Privacy policy

Every day, supporters of The Royal Free Charity (the ​“Charity”) are making a valuable difference to patients and staff at our three hospitals and in the local communities by providing services, research and equipment not covered by NHS funding. We value building long-lasting relationships with our supporters based on trust, transparency and compassion. Processing your information helps maintain a secure, well-managed database and adhere to best practices so that your information and preferences are kept up to date. Your information enables us to understand you better and be more appropriate when communicating with you. For instance, we are able to recognise and acknowledge your support and the commitment you show to the Charity over the years. This also better equips us to handle enquiries, deliver materials and process payments. Above all, it facilitates us in providing quality support. The Charity is a partnership charity encompassing the previous Royal Free Charity, Chase Farm Charity, Barnet Hospital Charity, St Peter’s Trust and Fiorina.

The Charity is a charitable company; it is registered with the Charity Commission (charity number 1165672) and Companies House (company number 09987907). It is also registered with the Information Commissioner’s Office as a data controller (registration number Z9381951).

This Privacy Policy sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by us. Please read this Privacy Policy carefully to understand our views and practices regarding your personal data and how we will treat it.

In meeting its charitable purposes the Charity, as a data controller, processes the personal data of the following categories of people:

• Patients (including those who use the services provided by the charity)
• Donors, fundraisers and supporters
• Volunteers
• Legacy pledgers, intenders and enquirers
• Email subscribers
• Trustees
• Job applicants
• Royal Free London staff (including those who use the services provided by the charity)
• Other users of the services provided by the charity

There are audience specific privacy policies covering each of the above categories that support this Privacy Policy. We encourage you to read those that are relevant to your relationship with us for greater detail on how we manage and use your personal data.

We may need to change or update this Privacy Policy from time to time and if we do so we will post the changes here. Where the changes are significant, we will inform individuals.

Dated: July 2022

The personal data that we may collect about you, the reason why we collect it and what we do with it will depend on your relationship with us. We collect personal data in lots of ways; such as when you sign up for an activity, sign up for email newsletters, make a donation to us or fundraise on our behalf. Please see the audience specific privacy policies, which can be found here, for more detail.

You have various legal rights in relation to the information you give us, or which we collect about you, as follows: 

• The right to access your information and obtain confirmation that we are processing your personal information (see below for our Subject Access Request process);
• The right to have your personal information rectified if it is incomplete or inaccurate;
• The right to have your personal information removed or deleted in certain circumstances, for example when you have withdrawn consent to it being processed and we have no other basis for processing it;
• The right to restrict the processing of your personal information in certain circumstances;
• The right to object to certain processing including the right to not be subject to automated decision-making and the right to object where we are processing your information on the basis of our legitimate interest;
• The right to require us not to send you marketing communications; and
• Where you have provided your consent to the processing, the right to withdraw consent to the processing of your data (without affecting the lawfulness of processing based on consent before its withdrawal).

Please note that not all of the above rights are absolute and requests may be refused where exceptions apply. For a more detailed explanation of these rights, please see the Information Commissioner’s guidance.

You can ask us to confirm if we are keeping any personal information about you and you can also request to receive a copy of that personal information – this is called a Subject Access Request.

To make a Subject Access Request you will need to provide adequate proof of identity such as a copy of your passport, birth certificate, or driving license before your request can be processed. Please try to be as clear as possible about the information you are seeking, as this will help us respond to your request more efficiently. Once we have received your Subject Access Request and proof of identity, you will receive a response from us within a month unless circumstances permit us to extend that deadline.

If you would like to submit a Subject Access Request or exercise any of the other rights referred to above, please and email us on [email protected] or write to The Data Protection Lead, Royal Free Charity, The Pears Building, Pond Street, London NW3 2PP. You can also call us on 0207 472 6677.

If you are not happy with how we handle any of your requests, queries, or concerns, you can contact the Information Commissioner’s Office which oversees the protection of personal information in the UK.

We will respect your email privacy. This means we carefully manage the communications we send you to ensure that we are contacting you in the most relevant way.

