Promise Dreams Privacy Policy

Transcription

1 Promise Dreams Privacy Policy Introduction Promise Dreams ( we ) promises to respect any personal data you share with us and keep it safe. We aim to be clear when we collect your data and not do anything you wouldn t reasonably expect. Developing a better understanding of our supporters through their personal data allows us make better decisions, fundraise more efficiently and, ultimately, helps us to reach our goal of providing a dream every day for seriously and terminally ill children. We have made improvements to this policy to make it more understandable to supporters. As of May 2018, we moved to an opt-in only communication policy. This means that we will only send marketing communications to those that have explicitly stated that they are happy for us to do so via their preferred channel(s) ( or post). Our marketing communications include latest news via our Promise Post, campaigns and fundraising work. If you would like to receive such communications but have not opted in please contact us on or info@promisedreams.co.uk This Privacy Policy explains: 1. How Promise Dreams may obtain your personal data 2. What information we collect 3. How we will use that information 4. Who we share your information with 5. Your choices regarding your information we hold 6. Where we store your personal data? 7. How long we hold your information for? 8. Data Protection Impact Assessment 9. Your rights. 10. Data Breaches. 11. Changes to this policy. 1. How do we obtain your personal data? When you give it to us directly. You may give us your information in order to sign up for one of our events, when you contact us to ask about our activities, make a donation to us, fundraise on our behalf, when you personally give us this detail or when you apply to us for a dream. From May 2018 onwards we only store this data if you have ticked the box and opted in to receive communication from Promise Dreams. We will only store information given to us in order to process dreams and to prove that the relationship existed. No contact will be made unless you have specifically opted-in. When you have given permission to other parties to share it with us. Your information may be shared with us by independent event organisers, for example the London Marathon or fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so when you have indicated that you wish to support Promise Dreams with your consent. You should check their Privacy Policy when you provide your information to understand

2 fully how they will process your information. We may also obtain information about you from a family member or a friend who contacts us on your behalf or if a fundraiser passes on your details to us. If the data is obtained in this way we will not use this data unless there has been a clear Opt-in from you. When your information is available publicly or from other external sources We may combine information that we already have about you with information available publicly or information available from external sources in order to gain a better understanding of you and to improve our fundraising methods. The information we get from other external sources may depend on your privacy settings or the responses you give, so you should regularly check them. For example, you may have provided permission for a company or other organisation to share your data with third parties including charities. This could be when you buy a product or service, register for an online competition or sign up with a comparison site. Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp or Twitter, you might give us permission to access information from those accounts or services. We may also obtain information about you where it is publicly available and found in places such as Companies House, Land Registry website and information that is published in articles and newspapers. 2. What information do we collect? Personal information is any information that can be used to identify you. For example, it can include information such as your name, date of birth, address, postal address, telephone number, fax number and credit/debit card details, as well as information relating to your health or personal circumstances. Data protection law recognises that certain categories of personal information are more sensitive. This is known as sensitive personal information and covers health information, racial or ethnic origin, religious beliefs or other beliefs or a similar nature, political opinion and trade union membership. We would only collect sensitive personal information where there is a clear need to do so such as participation in a challenge event, to ascertain what services are relevant to you or to cater other services and support to you or when applying to us for a dream. Before collecting any sensitive personal information about you we will make it clear to you what information we are collecting and the purposes for collecting such. 3. How do we use your information? How we use your information would largely depend on why you are providing it. We may use your information in the ways set out below. We use your personal information to give you the information you ask for.

3 We use your information to gain a full understanding of your situation so we can develop and offer you the best possible personalised information. (Volunteering, event participation etc.) We use your information to keep a record of your relationship with us and for internal administrative purposes (such as our accounting and records), and to let you know about changes to our services or policies. We use your personal information to look into, and respond to, complaints, legal claims or other issues. We use your personal information to claim Gift Aid on your donations. We use personal data to carry out statistical analysis and research in order to help us to understand how we are performing and how we can improve our services and meet the needs of people that require our help. We may also use your personal information for other purposes which we specifically notify you about and, where appropriate, obtain your consent. We use data given to us on application forms for a dream for purposes of the dream only and this may be given to third parties who are involved with the dream for example; Holiday company, builders for house adaptation. Direct marketing With your consent, we may use your information to send you communications about our work and how you can help us to help even more poorly children, for example, information about our campaigns, volunteering and fundraising activities and how you can donate to us. Our forms have clear marketing preference questions and we include an option to unsubscribe on every type of contact. ( , direct mail, telephone) You can let us know if you would prefer not to receive these communications at any time by ing info@promisedreams.co.uk, calling us on , or writing to us at Promise Dreams, Ground Floor, Edwin House, Boundary Industrial Estate, Stafford Road, Wolverhampton, WV10 7EL. Targeted communications We store information from your initial contact and your historical support to build a profile to ensure communications are relevant and timely, and to provide an improved experience to our supporters. This targeted communication also allows us to target our resources effectively. We do this because it allows us to understand the background of the people who support us and uses our services and helps us to make appropriate requests to supporters who may be able and willing to give more than they already do or to tailor our services to better suit them. Importantly it enables us to provide you with a service that is better suited for your needs while raising more funds, sooner, and more cost-effectively, than we otherwise would. In order to create a profile for you, we may use the information which you give us and which we collect from external resources, including information that is publicly available about you. We may also use this information to help us determine whether and in what ways you might be interested in getting involved in our other fundraising activities. You can let us know if you would prefer not to receive these communications at any time by ing info@promisedreams.co.uk, calling us on , or writing to us at Promise Dreams, Ground Floor, Edwin House, Boundary Industrial Estate, Stafford Road, Wolverhampton, WV10 7EL.

