Last updated on 23 September 2026.
This privacy policy sets out how the Internet Watch Foundation uses and protects your personal data.
1. Important information and who we are
This privacy policy gives you information about how the Internet Watch Foundation collects and uses your personal data through your use of this website, which supports our EU Campaign 2026. We collect very little personal data through this website, and the tool for writing to a Member of the European Parliament does not collect any.
This website is not intended for children, and we do not knowingly collect data relating to children.
Controller
Internet Watch Foundation is the controller and responsible for your personal data, referred to as IWF, we, us or our in this privacy policy. IWF is a registered charity in England and Wales, number 1112398, and a company limited by guarantee registered in England, number 3426366, with its registered office at Canopy House, 296 Cambridge Science Park, Milton Road, Cambridge, CB4 0WD, United Kingdom. If you have any questions, or wish to exercise your legal rights, please contact us using the information in section 10.
2. The types of personal data we collect about you
Personal data means any information about an individual from which that person can be identified. We collect very little personal data through this website. We may collect, use and store the following.
- Technical Data includes your internet protocol address, browser type and version, time zone setting and general location, operating system and platform, and other technology on the device you use to access this website.
- Usage Data includes information about how you interact with and use this website, such as the pages you view and the actions you take.
- Contact Data includes the email address you choose to give us if you write to us by email or if you sign up for our newsletter to receive updates on the campaign. If you sign up, we also ask for your country, and for your first name if you wish to give it. It will also include anything you include in an email to us, like your name.
We also use aggregated data, such as statistical data about how many people visit the website and which pages they read. Aggregated data is not personal data, because it does not directly or indirectly reveal your identity.
3. How is your personal data collected?
Automated technologies. As you interact with this website, we automatically collect Technical Data and Usage Data about your device and your browsing, using cookies and server logs. This is described in the cookies part of section 4. Some of this data is also received by our analytics provider, Google, which is based outside the United Kingdom.
When you write to us. If you send us an email, we receive the address you write from and whatever information you choose to include in your message.
The tool for writing to a Member of the European Parliament
This tool does not collect personal data. You select a country, which filters the list of Members of the European Parliament inside your browser. Your selection is not sent to us and is not stored. You then choose and edit a message, and send it from your own email application. The message, the recipient and your email address are never transmitted to us, to our agency or to the company that hosts this website, and no copy is kept.
Because the message is sent from your own email application, your name and email address are visible to the Member of the European Parliament and to their office, in the same way as any email you send. We have no control over that copy and we cannot recall or delete it. Their offices handle correspondence under their own rules. We ask you not to include information about your health, your beliefs or other sensitive details, or information about other people, in the message you send.
4. How we use your personal data
Legal basis
The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases.
Legitimate interests. We may use your personal data where it is necessary to conduct our activities and pursue our legitimate interests. We consider and balance any potential impact on you and your rights, both positive and negative, before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you, unless we have your consent or are otherwise required or permitted to by law.
Legal obligation. We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.
Consent. We rely on your consent for every cookie that is not strictly necessary. You give that consent through the cookie banner, and you can withdraw it at any time.
Purposes for which we will use your personal data
Technical Data is used to operate, maintain and protect this website, including troubleshooting, testing, system maintenance, support and security, on the basis of our legitimate interests in the provision of administration and IT services and network security. It is retained for up to 14 months.
Technical Data and Usage Data are used to measure how this website is used and how effective the campaign is, on the basis of your consent, given through the cookie banner. This data is retained for up to 14 months.
Contact Data is used to respond to you if you write to us, on the basis of our legitimate interests in responding to correspondence addressed to us. It is retained for as long as needed to deal with your enquiry, and for up to 12 months afterwards.
Marketing
This website includes the option to sign up to our newsletters. When you sign up, we ask for your email address and your country, and you can give us your first name if you wish. You then choose separately whether you want to receive emails about this campaign and whether you want to receive wider updates from IWF. Neither box is ticked for you. We do not use this information to build a marketing list; it will only be used to send you the updates you have asked for. For the campaign newsletter, your information will be retained for the purpose of sending you campaign updates until you tell us you no longer want to receive them or until the campaign newsletters come to an end. For the IWF newsletter, your information will be retained for the purpose of sending you updates on IWF and its work until you tell us you no longer want to receive them or until we notice that you have not engaged with our newsletter for a continuous period of 36 months. We will keep a record of your original consent for 5 years.
Cookies
Cookies are small files placed on your device when you visit a website. This website uses a consent management platform called tarteaucitron, which asks for your choice before any cookie that is not strictly necessary is placed, and lets you change that choice at any time through the cookie preferences link in the footer of every page. tarteaucitron is open-source software hosted on this website itself, so it is not a third-party service and it does not transfer your data to anyone.