You will only receive communications from us that you have requested. With the exception of where we may write to thank you for a donation or funds raised, or where we are sending you administrative paperwork such as a receipt, this means you will not receive unsolicited emails from the Charity unless you have agreed to receive communications from us. You can change your email preferences or unsubscribe at any time by: 

• clicking the ​“unsubscribe” link at the end of any emails you receive from us; or
• by contacting [email protected] or calling 0207 472 6677.

Alternatively, you can unsubscribe from other email communications by replying to the sender.

Please note that we may embed links to third party websites or pages that are not managed by the Charity. If you follow any of these links, please note that they have their own privacy policies. Please check those third-party policies before you submit any personal information to those websites. We do not accept any responsibility or liability for these policies.

We take appropriate security measures to protect your data against unauthorised access, alteration, disclosure or destruction. When sharing your data with third parties, we do so securely, including employing the following safeguards: 

• PCI DSS standards. We comply with the Payment Card Industry Data Security Standards in relation to debit/​credit card payments made on our website to protect financial information from theft and fraud. Your card details are not stored on the Charity’s electronic systems or as hard copies.
• Methods of disposal. Paper documents are disposed of by shredding in a manner that ensures confidentiality.
• Firewalls and encryption. We use industry-standard and up-to-date firewall and encryption technology.
• Secure data transfers. When transferring your data we ensure it is protected by using a secure data transfer site.
• Restricted access. Access to personal and financial data is permitted to authorised staff only.
• Secure storage. Our data storage is assessed through a secure physical and electronic process.

No transmission of information via the internet is completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our website and any transmission is at your own risk. Once we have received your personal information, we will use adequate procedures and security features to try to prevent unauthorised access.

We work with digital marketing agencies and use social media platforms to promote our news, research and fundraising campaigns to bring in events participation, donations, ambassadors and supporters.

From time to time these agencies may use your personal data, from our database, and upload it to these platforms, including Meta/​Facebook. Providing contact details such as your name, address, job role, and email to Facebook means we can present ads to you and others that share your interests to help identify new supporters for Royal Free Charity so we can better support our hospitals.

Facebook is not permitted to use this data for any other purpose. You can review Facebook’s Data Processing Terms here.

Information we share will be securely encrypted and you can ask us not to share your information by getting in touch: [email protected].

Please note, you may still see adverts on Facebook related to the Charity and the work we do; this is because the social media platform you have an account with will use the data they already hold about you (and not provided by the Charity) to decide what you view, when you view it and on which device you view it on.

You can control the kind of advertising which you see through the relevant social media site here: Facebook, Instagram, Twitter/​X, YouTube and LinkedIn.

What are cookies?

This cookie policy explains what cookies are and how we use them, the types of cookies we use i.e, the information we collect using cookies and how that information is used, and how to manage the cookie settings.

Cookies are small text files that are used to store small pieces of information. They are stored on your device when the website is loaded on your browser. These cookies help us make the website function properly, make it more secure, provide better user experience, and understand how the website performs and to analyze what works and where it needs improvement.

How do we use cookies?

As most of the online services, our website uses first-party and third-party cookies for several purposes. First-party cookies are mostly necessary for the website to function the right way, and they do not collect any of your personally identifiable data.

The third-party cookies used on our website are mainly for understanding how the website performs, how you interact with our website, keeping our services secure, providing advertisements that are relevant to you, and all in all providing you with a better and improved user experience and help speed up your future interactions with our website.

Types of Cookies we use

View our full list of cookies

Manage cookie preferences

You can change your cookie preferences any time by clicking the above button. This will let you revisit the cookie consent banner and change your preferences or withdraw your consent right away.

In addition to this, different browsers provide different methods to block and delete cookies used by websites. You can change the settings of your browser to block/​delete the cookies. Listed below are the links to the support documents on how to manage and delete cookies from the major web browsers.

