Privacy Policy

2.1. Applicable Individuals

There are multiple types of individual that we collect data from.

1. Website visitors
2. Those that may be interested in an Operation Wallacea expedition as a client, hereafter referred to as “Potential Clients.”
3. Those that may be interested in an Operation Wallacea expedition as a staff member, hereafter referred to as “Potential Staff.”
4. Those that are participants in an Operation Wallacea expedition, hereafter referred to as “Participants.” This type includes field staff members.
5. Those that are acting as a parent, guardian, emergency contact, are listed as a physician on a PADI/SSI form, or are the university supervisor of a participant joining an Operation Wallacea expedition, hereafter referred to as “Other Contacts.”

Information collected from each of type of individual is collected, handled and processed in different ways. Each given individual can also fall into multiple categories dependant on the nature of their interaction with us.

2.2. Requirements for Participants

All participants that are taking part in an Operation Wallacea expedition are required to provide all the information listed in section 2.6 as part of their booking. This is primarily a health and safety requirement but further detail on why we need that specific data can be found in section 5.2.

2.3. Information Collected from All Website Visitors

Operation Wallacea uses Google Analytics to track website usage, and this is done through the utilization of cookies. Data collected via google analytics includes IP address, operating system version, device type, system and performance information, browser type, information on which web pages you visit, click on, how you arrived at the website (via referral or search query) and other such log information.

Cookies can be deleted or disabled via your browser settings.

2.4. Information Collected from Potential Clients

• Name
• Email address
• Telephone numbers
• If applicable, postal address
• Details on current links with academic institutions or schools
• If applicable, details of current university degree course
• Details on interests for particular Operation Wallacea projects

2.5. Information Collected from Potential Staff

• Name
• Email address
• Telephone numbers
• Nationality
• Gender
• Application related information provided by the individual
• Submitted CV/Resume

2.6. Information Collected from Participants

• Name as displayed on passport
• Email address
• Postal Address/Billing Address
• Telephone numbers
• Date of Birth
• Gender
• Nationality
• Passport number
• Passport expiry date
• Emergency contact information
• Diet preferences
• Medical information comprising of
  • Current medications
  • Current allergies
  • Severity of those allergies
  • Current medical conditions
  • Past medical conditions
  • Current psychiatric issues
  • Past psychiatric issues
• If taking part in marine activities, participants must complete a form supplied by PADI that expands on the above medical information, and also includes
  • Name and address of primary physician
  • Contact number for primary physician
• If completing a dissertation/thesis project
  • Name and email address of their university supervisor
  • Copy of completed dissertation/thesis
• Details on current links with academic institutions or schools
• If applicable, details of current university degree course
• Details on interests for particular Operation Wallacea projects

2.7. Information Collected from Other Contacts

• Name
• Email address
• Telephone numbers (for emergency contacts)

2.8. Financial Information

Operation Wallacea is PCI compliant. All online and phone payments are handled externally via Sagepay or Authorize.net.

We do not store card details or bank account details for potential clients, potential staff, other contacts or the majority of participants. The sole exception to this is for staff members to whom we are making payments, whose details are kept in a manner compliant with PCI recommendations.

4.1. Client Database

The majority of the personal information Operation Wallacea has collected is kept on an online client database that was built and is maintained by Consilience Media (see also 6.4.5). As part of their contract they are required to implement industry best practice for securing the data electronically, and recommend security updates and changes to Operation Wallacea where appropriate.

Data collection of participants occurs through https://portal.opwall.com which is the client facing side of the client database.

4.2. Other Security Measures

Operation Wallacea has a data security policy that outlines all practices and precautions that must be implemented by staff in order to keep data safe. This includes items such as password policies, requirements for device encryption, procedures for securing data when on expeditions and local security measures for offices.

6.1. Permanent Staff Members

Operation Wallacea is based within the UK, but has a number of contracted staff members located in other countries that primarily market internationally. Most prominently this does include offices based in the United States and Canada. Those staff members have access to the client database, which is used to store all information on all categories of individual. The database itself is hosted within the UK (see section 4 and 6.4.5)

All our permanent staff members, regardless of location, are required as part of their employment to adhere to a centrally distributed data security policy regardless of the local laws in the country in which they’re based.

