Privacy Policy Family for Every Child respects your rights over your personal data. Who are we? The processing of your personal data is carried out by or on behalf of Family for Every Child. Family for Every Child is a registered charity in England and Wales (1149212) and a registered company in England and Wales (08177641). Family for Every Child New Zealand Trust is a registered charity in New Zealand (CC54645) and registered trust in New Zealand (2670471). Family Alliance is an incorporated tax exempt I.R.S 501c(3) non-profit organization, and registered under New York State Section 402 of the Not-For-Profit Corporation Law. We refer to all the above organisations throughout this policy collectively as ‘Family for Every Child’ or ‘We’. Who does this Policy apply to? This Policy applies to all personal data processed by Family for Every Child about its members, supporters and members of the public. This includes data gathered via third parties, such as social media sites, and which is therefore also covered by their own Privacy Policies. This Privacy Policy does not apply to personal information that we collect from you if you apply for a job or volunteering opportunity with Family for Every Child or become an employee or volunteer. This Privacy Policy outlines: How we collect personal data about you How we use your personal data Why we are allowed to process your personal information The circumstances under which we may share your personal data or disclose to others Additional details about cookies and technical information How we protect your personal information How long we keep your personal information Your rights over personal data How to contact us Where this Policy refers to ‘personal data’, it is referring to data about you (or other living people) from which you (or they) could be identified - such as a name, date of birth or contact details. This Policy was last updated in July 2019. Any updates will be posted to this version of the Policy. If you wish to see previous versions of the Policy, or have any questions, please get in touch. In New Zealand we abide by the New Zealand Privacy Act (Dec 2020), we closely follow the thirteen Privacy principles outlined in the Act. For more information on this email: info@familyforeverychild.org.nz How we collect personal data about you Family for Every Child may collect personal data directly from you via means such as: In person, when you speak to one of our staff or representatives Through a telephone call, either where you call us or we call you On paper, such as if you return a printed survey, application form, or a reply slip on a leaflet Digitally, such as if you fill in a form on a website or interact with Family for Every Child online When you enter into a transaction with Family for Every Child, such as donating or purchasing merchandise Indirectly from other public records or sources On social media platforms, where you have made the information public, or you have made the information available in a social media forum run by Family for Every Child We may collect personal data about you such as: Name Contact details (e.g. email address, postal address, telephone / mobile number) Date of birth Future communication preferences Information about your financial transactions with Family for Every Child including bank account details for setting up a regular direct debit or credit card details for processing card payments Employer details for processing a payroll gift Taxpayer status for claiming UK Gift Aid Demographic information Issues you raise Topics you are interested in Under data protection law, certain categories of personal information are recognised as sensitive, including health information and information regarding race, religious beliefs, and political opinions (‘sensitive personal data’). In limited cases, we may collect sensitive personal data about you. We would only collect sensitive personal data if there is a clear reason for doing so, such as where we need this information to ensure that we provide appropriate facilities or support. We may also collect aggregated or anonymous information when you interact with Family for Every Child digitally, such as by visiting one of our websites or communicating with one of our social media channels. This may include additional data to the above, such as: Your IP address Your device, browser or operating system Details of the links that you click and the content that you view Your username or social media handle Any other information you share when using third party sites (e.g. sending a tweet or using the Like function on Facebook). We may also place one or more cookies on your device. For further details on this, see below. We may also collect and process information about your interactions with us, including details about our contacts with you through email, SMS, post, on the phone or in person, details about donations you make, events or activities that you register for or attend and any other support you provide to us. We may also collect and record any other relevant information you share with us about yourself, including your interests or your affiliations with other charities, community groups, your employer, or a Family for Every Child member. If you are a minor, we may collect the name and contact details of a parent or guardian and, where appropriate, the name and location of your school. We may also receive information about you when you interact with third party service providers with whom we work. For example, where you’ve made a donation to us through a third-party website and given them permission to share your information with us. We may also collect information about you from other public sources or commercially available sources. We only do so where those sources are lawfully permitted to share the data with us and where we have a legal basis to process data from such sources. This may include, for example, checking the eligibility of a potential donor, screening data to ensure that we have the most up-to-date contact details, ensuring that our communication with you is relevant and tailored to your background and interests. We may collect information about you from publicly available sources either directly or through third-party subscription services or service providers. We may also carry out research using publicly available information to identify individuals who have an affinity to our cause but with whom we are not already in touch. Where we have identified that you may have the capacity or affinity to support Family for Every Child we may use the information we hold about you to identify connections between you and our existing supporters. We may review other information about you that is available to the public through internet searches, social networks, such as LinkedIn, subscription services, news archives or public databases (e.g. political and property registers), such as information about corporate directorships, shareholdings, published biographic