Privacy policy

We collect or use the following information to provide services and goods, including delivery: 

• Your name and contact details, such as your phone number and email address 
• Address 
• Date of birth 
• Purchase or account history 
• Payment details (including card or bank information for transfers and direct debits) 
• Health information (including dietary requirements, allergies and health conditions) 
• Account information 
• Website user information, including cookies 

We collect or use the following information for the operation of customer accounts and guarantees: 

• Names and contact details 
• Addresses 
• Payment details (including card or bank information for transfers and direct debits) 
• Account information, including registration details 
• Marketing preferences 

We also collect or use the following information for the operation of customer accounts and guarantees: 

• Racial or ethnic origin 
• Genetic information 
• Health information 
• Recorded images, such as photos or videos to show your journey 

We collect or use the following information for service updates or marketing purposes: 

• Names and contact details 
• Addresses 
• Marketing preferences 
• Purchase or viewing history 
• Website and app user journey information 
• Information relating to sponsorship 

We collect or use the following information for recruitment purposes: 

• Contact details (e.g., name, address, telephone number or personal email address) 
• Date of birth 
• National Insurance Number 
• Copies of passports or other photo ID 
• Employment history (e.g., job application, employment references or secondary employment) 
• Education history (e.g. qualifications) 
• Right to work information 
• Details of any criminal convictions (e.g., Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks) 

We collect or use the following information for fundraising purposes: 

• Names and contact details 
• Addresses 
• Date of birth 
• Donation or account history 
• Payment details (including card or bank information for transfers and direct debits) 
• Credit reference information 
• Health information (including dietary requirements, allergies and health conditions) 
• Call recordings 
• Marketing preferences 
• Customer or client accounts and records 
• Financial transaction information 
• Website and app user journey information 
• Records of consent, where appropriate 

We may undertake research, profiling and analysis to help inform our decisions as a fundraising charity. This helps us to understand more about the people we engage with, their connection to us and their interests, and to make the information we provide to supporters more relevant.  This may include: 

• Analysing our supporter base to identify, communicate and engage with philanthropists and people who might choose to give significant donations. 
• Carrying out in-house research, or engage specialist third party research consultancies, to determine whether an individual could be a potential major supporter and what aspects of our work might be of particular interest to them.   This research may be undertaken for existing supporters, prospective donors and people who may have an affinity to our cause but with whom we are not already in touch. 
• Using publicly available information from third party resources such as Google, Companies House, trade press and published biographies. The type of information we collect can include: 
  • career overview 
  • gift capacity 
  • areas of interest 
  • history of giving to us and others 
  • how the individual is connected with us and others 
  • public information on philanthropic activities 
  • screening our database or use a third-party organisation to do so 
  • using profiling information to produce short biographies of people who are due to meet our leadership or attend one of our events. 
  • asking our existing supporters, volunteers, staff and Trustees whether they would be prepared to facilitate introductions to their own networks 
  • carrying out checks on individuals who donate large donations, to comply with our duties in respect of anti-money laundering legislation and the prevention of fraud. 

We may collect or use information for wider research and evaluation purposes: 

• Carrying out research and evaluation on data we collect to help us decide how we can improve our services. 
• Conduct research and evaluation of our programmes and services (e.g., via surveys, focus groups, interviews, case studies, etc.). We may conduct such evaluations with partner organisations (e.g., via Randomised Control Trials). Funders/partners may share information from these evaluations (e.g., summary results, quotes, case studies) themselves but we will not pass on any details which make you identifiable. Where working with partner organisations where data sharing agreements are in place we will ensure that any data shared is appropriately protected by a Memorandum of Understanding and/or a data sharing agreement. 

• We may also conduct research which aims to better understand the wider context/environment in which we operate and/or better understand prevailing trends and opinions on issues relevant to the work we do, allowing us to make informed business decisions, as well as create communications, reports, resources, etc., which we may share publicly or with funders or partners or other key individuals, groups or stakeholders in order to raise awareness, increase engagement and support our policy work. Funders/partners may share this information themselves, but we will not pass on any details which make you identifiable. The research we conduct may be undertaken for existing customers, prospective customers, supporters, prospective donors, and people who may have an affinity for our cause but with whom we are not already in touch. Where working with partner organisations where data sharing agreements are in place we will ensure that any data shared is appropriately protected by a Memorandum of Understanding and/or a data sharing agreement. 
• We may share anonymised data with other organisations for the purposes of new research. Any data shared will be subject to a Memorandum of Understanding and/or a data sharing agreement. 

• We may collect personal data during the research session. This could include:
  • Personal data, including sensitive personal data 

• Personal information could be collected via: 
  • Audio recordings 
  • video recordings 
  • screen recordings 
  • written/typed notes/responses (including survey responses) 
  • photos 

We may use the following third-party tools and services to collect, transcribe or analyse research and evaluation data: 

• Survey tools 
• Online collaboration tools, including video conference and virtual whiteboard tools 
• Transcription services, including automatic transcription and analysis tools 
• Consent management tools 
• Analysis software (e.g., R) 

Our lawful bases for collecting or using personal information to provide services and goods are: 

• Consent 

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are: 

• Consent 

Our lawful bases for collecting or using personal information for service updates or marketing purposes are: 

• Consent 
• Legitimate interest: 
• Our legitimate interests include the interests of our organisation in conducting and managing our operations to enable us to give you the best service and the best and most secure experience, and where we believe it to be in the public interest to process your personal information. Specific examples of this include: sending you information and marketing materials to your postal address; analysis and profiling of our supporters. 

