Draft Privacy Practices Questionnaire

Home » Draft Privacy Practices Questionnaire

Draft Privacy Practices Questionnaire

Privacy Practices & Policy for Research4Life and its Committees

Objectives

To understand what personal data is collected, used, stored, and shared by each committee and in the core operations team.

To identify gaps in data protection and privacy practices.

To ensure alignment with relevant privacy laws (e.g., GDPR).

To establish a unified Research4Life privacy policy.

Core Committees to Review

Committees	Representative
Capacity Development	Lenny Rhine and Gehane Al Garraya
Content Strategy & Policy	Mary Ochs
Eligibility	Domiziana Francescon
Equity	Matt Giampoala tbc
Finance Oversight	Sarah Phibbs
Fundraising	Lise Mcleod
Marketing & Communications	Craig Teall
Operations/USIM	Kimberly Parker
Technology	Martin Mogga tbc
User Group	Mercy Mayo tbc

Draft Questions to Explore

Data Collection	What personal data do you collect? From whom? For what purpose?
Data Storage	Where is the data stored? Who has access? For how long?
Data Sharing	Do you share data with external parties? On what basis?
Consent & Transparency	How do you inform people about data use? How do you obtain consent?
Data Security	What measures do you take to secure data?
Governance & Accountability	Who is responsible for privacy decisions? Are there documented processes?
Third party Tools	Do you use platforms (e.g., Google Forms, Zoom, Mailchimp)? How do they handle data?

Thank you in advance for your time in taking our questionnaire 👉🏼

Draft Privacy Practices Questionnaire

First Name

Last Name

About Your Committee

Name of committee:

Main activities of your committee (e.g. training, outreach, communications):

Who are your primary audiences or stakeholders?

Data Collection & Use

What information is being collected?
- Personal information (name, email, address, phone number, etc.)
- Technical data (IP address, browser type, cookies, device info)
- Behavioral data (site usage, preferences, clicks)
- Sensitive data (only if applicable—e.g., health, financial, or demographic info)

What personal data do you collect (e.g. names, emails, affiliations, demographics)?

How do you collect this data (e.g. registration forms, email lists, event signups)?

For what purposes is the data used? (e.g. event invitations, reporting, newsletters)

Data Storage & Access

How is the information collected?
- Directly from users (e.g., form submissions, registrations)
- Automatically (e.g., through cookies or analytics tools)
- From third parties (e.g., social media logins, partners)

Where do you store this data? (e.g. shared drive, spreadsheet, online form tool)

Who has access to this data?

How long do you keep the data? Is there a deletion schedule?

Consent & Communication

Why is the information collected?
- To provide services
- For communication (e.g., newsletters, updates)
- For analytics and improvements
- For marketing (if applicable)
- To comply with legal obligations

Do you ask for consent when collecting personal data? If yes, how?

How do you explain to individuals how their data will be used?

Sharing & Security

How is the information used?
- Internally (by which teams or departments?)
- Shared with third parties (who and for what reason?)
- For automated decision-making or profiling (if any)

Who do you share data with?
- Third-party service providers (e.g., hosting, CRM, payment processors)
- Business partners or affiliates
- Government or legal authorities (if required)

Do you share personal data outside your committee or organization? With whom and why?

What measures do you take to protect personal data (e.g. password protection, limited access)?

Tools & Platforms

Is data transferred internationally?
- If so, where and under what safeguards?
- Compliance with GDPR, UK GDPR, CCPA, etc.

How is the information protected?
- Security measures (encryption, access control, data minimization)
- Data breach response plan

How long is data retained?
- For how long and why?
- Criteria for deciding retention periods

What rights do users have over their data?
- Access, correction, deletion
- Data portability
- Opting out of communications or data processing
- Right to complain to a regulator

What about cookies and tracking?
- What cookies are used and for what purposes?
- Consent and control over cookie settings

What tools/platforms does your committee use that involve personal data? (e.g. Google Forms, Mailchimp, Zoom)

Are these tools configured to support data privacy (e.g. settings for data storage, encryption, consent)?

Reflections

How are changes to the policy communicated?
- Will users be notified? How?
- When does the new version take effect?

Who can users contact with questions or concerns?
- Contact details for the data protection officer (if required)
- General contact email or form for privacy concerns

What challenges have you encountered in managing personal data?

Are there any practices you're proud of that others could learn from?

Do you see any areas where your committee could improve its privacy practices?