Hansel Privacy Notice – Fundraising Supporters

How do we use your personal data at Hansel

Hansel Privacy Notice – Our Supporters

How do we use your personal information?

We will only use your personal data as permitted by the UK General Data Protection Regulation (UK GDPR), the UK Data Protection Act and the Privacy and Electronic Communication Regulations (PECR).

This document is intended to outline the purpose of collecting any personal data in a transparent manner in accordance with any preferences you express.

If asked by the police, or any other regulatory or government authority investigating suspected illegal activities, we will need to provide your personal data.

How we use your personal data varies greatly depending on the nature of how you interact with us. This document explains how we use your personal data within our Fundraising & Communications function.

Your support is vital to Hansel. It helps us continue our vision to give people of all abilities the freedom to live the life they choose. Because your support is so important to us we want you to know how carefully we look after your personal details. This privacy notice tells you about our processing of your personal data, the types of personal information we hold, where we get it from, what we use it for, the legal basis for the processing, how we protect it, your rights in regard to this processing and how to make a complaint.

We may hold the following personal information:

Your contact details, such as name, address, phone numbers, email addresses.
Details of how you have supported us in the past, such as which events you’ve attended, donations you’ve made or prizes you have won.
Details of contacts we have had with you, such as letters we’ve sent or received, enquiries you’ve made or meetings you’ve attended.
Your date of birth and gender, if these are relevant to the support you provide, for example for competitions limited to age ranges.
Photographs of you.
Your contact preferences and, where required, your consent for our processing of your data.

Where we get your personal information:

We generally get the information from you directly or our contacts with you.
We may get information from another supporter.
It is possible that we may obtain lists of data from other reputable organisations but this is not something we routinely do.
We may use third-party service providers to provide us with additional information about you from, or inferred or derived from, external sources. This may include change of address if you use a mail redirection service or other publicly available sources.

What we use your personal information for:	Our legal basis for this processing:
· to give you the information, support, services or products you ask for · to do this well by having a full record our communications and relationships with you · to give you this efficiently by being aware of relationships you have with other supporters such as family and friends. · to thank you for your previous support · to invite you to events we believe may be of interest to you · to let you know about changes to our services and policies · to understand how we are performing and to monitor the effectiveness of our fundraising efforts.	Legitimate Interests as defined in article 6 (1) (f) of the UK GDPR tailored by the Data Protection Act 2018
· to meet your dietary and access requirements if you attend our events. This information may reveal information about your health, disabilities or religious beliefs and is considered sensitive and so is subject to additional data protection considerations.	Legitimate Interests as defined in article 6 (1) (f) of the UK GDPR tailored by the Data Protection Act 2018 Consent as defined in article 6 (1) (a) and as required article 9 (2) (a) of the UK GDPR tailored by the Data Protection Act 2018
· to give you information about our work and how you can help us, for example, by sending you our newsletters. Occasionally, we may include information from partner organisations or organisations that support us in these communications. We will adhere to your marketing preferences and you can change these at any time by contacting us or through our online portal.	For electronic communications (including email, phone and SMS): Consent as defined in article 6 (1) (a) of the UK GDPR tailored by the Data Protection Act 2018 and as required by PECR For communications sent by post: Legitimate Interests as defined in article 6 (1) (f) of the UK GDPR tailored by the Data Protection Act 2018
· From time to time we may also use your information, e.g. photographs or quotes, for public relations purposes e.g. press releases, on our website and social media channels. Images taken at events may be used unless you inform us at the event that you don’t want this but we (or the publisher) will seek your specific consent to include any additional personal information (e.g. your name) with a photograph. We would seek consent to use images taken elsewhere.	Consent as defined in article 6 (1) (a) of the UK GDPR tailored by the Data Protection Act 2018.
· If you support us through Gift Aid on your donations we use your personal information to claim Gift Aid from HMRC	Legal Obligation as defined in article 6 (1) (c) of the UK GDPR tailored by the Data Protection Act 2018.
· We may use your personal information to deal with legal claims and similar issues.	Legal Obligation as defined in article 6 (1) (c) of the UK GDPR tailored by the Data Protection Act 2018.
We use profiling techniques to ensure our communications are relevant and timely and to provide the best experience to our supporters. This sort of profiling can include information such as your age, where you live, your job, directorships, your financial circumstances, philanthropic interests, networks and any previous donations you have made. This analysis also allows us to target our resources effectively, better understand how likely it is that you may donate to us and tailor what type and level of support we may ask you for. We also use this information to help us determine if you might be interested in getting involved in our other fundraising activities.	Legitimate Interests as defined in article 6 (1) (f) of the UK GDPR tailored by the Data Protection Act 2018

How we protect your personal data:

Your personal data may be held on paper or electronically. In either case it is protected by a range of technological and organisational means including physical security, use of passwords, firewalls and malware detection, effective Information Governance policies and procedures and through training of our team.
We only retain your personal information for as long as it is needed (as defined by our retention schedule) and we securely destroy it after that.
Your personal information will never be passed to any third party for their own use.
If we share your personal information with a third party as part of our processing, such as if we use a cloud based information management system or an electronic marketing platform, we ensure that the third party meets our standards for protecting your data.
For financial and technical reasons we may, on occasion decide to use the services of a data processor outside the European Economic Area (EEA). This may include countries that the Court of Justice of the European Union considers does not provides an adequate level of protection for personal data. On these occasion we undertake a thorough risk assessment to determine whether additional safeguards are required to provide adequate protection for your personal data. For example, we use Mailchimp, which is hosted in the USA, as our electronic marketing platform.

Your rights:

To be informed about the processing of your personal data. This is what this document is doing.
To have access to your personal data. If you want to know what information we hold just ask.
To have any inaccuracies or omissions corrected. We do our best to get it right but please let us know if we have got something wrong.
To have your personal data erased. This is sometimes known as the right to be forgotten.
To restrict the processing of your personal data.
To obtain and reuse your personal data. If you want a copy of the data you’ve provided to us we’ll give you a computer readable file of it.
To object to the processing of your personal data where our legal basis is Legitimate Interests.
To withdraw your consent at any time.

There are restrictions on these rights but we will always honour both the letter and the spirit of the law. To exercise any of these rights please write to us at Fundraising & Communications Dept, Hansel, Murdoch House, Broadmeadows, Symington, KA1 5PU, phone us on 01563 830340 or email dpo@hansel.org.uk. You can also contact us through our website, www.hansel.org.uk.

Complaints:

If you are unhappy about any aspect of our processing of your personal information please contact the Data Protection Officer using the details above. You can also complain directly to: Information Commissioners Office – Scotland, 45 Melville St, Edinburgh, EH3 7HL.