4 5. Who do we share your information with? We do not swap, sell or rent your personal information to anyone. As part of our charitable work to make dreams come true for seriously and terminally ill children, we may engage service providers who operate on our behalf. In these circumstances, they will only have access to the personal information they need to fulfil that service and will only use that information for the purposes for which they have been instructed by us. Examples of service providers include a holiday company who we are booking a dream with or an equipment provider who provides dreams for us. If we are asked to share your details with other organisations that aren t our service providers, we will only do so if: we have your permission; we have a legal or regulatory obligation to do so; we need to enforce any agreements we have with you or investigate any complaints; we need to protect the rights, property and safety of Promise Dreams and its supporters. 6. Where we store your personal data? We take looking after your information very seriously. We've implemented appropriate physical, technical and organisational measures to protect the personal information we have under our control, both on and off-line, from improper access, use, alteration, destruction and loss. Unfortunately the transmission of information using the internet is not completely secure. Although we do our best to protect your personal information sent to us this way, we cannot guarantee the security of data transmitted to our site. Our websites may contain links to other sites. This privacy statement does not cover the information practices of those websites or advertisers. Our Network and IT provider is Altodigital and you can see their IT Policy on our website under policies. 7. How long we hold your information for? We only keep it as long as is reasonable and necessary for the relevant activity, which may be to fulfil statutory obligations (for example, the collection of Gift Aid). This is reviewed annually and if we feel that data is no longer required this will be safely deleted. 8. Data Protection Impact Assessment (DPIA) From time to time Promise Dreams will undertake new initiatives to continually improve as a charity. To ensure that all of these new initiatives comply with GDPR the Data Protection Officer will carry out a DPIA when processing operations, in particular involving using new technologies, or where no data protection impact assessment has been carried out before, or where they become necessary in the light of the time that has elapsed since the initial processing. A data protection impact assessment will be carried out by Promise Dreams prior to the processing in order to assess the particular likelihood and severity of the high risk, taking into account the nature, scope, context and purposes of the processing and the sources of the risk. That impact assessment should include the measures, safeguards and mechanisms envisaged for mitigating the risk.

5 9. Your Rights Under UK data protection law, you have rights over personal information that we hold about you. We ve summarised these below: Right to access your personal information You have a right to request access to the personal data that we hold about you. You also have the right to request a copy of the information we hold about you, and we will provide you with this unless legal exceptions apply. If you want to access your information, send a description of the information you want to see by post to Promise Dreams, Ground Floor Edwin House, Boundary Industrial Estate, WV10 7EL or by to info@promisedreams.co.uk Right to have your inaccurate personal information corrected You have the right to have inaccurate or incomplete information we hold about you corrected. If you believe the information we hold about you is inaccurate or incomplete, please provide us with details and we will investigate and, where applicable, correct any inaccuracies. We provide an opportunity to update information in the footer of each send out to you by following the link. Right to restrict use of your personal information You have a right to ask us to restrict the processing of some or all of your personal information in the following situations: if some information we hold on you isn t right; we re not lawfully allowed to use it; you need us to retain your information in order for you to establish, exercise or defend a legal claim; or you believe your privacy rights outweigh our legitimate interests to use your information for a particular purpose and you have objected to us doing so. Right to erasure of your personal information You may ask us to delete some or all of your personal information and in certain cases, and subject to certain exceptions, you have the right for this to be done. Right to object to the use of your personal information If we are processing your personal information based on our legitimate interests or for research or statistics, you have a right to object to our use of your information. If we are processing your personal information for direct marketing purposes, and you wish to object, we will stop processing your information for these purposes as soon as reasonably possible. If you want to exercise any of the above rights, please contact us on Promise Dreams, Ground Floor Edwin House, Boundary Industrial Estate, WV10 7EL or by on info@promisedreams.co.uk. We may be required to ask for further information and/or evidence of identity. We will endeavour to respond fully to all requests within one month of receipt of your request, however if we are unable to do so we will contact you with reasons for the delay. Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK s Information Commissioner s Office (ICO)

6 10. Breaches Promise Dreams as instructed under GDPR, will be obliged to tell the ICO about data breaches that are likely to have significant detrimental effect on individuals, and will include damage to someone s reputation, discrimination or financial loss. Promise Dreams will report all breaches to the ICO within 72 hours of become aware of them, and the individuals affected will also be notified within 72 hours. 11. Change to this policy We may change this Privacy Policy from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on the Promise Dreams Website or by contacting you directly.