Chrome: https://support.google.com/accounts/answer/32050

Safari: https://support.apple.com/en-in/guide/safari/sfri11471/mac

Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox?redirectslug=delete-cookies-remove-info-websites-stored&redirectlocale=en-US

Internet Explorer: https://support.microsoft.com/en-us/topic/how-to-delete-cookie-files-in-internet-explorer-bca9446f-d873-78de-77ba-d42645fa52fc

If you are using any other web browser, please visit your browser’s official support documents.

You can contact us at any time to change your communication preferences or let us know when something changes. If you have any queries about our Privacy Policy or want to raise a concern about how we process the information we hold about you, please email [email protected] or write to The Data Protection Lead, Royal Free Charity, The Pears Building, Pond Street, London NW3 2PP. You can also call us on 020 7472 6677.

What personal information do we collect?

The personal information we collect from patients of the Royal Free London who are supported by the Charity’s volunteers, individuals that use our services (e.g. the Recreation Club, the Complimentary Therapy Service, Support Hub) and Royal Free London staff may include:

• Your title, name, address and contact information (telephone number(s) and/​or email address(es))
• Your date of birth
• Your background and family situation
• Your nationality and ethnicity
• Photographs
• Medical information you share so that you can access our services such as Complimentary Therapy or the Support Hub.
• Financial information and national insurance number so that we can support you to access welfare rights advice through the Support Hub
• Equality monitoring data
• Records of your communications with us
• Information gathered through surveys or forms you have filled out
   

What about special category data?

Certain categories of personal information are recognised in law as sensitive, including health information and information regarding race and religious beliefs (‘special category data’). We only collect special category data when we have a legal basis to do so and that legal basis is supported by a condition for processing. When we collect health data (or other special category data), we rely on the ​“explicit consent” condition for processing that information.

We collect health and financial information because:

• It is needed for us to be able to provide support or services to named individuals, (e.g. through our Recreation Club and patient support services, including the Complementary Therapy Service, the Support Hub and our Volunteer Programme).

Where we have received personal health information we may use this to inform our research and grant-making. We only collect and use it when we have a legal basis to do so and that legal basis is supported by a condition for processing.

How do we collect your personal information?

When you give it to us directly

We collect personal information that you may provide to us including when you:

• Self-refer or are referred by a Royal Free London clinical team to one of our services either as a staff member or as a patient of Royal Free London or complete a form to request a service (e.g. to request a massage or to sign up to a talk or group)
• Become a member of the Recreation Club
• Agree to participate in a research project
• Complete a survey
   

When you give it to us indirectly

• Staff members of the Royal Free London may share your personal information if it is needed for us to be able to provide support to named individuals through our patient support services or volunteer services
• When you are referred to us by your GP
   

How do we use your information and what is our legal basis for processing it?

We will only process your information if we have a legal basis for doing so, including: –

Where you have granted us consent, for example: –

• To provide you with services or support (for example, when you book a massage, to facilitate your treatment, we will need you to fill in a health questionnaire)
• To participate in a research project (where any health data (or other special category data) is involved in our research projects, we rely on the ​“explicit consent” condition for processing that information)

Where we have a legitimate interest, for example: –

• To administer our internal operations
• To improve our services to ensure that any content is presented to you in the most effective manner for you
• The Support Hub sending supportive emails to former clients to check on their progress and with signposting information

Where we are required by law to process your information, for example: –

• To comply with our health and safety, and equality and diversity obligations
• We may need to disclose your details if required to regulatory bodies or legal advisors (our regulatory bodies include HMRC, the Charity Commission, Companies House, the Information Commissioner’s Office and the Fundraising Regulator)

We also use the information you provide in an anonymised form to: –

• Monitor and evaluate the impact of our services and research programmes
• Refine and improve our services
• Produce reports such as our annual report or reports for donors

What other organisations do we share your information with?

