Privacy policy

Introduction

Amnesty International has long campaigned for the right to privacy and against unlawful surveillance and intrusion. We take the same care in how we handle personal information people share with us.

This policy explains what personal information we collect, why we use it, the legal reasons we rely on to collect and store your personal information, who we share it with, how long we keep it, and the rights you have. We have written it in plain language, so it is easier to use.

This policy applies to personal information processed by Amnesty International Limited (the International Secretariat of the Amnesty International movement) through www.amnesty.org and other websites managed and operated by the International Secretariat, online systems, forms, campaigns, education activities, donation pages, membership interest forms, recruitment processes and other public-facing services we operate.

When we say “Amnesty International”, “we”, “us” or “our”, we mean Amnesty International Limited, the main operating company of Amnesty International’s International Secretariat (https://www.amnesty.org/en/who-we-are/). Amnesty International Limited is registered in England and Wales as a company limited by guarantee under number 01606776.

Amnesty International is the controller of the personal information covered by this policy. That means we decide why and how that information is used. Our contact details are at the end of this policy. You can contact us by post, email or telephone if you have questions or want to use your privacy rights.

Some Amnesty International sections, structures or partner organisations may have their own privacy policies. This policy does not replace those policies where another organisation is the controller of your information.

Personal information we collect

The personal information we collect depends on how you choose to interact with us. You can use all of the pages of our websites without telling us who you are. We may still collect technical information, such as your IP address, device information and cookie or similar technology information.

We collect personal information when you:

  • sign a petition, take an online action or join a campaign;
  • express an interest in joining Amnesty International or becoming an international member;
  • make a donation or other payment to us;
  • sign up for updates, events, fundraising communications or other communications from us;
  • sign up for human rights education courses;
  • take part in other online campaigns or activities, such as Amnesty International Decoders;
  • apply for a job, volunteering opportunity, internship or similar role with us;
  • contact us, make an enquiry, make a complaint or exercise your privacy rights; or
  • use our websites, emails, forms, social media pages or other online services.

The personal information we collect may include:

  • your name, age or age range, address, email address and telephone number;
  • your country, language, communication preferences and Amnesty International interests;
  • information you provide in petitions, campaign actions, membership interest forms, course registrations, surveys, enquiries or complaints;
  • donation and payment information, including donation amount, date, payment status and payment reference. Card details are encrypted by our third party payment providers. Amnesty International does not store your full card details;
  • technical information, such as IP address, device type, browser type, operating system, pages visited, links clicked, date and time of visits, approximate location inferred from technical data, cookie identifiers and similar online identifiers may be collected by us and are collected by our third party payment providers under their terms and conditions. Amnesty International is not responsible for the privacy policies of third party providers;
  • recruitment information, such as your application, CV, cover letter, employment history, qualifications, references, interview notes, assessment results, right-to-work information and information needed to manage the recruitment process;
  • special category information where you choose to provide it, where your interaction with us may reveal or suggest it, or where it is relevant and lawful for us to use it. This may include information about racial or ethnic origin, political opinions or beliefs, religion or belief, trade union membership, health, disability, sex life or sexual orientation; and
  • criminal offence information where it is relevant to a recruitment process, safeguarding, fraud prevention, legal claims, legal obligations or another lawful purpose.

We ask only for the information we need. Where providing information is optional, we will make that clear where we can. If you do not provide information we need to deliver a service, process a donation, assess an application or meet a legal requirement, we may not be able to do those things.

Cookies and online tracking

Our websites use cookies and similar technologies. These may include small files, pixels, tags and local storage. They help websites work, remember choices, understand how people use our services, measure campaigns, improve content and, where permitted, support advertising or fundraising activity.

Some cookies are needed for our websites to work. Others are optional. Where required by law, we ask for your consent before setting optional cookies or similar technologies. You can change your choices through the cookie tools on our websites or through your browser settings.

Cookies and similar technologies may collect IP addresses, device identifiers, browser information, pages viewed, links clicked and other online activity information. Some of this information may be shared with analytics, advertising or social media platforms, depending on your choices and the technology used. Where cookies, pixels or similar technologies are used for advertising, audience measurement or cross-site tracking, we use them only where permitted by law and consistent with your cookie choices.

For more detail, including the types of cookies we use and how to manage them, please read our Cookie Statement (https://www.amnesty.org/en/cookie-statement/).

How we use your personal information and our lawful bases

Data protection law says we need a lawful basis to use personal information. We use different lawful bases depending on the purpose and the type of information involved.

