Last modified: 31 January 2022

Addendum for Data Subjects in Japan added 24 February 2023

Partners in Justice International (PJI) is committed to protecting the privacy of our web site visitors, donors, beneficiaries, partners, and supporters.

What is this Privacy Notice?

This Privacy Notice (“Privacy Notice”) sets out Partners in Justice International’s information processing practices in relation to you and your personal data and applies when we collect and process personal data from you through the website www.partnersinjustice.org (our “Website”) and mobile applications, or otherwise through our work. It explains Partners in Justice International’s information processing practices and describes your rights regarding your personal data.

This notice may be changed or updated at any time. By visiting our Website and/or providing the information described below, you acknowledge that you accept the terms of this Privacy Notice. If you do not agree to the terms of this Privacy Notice, please do not use the Website. This Privacy Notice is at all times subject to any applicable requirements of local and regional law and regulation.

Who is responsible for your information?

Partners in Justice International (“PJI”) and its affiliates around the world (also referred to as “we”, “us”, or “our”) is the data controller and responsible for your personal data.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights in the European Union (“EU”) and the United Kingdom, (“UK”) please contact the DPO using the details set out below:

Email address: privacy@partnersinjustice.org

Postal address:

Partners in Justice International
712 H Street NE Suite 1662
Washington, DC 20002
Telephone number: (415) 952-0344

This Privacy Notice describes:

what personal data we collect about you;
how we obtain your personal data;
how we use your personal data;
on what basis we use your personal data;
how long we keep your personal data;
who we share your personal data with;
how we protect your personal data;
which countries we transfer your personal data to; and
your rights regarding your personal data.

This Privacy Notice should be read in conjunction with PJI’s Data Handling and Protection Policy.

Legal basis

In the EU and UK, we will only use your personal data when the General Data Protection Regulation 2016/679 (“EU GDPR”) and UK General Data Protection Regulation (“UK GDPR”) allows us to.

All processing (i.e., use) of your personal data will be in compliance with a “legal basis” for processing. In the majority of cases, the legal basis will be that such processing is justified on the basis that it is conducted in lawful furtherance of our legitimate interests, subject to your interests and your fundamental rights. Processing may also be justified where it is necessary for the performance of a contract to which you are a party, or to take steps (at your request) to enter into a contract; necessary for us to comply with a relevant legal obligation (e.g., where we are legally required by court order to disclosure the information); or necessary for the performance of a task carried out in the public interest (e.g. documenting human rights violations). Generally, we do not rely on consent as a legal basis for processing your personal data, although we will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

What personal data do we collect about you?

We may collect personal data from you in the course of our work, including through your use of our Website, by our use of “cookies,” when you contact or request information from us, when you engage our services or as a result of your relationship with one or more of our staff and clients.

We may collect some or all of the following types of information including:

Personal data. Our Website may collect personal data, information that either directly identifies you or could reasonably be used to identify you. Examples of personal data include your name, contact information, email address, and other information in combination with such identifiers.
Mobile devices information. If you access our Website on your mobile telephone or mobile device, we may also collect your unique device identifier and mobile device IP address, as well as information about your device’s operating system, mobile carrier and your location information. We may also ask you to consent to providing your mobile phone number (for example, so that we can send you push notifications).
Other information. In some instances, we automatically collect other basic information about you which does not directly identify you, but which may correspond with you or a particular device. We use this information to learn more about how our Website is used and to otherwise improve and administer the site. Automated technologies may include the use of web server logs to collect IP addresses, “cookies” and web beacons. Further information about our use of cookies can be found below in the “Use of cookies” section below.

How we obtain your personal data

We collect information or data from you in various ways, including:

During the course of your use of the Website (this will include any and all material you send or submit either to the Website or to any email address provided on the Website);
By our use of “cookies” (see the “Use of cookies” section below);
Information which you provide to us and when we request further information from you from time to time;
As part of our new work acceptance processes;
While monitoring our technology tools and services, including our Website and email communications sent to and from PJI;
When you provide it to us, or interact with us directly, for instance by engaging with our staff;
From providers of compliance-related information or credit-related information; and
From other sources, such as keeping the contact details we already hold for you accurate and up to date using publicly available sources.

How we use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data. These purposes apply to all personal data we collect.

The table also sets out which of the legal bases we rely on for those purposes in the EU and UK in accordance with the EU GDPR and the UK GDPR. We have also identified what our legitimate interests are where appropriate.

