Privacy Policy

1. Who We Are

DIIC Diversity & Inclusion in Construction C.I.C is a registered Community Interest Company supporting diversity, inclusion, opportunity and representation within the construction, engineering and built environment sectors.

For the purpose of UK data protection law, DIIC Diversity & Inclusion in Construction C.I.C is the “data controller” for the personal information we collect and use.

Last updated: July 2026

2. Personal Information We May Collect

We may collect personal information when you use our website, complete a form, register for an event, apply for membership, volunteer, donate, contact us, attend a programme, sign up to training or communicate with us.

The information we collect may include:

• Your name, job title, organisation and contact details.
• Email address, phone number and postal address.
• Event registration details, attendance records and ticket information.
• Membership, training, volunteering or programme application information.
• Payment, donation or sponsorship details where applicable.
• Messages, enquiries, feedback, complaints or correspondence you send to us.
• Information about your professional background, sector, career interests or support needs.
• Accessibility requirements, dietary requirements or reasonable adjustment requests.
• Photographs, video or audio recordings from events, where consent or another lawful basis applies.
• Website usage information, such as IP address, browser type, pages visited and cookie data.

3. Special Category Information

Due to the nature of our work in diversity, inclusion, accessibility, representation and support, we may occasionally collect sensitive information if you voluntarily provide it to us.

This may include information relating to:

• Race, ethnic background or underrepresented community status.
• Disability, accessibility needs or health-related adjustments.
• Gender, equality, diversity and inclusion monitoring information.
• Safeguarding, support needs or vulnerability, where relevant to a programme or service.

4. How We Use Your Information

We may use your personal information to:

• Respond to enquiries and provide information about DIIC services.
• Manage event registrations, attendance, tickets, speakers, exhibitors and sponsors.
• Deliver training, workshops, membership services and support programmes.
• Process donations, sponsorship, invoices or payments.
• Manage volunteers, partners, mentors, speakers and community supporters.
• Send event updates, joining instructions, newsletters or relevant communications.
• Improve our website, services, outreach, programmes and user experience.
• Monitor equality, diversity and inclusion outcomes where appropriate.
• Protect attendees, staff, volunteers, beneficiaries and the public through safeguarding and security measures.
• Comply with legal, accounting, regulatory and reporting obligations.

5. Lawful Basis for Using Your Information

We only use personal information where we have a lawful basis to do so. Depending on the situation, we may rely on one or more of the following lawful bases:

6. Cookies and Website Analytics

Our website may use cookies and similar technologies to help the website work properly, improve performance, understand visitor activity, remember preferences and support security.

Cookies may be used for:

• Essential website functionality.
• Website performance and analytics.
• Security and spam protection.
• Embedded content such as videos, maps or social media links.
• Marketing or advertising, where applicable and where consent is required.

You can control or delete cookies through your browser settings. Where required, we will ask for your consent before placing non-essential cookies on your device.

7. Who We May Share Your Information With

We do not sell your personal information. We may share your information only where necessary and appropriate, including with:

• Event platforms, ticketing providers and registration systems.
• Email, website hosting, IT support and cloud storage providers.
• Payment processors, accountants and professional advisers.
• Training providers, partners, sponsors or delivery organisations involved in a programme or event.
• Safeguarding, emergency, legal or regulatory bodies where necessary.
• Funders or reporting bodies, usually using anonymised or aggregated information where possible.
• Law enforcement, courts, regulators or public authorities where required by law.

Where we use third-party service providers, we take reasonable steps to ensure they handle personal information securely and only process it for authorised purposes.

8. International Transfers

Some of our website, email, event, payment or cloud service providers may store or process information outside the United Kingdom. Where this happens, we will take appropriate steps to ensure your personal information remains protected in line with applicable data protection law.

9. How Long We Keep Your Information

We only keep personal information for as long as necessary for the purpose it was collected, including to meet legal, accounting, safeguarding, reporting or operational requirements.

Typical retention periods may include:

• General enquiries: kept for as long as needed to respond and manage follow-up.
• Event registration records: kept for event administration, reporting and audit purposes.
• Membership, training and programme records: kept for the duration of involvement and a reasonable period afterwards.
• Financial and accounting records: usually kept for at least 6 years where required.
• Safeguarding or serious incident records: kept for longer where necessary for legal, safety or regulatory reasons.
• Marketing consent records: kept until you unsubscribe or withdraw consent, plus a record of your preference.

When information is no longer needed, we will delete it securely or anonymise it where appropriate.

10. How We Protect Your Information

We take reasonable technical and organisational measures to protect personal information from unauthorised access, loss, misuse, disclosure, alteration or destruction.

These measures may include:

• Access controls and password protection.
• Secure website, email and hosting arrangements.
• Limiting access to personal information to authorised people only.
• Staff, volunteer or partner confidentiality expectations.
• Secure disposal of records when no longer required.
• Reviewing suppliers and systems where appropriate.

11. Your Data Protection Rights

Under UK data protection law, you have rights in relation to your personal information. These may include:

• Right of access: to request a copy of the personal information we hold about you.
• Right to rectification: to ask us to correct inaccurate or incomplete information.
• Right to erasure: to ask us to delete your information in certain circumstances.
• Right to restrict processing: to ask us to limit how we use your information.
• Right to object: to object to certain uses of your information.
• Right to data portability: to request that certain information is transferred to you or another provider.
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time.
• Right to complain: to the Information Commissioner’s Office if you are unhappy with how we handle your information.

Some rights only apply in certain circumstances. We may need to verify your identity before responding to a request.

12. Marketing Communications

We may send you updates about DIIC events, programmes, training, membership, volunteering, fundraising, opportunities and related activities where you have consented or where we have a lawful basis to do so.

You can unsubscribe or ask us to stop sending marketing communications at any time by contacting us at enquiries@diic.org.uk or using the unsubscribe link where available.

13. Photography, Video and Events

DIIC events may include photography, video or audio recording for reporting, promotional, educational or community engagement purposes.

Where appropriate, we will provide notices at events and may ask for consent. If you do not wish to be photographed or filmed, please let us know before or during the event so reasonable steps can be taken.

14. Children and Young People

Some DIIC activities may involve young people, students, apprentices or early-career participants. Where we knowingly collect personal information from children or young people, we will take extra care and, where required, seek appropriate parental, guardian, school, college or organisational consent.

15. Links to Other Websites

Our website may contain links to external websites, partner organisations, social media platforms, event platforms or payment providers. We are not responsible for the privacy practices or content of external websites. Please read their privacy policies before providing personal information to them.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, website, legal requirements or how we handle personal information.

The latest version will be published on this page with an updated date.