If you would like to see previous versions, you can do so here.
Introduction
This Privacy Notice is to help you understand what information we, as a Data Controller, collect, why we collect it, and how you can manage your information when you:
- Interact with or use our website, including the Network Member Site, and when you download materials, or ask us to contact you.
- Register for, attend or speak at one of our events, convenings or virtual programs e.g. Catalyst Convene or webinars (“Event” or collectively “Events”).
- Use Catalyst Network Membership benefits as an Authorized User of a Network Member, or otherwise have a relationship with us, e.g. setting up an account or processing an invoice.
- Make a donation, subscribe to our newsletters, or otherwise contact us.
In this notice, “Network Member” means an organization with an active Catalyst Network Membership under the Catalyst Network Membership Terms and Conditions; “Authorized User” means an employee or other individual whom a Network Member authorizes to use its Network Membership benefits; and “Network Member Site” means the areas of our website available only to Authorized Users.
You can easily navigate to specific parts that explain how we use your data by using the panel on the left-hand side of this notice.
We will tell you:
- Why we can process your information
- The purposes of processing
- Whether you must provide your data to us
- How long we store it
- Who we may share it with
- Instances of transferring it to another country
- Instances of automated decision making or profiling
- Instances of using Artificial Intelligence to process your data
- Your rights and how to exercise them
Who we are
We are Catalyst, a global non-profit, charitable organization, supported by many of the world’s most powerful CEOs and leading companies with a mission of advancing diversity, equity and inclusion in the workplace, and building a better workplace for all. One way we do this is by using our research findings to create reports, presentations, and products that help organizations build inclusive workplaces. You can read more about us here.
Catalyst operates through three entities: Catalyst Inc. (United States), Catalyst Canada Inc. (Canada) and Catalyst United Kingdom. Catalyst and its affiliates (hereinafter “Catalyst”) act as joint controllers working together to decide how and why your personal information is used.
Contact us
Catalyst Inc. is headquartered in New York, in the United States of America. If you have any questions or concerns about Catalyst’s personal data policies or practices, or you would like to exercise your rights, you can contact our Privacy Team.
Contact details:
The Privacy Team
Catalyst Inc.
120 Wall Street, Suite 1606
New York, NY 10005
[email protected]
If you are in Canada, the person in charge of the protection of personal information is Nina Vaswani, who can be reached at [email protected].
How we collect and use (process) your personal data
Catalyst collects personal data about its Network Members, Authorized Users, donors, event participants and individuals who visit our website. We use this information to provide Network Membership benefits, including access to the Network Member Site content and resources, events and our on-demand engagements. We do not sell personal data to anyone and only share it as described in this Privacy Notice.
We do not knowingly collect information from children. Our website is intended for adults, consistent with our Terms of Use.
Most individuals provide their personal data directly to Catalyst. However, in some cases, Catalyst may receive personal data about individuals from third parties. This may happen, for example, if your employer is a Network Member and adds you as an Authorized User or registers you for an event, or when companies provide us with company contact information or contact and employment information for individuals who may be interested in our mission and fee for service products. We may also obtain business contact information, such as names, job titles, employers and professional profile details, from professional networking services such as LinkedIn. We may also collect your information from third parties or third-party websites (e.g., LinkedIn) if you fill out a form on that site requesting content from or register for an event with Catalyst.
Personal information Catalyst collects:
A. Network Members and Authorized Users
When your organization becomes a Network Member, we may collect information about you and your organization including but not limited to your name, your employer’s name, your work email address (including your country location), job title, login credentials, and billing and notice contacts. We may also collect a contact phone number. When you use the Network Member Site and membership benefits, we record your activity, such as content viewed or downloaded, programs attended and e-learning progress. If you are in the UK, the European Economic Area or Quebec, we do this only with your consent, which you can give or withdraw at any time through our cookie settings.
| Personal data categories | Purpose | GDPR Lawful Basis |
| First name, last name, company name, work email address, contact telephone number, job title and payment information | Provide Network Membership benefits including access to the Network Member Site and other content; to receive membership payments | Article 6(1)(f) - Catalyst’s legitimate interests (Authorized Users) Article 6(1)(c) - Catalyst’s Legal Obligation |
| Employment and other professional biographical information; professional activities; location; level of experience, topics of interest | Provide support; inform Network Member of benefits and professional opportunities; understanding Network Member’s needs and interests to better tailor products and services to meet Network Member needs; verifying registration and ensuring only registered guests are allowed attendance at events; business intelligence | Article 6(1)(f) - Catalyst’s legitimate interests
|
| Login and usage data; program participation; e-learning progress | Provide and secure the Network Member Site; deliver tier benefits; report usage to the Network Member (in aggregate only for users in the UK and EEA) | Article 6(1)(f) - Catalyst’s legitimate interests |
B. Live events
Catalyst hosts live, in-person and virtual events throughout the year. These include conferences and events such as Catalyst Convene. If you register for one of our events and you are an Authorized User, we will access the information in your account to provide you with information and services associated with the event. You may be asked to provide more information when signing up for an event than is found in your profile (e.g., whether it’s your first Catalyst event and your meal preferences).