We may share:

• Information about the support our volunteers or complimentary therapy service have provided with your referring clinician or clinical team at the Royal Free London Foundation NHS Trust
• We may also share information regarding your Recreation Club membership with your GP where they have referred you to the service
• Information with agencies you have asked us to contact on your behalf if you are a client of the Support Hub

We will not routinely share information with other third parties, other than in the following circumstances:

• Unless at your request (for example, our patient Support Hub service may contact third parties at your request as part of the support they provide to you)
• Whilst we protect your confidentiality, we can share your personal information without consent in certain circumstances:
  - there is a legal requirement to do so (e.g. because of a court order)
  - if there is an overriding public interest (e.g. to prevent harm to self or other)
• To prevent a vulnerable adult from abuse
   

How long do we keep your information?

We only keep your information as long as we need it. Subject to any other relationship you have with us, for example:

• We will retain information on patients referred to us by clinicians or clinical team(s) for seven years for complimentary therapies in line with Royal Free London’s patient records policies which specify how long patient records should be kept
• Information on Recreation Club members is maintained for the period of membership and for 7 years after the membership has been cancelled or expired
• Medical questionnaires completed for the purpose of receiving complementary therapy treatments are kept for 5 years
• Support Hub records are kept for the advice industry standard of 6 years

Every day, supporters of The Royal Free Charity (“Charity”) are making a valuable difference to patients and staff at our three hospitals by providing services, research and equipment not covered by NHS funding. We value building long-lasting relationships with our supporters based on trust, transparency and compassion. 

Processing your information helps maintain a secure, well-managed database and adherence to best practices so that your information and preferences are kept up to date. Your information enables us to understand you better and be more appropriate when communicating with you. For instance, we are able to recognise and acknowledge your support and the commitment you show to the Charity over the years ​‚and share information and updates that are relevant to you. This also better equips us to handle enquiries, produce materials and process payments.

What personal information do we collect?

The personal information we collect from you may include:

• Your title, name, address and contact information (telephone number(s) and/​or email address(es))
• Your date of birth
• Your background and family situation
• Photographs
• Details of your donations, including Gift Aid information, and financial data relating to donation payments. For example, if you donate by direct debit or standing order, we keep bank account details to set up and collect payments. If you wish to donate by credit card or debit card, your card details are collected in order to process your payment.
• Records of your communications with us
• Information gathered through surveys or forms you have filled out
• Your IP address(es) and information relating to what pages have been viewed and any information volunteered by you when your browse our website, and we may also track if you are opening and engaging with the emails we send you.

In addition to the above, when you visit our website we use cookies to improve your experience and personalise the service you receive. See our cookies policy for more information.

What about special category data?

We hold certain categories of personal information recognised in law as sensitive, including health information and information regarding race and religious beliefs (‘special category data’) and personal data relating to criminal convictions and offences.

We do not routinely collect special category data of our donors and fundraisers but when we do, there is a clear reason for doing so, such as accessibility or dietary requirements for events, or due diligence in respect of major donations. We may also collect special category data when we have a legitimate interest to record this (see below under ​“How do we use your information and what is our legal basis for processing it?” for more information).

How do we collect your personal information?

When you give it to us directly

We collect personal information that you may provide to us including when you:

• make a donation or complete a Gift Aid declaration
• respond to an invitation or attend an event
• buy something from or donate something to our shop
• pledge to leave us a gift in your will
• play our lottery
• tell us that you are fundraising for us

When you give it to us indirectly

We collect personal information that you may provide to us including:

• when you register for a challenge event (e.g. the London Marathon) and the organisers of that event share your information with us
• when staff of the Royal Free London NHS Trust shares information with our volunteers about your care and the support services you may require
• when we carry out research to shape our communication to ensure you only hear from us in a way that is right for you

Identifying and building relationships with philanthropists

The generosity of philanthropists enables our work and we aim to build meaningful long-term relationships with our supporters. To that end, we may carry out research to understand your connection to the Charity, your capacity to support at a higher level, and your areas of interest in our work.

We carry out research directly and in some instances we will use trusted third party partners, such as wealth screening agencies like Prospecting for Gold, or prospect research agencies like Factary, to manage our resources more efficiently.