The following cookies are strictly necessary and are placed without consent, because the website cannot function without them.
- A consent cookie named tarteaucitron, which records your choices so that you are not asked again on every page. It is kept for 182 days.
- Cookies placed by our hosting provider, Webflow, which are needed to serve the pages and to protect the website against abuse.
- A cookie placed by our translation provider, Weglot, which records the language you have selected so that the website is displayed in that language.
The following cookies are placed only if you accept them.
- Cookies placed by Google Analytics, through Google Tag Manager, which measure how many people visit the website, which pages they read and which actions they take. This helps us understand whether the campaign reaches the people it is meant to reach. These cookies are kept for up to two years, and the data associated with them is retained for 14 months.
We do not place advertising or retargeting cookies on this website.
This website uses Google Consent Mode. This means that Google tags are loaded when you arrive on the website, but until you give your consent they operate in a restricted mode: no cookie is placed, no advertising identifier is transmitted, and no measurement is associated with you as an individual. Your internet protocol address is transmitted to Google at that stage, as it is for any connection to a server. Once you accept, the tags operate normally and the cookies described above are placed.
You can withdraw or change your consent at any time using the cookie preferences link in the footer of this website. You can also delete cookies through your browser settings, though doing so will mean you are asked for your choice again on your next visit.
5. Disclosures of your personal data
We may share your personal data where necessary with the parties set out below, for the purposes set out above.
We use the following service providers. Webflow, Inc. hosts this website and serves it through a content delivery network, and is established in the United States. Google provides the analytics and tag management used to measure the campaign, and is established in the United States. Weglot SAS provides the translation of this website, and is established in France. MOJO Agency designs, builds and operates this campaign website on our instructions, as our processor, and is established in Belgium.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes, and only permit them to process your personal data for specified purposes and in accordance with our instructions.
6. International transfers
We may transfer your personal data to service providers that carry out certain functions on our behalf. This may involve transferring personal data outside the United Kingdom to countries whose laws do not provide the same level of data protection as United Kingdom law.
Whenever we transfer your personal data out of the United Kingdom to service providers, we ensure a similar degree of protection is afforded to it. We may use specific standard contractual terms approved for use in the United Kingdom, which give the transferred personal data the same protection as it has in the United Kingdom, namely the International Data Transfer Agreement. To obtain a copy of these contractual safeguards, please contact us.
7. Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach, and will notify you and any applicable regulator of a breach where we are legally required to do so.
8. Data retention
Details of retention periods for the different categories of your personal data are set out in section 4. In some circumstances you can ask us to delete your data. See section 9 for further information.
9. Your legal rights
You have a number of rights under data protection law in relation to your personal data. You have the right to:
- Request access to your personal data, commonly known as a subject access request. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Request correction of the personal data we hold about you. This enables you to have any incomplete or inaccurate data corrected, though we may need to verify the accuracy of the new data you provide.
- Request erasure of your personal data in certain circumstances, where there is no good reason for us to continue processing it. We may not always be able to comply for specific legal reasons, which will be notified to you at the time of your request.
- Object to processing of your personal data where we rely on a legitimate interest. In some cases we may demonstrate compelling legitimate grounds which override your right to object. You also have an absolute right to object at any time to processing for direct marketing purposes.
- Request the transfer of your personal data to you or to a third party, in a structured, commonly used, machine-readable format. This right only applies to automated information which you initially provided consent for us to use, or where we used the information to perform a contract with you.
- Withdraw consent at any time where we rely on consent. This will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you.
- Request restriction of processing, where you want us to establish the accuracy of the data, where our use of the data is unlawful but you do not want us to erase it, where you need us to hold the data to establish, exercise or defend legal claims, or where you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds.
If you wish to exercise any of these rights, please contact us using the details in section 10.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data, or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request, in order to speed up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is particularly complex, or if you have made a number of requests. In this case, we will notify you and keep you updated.
10. Contact details
If you have any questions about this privacy policy, about the use of your personal data, or if you want to exercise your privacy rights, please contact us by email at legal@iwf.org.uk, or by post, addressed to Legal, at Canopy House, 296 Cambridge Science Park, Milton Road, Cambridge, CB4 0WD, United Kingdom.
11. Complaints
If you have any concerns about our use of your personal information, you can make a data protection complaint to us by emailing legal@iwf.org.uk.
If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the ICO. The ICO's contact details are available from the ICO's website https://ico.org.uk or as follows:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Helpline number: 0303 123 1113.
12. Changes to the privacy policy and your duty to inform us of changes
We keep our privacy policy under regular review. This version was published on 23 September 2026. Historic versions can be obtained by contacting us.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.
13. Third-party links
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.