6.1.1. Country Managers

Each individual expedition is led by an Operation Wallacea staff member known as the “Country Manager” who has overall responsibility for that project and the health and safety of all participants. The country manager has received training on data protection and is responsible for ensuring that the guidelines placed down in the Operation Wallacea data security policy are adhered to on expedition.

6.2. Field and Temporary Staff Members

Due to the operating protocols of Operation Wallacea during expeditions, there are certain staff members that need to receive information that are not contracted to Operation Wallacea on a permanent basis. These individuals are typically recruited for a specific contract and due to the nature of their roles may have to receive personal information of participants.

These staff members are given information only pertinent to their role, but this may include sensitive items such as medical information. They are trained in data protection procedures and are contractually required to follow the data protection procedures laid out in Operation Wallacea’s data security policy.

The staff member responsible for the overall management of an expedition (Country Manager – see section 6.1.1) is required to ensure that the data given to these individuals is deleted upon the completion of their contract.

6.2.1. Camp or Site Managers

Camp/site managers are responsible for the wellbeing of all individuals within a specific location. They are only given information related to the individuals at that location, but this may include medical information to ensure on-site health and safety standards or the safety of a participant during an incident or emergency.

6.2.2. Medics
Expedition medics are given the details of all participants that they are responsible for during the duration of their contract. They are typically issued this information prior to the expedition in an anonymised format to allow them to prepare, or raise any medical concerns or queries about participants to the site management team. Once they reach site, they are given access to a non-anonymised version of the participants they share a location with.

6.2.3. Other Staff

All other on-site staff receive information that is only relevant to their potential job role.

For example:

• Those responsible for food preparation will receive names, dietary requirements and where appropriate allergy information.
• Those responsible for leading students in the field may be given names and limited health information if the site manager or medic determines that a specific participants medical history may put them at risk on a particular activity.

The determination of what is appropriate to pass on to which staff member is made by the country manager. (See 6.1.1)

6.3. Transfers of Data Outside the European Economic Area

The majority of our in-country partners are based in “third countries” that fall outside the European Economic Area. They are all contracted as data processors under article 26 of the GDPR and are required to adhere to the data processing and security described in section 6.2.

We do not transfer data to any organisation outside the European Economic Area that is not contracted as a data processor.

6.4. Data Processors

Data processors are organisations that we have contracted to perform a particular service or task for us. Those contractual obligations require that we pass them certain pieces of personal information, and as such we require that there are data protection and confidentiality provisions built into their contract.

Specifically, they are required to:

• Only act on the written instructions of Operation Wallacea;
• Ensure that people processing the data are subject to a duty of confidence;
• Take appropriate measures to ensure the security of processing;
• Only engage sub-processors with the prior consent of Operation Wallacea and under a written contract;
• Assist Operation Wallacea in providing subject access and allowing data subjects to exercise their rights under the GDPR;
• Assist Operation Wallacea in meeting its GDPR obligations in relation to the security of processing, the notification of personal data breaches and data protection impact assessments;
• Delete or return all personal data to Operation Wallacea as requested at the end of the contract (as a minimum all personal data that is not legally required to keep should be deleted within 8 weeks of the individual’s expedition) and
• Submit to audits and inspections, provide Operation Wallacea with whatever information it needs to ensure that they are both meeting their GDPR Article 28 obligations, and tell Operation Wallacea immediately if it is asked to do something infringing the GDPR or other data protection law of the EU or a member state.

6.4.1. In-Country Partners

Each Operation Wallacea expedition has a local partner organisation based in the country in which the expedition takes place. The roles and responsibilities of those partners vary significantly from country to country. Some have only minimal involvement in project preparation, setup, and execution whereas others are involved in every single aspect of it.

For example, they are frequently required to book accommodation, arrange transfers, buy supplies (eg food) and where appropriate hire local people as assist the expedition as cooks, guides and other ancillary staff members, among other items.

