+ Personal information we collect

We collect personal information from you in various ways, for example:

• if you supply personal information when using this Website;
• when you supply personal details in the course of registering support or volunteering, attending events or training;
• through surveys and data collection;
• when you sign-up to receive newsletters or email notifications from us;
• when you make a donation through our appointed partners Stripe, PayPal and Enthuse, in which case they will provide us with this information – see also section headed 'Third Party Platforms' below;
• if you order any merchandise; and/or
• if you raise a query or issue with us.

The type of personal information we collect includes your name, email address, home (or work) address, phone number and other personal details which you may choose to provide. Any credit card or debit card data you provide is securely handled by our appointed partners as our third party payment processor (or such other third party payment processor) as we use from time to time. We never store your credit or debit card details.

We may also collect information about your use of our Website (for example, the URL you came from; your browser type and the pages of our Website that were viewed during your visit). For more information on how we do this, please see the section headed 'Cookies’ below.

Such personal information is referred to in this Privacy Policy as 'Personal Data'.

+ Use of personal data

We may use your Personal Data about you for the following purposes:

• providing you with access to our Website as well as administering or developing Website features or content;
• providing you with news about us or any projects, campaigns or events that we may be involved in;
• providing you with information about volunteering opportunities;
• where you have agreed to take part in a survey or research;
• administering any on-going donations or support you provide;
• fundraising or direct marketing purposes. Where you have expressly consented to us doing so in accordance with applicable law, we may contact you for these purposes by telephone or electronic message (e.g. email or SMS). We may also contact you by post from time to time, unless you have told us that you do not want to receive these communications. If you wish to update your Personal Data or opt-out of receiving further fundraising or marketing communications from us please get in touch at the address shown in the 'Contact' section below; and/or
• we may also occasionally use Personal Data for the purpose of profiling (see the 'Profiling' section below).

We may also contact you for other purposes that you consent to from time to time.

+ Legal obligations

We aim to collect and process your Personal Data in accordance with applicable laws that regulate data protection and privacy. This includes but is not limited to the General Data Protection Regulation (GDPR).

+ Profiling

Please note that we may occasionally use Personal Data to conduct profiling or to conduct analysis of our database or persons who have positively expressed an interest supporting our work or attending one of our events/training. This will help us target communications in a more relevant, efficient and cost effective way, helping us reduce the chances of individuals receiving inappropriate or irrelevant communications. To do this profiling we may cross-check certain Personal Data against public sources to get a better understanding of who they are. You can object to such use of your Personal Data for this purpose at any time by contacting us at the address shown in the 'Contact' section below.

+ Disclosing personal data to third parties

We never sell, trade or rent Personal Data. We do not disclose Personal Data to third parties without your consent unless we are legally required to do so or where we need assistance of third party data processors, or agents (acting under our instructions) who we may need to assist us. We will take reasonable steps to ensure that Personal Data is only used by those third parties for specific, lawful purposes in accordance with this Privacy Policy.

+ International transfers

Personal Data that we collect will be processed by staff, volunteers and contractors who are based in the UK. However, given the international nature of our charity, by providing us with Personal Data, you agree that we may share Personal Data with our teams in other parts of the world in accordance with this Privacy Policy.

We use the third party platform provider, Beacon, to manage our customer relationship management ('CRM') database. We use Mailchimp as a marketing tool. We use Microsoft OneDrive and Google Drive to help warehouse our data on the cloud. This means that your Personal Data may be hosted by Beacon, Mailchimp, Microsoft OneDrive and Google Drive. They are all committed to protecting personal data to standards that meet those applicable legal standards in the UK and EU. For more information about their respective privacy policies, please see Beacon, Mailchimp, Microsoft OneDrive and Google Drive.

You should be aware that, in general, legal protection for personal data under applicable law in other non-EU countries may not be equivalent to the protection provided in the European Union and/or under UK law. In all cases, Personal Data you provide will only be disclosed to staff, volunteers and contractors who share our commitment to treating Personal Data responsibly and we aim to make sure your Personal Data is treated to the same security standards you would expect in the United Kingdom.

+ Your access rights

In accordance with your legal rights under applicable law, you can request to receive information regarding the Personal Data that we collect about you; what we use that Personal Data for and who it may be disclosed to. Please write to the email address in the 'Contact’ section below. Where applicable law allows, we may request a fee to cover our administrative expenses in responding and may also require further information to verify your identity or locate the specific information you seek before we can respond in full.

+ Security to protect personal data

We employ appropriate technical and organisational security measures to protect Personal Data from being accessed by unauthorised persons and against unlawful processing, accidental loss, destruction and damage. We also endeavour to take all reasonable steps to protect Personal Data from external threats. However, please be aware that there are always inherent risks in sending information by public networks or using public computers and we cannot 100% guarantee the security of all data disclosed or transmitted to us.

+ Data retention

We will retain certain Personal Data in respect of financial transactions for at least as long as the law requires us to for tax or accounting purposes (which in the UK may be up to 6 years after a particular transaction). In respect of the holding of Personal Data for fundraising or direct marketing purposes, we will retain this data for a limited period in line with recommendations of the ICO and other competent regulatory authorities.