In undertaking this research, we may seek publicly available data regarding wealth indicators such as profession, house prices and other factors relating to your place of work, area of residence or other information we hold, and overlay this on our website to estimate the potential for existing supporters to give more significant donations to the Charity, and to enable us to contact them to explore this. We may also record information about your propensity to support the Charity, such as your support of other charities, where this is in the public domain. We may create flags in our database to record these indicators.

We also conduct due diligence research on existing and potential supporters to ensure that donations accepted are unlikely to cause reputational damage to the Charity that could impact our ability to fundraise from other sources, or to provide our services.

We may hold data about people with whom we do not have a relationship, but whom we believe might support the Charity, including patients and contacts of the Royal Free London who have a connection to our work, local philanthropists, or those who are known to support our area of work, or any other reason we think someone might be interested in supporting the Charity. In these instances we may research these people using any of the methods above, and hold their data for up to three years before contacting them, at which point we will collect the individual’s communication preferences.

When we collect it as you use our website

We collect information about the services you use and how you use them in a number of ways, including:

• When you visit our website, including through the use of cookies, we may automatically collection information about your equipment, browsing actions and patterns (see our cookies policy for more information)
• When you view and interact with our emails and content

How do we use your information and what is our legal basis for processing it?

We will only process your information if we have a legal basis for doing so, including: –

To fulfil a contractual obligation, for example: –

• When you register for a challenge event
• To dispatch fundraising materials to you that you have purchased

Where you have granted us consent, for example: –

• To contact you if you subscribe to our mailing list
• To share fundraising information with you by email

Where we have a legitimate interest, for example: –

• To send you a thank you communication for your donation(s)
• To contact you with fundraising information by post or phone
• To manage, review and/​or assess any actual or potential contributions, whether these be through financial support, or in-kind donations
• To administer our internal operations, including the administration of activities involving our partners
• To improve our services to ensure that any content is presented to you in the most effective manner for you.

Where we are required by law to process your information, for example: –

• To make a Gift Aid claim
• To facilitate health and safety requirements at a challenge event

We also use the information you provide in an anonymised form to: –

• Monitor and evaluate the impact of our programmes
• Refine and improve our services
• Produce reports such as our annual report or reports for donors
   

What other organisations do we share your information with?

We may share your personal information with our service providers/​data processors so that they can carry out work on our behalf. Whenever we engage a third party to act on our behalf we ensure that the contract we enter into with them requires them to comply with UK data protection laws, to process your information only for the purposes we specify and to make sure they have the appropriate controls in place to protect the security of your information.

Examples of service providers/​data processors include: –

• Our email distribution service provider
• Donation processing companies
• Our print and production providers
• Prospect research and wealth intelligence agencies
• Any organisations that assist us with events that we are holding (e.g. sending out fundraising packs)

We may also share your personal data with partner organisations that work with us to deliver a service you have signed up for. For example, if you let us know that you participate in Unity Lottery, we may share that your personal data with that organisation to facilitate your engagement .

How long do we keep your information?

We only keep your data for as long as necessary for the purposes set out in this Privacy Policy. The retention period will vary according to the nature of the purpose under which the information is held. For example:

• We retain Gift Aid declarations in accordance with HMRC guidance, which in the case of a one-off donation is generally six years from the end of the accounting period in which the donation is received; the period is longer in the case of a declaration which applies to a series of donations or if an HMRC query is received during the normal retention period.

What personal information do we collect?

The Charity engages a wide range of individuals on a voluntary basis. We engage volunteers to support our services.

The personal information we collect from you may include:

• Your title, name, address and contact information (telephone number(s) and/​or email address(es))
• Your date of birth
• Next of kin/​emergency contact information
• Photographs
• Records of your communications with us
• Your profession, professional qualifications and related information (e.g. your job title, employer, professional history, any business interests etc.)
• Equality monitoring data
• Criminal record information
• Health information
• Bank details
   

What about special category data?