The only information passed over is that which is required for the in-country partner to complete their contract. This usually includes the following information collected via the Opwall Portal (https://portal.opwall.com)

• Name as displayed on passport
• Telephone number
• Date of Birth
• Gender
• Nationality
• Passport number
• Passport expiry date
  Diet preferences
• Details on current links with academic institutions or schools
• Allergy Information (See 6.4.2.1)

6.4.2. Transference of Medical Information to In-Country Partners

As a sensitive category of data, medical information is excluded from transfer to in-country Partners in all but the following exceptions:

6.4.2.1. Allergy Information

To minimize the risk to our participants of encountering a potential allergic reaction we do ensure that allergy information is passed to local partners. This is used to ensure that, alongside dietary information, those that may be involved in food preparation are aware of potential risks to the students.

It also ensures the participant accommodations are aware of any environmental issues that the participant may have.

6.4.2.2. PADI/SSI Documentation and Marine Activities

The Professional Association of Dive Instructors (hereafter known to as PADI) are the qualifying body for dive professionals utilized by Operation Wallacea on the majority of expeditions. We, and our in-country partners, hire PADI qualified staff exclusively to run in-water marine activities for those sites.

The sole exception to that is the Madagascar expedition, where Scuba Schools International (hereafter known as SSI) staff members are hired by our partner dive centre.

The forms that are required by PADI/SSI are almost identical, with the medical form used by both organizations being put together by the UHMS (Undersea and Hyperbaric Medical Society).

Both organisations have a requirement that all people participating in an activity supervised by one of their professionals complete a medical form to ensure that they are safe to dive, and that form must be seen and inspected by that professional.

That medical form lists many conditions that may impact diving, and if the person completing it confirms they have that condition they are required to get the form signed by a doctor.

In addition, Operation Wallacea also utilizes more conservative measures for dive safety due to the remote nature of the expeditions. There are a number of additional sub-questions that we have entered into the form at the recommendation of diving doctors, and for certain answers we will require that the participant visit a dive specialist instead of a regular physician.

Those forms, as such, can contain medical information. As a number of our in-country partners are also contracted to provide diving activities, these documents have to be passed to the relevant dive professionals.

6.4.2.3. Acting as Camp Managers or Medics

In a small number of instances, the in-country partner will also take a position as on-site management for a camp or expedition, or will have staff that are acting as medics.

Within those roles they are responsible for the health and safety of all participants in their care, and as such need to receive the additional medical information submitted by the individual i.e.;

• Current medications
• Current medical conditions
• Past medical conditions
• Current psychiatric issues
• Past psychiatric issues

While in a position where they are acting in a role as a camp manager or medic, the in-country partner is required to ensure that information is kept safe according to the Operation Wallacea data security policy.

6.4.3. Flight Providers

During the booking process participants are asked if they wish for their details to be passed on to a flight provider to simplify their travel procedures. This takes two potential forms that determines what information is transferred.

• For school/field trip groups that are booking an expedition with Operation Wallacea as a package that includes flights. (Name, nationality, passport number and expiry, date of birth, gender, dietary requirements and allergy information, school attending).
• For individuals that have opted into that contact during initial booking. (Name, date of birth, email address, phone number).

6.4.4. Insurers – Aviva

Operation Wallacea has an insurance policy in place with Aviva that covers all participants for the duration of their expedition. This insurance policy includes unlimited Overseas Medical and Travel Expenses, cover for Personal Property and Cancellation, Curtailment and Rearrangement cover for all participants

There is no data transferred to Aviva prior to an expedition barring the numbers of individuals undertaking it.

Data is only transferred to them in the instance of a claim, wherein only data relevant to that claim will be given to them. This may include, but is not limited to

• Name
• Contact Details
• Address
• In the case of travel expenses claims, travel and flight information.
• In the case of medical claims, medical information submitted via the portal.

See https://www.opwall.com/resource/insurance/ for more details and policy documentation.

6.4.5. Consilience Media

Our client database, online portal (https://portal.opwall.com) and online finance system has been designed, developed and is currently maintained and administered by Consilience Media. (https://consil.co.uk/). They are also responsible for the security of the server against data breach.

Due to their administrative privileges they have full access to all information stored within the databases, including all personal data.

6.4.6. Accountants

Our accountants, Forrester Boyd, have access to all our financial records via our accounting software. This does include record of all invoices that have been issued by Operation Wallacea and customer information required in the creation of those invoices. This is limited to name and billing address.