We use your personal information for the purposes below:

Online campaigning and education activities

To run petitions, email actions, campaigns and online activities, and to send your action to the intended recipient where that is part of the campaign. We usually rely on your consent, our legitimate interests in campaigning for human rights, or both, depending on the action. Where the information involved is special category information, or where your participation may reveal or suggest special category information, we also rely on appropriate special condition such as explicit consent, information you have clearly made public, substantial public interest or another applicable condition under data protection law, depending on the context.

To provide human rights education courses, events or other services you register for. We rely on contract, steps before entering into a contract, consent where appropriate, and legitimate interests in providing and improving those services.

Responding to your messages

To respond to your enquiries, complaints and requests. We rely on our legitimate interests in responding to people who contact us, and on legal obligation where the law requires us to respond or keep records.

Campaign updates

To send campaign updates, fundraising asks, newsletters and other marketing communications. We rely on consent where required and may rely on legitimate interests where the law allows. You can opt out at any time.

Membership

To manage your expression of interest in joining Amnesty International and to administer international membership where applicable. We rely on contract, steps before entering into a contract, legitimate interests and, where relevant, legal obligation.

Fundraising

To process donations and other payments, send receipts, manage payment records and prevent fraud. We rely on contract, legal obligation and legitimate interests. We may also use payment information to comply with financial, tax, audit and anti-money-laundering requirements

Recruitment

To assess and manage job, volunteering, internship and similar applications. We rely on steps before entering into a contract, contract, legal obligation and legitimate interests in recruiting suitable people fairly and effectively.

To monitor diversity, inclusion and equal opportunities in recruitment. We usually use anonymised or aggregated information where possible. Where we use identifiable special category information, we rely on explicit consent or another relevant condition under data protection law, such as substantial public interest for equality monitoring where applicable.

Protecting and improving our online services

To keep our websites, systems, people and information secure, including preventing misuse, fraud, cyber incidents and unauthorised access. We rely on legitimate interests and, where relevant, legal obligation.

To analyse and improve our websites, campaigns, services and communications. We rely on legitimate interests, and on consent where required for optional cookies or similar technologies.

To share information within the Amnesty International movement and with service providers where needed to deliver our work. We rely on legitimate interests, contract, legal obligation or consent, depending on the context.

To establish, exercise or defend legal claims, comply with court orders, respond to lawful requests from authorities, and meet regulatory or legal duties. We rely on legal obligation, legitimate interests and, where relevant, public interest or legal claims conditions.

In rare cases, we may use personal information where this is necessary to protect someone’s vital interests, for example in an emergency, or for an important public-interest purpose recognised by law.

Special category and criminal offence information

Special category information needs extra protection. Some of the ways you engage with us may reveal or suggest sensitive information about you, such as your political opinions, beliefs, campaigning interests, human rights concerns, personal experiences, health, disability, ethnicity, religion or belief, sex life or sexual orientation. For example, this may happen if you sign a petition, take a campaign action, contact us about a human rights issue, tell us about your personal circumstances, take part in an activity, apply for a role, or choose to provide diversity information.

We use special category information only where it is relevant, necessary and proportionate, and only where we have both a lawful basis and a special condition under UK GDPR, EU GDPR or other applicable data protection law. Depending on the context, this may include your explicit consent, employment and social protection law, substantial public interest, equality monitoring, vital interests, information you have clearly made public, legal claims, or another applicable condition under data protection law.

We recognise that information about your support for Amnesty International, your participation in campaigns, petitions or actions, and the human rights issues you engage with may be sensitive, particularly where it could reveal political opinions, beliefs, associations or risks to you or others. We take this into account when deciding what information to collect, how to use it, who to share it with, how long to keep it and what safeguards to apply.

Where information may create particular risks for individuals, such as campaigners, supporters, complainants, human rights defenders, witnesses, vulnerable people or people in higher-risk countries or situations, we may apply additional safeguards such as limiting access, limiting sharing, minimising the information collected or using anonymised or pseudonymised information where appropriate.

Criminal offence information also needs extra protection. We use it only where the law allows and where it is relevant, proportionate and necessary. This may include recruitment checks, safeguarding, fraud prevention, legal obligations, regulatory requirements or legal claims.

Marketing and fundraising communications

We want our communications to be useful and respectful. We may contact you about human rights campaigns, actions, events, education, fundraising, membership and ways to support our work.

We will ask for your consent before sending marketing or fundraising emails or similar electronic communications where the law requires consent. Where the law allows us to rely on legitimate interests, we will still give you clear ways to say no.