Purpose/Activity	Legal basis for processing including basis of legitimate interest (for the purposed of the EU GDPR and the UK GDPR)
To operate our Website and understand its use, for statistical purposes (number of site visits, average time visitors spend at the site, etc.) and security purposes	Necessary for our legitimate interests (for running our business)
To manage and process inquiries, registrations, donations and other interactions with you	Necessary for our legitimate interests (to communicate with you)
To send you information you have requested or consented to receiving such as PJI newsletters, breaking news, and other information regarding relevant PJI activities	Necessary for our legitimate interests (to communicate with you)
To perform a contract, such as engaging with an individual or organization to provide services	Performance of a contract Necessary for our legitimate interests (compliance with grant requirements)
To establish, exercise or defend legal claims or proceedings	Necessary to comply with a legal obligation
To comply with legal and regulatory obligations	Necessary to comply with a legal obligation
To invite you to meetings, events, and seminars	Necessary for our legitimate interests (to communicate with you)
To alert you to employment or volunteer opportunities	Necessary for our legitimate interests (to communicate with you)
To ask for financial support	Necessary for our legitimate interests (to communicate with you)
To seek your feedback	Necessary for our legitimate interests (to communicate with you)
To communicate with you on other PJI matters not listed above	Necessary for our legitimate interests (to communicate with you)
To provide you with personalized service	Necessary for our legitimate interests (for running our business)
For legitimate purposes related to our work and mission	Necessary for our legitimate interests (for running our business)
To address matters incidental to the purposes of use set out above, where permitted by applicable local law and regulation	Necessary for our legitimate interests (for running our business)

We do not sell, share, or otherwise disclose the information we collect through our Website and mobile applications, except as provided in this Privacy Notice.

We may allow our staff, volunteers, consultants, or other providers acting on our behalf (for example, our Website hosts) to access and use your personal data for the purposes for which you have provided it to us. If we do this, we will not give those individuals/organizations any rights to use your personal data (or to contact you) except in accordance with this Privacy Notice.

We may share your personal data with our affiliates and third-party organizations which we feel could be of interest to you, provided you agree to such sharing and such sharing is legal under applicable law. Please see the “Your rights regarding your personal information” section below if you wish to have your information shared this way.

We may disclose information to third parties who provide us with various business services, including monitoring and maintaining the Website and with whom we are working to provide you with services or information. We may also disclose information we collect in special cases, including when we have a reason to believe that such disclosure is necessary to identify, contact, or bring a legal action against someone who may be causing injury to or interference with our rights and property or those of any other person. We may also disclose information when we believe the law requires it and in any situation that involves threats to any person’s physical safety. When required by law, such sharing of information will be subject to an agreement with each such service provider, requiring such service provider to comply with data protection requirements.

Personal data may be shared with other non-affiliated third parties, including:

service providers which perform certain services on behalf of PJI, pursuant to our direction, or as directed or consented to by you, including providers of word processing, translation, photocopying and document review;
third parties engaged in the course of the services we provide to clients and partners, such as barristers, local counsel and technology service providers like data room and case management services;
third parties involved in hosting events or seminars;
auditors and professional advisors; and
regulatory authorities, courts and tribunals, government agencies and law enforcement agencies (such as the police).

We will share personal data with these third parties where permitted by applicable laws and regulations:

for the purposes set out in this Privacy Notice;
as may be required by applicable law or regulation;
as provided for by any contractual arrangement; or
in connection with PJI’s work and our operations (including where disclosure is necessary or desirable in order to facilitate the conduct of a specific matter, including transactions, cases or other matters).

We will not sell, rent, distribute, or otherwise make personal data commercially available to any third party except with your prior permission.

We may disclose personal data (i) if we are required to do so by law, legal process, statute, rule, regulation, or professional standard, or to respond to a subpoena, search warrant, or other legal request; (ii) in response to law enforcement authority or other government official requests; (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss; (iv) in connection with an investigation of suspected or actual illegal activity; or (v) in the event that PJI is dissolved or otherwise reorganized. Disclosure may also be required for audits or to investigate a complaint or security threat.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

You can engage with us through social media websites.

If you post information when you interact with our Website through social media sites, plug-ins or other applications, depending on your privacy settings, this information may become public on the Internet. You can control what information you share through privacy settings available on some social media sites. For more information about how you can customize your privacy settings and how third party social media sites handle your personally identifiable information, please refer to their privacy help guides, privacy notices and terms of use.

PJI may use social media sites such as Facebook, LinkedIn and Twitter. If you use these services, you should review their privacy policies for more information on how they deal with your personal data.

Meetings, events and seminars

We will collect and process personal data about you in relation to your attendance at our offices or at an event or seminar organized by PJI or its partners. We will only process and use special categories of personal data about your dietary or access requirements in order to cater for your needs and to meet any other legal or regulatory obligations we may have. We may share your information with IT and other service providers, or partners involved in organizing or hosting the relevant event.

