Uplift Data Protection & Privacy Policy

(Updated Dec. 2024)

This document provides a concise policy regarding the data protection obligations of Uplift and is part of our commitment to data protection by design and default. Uplift is a data controller with reference to the personal data which it manages, processes and stores.

Uplift commitment to data protection

Transparency and accountability are core principles at Uplift, which is why we respect your rights to privacy and data control. Participants and members can expect full compliance with both the General Data Protection Regulation (GDPR) and Ireland’s own data protection laws.

Purpose of this Policy

As a data controller, Uplift and its staff (hereafter referred-to collectively as Uplift) must comply with the data protection principles set out in the relevant Irish and EU legislation.

This Policy applies to all personal data collected, processed and stored by Uplift in the course of its activities. This Policy is designed to ensure Uplift’s compliance with the following legislation:

  • The European General Data Protection Regulation (GDPR) (2018)
  • The EU Electronic Communications “ePrivacy” Regulations (2011)

The GDPR confers rights on individuals as well as additional responsibilities on those persons and organisations processing personal data and Uplift will ensure that all policies and activities are done in compliance with this legislation.

(1) Why does Uplift collect and process personal data?

This Policy applies to all data collected, both manually and automated, held by Uplift. This includes electronic and paper records.

(2) What data does Uplift collect and process?

In order to provide you with an optimal web experience, build community power and positive change in Ireland, we need to collect and process your personal data. We commit to collecting the minimum amount of data necessary. The following table gives a summary of the personal data we collect from you, how we process it, and according to personal data protection regulations, what is the legal basis for the processing of your personal data.

Personal data collected Personal data processing Legal basis for processing
Contact data (name, email address, phone number) sending you emails about campaigns and fundraising Consent
Social media data (handle, public comments, private messages to Uplift) Answering campaign related queries, re-broadcasting values aligned content Legitimate Interest to pursue our campaign goals
Constituency Data Informing campaign strategy, sending location-relevant communication to members Legitimate Interest to pursue our campaign goals
Survey data Informing campaign strategy, sharing results to influence decision makers Legitimate Interest to pursue our campaign goals
Activity data (petitions signed, politicians contacted etc.) Informing campaign strategy, matching content to the most relevant audience Legitimate Interest to pursue our campaign goals
Publicly available contact data (email, social media handles, phone number) Contacting individuals (politicians, journalists, public figures such as CEOs) with persuasive messages, factual arguments, member stories, press releases and other campaign information Legitimate Interest to pursue our campaign goals
Cookie/pixel tracking We use cookies and tracking pixels to provide you with a better web experience. Please read our Cookies Policy for more information. Legitimate Interest to provide a smooth and easy to use platform
Financial data We use your credit card or bank account details to process donations Consent

Lawful processing

We are required to have one or more lawful grounds to process your personal information. Only 3 of these are relevant to us:

  • Personal information is processed on the basis of a person’s consent
  • Personal information is processed on the basis of a contractual relationship
  • Personal information is processed on the basis of legitimate interests

(2.a) Consent

We will ask for your consent to use your information for the following purposes:

  • to send you electronic communications such as emails, surveys, newsletters and fundraising emails
  • to collect and analyse sensitive personal information in the form of survey responses
  • To contact you by phone (call, text, WhatsApp message or push notification) about fundraising and other campaigning opportunities

(2.b) Contractual relationships

Most of our interactions with subscribers and website users are voluntary and not contractual. However, sometimes it will be necessary to process personal information so that we can enter contractual relationships with people. For example, if you apply for a paid position, role or to volunteer with us.

(2.c) Legitimate interests

Applicable law allows personal information to be collected and used if it is reasonably necessary for our legitimate activities (as long as its use is fair, balanced and does not unduly impact individuals’ rights). We will rely on this ground to process your personal data when it is not practical or appropriate to ask for consent.

Achieving our purposes

These include (but are not limited to) pursuing campaigns in line with our values:

  • Uplift members believe in the right of people to realise their full potential as members of society. This includes taking a stand on the rights of low paid workers, progressive taxation, freedom from oppression and injustices, having secure homes, education and health care, and access to public services.
  • Uplift members believe that discrimination and prejudice need to be challenged so that everyone can participate fully and equally, no exceptions.
  • Our planet is in extreme danger and Uplift members stand up for protecting our natural resources, biodiversity, including our woodlands, ending toxic pollution including fossil fuels, by campaigning for policies that support transition to clean energy and for climate action.

