Our privacy policy

The Whitehall & Industry Group privacy policy

1. Who we are

The Whitehall & Industry Group (WIG)
Address: 80 Petty France, London, SW1H 9EX
Phone: 020 7222 1166
Email: [email protected]
Website: www.wig.co.uk

Data Controller: The Whitehall & Industry Group (“WIG”) is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Protection Officer (DPO):
You can contact WIG’s Data Protection Officer at: [email protected]

 

2. The personal data we collect

We collect and process the following types of personal information:

  • Personal identifiers and contact details — name, job title, organisation, phone numbers, and email addresses.
  • Special category data — including accessibility or dietary information provided for events or programmes.
  • Engagement and transactional data — attendance at WIG events, leadership programmes, mentoring, or other services.
  • Website interaction data — downloads, video views, and browsing behaviour via cookies and analytics tools.
  • Areas of professional interest or expertise — to tailor relevant communications and events.
  • Communication history — records of interactions such as event bookings, enquiries, and marketing responses.

We do not collect data on criminal convictions or offences.

 

3. How we collect your personal data

We collect personal data in the following ways:

  • Directly from you when you register on the WIG website, apply for a programme or role, or communicate with us by phone or email.
  • Indirectly from your employer (if your organisation is a WIG member and nominates you as a contact).
  • Through cookies and analytics tools on our website (see Section 7).
  • From third parties who support WIG services, such as event partners or mentoring platforms.

 

4. How we use your information and our lawful bases

We process your data to:

Purpose

Lawful Basis

Notes

Manage membership records and provide member services

Legitimate interests (managing relationships and delivering services)

balancing test available on request

Deliver events, leadership programmes, and mentoring

Performance of a contract or legitimate interests

consent only required for optional data like dietary preferences

Send you relevant updates, newsletters, and opportunities

Legitimate interests (direct marketing to members and contacts)

unsubscribe option provided in every email

Operate our website and online resources

Legitimate interests and consent (for cookies and analytics)

cookie banner and preferences managed under PECR

Record and respond to enquiries or complaints

Legal obligation and legitimate interests

retained for audit and compliance purposes

Process applications for employment, secondments, or mentoring

Steps prior to entering a contract

deleted if not successful after retention period

We only rely on consent where we genuinely need it and where no other lawful basis applies. You can withdraw your consent at any time by contacting [email protected].

 

5. Sharing your personal data

We only share your personal information when necessary to deliver WIG’s services, including with:

  • Event venues, programme facilitators, and mentoring partners.
  • Service providers such as CRM hosting (Microsoft Dynamics), IT support, and analytics providers.
  • Regulatory or legal authorities if required by law.

We require all third parties to implement appropriate data protection and security measures and to process your data only in accordance with our instructions.

 

6. International data transfers

We use Microsoft Dynamics and Microsoft 365 for customer relationship management and collaboration. These systems host data primarily in UK and EU data centres. However, limited access from outside these regions (for example, from the United States) may occur for system support or maintenance. Where such transfers occur, they are protected using the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), approved by the ICO.

In addition, we use Google Analytics 4, which may transfer pseudonymised website interaction data to the United States under the EU–US Data Privacy Framework and UK Addendum safeguards.

No other international transfers of personal data are made by WIG.

 

7. Cookies and website analytics

We use cookies and similar technologies to improve website functionality, analyse engagement, and tailor communications.
When you first visit our website, you will be asked to consent to non-essential cookies. You can change your preferences at any time using the cookie settings link on our site.

Essential cookies — required for core website functions (do not require consent).
Analytics cookies — used for aggregated statistics via Google Analytics 4 (require consent).
Marketing cookies — used to understand engagement with our events and services (require consent).

For detailed information, see our updated Cookie Policy (linked in footer).

 

8. How we store and protect your data

Your data is stored securely within WIG systems or approved third-party platforms after data protection and security assessments have been completed.
All systems are password-protected, and access is restricted to authorised personnel.

Retention periods:

  • Member contact and engagement data — kept for the duration of membership + five years after membership lapses for organisations and 18 Months for individuals.
  • Non-member contacts — retained until five years of inactivity, then deleted or anonymised.
  • Special category data (e.g. health or access requirements) — retained only for the duration of the relevant service or event and then deleted.
  • Recruitment data — retained for up to 12 months after conclusion of the process unless legally required longer.

All deletions and anonymisations are securely conducted in line with WIG’s Data Retention Policy.

 

9. Your data protection rights

Under the UK GDPR, you have the following rights:

  • Access – to request copies of your personal data.
  • Rectification – to correct inaccurate or incomplete data.
  • Erasure – to request deletion of your data in certain circumstances.
  • Restriction – to limit how we use your data.
  • Objection – to object to processing based on legitimate interests or direct marketing.
  • Portability – to request transfer of your data to you or another organisation.

You can exercise these rights by contacting our DPO at [email protected].
We will respond within one month and there is no charge for making a request.

 

10. How to complain

If you are concerned about how we handle your data, you may contact: [email protected]

If you remain dissatisfied, you have the right to lodge a complaint with:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk

11. Updates to this policy

This Privacy Policy was last reviewed in November 2025. WIG will review and update it annually, or sooner if there are significant changes to our processing activities or applicable laws.