Privacy Policy
Women on Boards CIC®
Last updated: 19 October 2026
1. Introduction
Women on Boards CIC® is committed to protecting your personal information and respecting your privacy.
We are a UK Community Interest Company working to strengthen leadership, governance and opportunity through professional development, networking, research, strategic partnerships and policy engagement.
This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website or engage with our services and activities.
It applies to:
-
Our website and online enquiries.
-
Network memberships, mentoring and leadership development programmes.
-
Events, workshops, roundtables and professional meetings.
-
Research, surveys, consultations and Think Tank activities.
-
Policy, governance and parliamentary engagement.
-
Partnerships, sponsorship and collaborative activities.
-
Newsletters and marketing communications.
-
Purchases, bookings and payments made through our website.
-
Reports, publications, case studies and organisational impact activities.
We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended.
2. Who We Are
Women on Boards CIC® is responsible for determining how and why personal information is processed for its own organisational activities.
Organisation: Women on Boards CIC®
Website: https://www.womenonboardscic.com
Registered office:
c/o T Richards Ltd
Curzon Street
Burton on Trent
Staffordshire
DE14 2DH
United Kingdom
Privacy contact: network@womenonboardscic.com
For the purposes of UK data protection legislation, Women on Boards CIC® is the data controller for personal information processed under its authority.
Where activities are delivered in collaboration with external organisations, those organisations may act as independent controllers, joint controllers or data processors, depending on the arrangements.
3. Personal Information We Collect
The information we collect depends on how you interact with us.
Personal and professional information
We may collect your name, email address, telephone number, organisation, job title, business sector, professional background, location and other information you choose to provide.
Membership and programme information
When you join our Network or participate in a leadership development programme, we may collect application details, membership records, participation information, attendance, professional development interests, feedback and relevant correspondence.
Event and meeting information
We may collect event registrations, attendance information, accessibility requirements, dietary information, photographs, recordings and feedback.
Research and consultation information
We may collect survey responses, interview contributions, professional experiences, views on leadership and governance, organisational information and other information voluntarily provided through research or consultation activities.
Financial and transaction information
We may collect information necessary to process bookings, membership payments, invoices, refunds and other transactions.
Payments made through our website are administered using Wix and the payment services configured within that platform.
Payment information is processed according to the arrangements and privacy policies of the relevant payment service providers. We do not need to receive complete payment card details to administer a transaction.
Website and technical information
Our website may collect technical information, including IP addresses, device and browser information, website interactions, referral sources and cookie preferences.
We use Wix Analytics and Google Analytics to understand website performance and visitor activity, subject to applicable consent requirements.
4. How We Collect Information
We collect personal information when you:
-
Complete a website form or contact us directly.
-
Subscribe to our newsletter or other communications.
-
Apply for or purchase a membership or programme.
-
Register for an event, workshop or roundtable.
-
Participate in research, surveys or consultations.
-
Communicate with our team or representatives.
-
Engage with our professional, partnership or policy activities.
-
Visit our website and interact with permitted analytics technologies.
We may also receive professional contact information through introductions, event collaborations, research partnerships or publicly available business sources.
Where information is obtained indirectly, we will provide relevant privacy information where required.
5. Why We Use Personal Information
We use personal information to:
-
Respond to enquiries and requests for information.
-
Administer memberships and leadership development programmes.
-
Organise and deliver events, workshops, meetings and roundtables.
-
Manage registrations, payments, invoicing and participation.
-
Communicate with members, participants, contributors and professional contacts.
-
Conduct research, surveys, consultations and evaluations.
-
Develop reports, publications, recommendations and evidence-based policy contributions.
-
Coordinate strategic partnerships, sponsorship and stakeholder engagement.
-
Manage governance, advisory and policy-related activities.
-
Assess and communicate the impact of our work.
-
Improve our services, website and organisational operations.
-
Send newsletters, invitations and promotional communications where permitted.
-
Meet legal, regulatory, accounting and other statutory obligations.
We do not sell personal information.
6. Our Lawful Bases for Processing
Under the UK GDPR, we must have an appropriate lawful basis for processing personal information.
The lawful basis depends on the purpose of the processing.
Contract
Where processing is necessary to provide a membership, programme, event or other service you have requested, or to take steps before entering into a contract.