(3) Who has access to your data?

Uplift staff, which is our small team of a trusted few people who are hired, and trained to deal carefully, professionally and legally with people’s data, have access to your data and they process it in line with the purposes and practices outlined in this document.

Petition starters can access a limited subset of data related to their campaign set up on our petition platform MyUplift.  They can see your full name and county so that they can deliver the list of signatures to the target of the petition. Petition starters are bound by our terms and conditions and required to use your data only for the purpose of petition delivery. Campaign targets receive a subset of your data, depending on the action:

  • Petitions: petition deliveries include your full name.
  • Emails: when Uplift facilitates sending an email to a campaign target with a template, your email address, name, postal address and any other data you include in the email body is shared.
  • Phone calls: when Uplift facilitates making a phone call to a campaign target, the target receives your phone number (via caller ID).
  • Surveys: where specified survey answers or summary results are shared to persuade campaign targets or the public. We will always indicate when a survey is intended to be shared.

(3.a) The use of third-party data processors

In the course of its role as data controller, Uplift engages third-party service providers, or data processors, to process personal data on its behalf.

In each case, a formal, written contract is in place with the processor, outlining their obligations in relation to the personal data, which are the same as those which apply to us, and as outlined in this policy, the security measures that they must have in place to protect the data, the specific purpose or purposes for which they are engaged, and the understanding that they will only process the data

  • as instructed by Uplift, and
  • in compliance with the European General Data Protection Regulation and the EU Electronic Communications Regulations.

The contract will also include reference to the fact that the data controller is entitled, from time to time, to audit or inspect the data management activities of the data processor, and to ensure that they remain compliant with the relevant legislation, and with the terms of the contract.

Regular audit trail monitoring will be carried out to ensure compliance with this Agreement by any third-party entity which processes personal data on behalf of Uplift.

Failure of a data processor to manage Uplift’s data in a compliant manner will be viewed as a breach of contract, and will be pursued through the courts if necessary.

(4) How is your data protected?

Uplift will ensure that the personal data it collects will be protected against unauthorised or unlawful processing and against accidental loss, destruction or damage. To this end, Uplift will employ high standards of security, in line with GDPR regulation, which is the strictest form of privacy legislation anywhere in the world on the protection of people’s data,  in order to protect the personal data under its care. Uplift’s Password Policy and Data Retention & Destruction Policies guarantee protection against unauthorised access to, or alteration, destruction or disclosure of any personal data held by Uplift in its capacity as data controller.

In the event of a data breach likely to result in a risk to the rights and freedoms of the data subject or other persons, Uplift will notify the Irish Data Protection Commissioner without undue delay and, where feasible, within 72 hours after having become aware of the breach, in line with Article 33 of the GDPR. A GDPR review is carried out annually by Uplift to ensure we are compliant with current data protection regulations.

(5) How is your data processed?

Uplift processes data in a variety of ways in order to run effective campaigns. Most often, this involves emailing members or reviewing survey data.

(5.a) Why are we sending you emails?

Uplift sends or facilitates the sending of emails in several ways:

  • Emails from Uplift staff team about campaign updates, opportunities for action and fundraisers. You only get these emails if you took action with us and selected “Yes, tell me how I can support people powered change”, “Yes, I want to get updates on this campaign and other campaigns at Uplift and you can opt out any time by clicking the unsubscribe link in any of these emails or by selecting “No, I don’t want to hear about this campaigns progress or other actions at Uplift”
  • Emails confirming your action or “Thank you” emails. Everyone gets these emails so that we can be sure the real owner of the email address took this action, and to give you the opportunity to correct the record if necessary.
  • Emails from petition starters via MyUplift. Petition starters are able to email anyone who signed their petition and selected “Yes, tell me how I can support people powered change” “Yes, I want to get updates on this and other campaigns at Uplift”, with some moderation by the Uplift staff team. You can opt out any time by clicking the unsubscribe link in any of these emails or by selecting “No, I don’t want to hear about this campaigns progress or other actions at Uplift”.
  • Direct responses – when you get in touch by responding to one of our emails or sending a message to [email protected], a volunteer or member of the staff team will respond to you directly.
  • Emails to individuals (politicians, public figures such as CEOs) from Uplift members. Uplift facilitates these messages with templates and tips for email writing, but they are sent by individual members (as reflected in the “from” address).
  • Emails to journalists. We will occasionally send press releases with information we feel is newsworthy or otherwise relevant to journalists.

