INTRODUCTION AND PURPOSE
This Privacy Notice applies to the processing of your personal data in the context of a direct environmental and social (E&S) complaint submitted to the International Finance Corporation (also referred to herein as “IFC”, “us” or “we”). For the purpose of this Privacy Notice, “personal data” means any information relating to an identified or identifiable individual.
Individuals and communities can submit E&S complaints directly to IFC if they believe an IFC-supported project has or is likely to have an adverse effect on them, their community, or their environment. Lodging E&S complaints directly with IFC aims to enhance IFC’s accountability to project-affected communities by ensuring that complaints are promptly reviewed and addressed.
PERSONAL DATA WE COLLECT
Personal Data you Provide to IFC
We collect and process the personal data you provide to us when submitting a direct complaint, such as names, contact details, and personal data in documentation or information related to your complaint. The Stakeholder Grievance Response (SGR) team in the E&S Policy and Risk Department may request additional information from complainants or their authorized representatives if this information is deemed necessary to process complaints. Please do not share unsolicited personal data if it is not needed for the processing of your complaint by IFC.
Personal Data we Collect from Third Parties
To process your complaint, we may collect information about you from third parties involved in the IFC-supported project you are complaining about. In doing so, we will make best efforts to protect your personal data to the extent practical in the circumstances of your complaint.
HOW WE WILL USE YOUR PERSONAL DATA
Your personal data will be used by IFC personnel staffing the SGR team to process your complaint. We treat all complaints as confidential.
IFC uses anonymized data from the complaints it receives for analytical assessments, institutional learning and reporting purposes. This may include analyzing trends observed in complaints, identifying recurring issues, preparing monthly status reports, and other products.
PERSONAL DATA WE SHARE
We do not disclose your personal data collected, except as described in this Privacy Notice. The SGR team is functionally separate from IFC teams tasked with preparing and supporting projects in IFC’s organizational structure. Staff in the SGR team rely on other IFC units for appropriate follow-up on the issues raised in complaints and may share your personal data with other IFC units if the complaint is processed further. IFC units will in turn process your personal data in accordance with the World Bank Group (WBG) Personal Data Privacy Policy. Staff in the SGR team mark all communications to IFC staff about complaints as confidential.
IFC may also rely on external advisors (e.g., legal advisors) and service providers (e.g., vendors or contractors) in the internal review and processing of direct complaints. Any access such external advisors and services providers have to personal data will be subject to contractually agreed conditions of confidentiality and security.
The SGR team will seek your written consent for IFC to share your personal data with any other third parties outside of IFC for follow-up on the issues raised in your complaint. Such “other third parties” may include, but are not limited to, relevant entities involved in the implementation of IFC-supported projects, the entity about which the complaint is being made, government agencies, national or local administrations, project contractors or sub-contractors, project level grievance mechanisms, and other accountability mechanisms processing your case. In some cases, your complaint cannot be processed further and/or resolved without your consent to disclose your personal data to other third parties outside IFC. If you choose to provide your consent, your personal data will be shared with the other third parties only to follow up on your complaint.
If you choose not to provide your consent, we will continue to maintain confidentiality and follow up on your complaint to the extent possible while noting the corresponding limitations on the complaint handling process, including the limited range of possible solutions and available options that can be offered towards case resolution.
Filing a complaint with IFC directly and individuals from third parties simultaneously or forwarding to IFC a complaint addressed to other third parties authorize us to follow up on your complaint with such third parties. IFC does not have any control over how such third parties process your personal data. If you do not want us to follow up with these third parties, please do not copy them in the complaint you submit to us.
HOW WE PROTECT YOUR PERSONAL DATA
We use reasonable organizational, technical, and administrative measures to help protect against the loss, misuse, and alteration of personal data collected as part of the complaint-handling process and under our control.
HOW LONG WE KEEP YOUR PERSONAL DATA
We keep personal data for as long as necessary for the purposes described in this Privacy Notice, in accordance with our appliable records retention and disposition schedules.
HOW TO REQUEST INFORMATION ON YOUR PERSONAL DATA PROCESSED BY IFC
The SGR team can be contacted directly at EScomplaints@ifc.org.
As part of its data privacy framework, IFC has also established a procedure for individuals to request information regarding their personal data processed by IFC and, when appropriate, to seek redress if they reasonably believe their personal data has not been processed in accordance with the WBG Personal Data Privacy Policy, as further described at the following link.
You may submit such a request using the webform available here.
MORE INFORMATION AND DATA PRIVACY OFFICE
For more information on IFC’s approach to personal data protection, please visit ifc.org/privacy. You can also contact the IFC Data Privacy Office directly at ifcdataprivacy@ifc.org.
CHANGES TO THIS PRIVACY NOTICE
This Privacy Notice was last updated on the date listed above. We may update this Privacy Notice at any time. Changes to this Privacy Notice will be dated and will be effective from the date specified forward.