Legitimate interests
Where processing is necessary for our legitimate organisational interests, such as managing professional relationships, responding to enquiries, conducting proportionate research, improving services and administering stakeholder engagement, provided those interests are not overridden by individuals' rights and freedoms.
Consent
Where you have given valid consent for a specific purpose, such as receiving certain marketing communications, participating in particular optional research activities or the use of non-essential cookies.
Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect processing already undertaken lawfully.
Legal obligation
Where processing is necessary to comply with applicable legal requirements, including financial record-keeping, tax, regulatory and other statutory obligations.
We assess and document the appropriate lawful basis for each processing activity.
7. Network Membership and Leadership Development
Our Network and professional development activities are designed to support leadership capability, governance understanding, professional relationships and opportunities for progression.
When you become a member or participant, we process information necessary to:
-
Manage applications and memberships.
-
Allocate participants to appropriate programmes or cohorts.
-
Administer bookings, invoices and payments.
-
Communicate programme arrangements and updates.
-
Facilitate events, mentoring, workshops and peer learning.
-
Record attendance and programme feedback.
-
Evaluate programme delivery and effectiveness.
Some activities may involve online meeting platforms, professional networking groups or external speakers and delivery partners.
Where participation involves sharing information with other members, we will explain the relevant arrangements. Participants are expected to respect the confidentiality of information shared within professional learning environments.
We may use anonymised or aggregated programme information to evaluate outcomes and communicate organisational impact.
Identifiable testimonials, case studies and personal experiences will only be published where we have an appropriate lawful basis and have provided relevant information about the intended use.
8. Events, Workshops and Roundtables
We process personal information to organise and deliver events, workshops, roundtables and other professional meetings.
This may include registration details, attendance records, event communications, accessibility requirements and feedback.
Where events involve venues, speakers, sponsors or delivery partners, we may share limited personal information where necessary and lawful.
Attendance at an event does not automatically mean that your contact details will be shared with sponsors or that you will receive unrelated marketing communications.
Where photography, filming or recording takes place, we will provide appropriate information about its purpose and intended use.
Some events may operate under the Chatham House Rule or other confidentiality arrangements. These arrangements govern participants' use of information but do not replace our data protection obligations.
9. Research, Surveys and Think Tank Activities
Research and evidence gathering are important elements of our work.
We conduct or support activities designed to improve understanding of leadership, governance, organisational practices and opportunities within businesses and other organisations.
These activities may include surveys, interviews, consultations, Think Tanks, roundtables and research projects.
We collaborate with academic and research institutions, including and not limited to:
-
London School of Economics and Political Science (LSE).
-
Oxford Brookes University.
-
De Montfort University.
Depending on the research project, these organisations may have separate responsibilities for collecting, analysing, storing or managing research information.
We will explain the relevant arrangements to participants where required, including whether identifiable personal information will be shared with a research partner.
Research findings may be published in aggregated or anonymised form.
Where identifiable quotations, experiences or case studies are intended for publication, we will explain the intended use and obtain any permissions required.
Where research involves sensitive information, including information about health, ethnicity or other special categories of personal data, we will identify an appropriate lawful basis, an additional condition under Article 9 UK GDPR and any necessary safeguards.
Participation in voluntary research does not automatically constitute consent to unrelated marketing.
10. Policy, Governance and Parliamentary Engagement
Women on Boards CIC® undertakes policy and governance engagement, including work connected with the All-Party Parliamentary Group on Equitable Governance.
We may process professional contact details, correspondence, meeting records, stakeholder contributions, consultation responses and related information for legitimate organisational and policy purposes.
This may involve engagement with parliamentarians, public bodies, universities, businesses, professional associations and other organisations.
Information will only be shared where there is an appropriate legal basis.
Where another organisation is responsible for a particular activity or record, its own privacy information may also apply.
11. Partnerships, Sponsorship and Professional Relationships
We work with organisations and individuals through strategic partnerships, sponsorship, professional collaboration and stakeholder engagement.
We may maintain relevant professional information about existing and prospective partners, funders, advisers, speakers, collaborators and organisational representatives.
We use this information to coordinate meetings, develop relationships, administer agreements, deliver collaborative activities and communicate relevant opportunities.
We do not automatically add professional contacts to general marketing lists simply because they have attended a meeting, participated in an event or been introduced to us.