6.5. Other

6.5.1. Mailchimp

Mailchimp is an online marketing platform that we use to create and distribute emails in the following circumstances;

• Ex-participant newsletter. We maintain a newsletter for ex-participants that distributes updates about Operation Wallacea, updates about the Operation Wallacea expedition that they joined and potential job opportunities.
• Marketing emails to potential clients. We periodically use mailchimp to send emails to those that have expressed an interest in joining an Operation Wallacea expedition.

Emails from Mailchimp can be opted out of at any time by clicking the “unsubscribe” link at the bottom of each. All those people who unsubscribe via mailchimp are also removed as a potential client from our databases. Details transferred to Mailchimp are restricted to name and email address.

Mailchimp’s own privacy details can be found here: https://mailchimp.com/legal/privacy/

Under the General Data Protection Regulation you have a number of legal rights with regards to your data.

8.1. The right to be informed

This document is intended to provide the basis of your right to be informed, including details on how we collect, use and process all the information that we collect, and the lawful basis under which we do so.

This includes:

• The name and contact details of our organisation. (Section 8.6)
• The purposes of the processing. (Section 5)
• The lawful basis for the processing. (Section 5)
• The categories of personal data obtained (Section 5.2)
• The recipients or categories of recipients of the personal data. (Section 6)
• The details of transfers of the personal data to any third countries or international organisations. (Section 6)
• The retention periods for the personal data. (Section 7)
• The rights available to individuals in respect of the processing. (Section 8)
• The right to withdraw consent (Section 8)
• The right to lodge a complaint with a supervisory authority. (Section 10)
• The source of the personal data (if the personal data is not obtained from the individual it relates to). (Section 3)
• The details of whether individuals are under a statutory or contractual obligation to provide the personal data (if applicable, and if the personal data is collected from the individual it relates to). (Section 2.2)
• Rights in relation to automated decision making and profiling. (Section 8)

8.2. The right of access and the right of portability

You have the right to obtain and access all personal data that we store about you, and to obtain and reuse data submitted to for your own purposes.

If you would like that information please contact dataprotection@opwall.com

All requests will be answered within a 30-day period and be provided free of charge, apart from requests that are manifestly unfounded, excessive or repetitive, which may infer a fee or allow us our right to refusal. You will retain the right to appeal to the supervisory authority if that is the case. (See section 10)

8.3. The right to rectification

You have the right to correct any inaccurate personal data that we hold about you. For the majority of data for participants, this can be most frequently done through the Opwall Portal (https://portal.opwall.com) but you can also request rectification by contact dataprotection@opwall.com

8.4. The right to erasure/right to be forgotten

You have the right to have all data that we hold on you erased, if there is not a legal requirement that we retain it.

We are required to hold onto information related to financial transactions for a period of six years, and are required to retain all information for those that have participated in an expedition for six years. You can still exercise the right for erasure if you attended an expedition within that period, unless you were involved in on-site treatment of medical issues, or an incident.

You can request erasure by contacting dataprotection@opwall.com

8.5. The right to object

You have the right to object to our processing of your data under certain specific circumstances. The only processing Operation Wallacea undertakes with regards to this right is direct marketing, and we will immediately cease direct marketing if you request that we do so.

You can do this by contacting dataprotection@opwall.com

8.6. The right to withdraw consent

You have the right to withdraw consent with regards to our use or processing of any of the data that we hold on you. However, certain items are required as part of a booking with us and if you were to remove consent you would be unable to join an expedition. Standard cancellation charges per our terms and conditions would apply.

8.7. Rights in relation to automated decision making and profiling.

This right relates to profiling or carrying out automated decision making with regards to your data. Operation Wallacea currently does not undertake any activities that involve this.

If you have a complaint about how we handle, or have handled your data, please contact us at dataprotection@opwall.com.

If you find our responses inadequate or unsatisfactory, if you are resident in the European Union you can contact your local data protection supervisory authority. As Operation Wallacea operates out of the United Kingdom, we operate under the remit of the UK Information Commissioners Office (ICO). You can find contact information for lodging a complaint on their website: https://ico.org.uk/