Certain categories of personal information are recognised in law as sensitive, including health information and information regarding race and religious beliefs (‘special category data’). We only collect special category data when we have a legal basis to do so and that legal basis is supported by a condition for processing. When we collect health data (or other special category data), we rely on the ​“explicit consent” condition for processing that information.

We only collect special category and personal data from our volunteers if there is a clear reason for doing so. These include:

• Collecting equality and diversity monitoring information to ensure our volunteers are representative of the local community
• Conducting Disclosure and Baring checks to safeguard our beneficiaries and other volunteers (role dependent)
• Health information in order to assess and mitigate any risk to your health that volunteering may cause
• Financial information (bank details) in order to reimburse expenses incurred
   

How do we collect your personal information?

When you give it to us directly

We collect personal information that you may provide to us when you apply to volunteer with us

How do we use your information and what is our legal basis for processing it?

We will only process your information if we have a legal basis for doing so, including: –

To fulfil a contractual obligation, for example: –

• To facilitate the terms of your volunteering agreement

Where we have a legitimate interest, for example: –

• To administer our internal operations, including the administration of activities involving our partners

Where we are required by law to process your information, for example: –

• To discharge our health and safety, safeguarding and equality and diversity obligations
   

What other organisations do we share your information with?

We may share your personal information with our service providers/​data processors so that they can carry out work on our behalf. Whenever we engage a third party to act on our behalf we ensure that the contract we enter into with them requires them to comply with UK data protection laws, to process your information only for the purposes we specify and to make sure they have the appropriate controls in place to protect the security of your information.

Examples of service providers/​data processors include: –

• Any organisations that assist us with events that we are holding that you may be volunteering at
• The disclosure and barring service in order to carry out a criminal record check if required for your role
• Retail providers in order to send you recognition gifts i.e. flowers

We may also share your personal data with partner organisations that are working with us to deliver our volunteering. For example:

• The NHS trust Occupational Health team if you declare that you have a health condition before you volunteer
• Reporting that you have volunteered with us to The Duke of Edinburgh Award if applicable
   

How long do we keep your information?

We only keep your information as long as we need. Subject to any other relationship you have with us, we will retain volunteer data for 6 years.

The individual support we receive from gifts in wills is a vital income stream for the Charity and provides our generous supporters with an opportunity to leave a lasting legacy. We value not only the support of legacy pledgers who have actively chosen to confirm a gift for the Charity in their will, but also the support of individuals who have expressed an intention to leave the Charity a legacy, and individuals that have enquired about the process.

What personal information do we collect?

The personal information we collect from you may include:

• Your title, name, address and contact information (telephone number(s) and/​or email address(es))
• Your date of birth
• Your background and family situation
• Photographs
  Details of your donations, including Gift Aid information, and financial data relating to donation payments. For example, if you donate by direct debit or standing order, we keep bank account details to set up and collect payments. If you wish to donate by credit card or debit card, your card details are collected in order to process your payment.
• Records of your communications with us
• Information gathered through surveys or forms you have filled out
• Your IP address(es) and information relating to what pages have been viewed and any information volunteered by you when your browse our website, and we may also track if you are opening and engaging with the service emails we send you.
   

What about special category data?

Certain categories of personal information are recognised in law as sensitive, including health information and information regarding race and religious beliefs (‘special category data’) and personal data relating to criminal convictions and offences.

We do not routinely collect special category data of individuals that may have decided to leave us a legacy in their will but when we do, there is a clear reason for doing so.

How do we collect your personal information?

When you give it to us directly

We collect personal information that you may provide to us including when you:

• enquire about how to leave a gift in your will, or
• tell us that you intend to gift us a legacy in your will

When you give it to us indirectly

We may receive information from legacy notification services (e.g. Smee & Ford) about a legacy gift for the Charity and that information may contain personal data of beneficiaries or executors of that estate.

We also use the information you provide in an anonymised form to: -

• Monitor and evaluate the impact of our research programmes
• Refine and improve our services
• Produce reports such as our annual report or reports for donors
   

How do we use your information and what is our legal basis for processing it?

