Privacy policy

Preservation of the User's privacy is very important to the Royal Institute of British Architects (“RIBA”). The RIBA is committed to protecting the rights of users in relation to their personal information and confirms that all personal information submitted by the User to the website (“Site”) will be processed in accordance with the principles of the Data Protection Act 2018 and the General Data Protection Regulations (“the Data Protection Legislation”) and, where relevant, applicable China data protection laws.

Links to RIBA owned websites ancillary to this Site are covered by the RIBA’s Privacy Policy. Links to Third Party Sites, provided on this Site, are not covered by the RIBA's Privacy Policy and when visiting such Third Party Sites the User should check the privacy statements of each site that they visit.

Who we are
What personal data do we collect
How will it be used
Transfer of data outside the UK or EEA
Who we share data with
How long we will keep your data
How we protect your data
Your choices and rights
Complaints
Changes to the policy
For Users of the Site/Members in the People’s Republic Of China (“China”) (for the purposes of this Privacy Policy, excluding Hong Kong SAR, Macau SAR and Taiwan)

This Privacy Notice explains your rights and gives you information you are entitled to under the Data Protection Legislation. Note this section only refers to your personal data which we process, and collect about you when you contact us by phone, email, letter, complete online forms, attend any of our events or when you use any of our websites.

1. Who we are

The Royal Institute of British Architects (RIBA) is a global professional membership body driving excellence in architecture. We serve our members and society in order to deliver better buildings and places, stronger communities and a sustainable environment. Being inclusive, ethical, environmentally aware and collaborative underpins all that we do. RIBA’s registered office is at 66 Portland Place, London W1D 1AD, United Kingdom. We are a registered charity in England and Wales under number 210566 and company number RC000484

The RIBA is registered with the Office of the Information Commissioner as a data controller under registration number Z684317X. Users may contact the RIBA in relation to data protection matters at dpo@riba.org or writing to the above address.

2. What personal data we collect

RIBA processes Users’ data for the purposes of administering membership, managing RIBA, collecting subscription fees, running events such as continuing professional development (“CPD”) or exhibitions open to the public, producing and distributing publicity material, handling complaints against its members, fundraising, disseminating newsletters and guidance and ancillary or related activities.

RIBA collects and processes various types of personal information about you for the purposes described in this Privacy Policy, including:

information (such as your name, date of birth, phone number, email address, IP address, home address, employment details, education background) that you provide by filling in an application form to become a member, enter a competition or award, use our library or collection services or correspond with us via our Site, including if you subscribe to our newsletter
visual images including live footage and photographs
audio recordings
to enable diversity monitoring we may ask for additional information, including some special category data such as health, sexuality or ethnicity data. It is not mandatory that you give this information
details regarding any transactions you authorise us to make (such as your billing address and payment details)
details of the type of visitor/user of our library and collection services
CV and any other application details when using the RIBA Jobs site
school details (in relation to the National Schools Programme)
personal information that may be contained in communications you send to us, for example to report a problem or to submit queries, concerns, comments or complaints
Information to confirm that you meet the criteria of a “fit and proper person” to receive a RIBA award or honour. You may be directed to a third party who will validate this information with your knowledge.

If you do not provide us with certain personal information (for example, if you do not provide us with the personal information that is indicated as mandatory on the membership enquiry form/contact us page), we might not be able to provide certain services to you as we process your application.

Users should note that where their information is displayed, with consent, on the Site (such as in Find an Architect or the Chartered Members Directory) it is accessible to third parties who may independently lift that information for their own marketing purposes. RIBA has no control over, and accepts no liability in respect, of such access.

Users of the RIBA Hub site are able to control the details of personal information shared with fellow users. It is the members' responsibility to ensure they have reviewed and updated their sharing and visibility preferences.

3. How it will be used

RIBA’s lawful basis for processing your personal data are listed below:

processing is necessary for our legitimate business interests
is necessary to deliver a contract or service
Legal obligation the processing is necessary to comply with the law (not including contractual obligations)
You have given us consent. All electronic marketing communications (such as newsletters) include the option to directly unsubscribe or you can email dpo@riba.org to ask for your preferences to be updated;

We need to process personal data in order to:

provide our services to you, including administering your membership and maintaining membership records
manage the organisation
collect subscription fees or other payments due by you
process job applications
run events such as CPD, competitions or exhibitions open to the public, or fundraising activities
manage competitions or surveys
correspond with you and handle your queries or complaints; conduct investigations and carry out disciplinary actions against our members
send you newsletters and guidance or other advertising and promotional emails which we think you may find interesting
provide you with ancillary or related activities
manage access and record usage of our library and collections
identify visitors to our Site, improve our Site and services and customise our Site for you
conduct research or for other analytical purposes

If we wish to use your personal information for purposes other than those stated in this Privacy Policy, we will obtain your further consent.