If you are not an Authorized User and you sign up for one of our events, we will collect the following information: name, email, company, title, industry, address, phone number, whether it’s your first Catalyst event, your meal preferences, and any special accommodations (e.g. mobility assistance, allergies).
Catalyst uses the information provided by event attendees to provide them with event services, including badge printing, tailoring sessions to meet the audience profile and to determine the sessions likely to require the biggest rooms, and related purposes connected with the event. We also use the information for billing purposes, as some attendees do not pay at the time of registration.
If you are a presenter or speaker at one of our events, we will collect information about you including your name, employer and contact information, biography and photograph. We may also collect information provided by event attendees who evaluated your performance as a presenter. We may also make and store a recording of your voice and likeness in certain instances.
We may also photograph, film and record our events, including attendees who appear on camera, ask questions or speak, and use these recordings to share and promote our work, as described in our Event Attendance Terms and Conditions. Closed-door sessions, such as Convening Circles, are not photographed or recorded by Catalyst. We keep a record of your participation in Catalyst events as an attendee or presenter. This information may be used to provide you with information relating to the event or to tell you about other events and publications. It may also be used to help Catalyst understand our Network Members’ needs and interests to better tailor future events.
When you register for a live event, you will have an opportunity to opt-in to be listed in an attendee list. This list is shared with event sponsors/exhibitors as well as other attendees who request it. You can withdraw your consent at any time before the list is shared.
| Personal data categories | Purpose | GDPR Lawful Basis |
| Name, contact information, including mobile telephone number, and payment information | Event registration; Attendee Hub validation | Article 6(1)(b) - contract, where you register yourself; Article 6(1)(f) - Catalyst’s legitimate interests, where your employer registers you |
| Professional biographical information; professional activities information | Ensure event subject matter and content is relevant to attendee needs; badge printing; determining which sessions require larger rooms; providing attendees with information and services associated with the event | Article 6 (1)(f) - Catalyst’s legitimate interests |
| Meal preferences; accessibility and accommodation needs | Ensure adequate food and dietary provisions; provide accommodations | Article 9(2)(a) - explicit consent, where the data reveals health information or religious beliefs; otherwise Article 6(1)(f) - Catalyst’s legitimate interests |
| Attendee list entry | Share with event sponsors, exhibitors and attendees | Article 6(1)(a) - consent |
| Photos and recordings | Promote and archive Catalyst events; share session content | Article 6(1)(f) - Catalyst’s legitimate interests |
C. Web conferences
Catalyst offers several webinar and virtual conferences throughout the year, including virtual programming. Many of them are free to Network Members and their Authorized Users, while non-members may be charged a fee.
| Personal data categories | Purpose | GDPR Lawful Basis |
| Name and contact information; attendance and participation | Access to web conference | Article 6(1)(f) - Catalyst’s legitimate interest |
| Payment information | Process payments | Article 6(1)(b) - Contract where you pay yourself Article 6(1)(f) - Catalyst’s legitimate interest |
D. Publications & newsletters
In addition to producing original content, Catalyst also subscribes to news feeds and blogs produced by others, which we often link to from our website and within our newsletters. This means you may find yourself on Catalyst website or reading an email from Catalyst and we will offer you a link to another organization’s website where you will find content on diversity, equity and inclusion that we find relevant and useful to you. At these times, you will be leaving Catalyst’s website. Catalyst is not responsible or liable for content provided by these third-party websites or personal information they may happen to gather from you.
To receive Catalyst newsletters by email, you need to provide Catalyst with at least your first name and last name, an email address, and the country in which you live. The purpose of processing this data is to have the necessary information to deliver Catalyst’s newsletters by email. You may at your own option choose to subscribe to Catalyst News and Updates which may be considered direct marketing. You may unsubscribe at any time to newsletter subscriptions as well as marketing messages.
Catalyst uses third-party email service providers to manage our email communications and subscriptions. These services enable us to send bulk emails, manage subscription preferences and unsubscribe requests, and monitor email delivery and engagement metrics such as opens, clicks, and invalid email addresses. When you click on a link in one of our emails a tracking identifier may be included in the URL. Where you have consented to the use of relevant cookies and similar technologies through our cookie preference tool, information about your interaction with our emails and visits to our websites may be associated with your profile. This helps us better understand the content and services that are of interest to our audiences so that we can improve and tailor our communications.
For further information about the cookies and similar technologies we use, including how to manage your preferences, please see our Cookie Notice.