information, employment and earnings, philanthropic interests and networks, charitable giving history and motivations and relevant media coverage, so that we can engage with you in a more personalised way. How we may use your personal data We may use your personal data to further our objectives, share it with our members and/or contact you in the future. Examples of the way we may use your data include to: Inform you of our work and the different ways in which you can help Ask you to support specific activities Process donations we may receive from you Understand your view and issues important to you Process surveys you have participated in Respond to queries that you raise with us Conduct fundraising activities, including checking your eligibility to donate Manage our site and services Update you on the work of the Family for Every Child, as well as wider sector opportunities and news Internal record keeping relating to any donations, feedback or complaints Invite you to events Contact you where you have been identified as a contact person for an organisation, including one of our members (if we obtain your contact details in this way, we will only use them to contact you in your capacity as a representative of that organisation unless you have separately indicated that you are happy to be contacted as an individual supporter) For more specific information about how we use your data for these activities, and the legal basis on which we rely to process your data in this way, please see the ‘Why we are allowed to process your personal information’ part of this Policy. If you have provided us with your email, mobile or landline phone number and we have a legal right to use them for such purposes, we may use that information to contact you to promote causes and campaigns that we are running, such as by sending you an email, online advert, or a text message. You may opt out of communication from us at any time. Depending on how and why you provide us with your personal data, it may be shared within Family for Every Child (i.e. individuals from member organisations with other members) or with companies that provide services to Family for Every Child (“service providers”). Why we are allowed to process your personal information Our Privacy Policy takes into account several laws, including the: UK Data Protection Act 2018 Privacy and Electronic Communications (EC Directive) Regulations 2003 General Data Protection Regulation (EU) 2016/679 Generally, our processing of your personal information as described in this Policy is allowed by these laws based on one or more lawful grounds, including: Where you have provided your consent to us using your personal information in a certain way. For example, we only use your information to send you marketing communications by email or text with your consent. We also may ask for your explicit consent if you share sensitive personal information with us. Where the processing is reasonably necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering a contract. Where the processing is reasonably necessary to comply with a legal obligation to which we are subject. For example, we may rely on this basis where we are obliged to share your personal information with a regulator or tax authority. Where the processing is reasonably necessary for the purpose of a legitimate interest pursued by us or a third party and your privacy rights do not override the legitimate interest. Our “legitimate interests” include pursuing the aims and ideals of Family for Every Child through the work we do with our members to achieve our charitable aims and fundraising. However, "legitimate interests" can also include your interests, such as when you have requested information from us and those of third parties, such as our members. For example, we rely on legitimate interests for activities such as sending marketing communications by post or telephone unless you have told us that you would prefer not to hear from us in this way, contacting you as a representative of a member organisation or other organisation about organising an event, and analysing your interaction with us to improve our internal business processes. In any event, where we are relying on legitimate interests to process your personal information, we will consider any potential impact on you (positive or negative), your rights under data protection laws, and we will not use your personal information for activities where the impact on you overrides the legitimate interests in the processing. Where we process sensitive personal data (as mentioned above), we will make sure that we only do so in accordance with one of the additional lawful grounds for processing that type of data, such as where we have your explicit consent or you have made that information manifestly public. The circumstances under which we may share your personal data or disclose it to others Family for Every Child will not sell your personal data to third parties. Depending on how and why you provide us with your personal data it may be shared within Family for Every Child (e.g. member’s information shared with other members). It may also be shared with those who provide services to the Family for Every Child (“service providers”). We may use service providers to undertake processing operations on our behalf to provide us with a variety of administrative, statistical, advertising and technical services. We will only supply service providers with the minimum amount of personal data they need to fulfil the services we request. We oblige all of our data processors to sign contracts with us that clearly set out their commitment to respecting individual rights, protecting your personal data – including not using it for any purpose other than providing us with an agreed service or fulfilling their legal obligations - and their commitments to assisting us to help you exercise your rights as a data subject. With your consent, service providers may hold personal data about you in order to facilitate the provision of future services or financial transactions to which you have agreed, such as a payment processor retaining your payment details in order to process agreed future payments from you. Please note that some of our service providers are based outside of the European Economic Area (the “EEA”). Where we transfer your data to a service provider that is outside of the EEA we seek to ensure that appropriate safeguards are in place to make sure that your personal data is held securely and that your rights as a data subject are upheld – in almost all cases we do this by ensuring that the agreements between us and our chosen service providers contain what are called the ‘model clauses’ that oblige them to treat your personal data as if they themselves were based in the EEA. In addition, we may share your personal data with third parties when we are required to do so by law (for example, with the Police where they ask us to assist them with their investigations). In some cases, this may result in