Recruitment

If you submit personal data to us via any of the e-mail addresses specified on our Contact page or to an e-mail address specified in the Get Involved page for applying for a position at PJI, we will process such personal data solely for the purposes of considering applications and recruitment, not for marketing purposes.

Use of cookies

We may also collect data that may include your personal data by sending “cookies” to your browser, which will store them in your device (e.g., computer, phone, etc.) in order to facilitate your browsing. A cookie is a small chunk of information sent by our web server to the web browser software that you are using to access the Website. A cookie enables our web server to collect information from your web browser software.

We collect user permission for our use of cookies through a clear notice in the form of a website banner that appears when users view the Website, giving users the option to select, reject, or accept the use of cookies.

Please see our Cookie Policy for further information about cookies and our use of cookies.

How long we keep your personal data?

PJI endeavours to ensure that personal data is kept up-to-date and that irrelevant, excessive or out-of-date personal data is updated or deleted. To determine the appropriate retention period for your personal data, we will consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process the personal data and whether we can achieve such purposes through other means, the applicable legal and regulatory requirements (including requirements to retain the personal data for a minimum period), limitation periods for taking legal action, good practice and PJI’s work and mission-related purposes.

For more information regarding the data retention periods, please contact us at privacy@partnersinjustice.org.

Do we have security measures in place to protect your information?

The security of your personal data and respect for your right to privacy are important PJI priorities. PJI has implemented appropriate physical, technical and administrative security standards to protect personal data from loss, misuse, alteration or destruction. We will protect your personal data against unauthorised access, use or disclosure, using security technologies and procedures. PJI adheres to a Data Handling and Security Policy, which supplements this Privacy Notice and is available on our Website.

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

While we take reasonable measures to protect the information you submit via the Website against loss, theft, and unauthorised use, disclosure, or modification, we are also aware, and would like you to be aware, that no internet, email, or mobile application transmission is ever fully secure or error free. Email or other messages sent through the Website are not automatically secure or encrypted. You should use caution whenever submitting information through email or the Website and take special care in deciding which information you provide us. If you would like to transmit information to us more securely, please contact us to make appropriate arrangements.

Transfer of information across national borders

We work throughout the world and may transfer certain personal data across geographical borders within PJI, or to authorised service providers or business partners in other countries working on our behalf in accordance with applicable law.

Some of our activities and third parties may be in countries that have not been determined by the European Commission or the UK to have an adequate level of data protection. When we do transfer your personal data from the European Economic Area and the UK to countries outside of the European Economic Area and the UK, we use a variety of legal mechanisms to help ensure a similar degree of protection is afforded to your personal data:

we ensure transfers within PJI ensure that personal data receives an adequate and consistent level of protection wherever it resides within PJI;
where we transfer your personal data outside PJI or to third parties who help provide our services, we obtain contractual commitments from them to protect your personal data; or
where we receive requests for information from law enforcement or regulators, we carefully validate these requests before any personal data is disclosed.

If you would like further information about whether your information will be disclosed to overseas recipients, please contact us at privacy@partnersinjustice.org. You also have a right to contact us for more information about the safeguards we have put in place to ensure the adequate protection of your personal data when it is transferred.

Security of electronic communications

Please note that any electronic communication made between you and us, including via the Website, may not be secure and, unless you are already a client, may not be treated as privileged or confidential. While we welcome your enquiries, please do not send us any electronic communication that contains any confidential or sensitive personal data or data.

Your rights regarding your personal data

Subject to the provisions of local and regional laws and regulations from time to time, you may be entitled:

to object, on grounds relating to your particular situation and subject to certain conditions, to the processing of your personal data;
to request confirmation as to whether PJI has personal data relating to you;
to access the personal data about you being processed by PJI and to obtain certain information about the processing of that personal data;
to require PJI to rectify any inaccurate or incomplete personal data about you;
to require PJI to erase personal data about you in certain circumstances, subject to compliance with any applicable data retention obligation;
to restrict PJI from processing personal data about you in certain circumstances;
to receive personal data relating to you in a format that can be processed by a device and the right to have personal data relating to you transferred to another data controller in certain circumstances;
to stop unauthorized transfers of your personal data to a third party; and
if you are subject to French data protection laws, to establish guidelines for the preservation, deletion and transmission of your personal data after your death.

Should you wish to discuss your entitlement to, or exercise of any such rights, please contact privacy@partnersinjustice.org

EU and UK Data Subject Rights

If you are an EU or a UK data subject, you have the following rights of this EU and UK Data Subject Rights section. To exercise these rights, please email us at privacy@partnersinjustice.org with a description of your request.