Any direct marketing communications will comply with applicable UK data protection and electronic marketing requirements.
12. The SME Code™ and Related Initiatives
Women on Boards CIC® is involved in developing The SME Code™, a voluntary framework supporting stronger leadership and governance within small and medium-sized enterprises.
Associated activities may include research, consultation, pilot programmes, organisational assessment, accreditation, benchmarking and other related initiatives.
The SME Code™ has a separate website:
This Privacy Policy covers personal information processed by Women on Boards CIC® for its own activities.
Where information is collected through The SME Code™ website or its assessment, other related services, the applicable privacy information for those services should be consulted.
Where information is shared between these initiatives, we will ensure that there is an appropriate lawful basis and relevant transparency information.
Participation in one programme does not automatically authorise unrelated processing under another.
13. Our Website, Wix and Payment Services
Our website is operated using Wix.
Wix provides website hosting, website management and associated functionality, including forms, bookings, transactions and payment administration where these services are enabled.
Information submitted through our website may be processed or stored within Wix systems and by relevant service providers supporting those systems.
Payments made through our website are administered using Wix and its configured payment services.
We process relevant transaction information to manage purchases, membership fees, bookings, refunds and accounting records.
The relevant providers may process personal information under their own privacy policies and contractual arrangements.
For more information, please refer to the Wix Privacy Policy:
https://www.wix.com/about/privacy
14. Newsletters and EmailOctopus
We use EmailOctopus to manage email subscriptions and distribute newsletters, organisational updates and other permitted communications.
Where you subscribe, we may process your name, email address, subscription preferences and information associated with email delivery and engagement.
EmailOctopus processes this information to support our mailing list administration and communications.
We send electronic marketing communications only where permitted under applicable law.
Where consent is required, we will obtain it through an appropriate opt-in process.
You can unsubscribe from marketing emails using the unsubscribe link included in our communications or by contacting:
Unsubscribing from marketing does not prevent us from sending essential administrative communications about an existing membership, purchase, booking or other contractual arrangement.
For further information about EmailOctopus, visit:
15. Website Analytics and Cookies
We use Wix Analytics and Google Analytics to understand how visitors interact with our website.
These services may collect information such as:
-
Pages visited.
-
Time spent on the website.
-
General visitor location.
-
Device and browser information.
-
Referral sources.
-
Website interactions and usage patterns.
Our website also uses cookies and similar technologies to support essential website functions and, where permitted, analytics.
Essential cookies are used where necessary for website functionality, security or other legally exempt purposes.
Non-essential analytics cookies and tracking technologies are subject to applicable consent requirements.
Where consent is required, visitors must be able to accept or reject non-essential technologies before they are activated.
Visitors should also be able to change or withdraw their cookie preferences.
Details of the specific cookies in use, their purposes, providers and durations should be made available through the website's cookie management information.
Further information is available through:
Wix: https://www.wix.com/about/privacy
Google: https://policies.google.com/privacy
16. Sharing Personal Information
We do not sell personal information.
We may share personal information where necessary and lawful with organisations that support our activities.
These may include:
Technology and communications providers
Wix, EmailOctopus, Google and other service providers used to operate our website, manage communications, administer payments or support online activities.
Academic and research partners
LSE, Oxford Brookes University, De Montfort University and other relevant research collaborators, where applicable to a specific project.
Event and programme delivery partners
Venues, facilitators, speakers and other organisations involved in delivering agreed activities.
Professional advisers
Accountants, legal advisers and other professional service providers where necessary.
Public authorities
Regulators, courts or other authorities where disclosure is legally required.
We seek to ensure that personal information is shared only for appropriate purposes and that relevant contractual, organisational and security safeguards are in place.
Where a recipient acts as an independent data controller, its own privacy policy may also apply.
17. International Data Transfers
Some of our technology and service providers may process or store personal information outside the United Kingdom.
This may include services associated with website hosting, email communications, analytics or payments.
Where personal information is transferred internationally, we will ensure that any safeguards required by UK data protection legislation are in place.
These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or other recognised transfer arrangements.
You may contact us for further information about applicable international transfer safeguards.
18. Data Security
We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, misuse, alteration and disclosure.
Our approach includes limiting access to information according to organisational responsibilities and using appropriate security features available through our technology providers.