As noted above, you may manage your Catalyst subscriptions by subscribing or unsubscribing at any time. Please note that if you have set your browser to block cookies, this may have an impact on your ability to unsubscribe. If you have any difficulties managing your email or other communication preferences with Catalyst, please contact us at [email protected].
| Personal data categories | Purpose | GDPR Lawful Basis |
| Name, work email address and country | Access to email newsletters; direct marketing | Article 6 (1)(f) - Catalyst’s legitimate interest; Article 6(1)(a) - Consent |
| Email engagement data (opens and clicks) | Understand which content is useful | Article 6(1)(a) - consent |
E. Web and digital analytics
Catalyst uses analytics tools such as Google Analytics to track how often people gain access to or read our content. Provided you have opted-in to analytics cookies, we use this information in the aggregate to understand what content our Network Members and visitors to our website find useful or interesting, so we can produce the most valuable content to meet your needs.
| Personal data categories | Purpose | GDPR Lawful Basis |
| Website server logs | Improve products and services; operate and secure the website | Article 6(1)(f) - Catalyst’s legitimate interest |
| Website activity, linked to your account and to the interests, job title and survey responses you give us. | Website analytics; testing different versions of our pages; satisfaction surveys; tailor content | Article 6(1)(a) - consent (cookies and website tracking); Article 6(1)(f) - Catalyst’s legitimate interests |
F. Your correspondence with Catalyst
If you correspond with us by email, the postal service, or other form of communication, we may retain such correspondence, and the information contained in it and use it to respond to your enquiry or to keep a record of your complaint, accommodation request, or similar concern. If you wish to have Catalyst delete your personal information or otherwise refrain from communicating with you, please contact us at [email protected].
Note: if you ask Catalyst not to contact you by email at a certain email address, Catalyst will retain a copy of that email address on its “master do not send” list in order to comply with your no-contact request.
| Personal data categories | Purpose | GDPR Lawful Basis |
| Name, contact information, communication content | Network Member and Authorized User service and support | Article 6(1)(f) - Catalyst’s legitimate interest; Article 6(1)(c) - legal obligation, when you exercise your privacy rights |
G. Payment and purchase information
You may choose to purchase on-demand products from, or make an individual donation to, Catalyst using a payment card. Typically, payment card information is provided directly to our PCI DSS-compliant payment processor. Catalyst does not store card information. Occasionally, individuals ask Catalyst employees to, on their behalf, enter payment card information into the PCI/DSS-compliant payment processing service to which the Catalyst subscribes. We strongly encourage you not to submit this information by email. When Catalyst employees receive payment card information from customers or members by email, phone, or mail, it is entered as instructed and then deleted or destroyed.
| Personal data categories | Purpose | GDPR Lawful Basis |
| Name; payment information; billing address | Fulfilling on-demand services, Network Membership orders and/or donation payments | Article 6(1)(b) - contract; Article 6(1)(c) - legal obligation (tax and accounting records) |
H. Donations
Catalyst receives online donations. We collect your name, contact details, billing address, donation amount and date, employer-matching details and acknowledgment preferences. We use them to process your donation, send acknowledgments and tax receipts, keep required records, and keep you informed about our work. We rely on Article 6(1)(b) (contract) and Article 6(1)(c) (legal obligation) to process donations, and on Article 6(1)(f) (legitimate interests) for donor stewardship, with consent for email where the law requires it.
Sensitive data, artificial intelligence and automated decisions
We may collect sensitive personal data only when you choose to give it to us and only for a specific purpose.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. We do use profiling to build a profile from your website activity and the information you give us, and we use it for analytics and to tailor content (see section E). We may also use AI features in our content and data platforms to help produce aggregated reports. Our contracts with these providers prohibit them from using our data to train their own AI models. You can object to profiling at any time, including for direct marketing, by contacting [email protected].
What happens if you don’t give us your data
You can enjoy many of Catalyst’s content and services without giving us your personal data because a great deal of information on our website is available even to those who are not from a Network Member organization. You can also enjoy subscriptions to our newsletters without becoming a Network Member, but you will need to provide your name, email and country. Some personal information is necessary so that Catalyst can supply you with the services you have purchased or requested, and to authenticate you so that we know it is you and not someone else.
Use of Catalyst website
As is true of most other websites, Catalyst’s website collects certain information automatically and stores it in log files. The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system and other usage information about the use of the Catalyst’s website, including a history of the pages you view. We use this information to help us design our site to better suit our users’ needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyse trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.
Catalyst has a legitimate interest in understanding how users, Network Members and potential Network Members use its website. This assists Catalyst with providing more relevant content and products and services, with communicating value to our Network Members and users, and with providing appropriate staffing to meet user and Network Member needs.