(5.b) Why are we calling you?

Uplift or third parties operating on Uplift’s behalf may contact you by phone or Whatsapp message from time to time.

  • If you phone us and we miss the call, or another member of staff is best suited to deal with your request, we will call you back
  • On some surveys, we include an optional phone number question with the text “If you choose to share your phone number, Uplift (or a representative of Uplift) may call you to share campaign updates, events and fundraising. You can opt out at any time by going to this opt out page or by contacting Uplift staff at [email protected].”. If you provide your phone number, we may contact you with fundraising or other campaign opportunities.
  • We send out campaign-related messages to members on WhatsApp.

(5.c) Member surveys and research

We may use your answers on Uplift surveys to undertake research. We may combine this information with other personal information you have given us in the past, or which we collect via member surveys (see section 6 below) for this purpose. And we may collect demographic and attitudinal information for this analysis.

This may include creating member ‘personas’ and profiles of your interests. This helps us to get a better understanding of your background, interests and preferences in order to improve our communications and/or interactions with you, to help ensure they are targeted to be relevant and appropriate, and to provide information (sometimes through third parties) about campaigns and other aspects of our services which we consider may be of interest to you. It also allows us to better understand our members and ensure your member experience is tailored to your needs.

Additionally it allows us to (i) focus our resources on issues of interest to our members, and (ii) send out communications through mediums (for example, we might focus on advertising in publications where most of our members get their news), that are of interest to our members.

We may analyse this information in anonymous/ aggregated form (so that it does not identify you) and share that analysis with key decision makers – for example, to tell TDs that hundreds of Uplift members in their constituency are nurses.

We rely on our legitimate interests to undertake data processing for these purposes. If we use your special category data for these purposes, we will obtain your explicit consent where necessary or rely on other conditions under applicable data protection law.

We may use third parties, such as data analysts, to assist us with undertaking this type of research and profiling, and we will have agreements in place to ensure that any third parties adhere to the same strict data protection regulations as us. .

(5.d) Pixel tracking

We use ‘pixel trackers’ (including trackers provided by SendGrid) to provide us with insights about the way you interact with our emails, so we can learn about the effectiveness of our communications. For example, these tools tell us when and if you open an email from Uplift and whether you click on a link within the email. This is useful because it allows us to decide what kind of content you and our other members are interested in receiving.

We may then change the type of emails we send to you and our membership, or stop sending you emails at all if it seems you are no longer interested to hear from us.

These tools also protect our communications from being incorrectly flagged as ‘spam’ by email providers.

If you use an email client that allows it, you can ‘block’ pixels by changing your settings to block images being loaded by default.

(5.e) Donations

Financial transactions carried out on our website are handled through one of three third-party payment processors.

  1. Stripe: We recommend that you read Stripe’s privacy policy (available at https://stripe.com/en-ie/privacy) prior to effecting any transactions with us. We will provide your personal data to Stripe only to the extent necessary for the purposes of processing payments for transactions you enter into with us. We do not store your financial details.
  2. You may also donate to us using PayPal. If you donate using PayPal, your personal information will be provided to PayPal so they can process your donation. Please see their privacy notice for more information about how they use and retain your personal information: https://www.paypal.com/uk/webapps/mpp/ua/privacy-full.
  3. If you set up a recurring monthly donation via direct debit, we will use a provider called GoCardless to process your regular direct debit payments. https://gocardless.com/privacy/
  4. Fundraise Up: We also accept once off and monthly donations via donation platform, Fundraise Up. We recommend that you read Fundraise Up’s privacy policy (available at https://fundraiseup.com/privacy/) prior to effecting any transactions with us. We will provide your personal data to Fundraise Up only to the extent necessary for the purposes of processing payments through their platform for transactions you enter into with us. We do not store your financial details.
    Please note that Fundraise Up facilitates payments via a number of different processors. We also recommend that you read each processor’s privacy policy before undertaking any transactions with us.
    – Stripe https://stripe.com/en-ie/privacy
    – Google Pay https://payments.google.com/payments/apis-secure/u/0/get_legal_document?ldo=0&ldt=privacynotice&ldl=en
    – Apple Pay https://www.apple.com/legal/privacy/data/en/apple-pay/
    – PayPal https://www.paypal.com/ie/legalhub/paypal/privacy-full

We will provide your personal information to payment processors only to the extent necessary to process payments. We do not store your financial details.

