we combine with information you have provided to help us understand your potential interest in, connection to, or ability to support Impetus and our charitable objectives. We will only use this information where it is lawful and proportionate to do so, including where it is publicly available, where it has been provided through a referral or introduction, or where you have given permission for a third party to share information with charities such as Impetus.

These sources may include, but are not limited to:

• Companies House;
• OpenCorporates and other company information sources;
• the Charity Commission;
• 360Giving and other grant-making or philanthropy sources;
• Giving is Great and other publicly available philanthropy information;
  ProPublica Nonprofit Explorer and similar overseas charity or nonprofit information sources;
• HM Land Registry and other publicly available property information;
• professional networking platforms, such as LinkedIn;
• organisation websites and professional biographies;
• publicly available media reports and internet searches;
• professional registers, such as the Financial Conduct Authority Financial Services Register;
• sanctions lists, Politically Exposed Persons registers, adverse media screening sources and other reputable due diligence, compliance or risk-screening providers;
• professional advisers;
• referrals and introductions from trustees, supporters, donors, partners and professional contacts; and
• other publicly available sources relevant to fundraising, governance, due diligence, relationship management or regulatory compliance activities.

Special Category Data

Special category data includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health information, biometric data, genetic data, sexual orientation or sex life.

We will process special category data only where lawful to do so and where appropriate safeguards are in place. This may include circumstances where:

• you have provided explicit consent;
• processing is necessary to make reasonable adjustments for events or activities;
• information has clearly been made public by the individual; or
• processing is otherwise permitted under UK data protection legislation.

Criminal Offence Data

Impetus may process criminal offence data where necessary for due diligence, risk management, safeguarding or governance purposes.

This may include due diligence carried out in accordance with our Fundraising Gift Acceptance Policy, our legal and regulatory obligations and relevant Charity Commission guidance on the acceptance and refusal of donations.

Such processing will only be undertaken where lawful, necessary and proportionate, and where appropriate safeguards are in place.

How do we use personal data?

We may use personal data to:

• provide information about our work, research reports, policy briefings, publications, events and activities;
• manage event registrations and attendance;
• communicate with supporters, donors, partners and stakeholders;
• undertake research, consultation and engagement activities;
• conduct qualitative research, surveys and feedback exercises;
• manage donations and supporter relationships;
• identify and engage potential supporters, donors, trustees, introducers and partners;
• understand whether individuals or organisations may have an interest in supporting Impetus, our charitable objectives or, where relevant, our portfolio partners;
• carry out prospect research, philanthropy research, due diligence and risk assessments;
• administer governance and trustee recruitment activities;
• issue press releases and promote our work;
• improve our communications, services and website; and
• comply with legal and regulatory obligations.

Newsletters and Communications

Where you have requested information from us, subscribed to receive updates, attended an event, supported our work or otherwise engaged with Impetus, we may send you communications about our activities, publications, events, policy work and fundraising.

You can update your communication preferences or unsubscribe from communications at any time.

Lawful Bases for Processing

Depending on the circumstances, we may rely on one or more of the following lawful bases:

• consent;
• contractual necessity;
• legal obligation; and
• legitimate interests.

Where we rely on legitimate interests, we will ensure that our interests are balanced against the rights and freedoms of the individuals concerned.

We have a legitimate interest in processing personal data where this is necessary and proportionate to support our charitable mission, including fundraising, research, policy, communications, events, due diligence, governance and relationship management activities.

Fundraising, Prospect Research and Due Diligence

To support our charitable objectives, fundraising activities, governance responsibilities and reputation management, Impetus may undertake proportionate prospect research, philanthropy research, network mapping, due diligence and relationship management activities.

This helps us understand more about individuals and organisations who may have an interest in supporting Impetus, our charitable objectives and, where relevant, our portfolio partners through donations, pro bono work, introductions, advocacy or other forms of support.

This may involve reviewing information obtained from publicly available sources and reputable third-party providers to:

• identify individuals and organisations who may have an interest in supporting our charitable objectives;
• understand philanthropic interests, professional background, networks and connections relevant to our work;
• assess potential affinity, propensity and capacity to support Impetus;
• assess suitability for governance, fundraising, donor, partnership or pro bono opportunities;
• identify and manage legal, financial, regulatory and reputational risks;
• comply with charity law, fundraising standards, due diligence expectations and good governance practice;
• make informed decisions about whether to accept or refuse donations, partnerships or other support;
• protect the reputation, integrity and assets of Impetus.