Cookies and web beacons
Catalyst makes available a comprehensive Cookie Notice that describes the cookies used on Catalyst’s website and provides information on how users can accept or reject them. Click here to view the notice.
When and how we share your personal data
Information about your Network Membership, donations or purchases is maintained in association with your account. The personal information Catalyst collects from you is stored in one or more databases hosted by third-party processors located in the United States. These third parties do not use or have access to your personal information for any purpose other than providing their services to us. You can view a list of our main third-party processors here.
We may share your personal data with our service providers, where required by law, to protect rights or safety, in connection with a corporate transition, or where you have requested, authorized, or consented to disclosure. We also share information with your organization if it is a Network Member, as described in section A. We may also use and share aggregated or anonymized information that does not identify individuals.
The Catalyst website uses interfaces with social media sites such as Facebook, LinkedIn and others. If you choose to "like" or share information from the Catalyst website through these services, you should review the privacy policy of that service. If you are a member of a social media site, the interfaces may allow the social media site to connect your site visit to your personal data.
Transfers of your personal data
Catalyst has its headquarters in the United States. Information we collect about you will be processed in the United States. If you are outside the United States, this involves a transfer of your personal data to the United States. When we transfer personal data from the UK or the European Economic Area to a country without an adequacy decision, we use safeguards approved by law, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. For data about individuals in Quebec, we assess the protection the data will receive before transferring it outside Quebec. Catalyst also enters into data processing agreements and model clauses with its suppliers whenever required. For more information or if you have any questions, please contact us at [email protected].
Your rights
The rights you have depend on where you live. We describe them below.
This Privacy Notice is intended to provide you with information about what personal data Catalyst collects about you and how it is used. If you have any questions, please contact us at [email protected]. If you wish to confirm that Catalyst is processing your personal data, or to have access to the personal data Catalyst may have about you, please contact us at [email protected].
You may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside Catalyst might have received the data from Catalyst; what the source of the information was (if you didn’t provide it directly to Catalyst); and how long it will be stored. You have a right to correct (rectify) the record of your personal data maintained by Catalyst if it is inaccurate. You may request that Catalyst erase that data or cease processing it, subject to certain exceptions. You may also request that Catalyst cease using your data for direct marketing purposes. In many countries, you have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how Catalyst processes your personal data. When technically feasible, Catalyst will—at your request—provide your personal data to you or transmit it directly to another controller. You may also ask us to restrict our processing of your personal data, and you may withdraw your consent at any time, without affecting processing that has already happened.
Right to object. You have the right to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation. You also have an absolute right to object to direct marketing, including profiling for direct marketing.
Canada. You have the right to access and correct your personal information and to withdraw consent, subject to legal and contractual limits. In Quebec, you also have the right to data portability, to be told about decisions made exclusively by automated processing, and to ask us to stop disseminating your information or to de-index it.
United States. Depending on your state of residence, you may have the right to know about, access, correct, delete and obtain a portable copy of your personal data, and to opt out of the sale of personal data, targeted advertising and certain profiling.
You may, at no cost to you, receive a report of most of the personal data Catalyst has regarding you by emailing [email protected]. We will verify your identity before acting on a request and will respond within one month in the UK and EEA, 30 days in Canada and 45 days in US states, extending these periods only where the law permits. If for some reason access is denied, Catalyst will provide an explanation as to why access has been denied.
For questions or complaints concerning the processing of your personal data, you can email our Privacy Team at [email protected].
In many jurisdictions, including but not limited to the European Union, you have recourse with your nation’s data protection authority. To find your DPA, visit Authorities Listings | Global Privacy Enforcement Network. In the UK, this is the Information Commissioner’s Office. In Canada, it is the Office of the Privacy Commissioner of Canada and, in Quebec, the Commission d’accès à l’information.
Security
To help protect the privacy of data and personally identifiable information you transmit through use of this site, we maintain physical, technical and administrative safeguards. We update and test our security technology on an ongoing basis. We restrict access to your personal data to those employees who need to know that information to provide benefits or services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information. We commit to taking appropriate disciplinary measures to enforce our employees' privacy responsibilities. You can read more about our security practices in our Trust Center.
Data storage and retention
Your personal data is stored by Catalyst on its servers, and on the servers of third-party cloud-based database management services Catalyst engages, located in the United States. We keep personal data only as long as we need it for the purposes described in this notice, including to meet legal, tax and accounting requirements, and then delete or anonymize it. For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact our Privacy Team at [email protected].
Changes to this notice
We may update this notice from time to time. We will post the updated version with a new effective date. If we make material changes, we will notify Network Members and Authorized Users we have contact details for, by email or a notice on our website.
Questions, concerns or complaints
If you have questions, concerns, complaints, or would like to exercise your rights, please contact our Privacy Team at [email protected].