We also expect external service providers processing information on our behalf to maintain appropriate security measures.
No online system can be guaranteed to be entirely secure. We review our arrangements in proportion to the nature of the information processed and the risks involved.
19. How Long We Keep Personal Information
We retain personal information only for as long as necessary for the purpose for which it was collected, including relevant legal, financial, contractual and regulatory requirements.
Retention periods vary depending on the information and the purpose of processing.
For example:
-
Enquiry information: Retained while needed to respond to and manage the enquiry and any necessary follow-up.
-
Membership and programme records: Retained while needed for service delivery and legitimate post-programme purposes.
-
Financial and transaction records: Retained for applicable accounting and tax obligations.
-
Marketing records: Retained while there is an appropriate lawful basis, subject to subscription preferences, withdrawal of consent and relevant suppression requirements.
-
Research information: Retained according to the relevant project's requirements, research arrangements and applicable legal obligations.
-
Event records, photographs and recordings: Retained only where there is a continuing legitimate and lawful purpose.
We periodically review information held and delete or anonymise records that are no longer required.
Where information must be retained for legal or regulatory reasons, those requirements will take precedence over routine deletion.
You may contact us to request further information about the retention criteria applicable to your personal information.
20. Special Category Personal Information
Some information receives additional protection under UK data protection legislation.
This includes information relating to health, racial or ethnic origin, religious beliefs, political opinions and other special categories.
We may receive such information through voluntary research contributions, accessibility requests, event arrangements or specific programme activities.
We only process special category information where there is an appropriate Article 6 lawful basis, a valid Article 9 condition and any required additional safeguards.
We aim to minimise the collection of sensitive information and restrict access to those who need it for legitimate purposes.
21. Photography, Video and Testimonials
We may produce photographs, videos, recordings, testimonials, reports and other communications relating to our activities.
Where individuals can be identified, we will provide appropriate information about the collection and intended use of their personal information.
We will obtain consent where required or rely on another appropriate lawful basis where permitted.
Requests relating to identifiable photographs, recordings or published material will be considered in accordance with applicable data protection rights and other relevant legal obligations.
22. Your Data Protection Rights
Under UK data protection legislation, you may have the right to:
-
Access personal information held about you.
-
Request correction of inaccurate information.
-
Request deletion of personal information in certain circumstances.
-
Restrict certain processing activities.
-
Object to processing based on legitimate interests.
-
Request portability of certain information.
-
Withdraw consent where processing relies on consent.
-
Exercise rights relating to qualifying solely automated decision-making.
These rights are subject to relevant legal conditions and exceptions.
To exercise your rights, contact:
We will respond within the applicable statutory timescale, normally one month, subject to any lawful extension.
23. Automated Processing and Profiling
We may use digital systems to support membership administration, communications, research analysis and organisational reporting.
Where automated processing is used, we will apply appropriate data protection safeguards.
If we introduce solely automated decision-making that has legal or similarly significant effects on individuals, we will provide the information and safeguards required by applicable legislation.
24. External Websites and Platforms
Our website may link to third-party websites, research institutions, professional networks, event platforms and partner organisations.
These organisations may operate under their own privacy policies.
We encourage visitors to review the relevant privacy information before submitting personal information to external services.
25. Children's Information
Our principal membership, leadership development and professional engagement activities are intended for adults.
We do not knowingly collect children's personal information through our general professional services.
Where a specific activity involves children or young people, appropriate privacy information and safeguards will be provided.
26. Changes to This Policy
We may update this Privacy Policy to reflect changes in our activities, services, technology, legal obligations or data protection arrangements.
The latest version will be available on our website and will include the date of the most recent update.
Where changes materially affect how we process personal information, we will provide additional information or obtain fresh consent where required.
27. Contact and Complaints
If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact:
Women on Boards CIC®
Email: network@womenonboardscic.com
Registered office:
c/o T Richards Ltd
Curzon Street
Burton on Trent
Staffordshire
DE14 2DH
United Kingdom
Website: https://www.womenonboardscic.com
If you are dissatisfied with our handling of your personal information, you may complain to the Information Commissioner's Office (ICO).
Information Commissioner's Office
Website: https://ico.org.uk
Telephone: 0303 123 1113
We encourage you to contact us first so that we have an opportunity to address your concerns.