Our lawful bases for collecting or using personal information for recruitment purposes are: 

• Consent 
• Contract 

Our lawful bases for collecting or using personal information to process donations are: 

• Legitimate interest 
• Analysis and profiling of our supporters. 
• Use of personal information to monitor use of our website for technical purposes in relation to funded partners, monitoring and evaluating funding, activities and compliance with their Conditions of Funding, audit checks and conducting organisational checks and verifications for fraud or error detection. 
• Sending you information and marketing materials to your postal address. 

Our lawful bases for collecting or using personal information to better understand our existing and potential supporters are: 

• Legitimate interest 
• We rely on our legitimate interests to process this data as connecting people to our cause is instrumental in meeting our charitable objectives. We are careful to ensure that the information we process is not excessive nor intrusive. 

Our lawful bases for collecting or using personal information for research and evaluation purposes are: 

• Consent 
• Legitimate interest 
• We rely on our legitimate interests to collect, process and analyse this data in line with the interests of our organisation in conducting and managing our operations to  enable us to give you the best service, and where we believe it to be in the public interest to process your personal information (for example in our policy and advocacy work). Additionally, through longer-term retention of anonymised data, we are able to understand historic trends or patterns, which allows us to make more informed decisions about the development of our services. 

• You, directly 
• Third party donation platforms (e.g., iRaiser, JustGiving, Enthuse, Donr, Crowdfunder, Access Paysuite) 
• Social media platforms (e.g., Facebook, Instagram, LinkedIn, X, TikTok) 
• Email marketing platforms (e.g., Mailchimp, Dotdigital) 
• Third party marketing services 
• Payroll giving companies 

When a record is no longer needed for business purposes, we will mark it as closed or inactive. After closure, we will only keep data and records for as long as they are needed, as stated in the Data Protection Act 2018 or other pertinent legislation. There are minimum recommended retention periods for different record types, therefore it’s essential to consider the record’s nature when determining how long to keep it, and a shorter retention period may be suitable in some cases. 

Payment service providers: If you make a donation or payment on our site, cookies are used by our payment services providers to enable your visit to be identified between page loads, and to make sure that at the payment point only your specific computer can continue with payment. 

Google Analytics: We use a service called Google Analytics which collects information about how visitors use our website. We use this information to compile reports and to help us improve the website. The information we collect includes the number of visitors to the website, where visitors have come to the website from and the pages they visited. The information is collected and processed in a way that does not directly identify anyone. Where sites or apps have implemented Google Analytics with other Google Advertising products, like Google Ads, additional advertising identifiers may be collected. You can opt-out of this using our cookie settings. We rely on consent as our basis for processing and only collect the analytics information if you opt-in to the use of non-essential cookies and similar technology. 

If you make a donation to us, we may provide your data to a third party agency who will be able to check whether you have signed up with them to claim Gift Aid on any charitable donation you make.  They will also process our Gift Aid declarations, matching donations to declarations, filtering out unsuitable entries (e.g. any mistakes in entries such as addresses or duplicated entries) and submit them to HMRC to process. They will also analyse data to provide us with reports so we can understand our donor base better. 

Analytics, search engine and marketing providers: We may share data with analytics and search engine providers who assist in the optimisation of our site and our services. We also work with marketing/segmentation specialists who may provide us with data so that we can reach our target audience.  We may also share your data with third party research and profiling specialists, who may provide us with information so that we can better understand and engage with our supporters. 

HMRC/Other Regulators: Where we are under a legal duty to disclose or share your personal information in order to comply with legal obligations, including to HM Revenue & Customs, regulators and other authorities (who require reporting of processing activities in certain circumstances, including in relation to Gift Aid). 

The Government: We receive funding from various sources, including government entities (such as the UK Department for Digital, Culture, Media & Sport (DCMS) and the Department for Education (DfE)). These organisations and their appointed agents may process data on our behalf including for monitoring, evaluation and audit purposes, and to conduct checks and verifications for fraud or error detection. They may contact you to discuss these matters. 

Partners: We work with various partners, including suppliers and subcontractors who will process data on our behalf. These suppliers include those who provide us with IT services, system administration, our funding management system and related tools or applications, as well as other services (including market research). 

Legal Rights: To enforce and protect our legal rights, or the safety of those who work for us, or with us, our beneficiaries, donors or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction. 

We require all third parties to respect the security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions. We will not transfer your data outside of the UK. We will always take steps to make sure appropriate protections are in place (in accordance with UK data protection law) and that your information is protected. This includes ensuring the appropriate transfer mechanisms are in place. 

Under data protection law, you have rights including: 

Your right of access – You have the right to ask us for copies of your personal data. 

Your right to rectification – You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 

Your right to erasure – You have the right to ask us to erase your personal data in certain circumstances. 

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal data in certain circumstances. 

Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances. 

Your right to data portability – You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances. 

Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent. 

You don’t usually need to pay a fee to exercise your rights. If you make a request, we have one calendar month to respond to you. 

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice. 

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice. 

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. 

The ICO’s address: 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF 

Helpline number: 0303 123 1113 

Website: https://www.ico.org.uk/make-a-complaint