Note your personal data will not be used for automated decision making.

4. Transfer of personal data outside the UK or EEA

We may share, transfer or store your personal information outside of the UK or EEA where we are satisfied that adequate levels of protection are in place to protect the integrity and security of your personal information or adequate security measures are adopted and in compliance with applicable privacy and data protection laws.

5. Who we share your personal data with

With your consent, we may from time to time share or disclose your personal information as follows:

We may share your personal information with other candidates on your course for the purpose of study groups.

We may from time to time share or disclose your personal information to our regional and international offices, our partners and our service providers who assist us in providing the services we offer; processing transactions; fulfilling requests; running CPD, competitions, events and exhibitions; receiving and sending communications and newsletters; and providing supporting services.

We may pass your personal information to third parties who may be carrying out the filming, photography or recordings on the RIBA’s behalf.

We may pass your personal information on to our Architecture Ambassadors who help us deliver the National Schools Programme,

This includes without limitation NBS Enterprises Limited (including RIBA CPD Providers Network, and NBS products and services), Crowe Shanghai Business and Tax advisory.

6. How long we will keep your personal data

RIBA retains personal data of Users only for as long as required to fulfil the purposes for which it was collected or for as long as otherwise required or permitted by applicable laws. A Data Retention Policy codifies the different periods of time after which personal data will be destroyed or returned to the User.

7. How we protect your personal data

RIBA take the security of your personal information seriously. In order to prevent unauthorised access or disclosure and unlawful or unauthorised processing and accidental loss, destruction or damage, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect. For example, we have adopted internal data protection procedures and trained our staff on them with a view to preventing breaches of security.

We are committed to taking all reasonable and appropriate steps to protect personal information we collect from you from improper use or disclosure, unauthorised access, unauthorised modification, and unlawful destruction or accidental loss. We have taken and will take appropriate information security, technical, storage and organisational measures to such end, including measures to deal with any suspected data breach. All providers who are associated with the processing of your information are obliged to respect the confidentiality of your personal data.

We take all reasonable steps to protect any personal information you submit via the website. However, as our website is grouped to the internet, which is inherently insecure, we cannot guarantee the information you supply will not be intercepted while being transmitted over the internet. Accordingly, we have no responsibility or liability for the security of personal information transmitted via our website.

Links to Third Party Sites, provided on this Site, are not covered by RIBA's Privacy Policy and when visiting such Third Party Sites the User should check the privacy statements of each site that they visit.

For ease of use and compatibility, RIBA will not encrypt emails, except those relating to payments, unless the User expressly asks RIBA to do so. If a User would like RIBA to encrypt emails sent to that User, the User should provide RIBA with the necessary certification to enable RIBA to do so. Email, unless encrypted, is not a fully secure means of communication.

8. Your choices and rights

As an individual you have explicit rights under the Data Protection Legislation:

the right to be informed
the right of access
the right to rectification
the right to erasure (also known as the ‘right to be forgotten’)
the right to restrict processing
the right to data portability
the right to object
rights with respect to automated decision-making and profiling
the right to withdraw your consent to the collection, holding and processing of your personal data at any time.

Please contact us at Data Protection Officer (DPO), 66 Portland Place, London W1D 1AD or email to dpo@riba.org if you wish to take up any of these rights.

9. Complaints

If you are not satisfied with our response or believe we are processing your personal information in a way that is not in accordance with the law, you have the right to lodge a complaint with the supervisory authority in the UK responsible for the implementation and enforcement data protection law: the Information Commissioner’s Office (the “ICO”).

You can contact the ICO via their website – https://ico.org.uk/concerns/ - or by calling their helpline – 0303 123 1113 or write to them at ICO, Wycliffe House, Water Lane, Cheshire SK9 5AF.