We also perform due diligence on potential and actual donors, supporters, trustees and partners in accordance with our Fundraising Gift Acceptance Policy and relevant legal, regulatory and charity governance obligations.

Impetus is registered with the Fundraising Regulator and follows the Code of Fundraising Practice.

Where personal data is obtained indirectly from publicly available or third-party sources, we will provide privacy information in accordance with applicable data protection legislation and make relevant privacy information available through this Privacy Notice.

Consultants, contractors and specialist advisers may support these activities from time to time. Where this occurs, appropriate contractual and data protection safeguards will be in place.

Who do we share personal data with?

We may share personal data where necessary with:

• employees, trustees and authorised volunteers of Impetus;
• consultants, contractors and professional advisers;
• auditors and legal advisers;
• IT, CRM, data hosting and communications providers;
• due diligence, compliance and screening providers;
• event venues, speakers, partners and funders where relevant to the activity concerned;
• project funders, portfolio partners or partner organisations where this is necessary to deliver activities, manage events, support research or fulfil legitimate organisational purposes;
• regulators, statutory bodies and law enforcement agencies where required by law; and
• other organisations where disclosure is necessary to protect the legitimate interests of Impetus or to comply with legal obligations.

We will not share your information for marketing purposes with other companies or organisations.

We require third-party providers to process personal data securely and only in accordance with our instructions and applicable data protection legislation.

Where personal data is shared with third parties, such as project funders, partners, venues or event speakers, this will be made clear to individuals where appropriate.

Automated Decision-Making

Impetus may use approved technology tools, including analytical and modelling tools, to support fundraising, administrative and operational activities.

For example, such tools may help us assess the likelihood of an individual or organisation being able to support Impetus through philanthropy, pro bono work, introductions or other forms of support.

However, Impetus does not make decisions that produce legal or similarly significant effects on individuals solely through automated decision-making.

If you would prefer us not to use your personal data in this way, please contact us using the details below.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to meet legal, regulatory, financial, safeguarding and operational requirements.

Retention periods are reviewed periodically and personal data that is no longer required will be securely deleted, destroyed or anonymised.

Data Security

Impetus maintains appropriate technical and organisational measures to protect personal data from loss, misuse, unauthorised access, disclosure or alteration.

Access to personal data is restricted to those who require it for legitimate organisational purposes.

Personal data may be held in Impetus systems, including secure internal systems, email systems, CRM systems and third-party platforms used on our behalf.

Where service providers process personal data outside the UK, we will ensure appropriate safeguards are in place in accordance with UK data protection legislation.

Your Rights

Under UK data protection legislation, you may have the right to:

• access your personal data;
• request correction of inaccurate information;
• request deletion of personal data in certain circumstances;
• restrict processing in certain circumstances;
• object to processing based on legitimate interests;
• withdraw consent where consent is relied upon;
• request transfer of personal data where applicable; and
• lodge a complaint with the Information Commissioner's Office.

Complaints

If you are dissatisfied with how we process your personal data, you have the right to complain to the Information Commissioner's Office (ICO).

Information about how to make a complaint can be found at:
https://ico.org.uk/make-a-complaint/

We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

How to Contact Us

If you have any questions about this Privacy Notice or how we process personal data, please contact our Data Protection Lead:

Cecilie Gianneri
Director of Finance and Operations

Email: cecilie.gianneri@impetus.org.uk

Address:
Impetus
1st Floor, Golden Cross House
8 Duncannon Street
London WC2N 4JF

Cookies

Cookies are small text files placed on your device to collect standard internet log information and visitor behaviour information.

We use cookies and similar technologies to understand how visitors use our website, improve website performance and enhance user experience.

We use Google Analytics and other website tools to help us understand website usage.

You can control cookie settings through your browser and through our website cookie controls.

Other Websites

Our website may contain links to external websites.

This Privacy Notice applies only to the Impetus website. We encourage you to read the privacy notices of any other websites you visit.

This Privacy Notice does not apply to portfolio partners supported by Impetus. Portfolio partners will have their own privacy notices or policies explaining how they collect and use personal data.

Changes to this Privacy Notice

We keep this Privacy Notice under regular review and may update it from time to time to reflect changes in legislation, guidance or organisational practice.

Any significant changes will be published on our website.

Updated: 23rd June 2026