Right to Access. You have right to access personal data that PJI holds about you.
Right to Rectification. You have a right to request us to correct your personal data where it is inaccurate or out of date.
Right to be Forgotten (Right to Erasure). You have the right, under certain circumstances, to have your personal data erased. Your information can only be erased if your data is no longer necessary for the purpose for which it was collected, and we have no other legal ground for processing the data.
Right to Object to Processing. You have the right to object to the processing of your personal data at any time, on legitimate grounds, except if otherwise permitted by applicable law. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.
Right to Restrict Processing. You have the right to restrict the processing of your personal data, but only where:
its accuracy is contested, to allow us to verify its accuracy; or
the processing is unlawful, but you do not want it erased; or
it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
you have objected to processing of your data, and verification of overriding grounds is pending.
Right to Data Portability. You have the right to data portability, which requires us to provide personal data to you or another controller in a commonly used, machine readable format, but only where the processing of that information is based on (i) your consent; or (ii) the performance of a contract to which you are a party.
Right to Decline Automated Decision Making. You have the right to not be subject to decisions based solely on automated decision making, which produce legal or significant effects for you, except where these are (i) necessary for a contract to which you are a party; (ii) authorized by law; (iii) based on your explicit consent.

Even where such decisions are permitted, you can contest the decision and require PJI to exercise human intervention.

We currently do not use automated decision making (including automated decision making using profiling) when processing your personal data. If we ever use an automated decision-making solution, you have a right to request that a decision based off your personal data cannot be solely decided via an automated process.

You also have the right to make a complaint at any time to a data protection supervisory authority of your habitual residence, place of work or of an alleged infringement of the EU GDPR or UK GDPR. We would, however, appreciate the chance to deal with your concerns before you approach the relevant data protection supervisory authority, so please contact us in the first instance.

You will not have to pay a fee to access your personal data (or to exercise any of the rights outlined above). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Your California Privacy Rights

Section 1798.83 of the California Civil Code permits California residents to request from a business, with whom the California resident has an established business relationship, certain information about the types of personal data the business has shared with third parties for those third parties’ direct marketing purposes and the names and addresses of the third parties with whom the business has shared such information during the immediately preceding calendar year. You may make one request each year by emailing us at privacy@partnersinjustice.org.

Do we collect information from children?

Our Website is not intended for children under 16 years of age. We do not knowingly collect personal data from an individual under age 16. If you are under the age of 16, please do not submit any personal data through the Website. If we learn we have collected or received personal data from a child under 16 without verification of parental consent, we will delete that information. If you have reason to believe that we may have accidentally received personal data from an individual under age 16, please contact us immediately at privacy@partnersinjustice.org.

Changes to this Privacy Notice

It is our policy to post any changes we make to our Privacy Notice on this page. If we make material changes to how we treat your personal data, we will notify you by email. The date the privacy policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and this Privacy Notice to check for any changes.

Contacts

If you have any questions or comments regarding this Privacy Notice or the processing of your personal data by PJI, please contact privacy@partnersinjustice.org.

Addendum for Data Subjects in Japan

If you live in Japan, the following applies to you in addition to the provisions of this privacy policy.

Joint Use of Personal Data

We will jointly use your personal data with each of our affiliates in accordance with Article 27.5.3 of the Act on Protection of Personal Information (the “APPI”) within the scope necessary for achieving the purposes of use. In this case, the categories of personal data jointly used are described in “What personal data do we collect about you?” and the purpose for the sharing information is same as the purpose described in “How we use your personal data”. Partners in Justice International (located in 712 H Street NE Suite 1662, Washington, DC 20002) is responsible for the management of the jointly used personal data (please see partnersinjustice.org/who-we-are/our-team/ for our representative’s name).

Contacts

Partners in Justice International

712 H Street NE Suite 1662, Washington, DC 20002

Please see partnersinjustice.org/who-we-are/our-team/ for our representative’s name

Please contact us at privacy@partnersinjustice.org for any request to exercise your rights regarding your personal data, queries including data protection measures we take or complaints about our handling of personal data.

Privacy

What is this Privacy Notice?

Who is responsible for your information?

This Privacy Notice describes:

Legal basis

What personal data do we collect about you?

How we obtain your personal data

How we use your personal data

With whom do we share your personal data?

Social media:

Meetings, events and seminars

Recruitment

Use of cookies

How long we keep your personal data?

Do we have security measures in place to protect your information?

Transfer of information across national borders

Security of electronic communications

Your rights regarding your personal data

EU and UK Data Subject Rights

Your California Privacy Rights

Do we collect information from children?

Changes to this Privacy Notice

Contacts

Addendum for Data Subjects in Japan

Joint Use of Personal Data

Contacts