Introduction
The Open Society Foundations (“Open Society”, “the Foundations” “we”, “us”, “our”) are committed to upholding data protection laws and providing you with transparent information about how we deal with your data.
Impact investments, such as those made by the Soros Economic Development Fund, are an important part of our work. These investments are intended to advance the Foundations’ enduring commitments of equity, expression, and justice and are made for charitable purposes in furtherance of our mission.
In order to determine whether a potential investment is suitable for us to make and to manage the investments that we have made, we collect and review information about the investee. This Data Use Notice (“Notice”) is intended to provide you with information about how we use your personal data for this purpose and the legal basis for this. This Notice should be read in conjunction with our general Privacy Policy available here.
Data Controller
Open Society Foundations have offices located throughout the world. You can learn more about where we are located on our Offices and Foundations page.
In general, the data controller for the investment process will be the Open Society Institute (EIN: 137029285 at registered office 224 West 57th Street, New York, New York 10019), the Open Society Foundation London (company no. 10187396 at registered office 4th Floor Herbal House, 8 Back Hill, Farringdon London EC1R 5EN) and Open Society-Africa (company no. 147899 C2/GBL at registered office c/o AXIS Fiduciary Ltd, 2nd Floor, The AXIS, 26 Cybercity, Ebene, 72201, Republic of Mauritius, acting through its Kenyan branch with Certificate of Compliance Number FC-LKTY6D whose address is c/o P.O. Box 2193-00202, Merchant Square, 3rd Floor, Riverside Drive, Nairobi, Kenya). Your information may also be shared with other Open Society offices in certain cases—only for the purposes of facilitating, making, or managing the investment. Where your data is shared with another Open Society office, this will be in accordance with underpinning agreements (see the Data sharing and subprocessors section below).
If you have any questions or concerns about investment
related data processing, you can contact dataprotection@opensocietyfoundations.org.
What data we process, why and the legal basis
Review process
When we consider making an investment, the personal data we process includes names and contact details, plus any other information you choose to disclose for consideration, which may include biographical information about individuals employed or associated with the potential investee. We process this data on the basis of our legitimate interests in evaluating investment opportunities and preparing to enter into a contract for investment.
Governance and investment management
Where we make an investment, we engage in an ongoing governance relationship with the investee. Along with quarterly financial reports and general updates on the organization, the personal data we process for this purpose is generally limited to any information about changes in management or key personnel that may affect the investee organization. We process this data on the basis of our ongoing contractual relationship with you and/or the legal obligations on us connected to managing the investment.
Sensitive data
Under European data protection laws, “special category” data includes information related to race, sexual orientation, political opinions, and trade or union membership (see Article 9 of the General Data Protection Regulation). While, in general, we do not request this type of information, we understand that some individuals or organizations may choose to disclose this because it is relevant to the investment process—for example where the special category data is inherently connected to an investee organization’s values or mission. We process this data on the basis of either our legitimate interests as a foundation or where you have otherwise made this information public.
Data sharing and subprocessors
Sharing within the Open Society Foundations network
In order to facilitate consideration of a potential investment or investment management, your information may need to be shared between our offices. Where this is the case, your personal data will always be appropriately protected and kept confidential in line with agreements that include international transfer safeguards where applicable.
Subprocessors
We work with certain carefully selected third-party service providers who perform data processing tasks on the basis of our legitimate interests in facilitating the investment process. These may include cloud service providers, legal counsel, financial consultants and technical experts. These third parties are engaged by us on terms which ensure confidentiality and compliance with data protection laws as required. A list of the subprocessors we engage is available upon request.
International transfers of data
Where applicable, international transfer safeguards are in place to ensure your data is protected, for example the Standard Contractual Clauses issued by the European Commission.
Retention
We are in the process of reviewing our retention periods and will publish those, once available, on our website.
Information security
We take all reasonable steps to ensure that personal data is processed securely and treated in accordance with this Notice. The technical and organizational measures to prevent unauthorized access to personal data include limiting staff and subprocessor access to personal data in accordance with specific job responsibilities or contractual obligations, the encryption of data where possible, the institution of security protocols and staff training. Although we do our best to protect personal data, information transmitted over the internet remains vulnerable to interception—for this reason, the transmission of any personal data to our websites or via email to us is therefore at the data subject’s own risk.
Your rights
We will honor your requests to exercise your rights in relation to your personal data to the extent possible and required under applicable law. Certain of these rights may only be available to individuals who interact with our UK or EU offices and to individuals who are located in the United Kingdom or the EU.
As a data subject, you have the right to request access to, rectification or erasure of your data. In addition, you may object to processing, or withdraw your consent and you may also have the right to limit the processing of your data and the right to receive the data you have provided to us in a structured, commonly used and machine-readable format, or the right to have such data transmitted to a third party.
See our general website Privacy Policy for more information, or to make a request in relation to data or to exercise the rights above as they may apply to you, contact dataprotection@opensocietyfoundations.org.
Concerns
You also have the right to bring concerns to your national data protection regulator if you feel that your personal data has been unlawfully processed. Data subjects covered by EU law may also be entitled to lodge complaints in regard to data processing or the handling of subject access requests with the data protection supervisory authority in their country of residence. Relevant supervisory authority names and contact details are listed here.
Changes and revisions
This Notice was last updated on May 10, 2023.