We may use limited information about you, such as your country, language, communication preferences, previous interactions, donation history, campaign interests or website engagement, to help make our communications more relevant and avoid sending unnecessary messages. We do not intentionally use special category information, children’s information or information about vulnerable individuals for marketing, fundraising profiling or audience targeting unless the law allows it and appropriate safeguards are in place.

You can unsubscribe or change your preferences at any time. You can use the unsubscribe link in our emails, follow any preference tools we provide, or contact us using the details at the end of this policy. You can also object to our use of your personal information for direct marketing, including related profiling. If you object, we will stop using your personal information for those purposes.

If you opt out of marketing or fundraising communications, we may still contact you about service messages. For example, we may send receipts, respond to requests, give information about a course or application, or provide important information about your relationship with us.

Sharing your personal information

We do not sell your personal information. We share it only where we have a proper reason and appropriate safeguards.

We may share personal information with:

  • other parts of the Amnesty International global movement, including national sections, structures and related organisations, where this helps us run campaigns, respond to your interest in joining Amnesty International, support local engagement or further our human rights work;
  • service providers that process information for us, such as website hosting providers, IT providers, email and communications providers, donation and payment processors, course providers, recruitment platforms, analytics providers and support service providers;
  • banks, payment providers, relevant financial institutions and fraud prevention or checking services where needed to process payments, prevent fraud or deal with suspected fraudulent transactions;
  • recruitment providers, referees, background-check providers where relevant and lawful, and other organisations involved in the recruitment process;
  • analytics, cookies, advertising and social media platforms where permitted by law and consistent with your choices. This may include custom audience or lookalike audience tools, where information such as an email address may be securely matched to show Amnesty International content to existing or potential supporters. We use these tools only where we have a lawful basis and, where required, cookie or marketing consent. We do not sell your personal information or intentionally use children’s information, special category information or information about vulnerable individuals for custom audience or lookalike audience targeting unless the law allows it and appropriate safeguards are in place;
  • professional advisers, insurers, auditors and organisations that support governance, finance, risk, legal or compliance work; and
  • courts, regulators, law enforcement bodies, public authorities or other third parties where required by law, where we need to protect rights, safety or security, or where disclosure cannot reasonably be resisted.

Where we share information with another Amnesty International organisation that uses it as a separate controller, that organisation is responsible for its own use of the information and its own privacy information may apply.

Where service providers process personal information for us, we require them to use it only on our instructions, keep it secure and meet data protection requirements. Some organisations we share with such as advertising, analytics or social media platforms, may also use personal information for their own purposes as separate controllers, depending on the service and your settings with them. Where that happens, they are responsible for how they use your information under their own privacy information.

International transfers

Amnesty International is a global movement. We and the organisations we work with may process personal information in countries outside the UK, the European Economic Area or the country where you live.

When we transfer personal information internationally, we take steps to protect it. Where UK GDPR or EU GDPR applies, we use a valid transfer mechanism. This may include an adequacy regulation or adequacy decision, standard contractual clauses, the UK international data transfer addendum, an international data transfer agreement, or another lawful safeguard or derogation available under data protection law.

Where we share information with another part of the Amnesty International movement outside the UK or EEA, we use appropriate arrangements so that the information is handled to a standard consistent with applicable data protection law.

Third-party websites and embedded content

Our websites may link to third party websites, applications or third party embedded content. These may include websites or applications operated by Amnesty International sections, related organisations or other third parties. This policy does not apply to services we do not control such as other Amnesty International movement websites that are not managed, owned or operated by the International Secretariat. Those organisations may have their own privacy policies.

Children and young people

Our websites, campaigns and activities are not specifically aimed at children, but we recognise that children and young people may engage with and support our work.

If you are under 13, you must not provide your personal information to us unless a parent or guardian has given their consent.

If you are aged between 13 and 18, you can take part in our campaigns and activities, but we encourage you to involve a parent or guardian before sharing personal information. We may also apply additional safeguards when you do so.

Where we rely on consent to use personal data, we take reasonable steps to ensure that it is valid. This may include seeking consent from or verifying consent with a parent or guardian where required.

We take extra care when handling children’s personal data. In particular, we:

  • only collect and use personal data that is necessary and proportionate;
  • present privacy information in a clear and age-appropriate way;
  • take into account the best interests of the child;
  • apply additional safeguards when children engage with our campaigns, educational activities, events and communications;
  • do not use children’s personal data for profiling or marketing where this could be unfair, misleading or inappropriate.

In some cases, we may require the involvement of a parent or guardian before allowing a child to participate in certain activities or before collecting or using their personal data. We may also restrict access to certain features where appropriate safeguards cannot be put in place.

If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete it as soon as reasonably practicable.

Children, parents and guardians can contact us at any time to ask questions or exercise their data protection rights.