Accuracy

The RIBA take all reasonable steps to keep personal data in its possession or control, which is used on an ongoing basis, accurate, complete, current, and relevant, based on the most recent information available to us. If we are advised of a change of information, we will update the data accordingly.

We rely on you to notify us of any changes to your personal data.

10. Changes to our privacy policy

Our privacy policy may be updated from time to time so you may wish to check them each time you submit personal information to us. The date of the most recent revisions will appear on this page. If you do not agree to these changes, please do not continue to use The RIBA website to submit personal information to us.

11. For Users of the Site/Members in the People’s Republic of China (“China”) (for the purposes of this Privacy Policy, excluding Hong Kong SAR, Macau SAR and Taiwan)

The below applies to you if you are a resident in China. The terms set out below are supplemental to, and should be read in conjunction, with the terms of this Privacy Policy. In case of conflict between this Privacy Policy and this China section, this section shall prevail.

Reference to “personal data” or “personal information” used in this section shall be deemed to include reference to sensitive personal information where applicable, and shall have the same meanings given to those terms in relevant China data protection laws and regulations (as amended from time to time).

The data controller of your personal information is RIBA UK.

Personal information we collect

Unless permitted by applicable China data protection laws, we will obtain your consent to our collection, use, sharing, transfer or other processing of your personal information.

We collect and process various types of personal information about you for the purposes described in this Privacy Policy, including:

information (such as your name, date of birth, phone number, email address, home address, employment details, education background) that you provide by filling in an application form to become a member, enter a competition or award or correspond with us via our Site, including if you subscribe to our newsletter
details regarding any transactions you authorise us to make (such as your billing address and payment details)
· personal information that may be contained in communications you send to us, for example, to report a problem or to submit queries, concerns, comments or complaints; and

How we use personal information

With your consent, we may use your personal information to:

provide our services to you, including administering your membership and maintaining membership records
collect subscription fees or other payments due by you
run events such as CPD, competitions or exhibitions open to the public, or fundraising activities
correspond with you and handle your queries or complaints; conduct investigations and carry out disciplinary actions against our members
send you newsletters and guidance or other advertising and promotional emails which we think you may find interesting
provide you with ancillary or related activities
identify visitors to our Site, improve our Site and services and customise our Site for you
conduct research or for other analytical purposes

If we wish to use your personal information for purposes other than those stated in this Privacy Policy, we will obtain your further consent.

Sharing and disclosure of personal information

With your consent, we may from time to time share or disclose your personal information as follows:

we may share your personal information with other candidates on your course for the purpose of study groups
we may from time to time share or disclose your personal information to our regional and international offices, our partners and our service providers who assist us in providing the services we offer; processing transactions; fulfilling requests; running CPD, competitions, events and exhibitions; receiving and sending communications and newsletters; and providing supporting services. This includes without limitation NBS Enterprises Limited (including RIBA CPD Providers Network, and NBS products and services), Crowe Shanghai Business and Tax advisory
we may from time to time share or disclose your personal information to our regional and international offices, our partners and our service providers who assist us in providing the services we offer; processing transactions; fulfilling requests; running CPD, competitions, events and exhibitions; receiving and sending communications and newsletters; and providing supporting services. This includes without limitation NBS Enterprises Limited (including RIBA CPD Providers Network, and NBS products and services), Crowe Shanghai Business and Tax advisory.
we will respond to requests for personal information where required or permitted to do so by law or when we believe that disclosure is necessary to protect our rights or comply with a judicial proceeding, court order, request from a government authority or regulator or any other legal process served on us, in each case anywhere in the world

We will put in place appropriate security measures and/or request these third parties to have in place security measures to protect your personal information.

International data transfers

With your consent, we may share, transfer or store your personal information outside of China where we are satisfied that adequate levels of protection are in place to protect the integrity and security of your personal information or adequate security measures are adopted and in compliance with applicable privacy and data protection laws.

Your rights

You may ask us to provide you with access to, or a copy of, your personal information, or to correct the personal information we have about you. In certain circumstances, you may request that we delete your personal information. You may also withdraw your consent to our processing of your personal information; request to de-register your account/ membership; or complain to us about our processing of your personal information.

Please contact us at Umi.Lyu@riba.org – Unit 1708, Garden Square, 968 Beijing Road w, Shanghai 20040, if you would like to make such requests.

This privacy notice was last updated in August 2023

​​Privacy policy

Contents