(5.f) Public contact data

In the pursuit of our campaign goals, Uplift may collect and categorise publicly available contact information (emails, phone numbers and social media handles). For this specific category, we engage in the following practices:

  • We record the public source of the data and when it was collected.
  • We audit the data at least annually and remove any data which is no longer publicly available.

(6) Your Rights

Where we rely on your consent to use your personal information, you have the right to withdraw that consent at any time. This includes the right to ask us to stop using your personal information for direct marketing purposes or to be unsubscribed from our email list at any time. You also have the following rights:

(6.a) Right to be informed

You have the right to be told how your personal information will be used. This Policy and other policies and statements used on our website and in our communications are intended to provide you with a clear and transparent description of how your personal information may be used.

(6.b) Right of access

You can write to us to ask for confirmation of what information we hold about you and to request a copy of that information. Provided we are satisfied that you are entitled to see the information requested and we have successfully confirmed your identity, we will provide you with your data. The simplest way to access your data is to use the form on this page: https://www.uplift.ie/gdpr-data-requests/

(6.c) Right of erasure

You can ask us for your personal information to be deleted from our records. In many cases we would propose to suppress further communications with you, rather than delete it. The simplest way to ask for your data to be erased is by sending an email to [email protected]. Our data protection manager will respond to your request within the legal timeframe.

(6.d) Right of rectification

If you believe our records of your personal information are inaccurate, you have the right to ask for those records to be updated.

(6.e) Right to restrict processing

You have the right to ask for processing of your personal data to be restricted if there is disagreement about its accuracy or legitimate usage.

(6.f) Right to data portability

In some circumstances, you may be entitled to obtain your personal data from a data controller (in this case Uplift) in a format that makes it easier to reuse your information in another context, and to transmit this data to another data controller of your choosing without hindrance. This is referred to as the right to data portability.

To the extent required by applicable data protection laws, where we are processing your personal information (i) under your consent, (ii) because such processing is necessary for the performance of a contract to which you are party or to take steps at your request prior to entering into a contact or (iii) by automated means, you may ask us to provide it to you – or another service provider – in a machine-readable format.

To exercise these rights, please send a description of the personal information in question using the contact details in section 9 below. We also have specific pages to unsubscribe from our email list (https://id.uplift.ie/subscriptions/unsubscribe?subscription=1) or to unsubscribe from phone calls (https://id.uplift.ie/subscriptions/unsubscribe?subscription=6).. Where we consider that the information with which you have provided us does not enable us to identify the personal information in question, we reserve the right to ask for (i) personal identification and/or (ii) further information.

Please note that some of these rights only apply in limited circumstances. For more information, we suggest that you consult the Data Protection Commission (“DPC”) guidance – or please contact us using the details in section 9 below.

You are further entitled to make a complaint including about the way we have processed your data to the DPC. For further information on how to exercise this right, please see the guidance at https://www.dataprotection.ie/en/individuals/raising-concern-commission.

(7) Data retention

Uplift will ensure that personal data is not kept for longer than what is strictly necessary for the purpose for which the data is processed, in line with the principles laid down in Article 5 of the GDPR.

To fulfil this commitment, Uplift has developed a Data Retention and Destruction Policy and associated schedule to ensure Uplift fulfils its obligation in regards to retention periods for all categories of personal data processed by the organisation.

Once the respective retention period has elapsed, Uplift undertakes to destroy, erase or otherwise put this data beyond use, in line with its Data Retention and Destruction Policy.

(8) Review

This Policy will be reviewed at least annually by the Board of Directors to ensure alignment to appropriate risk management requirements and its continued relevance to current and planned operations, or legal developments and legislative obligations.

(9) Contact

We are not required by law to have a “Data Protection Officer” – however we have a Data Protection Manager. Please let us know if you have any queries or concerns whatsoever about the way in which your data is being processed by either emailing the Data Protection Manager at [email protected] and/or our wider team at [email protected]

(10) Supervisory authority

Uplift’s headquarters is in Ireland. Should you wish to contact the relevant supervisory authority in relation to a data protection issue involving Uplift, you should contact:

The Irish Data Protection Commissioner:

Telephone +353 57 8684800

+353 (0)761 104 800 
Fax +353 57 868 4757
Postal Address Data Protection Commissioner
Canal House
Station Road
Portarlington
Dublin Office 21 Fitzwilliam Square
Dublin 2
D02 RD28
Ireland.
Portarlington Office Canal House
Station Road
Portarlington
R32 AP23 Co. Laois