Security

We use appropriate technical and organisational measures to protect personal information. These measures are designed to keep information secure, accurate and available only to people who need it. They include controls for access, storage, payment processing, service providers and system security.

We also take care to use secure systems for processing payments through our payment service providers. No transmission over the internet can ever be completely secure. But we work to protect personal information and respond appropriately if a security issue occurs.

How long we keep personal information

We keep personal information only for as long as we need it for the purposes described in this policy. We then delete it, anonymise it or keep only what we need for legal, accountability, archival, research or analytical purposes.

The time we keep information depends on the type of information, why we collected it, whether you remain engaged with us, whether we need it to provide a service or manage a relationship, and whether we must keep it for legal, financial, audit, tax, regulatory, employment, safeguarding, dispute or evidence reasons.

For example, donation records may need to be kept for financial and audit reasons. Recruitment records may need to be kept to manage applications, respond to queries and protect legal rights. Website and cookie information may be kept for shorter or longer periods depending on the technology and purpose, as explained in our Cookie Statement.

We may keep limited suppression records where you opt out of marketing or fundraising communications, so that we can respect your choice. We may also keep limited records of petitions, campaign actions, donations, complaints or rights requests where needed for accountability, legal, audit or evidence purposes.

Unsuccessful recruitment applications will be retained for three years after the conclusion of the selection process, unless a longer period is required or permitted by law in a particular case.

Your privacy rights

The personal information we hold about you is yours. Depending on where you live and how we use your information, you may have the rights below under UK GDPR, EU GDPR or other applicable data protection laws.

  • to be told how we use your personal information;
  • to ask for a copy of the personal information we hold about you;
  • to ask us to correct inaccurate or incomplete information;
  • to ask us to delete your information;
  • to ask us to restrict how we use your information;
  • to object to how we use your information, including where we rely on legitimate interests;
  • to object at any time to direct marketing, including fundraising communications and related profiling;
  • to ask us to transfer information you provided to us to you or another organisation, where the right to portability applies;
  • to withdraw consent at any time where we rely on consent. This will not affect anything we have already done lawfully before you withdrew consent; and
  • to rights related to automated decision-making and profiling, where applicable.

These rights are not absolute. Sometimes we may need to keep or use information, for example to meet a legal obligation, protect rights, deal with a complaint or establish, exercise or defend legal claims. If we cannot do what you ask, we will explain why where we can.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects for you, unless we tell you otherwise and the law allows us to do so.

Recruitment privacy statement

Amnesty International is committed to handling personal information responsibly during recruitment.

We use information you provide in your application to manage recruitment and selection. This may include assessing your suitability, arranging interviews or assessments, checking information you provide, communicating with you, making decisions about your application, meeting legal obligations and protecting our legal rights.

We may use recruitment service providers to help manage applications and related processes. We will not disclose your recruitment information to other third parties without a proper reason, such as your consent, a legal requirement, recruitment administration, reference checking, safeguarding, legal claims or another lawful basis described in this policy.

If you choose to provide diversity and equal opportunities information, such as gender, age, sexual orientation, religion or belief, caring responsibilities, disability, ethnic origin or region of origin, we use it for equality, diversity and inclusion monitoring. We use anonymised or aggregated information where possible.

We may also process special category information and criminal offence information where it is relevant to recruitment and where the law allows it. This may include equality monitoring, reasonable adjustments, right-to-work checks, safeguarding, assessing suitability for a role, legal obligations or legal claims.

You may be asked to confirm a declaration as part of your application. The declaration may say that the information in your application is true and complete, that deliberate omissions, falsification or misrepresentation may lead to rejection or dismissal, that we may seek clarification about professional registration details where applicable, and that we may process your personal information on the privacy terms set out in this policy.

How to contact us or use your rights

If you want to use your rights, ask a question or raise a concern about this policy, you can contact us in the following ways:

  • By post: Amnesty International Limited, International Secretariat, 1 Easton Street, London, WC1X 0DW, UK.
  • By email: [email protected]
  • By telephone: +44 (0) 20 7413 5500

Complaints

If you are unhappy with how we handle your personal information, please contact us using the details above. Please include enough information for us to understand your complaint. We will acknowledge receipt of complaints within 30 days. We will take appropriate steps to respond to complaints without delay, keep you informed about the progress of your complaint and tell you about the outcome.

You also have the right to complain to a data protection supervisory authority. In the UK, this is the Information Commissioner’s Office:

If EU GDPR applies to how we use your information, you may also complain to the supervisory authority in the EU country where you live, work or where you believe an issue has happened.