We will only process your information if we have a legal basis for doing so, including: -

To fulfil a contractual obligation, for example: -

• To facilitate the terms of your volunteering agreement

Where we have a legitimate interest, for example: -

• To administer our internal operations, including the administration of activities involving our partners
   

What other organisations do we share your information with?

Where necessary to administer your gift, we may share your information with out legal advisers, currently Withers Llp
 

How long do we keep your information?

We only keep your information as long as we need. Subject to any other relationship you have with us, we will retain legacy pledger data and data for legacy intenders and enquiries for 90 years. Financial data and records relating to the estate administration for a confirmed legacy (which may include the personal data of beneficiaries and executors of the estate) are retained for 7 years from the date of death.

What personal information do we collect?

The personal information we collect from email subscribers may include:

• Your title, name, address and contact information (telephone number(s) and/​or email address(es))
• Your date of birth
• Details of your donations, including Gift Aid information, and financial data relating to donation payments. For example, if you donate by direct debit or standing order, we keep bank account details to set up and collect payments. If you wish to donate by credit card or debit card, your card details are collected in order to process your payment.
• Records of your communications with us
• Information gathered through surveys or forms you have filled out
• Your IP address(es) and information relating to what pages have been viewed and any information volunteered by you when your browse our website, and we may also track if you are opening and engaging with the service emails we send you.

In addition to the above, when you visit our website we use cookies to improve your experience and personalise the service you receive. See our cookies policy for more information.

What about special category data?

Certain categories of personal information are recognised in law as sensitive, including health information and information regarding race and religious beliefs (‘special category data’) and personal data relating to criminal convictions and offences.

We do not routinely collect such information about our email subscribers unless that information has been manifestly made public by you. If we do need to collect special category data, we will only do so when we have a legal basis and that legal basis will be supported by a condition for processing.

How do we collect your personal information?

When you give it to us directly

We collect personal information that you may provide to us including when you:

• confirm your subscription to receive our newsletter emails; or
• respond to any invitations included in those emails

When we collect it as you use our website

We collect information about the services you use and how you use them in a number of ways, including:

• When you visit our website, including through the use of cookies, we may automatically collect information about your equipment, browsing actions and patterns. See our cookies policy for more information; or
• When you view and interact with our emails and content
   

How do we use your information and what is our legal basis for processing it?

We will only process your information if we have a legal basis for doing so, including: –

Where you have granted us consent, for example: –

• To contact you if you subscribe to our mailing list with marketing emails, newsletters and updates, and/​or information on our research activities
• To let you know about our programmes and any events that we may be hosting
   

Where we have a legitimate interest, for example: –

• To improve our services to ensure that any content is presented to you in the most effective manner for you

We also use the information you provide in an anonymised form to: –

• Monitor and evaluate the impact of our programmes
• Refine and improve our services
• Produce reports such as our annual report or reports for donors
   

What other organisations do we share your information with?

We may share your personal information with our service providers/​data processors so that they can carry out work on our behalf. Whenever we engage a third party to act on our behalf we ensure that the contract we enter into with them requires them to comply with UK data protection laws, to process your information only for the purposes we specify and to make sure they have the appropriate controls in place to protect the security of your information.

For our email subscribers, we share your personal information with our email distribution service provider that sends out and helps us tailor our emails, and we will not share it with any other third parties without your explicit consent.

How long do we keep your information?

We generally keep any information we hold about our email subscribers for as long as they are subscribed to our emails. However, we are required to keep a minimal amount of your personal information (your name and email address) if you indicate that you do not wish to be contacted for email communication purposes to ensure that we stop sending you marketing emails unless you request to receive them again in the future.

What personal information do we collect?

Our Board of Trustees have overall control of the Charity and lead it to ensure that its activities are aligned to its charitable objectives. The personal information we collect may include:

• Your title, name, address and contact information (telephone number(s) and/​or email address(es))
• Your date of birth
• Your nationality and ethnicity
• Your profession, professional qualifications and related information (e.g. your job title, employer, professional history, any business interests etc)
• Photographs
• Records of your communications with us
   

What about special category data?

