Privacy Policy

What personal data we collect and why we collect it



Sandbag is a not-for-profit climate change policy think tank based in Brussels and London set up in 2008.  We are strongly committed to protecting personal data and are committed to protecting your privacy in accordance with our obligations under data protection legislation.  From 28 May 2018 this is the General Data Protection Regulation (GDPR) as supplemented by the Data Protection Act 2018 and related laws.
This Privacy Statement explains what information Sandbag collects about you and how it will be used.
Personal data is any information relating to an identified or identifiable living person.  This Privacy Statement applies to personal data provided to us, both by individuals themselves or by others.  Sandbag will respect any personal data you share with us, or that we get from other organisations and keep it safe.  We may use personal data provided to us for any of the purposes described in this Privacy Statement or as otherwise stated at the point of collection.
If you have any queries regarding this privacy policy, please contact us at or on +44 (0) 20 3876 6451.

Where and how we collect your information

We collect information in the following ways:

2.1 Information you give us

Any information you provide to us through our website  This includes:

  • signing up to our mailing list via the contact form;
  • sending us feedback on the EU ETS Dashboard;
  • sending us a message through the Get in Touch form; and
  • if you have previously used the Carbon Destruction service.

We use cookies to enhance your experience.  Cookies mean that the Sandbag website will remember your IP address and username for twelve months.
When you are accessing our website, your device may provide us with information about your IP address,  the type of device you’re using, what operating system you’re using and may report any details of a website crash. Your device manufacturer or operating system provider will be able to provide you with more details about the information your device makes available to websites.

2.2 Google Analytics
We use Google Analytics to help us understand how visitors are using and engaging with our website and apps (we do not collect data on the specific usage of the dashboard). This allows us to make improvements to our web services and your online experience.
The Google Analytics tracking tool uses a number of cookies to collect information and report website usage statistics and does so without personally identifying individual visitors to Google or Sandbag. The information generated by the cookie about your use of Sandbag’s website will be transmitted and stored by Google on servers in the United States.
For more information about Google’s privacy policy in regards to Google Analytics, please see  
Sandbag will not merge personally-identifiable information with anonymous information gathered from these analytics systems unless there is prior notice and affirmative consent via opt-in from the user.  When using any of these tracking tools Sandbag does not identify users or facilitate the merging of personally identifiable information with non-personally identifiable information collected.
If you wish to opt-out of Google Analytics tracking please visit and install the Google Analytics Opt-out Browser Add-on here:

What information do we collect and how do we use it?

The type of personal information we will collect about you will depend on the purpose of collecting the information.

3.1 Direct marketing

We will contact you by email if you actively consented to this or if we believe there is a legitimate interest in contacting you.  By consenting to Sandbag emails or option in to email communications, you grant us permission to use your email to send you email marketing communication.  At any stage you may choose to opt out of such communications.

3.2 Third parties

Sandbag will not sell your data. We will not share your data for marketing purposes.  However, in some circumstances we may need to share your details with a third party for processing.
Personal data held by us may be transferred to:

  • third party organisations that provide applications, data processing or IT services
  • third party organisations that otherwise provide goods, services or information

3.3 Enhancing your supporter experience

We may use profiling and screening techniques to ensure that the communications we send you are relevant to you. This allows us to provide an improved experience for our supporters. When building a profile of our supporters we may analyse geographic and demographic information, to better understand your interests so we can contact you with relevant messages. An example of this would be looking at your location so we can share information about relevant events in your area. You can opt out of your data being used in this way by emailing

3.4 Your choice

You always have a choice as to whether and how you want to receive communications about our work, products and services and ways you can get involved. If you do not want us to use your contact details to contact you in the future you can opt out of this when we collect your details or at a later time.
If you ever want to change your contact preferences, or opt out of communications, you can do this at any time by completing this form.
Alternatively, you can opt out of our email marketing at any time by clicking the unsubscribe link at the bottom of any email from us; and if you choose not to be contacted by us we will never send you personalised marketing communications, but we will keep your details on a ‘suppression list’ to ensure you aren’t contacted.

3.5 Legal basis for processing your personal data

In some circumstances we will collect and process your personal information.
Sometimes, we will need to process your data as it is part of a contract which you have entered into. For instance, if you take part in an event, then we may need to contact you to enable us to provide the relevant services under the agreement with you.
However in most circumstances, we will rely on your consent when using your personal data. An example of this would be when we request your consent to receive marketing emails from Sandbag.

3.6 Retention

We hold your information for only as long as necessary for the purpose needed.

3.7 Jobs, interns and volunteering application data

If you apply to work or volunteer or to be an intern at Sandbag, we will use the information you supply us with to process your application and to monitor recruitment statistics.
If you are unsuccessful in your application we will not keep your information for more than 12 months.

How do we keep your personal information secure?

We always ensure that we have the necessary controls in place to protect the personal data you provide us with.  We carry out regular audits of who has access to data and to confirm it is being managed appropriately.

Your right to your personal information

Under the GDPR  you have the right to request a copy of the personal information we hold about you.  You also have the right to request that we erase any personal information we hold, where we have no compelling reason to continue processing this data.
If you wish to request this information, please contact or on +44 (0) 20 3876 6451.  We will then send you a form you will need to complete and send back to us by email.  We will also require you to provide two forms of identification. Once we have received your information request and your identification we will respond within one month.

Updates to this Privacy Statement

We may make changes to this Privacy Statement.  If we do make significant changes to the way we collect and process your personal information we will make this clear on the Sandbag website, or by contacting you directly.
This Privacy Statement was last updated on 21 May 2018.

Raising queries or concerns

If you have any questions, comments or concerns about data protection at Sandbag, please contact us at  If you are not satisfied with the response you receive from us for any reason then you may wish to contact the Information Commissioner’s Office via


When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.
An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: After approval of your comment, your profile picture is visible to the public in the context of your comment.
If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognise and approve any follow-up comments automatically instead of holding them in a moderation queue.
For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracing your interaction with the embedded content if you have an account and are logged in to that website.