Certain categories of personal information are recognised in law as sensitive, including health information and information regarding race and religious beliefs (‘special category data’) and personal data relating to criminal convictions and offences.

We do not routinely collect such information about our Trustees unless that information has been manifestly made public by them. If we do need to collect special category data, we will only do so when we have a legal basis and that legal basis will be supported by a condition for processing.

How do we collect your personal information?

When you give it to us directly

We collect personal information that you may provide to us including when you:

• complete trustee appointment documents;
• provide identification documents
   

When you give it to us indirectly

When appointed as a Board member we may collect references prior to approving your application.

How do we use your information and what is our legal basis for processing it?

We will only process your information if we have a legal basis for doing so, including: –

To fulfil a contractual obligation, for example: –

• To administer trustee indemnity insurance;

Where you have granted us consent, for example: –

• To request references
   

Where we have a legitimate interest, for example: –

• To improve how we engage and communicate with trustees, including in relation to confidential matters

Where we are required by law to process your information, for example: –

• To comply with our obligations under charity law
• We may need to disclose your details to regulatory bodies or legal advisors if required. Our regulatory bodies include HMRC, the Charity Commission, Companies House, the Information Commissioner’s Office and the Fundraising Regulator
   

What other organisations do we share your information with?

We do not share your information with third parties other than:

• Registering trustees with the Charity Commission and as directors of the Charity, and potentially its subsidiaries, with Companies House.
• Listing trustees on our external website, including a personal biography
   

How long do we keep your information?

We only keep your data for as long as necessary for the purposes set out in this Privacy Policy. The retention period will vary according to the nature of the purpose under which the information is held. For example:

• We must retain minutes of meetings indefinitely
• We retain any general correspondence for a minimum of 10 years.

What personal information do we collect?

The personal information we collect may include:

• Your title, name, address and contact information (telephone number(s) and/​or email address(es))
• Your date of birth
• Your nationality and ethnicity
• Records of your communications with us
• Information gathered through surveys or forms you have filled out

Should you be successful in your application for a post at the Charity you will be provided with an employee privacy notice as part of the contract negotiation process.

What about special category data?

Certain categories of personal information are recognised in law as sensitive, including health information and information regarding race and religious beliefs (‘special category data’) and personal data relating to criminal convictions and offences.

We may collect special category data in order to discharge our equality and diversity obligations. We will only collect special category data when we have a legal basis to do so and that legal basis is supported by a condition for processing.

How do we collect your personal information?

When you give it to us directly

We collect personal information that you may provide to us including when you:

• fill out a job application form
• send your CV along with a covering letter
• provide identification documents

When you give it to us indirectly

We only collect personal data about job applicants indirectly if it is being passed to us by a recruiter or via a reference request.

How do we use your information and what is our legal basis for processing it?

We will only process your information if we have a legal basis for doing so, including: –

Where you have granted us consent, for example: –

• To request references

Where we are required by law to process your information, for example: –

• To comply with our obligations under charity law
• To comply with our health and safety, and equality and diversity obligations
• We may need to disclose your details if required to regulatory bodies or legal advisors (our regulatory bodies include HMRC, the Charity Commission, Companies House, the Information Commissioner’s Office and the Fundraising Regulator)
   

What other organisations do we share your information with?

We may share your personal information with our service providers/​data processors so that they can carry out work on our behalf. Whenever we engage a third party to act on our behalf we ensure that the contract we enter into with them require them to comply with UK data protection laws, to process your information only for the purposes we specify and to make sure they have the appropriate controls in place to protect the security of your information.

Examples of service providers/​data processors include: –

• Recruitment agencies
   

How long do we keep your information?

We only keep your data for as long as necessary for the purposes set out in this Privacy Policy. The retention period will vary according to the nature of the purpose under which the information is held. For example:

• Interview notes and supporting documentation will be kept for 6 months
• If applicants are successful we will keep information for 6 years, however some information such as Pension and HRMC and Home Office documents will be kept longer