your personal data becoming public. However, except in the limited circumstances noted above, we will never pass your personal data to any unrelated third parties (not service providers) unless you have given us your permission to do so. Where you have agreed to receive email or SMS marketing communications from us, we may provide your email address or mobile phone number in an encrypted format to social media companies, such as Facebook, Instagram, Twitter or YouTube, or digital advertising networks that are providing services to us by displaying our advertising to you on those social media platforms and other websites, as well as identifying audiences with interests similar to yours. You can opt out of your data being used to display advertising to you by contacting our Supporter Care Team or our Data Protection Officer as described below. However, opting out will not prevent our advertisements being shown to you on a randomised basis or based on cookie data and it may mean that you stop receiving marketing communications from us more generally. Additional details about cookies and technical information A cookie is a small text file placed on your device when you visit a website. You can accept or decline cookies through your browser settings or other software. When you visit one of our websites, we may place one or more cookies on your device. These are for purposes which include: Improving your experience of visiting the site, including providing personalised content Gathering information you have submitted via the site Processing requests for information or action that you have made through the site Processing login requests Enabling your activity in one place to be used to decide on what information, if any, to present to you in other places Gathering statistical information about the usage of the site Ensuring the smooth operation of online services Remembering whether or not you have been shown a cookie notification message on an earlier visit to the site Making sure online adverts you may receive from us are relevant to your interests. By using one or more of our sites, you are consenting to our use of cookies in accordance with this Policy. If you do not agree to our use of cookies, then you should set your browser or other software settings accordingly. We may provide links to third party organisations with whom we have affinity arrangements, such as an online retailer. In such cases additional cookies may be placed to facilitate this arrangement and the third parties may also gather personal data about you in line with their own privacy policies. If a third party shares any personal data gathered in this way with Family for Every Child, this will be made clear in its own privacy policy. We may also provide options to share content on social media which may result in you being directed to the social media network’s own systems. If you proceed with this, those networks may gather personal data about you in line with their own privacy policies. On our websites or in other digital communications we may also use technologies variously described as web beacons, pixel tags, clear gifs or tracking pixels to provide us with information about how people have navigated through the site or responded to the communication. How we protect your personal information We take appropriate physical, electronic and managerial measures to ensure that we keep your information secure, accurate and up to date, and that we only keep it as long as is reasonable and necessary. Although we use appropriate security measures once we have received your personal information, the transmission of information over the internet is never completely secure. We do our best to protect personal information, but we cannot guarantee the security of information transmitted to our website, so any transmission is at the user’s own risk. However, any payment card details (such as credit or debit cards) we receive on our website are passed securely to our payment processing provider. For financial and technical reasons, we may, on occasion, need to use the services of a service provider outside the European Economic Area (EEA) – this may include a country which does not have the same level of data protection as in the United Kingdom. However, we will only use a service provider outside the EEA on the basis of an agreement with the service provider, designed to protect your data – please contact our Data Protection Officer if you would like to see a copy of any of these agreements. We will take all steps reasonably necessary to ensure that your data is processed securely and in accordance with this Privacy Policy. How long we keep your personal information We will keep and delete your information according to our internal policies and will keep it no longer than reasonably necessary for the purposes for which we hold it, taking into account relevant legal and regulatory retention requirements (e.g. tax or health and safety requirements) and operational considerations. Your rights over personal data You have legal rights over any of your personal data that we hold. Right of access You may, at any time, request access to the personal data that we hold which relates to you (sometimes called a subject access request). This right entitles you to receive a copy of the personal data that we hold about you. It is not a right that allows you to request personal data about other people, or a right to request specific documents from us that do not relate to your personal data. Right to rectification and erasure You may, at any time, request that we correct personal data that we hold about you which you believe is incorrect or inaccurate. You may also ask us to erase personal data if you do not believe that we need to continue retaining it (sometimes called the right to be forgotten). Please note that we may ask you to verify any new data that you provide to us and may take our own steps to check that the new data you have supplied us with is accurate. Further, we are not always obliged to erase personal data when asked to do so; if for any reason we believe that we have a good legal reason to continue processing personal data that you ask us to erase, we will tell you what that reason is at the time we respond to your request. Right to restrict processing Where we process your personal data on the legal basis of us having a legitimate interest to do so, you are entitled to ask us to stop processing it in that way if you feel that our continuing to do so impacts on your fundamental rights and freedoms or if you feel that those legitimate interests are not valid. You may also ask us to stop processing your personal data (a) if you dispute the accuracy of that personal data and want us to verify its accuracy; (b) where it has been established that our use of the data is unlawful but you do not want us to erase it; (c) where we no longer need to process your personal data (and would otherwise dispose of it) but you wish for us to continue storing it in order to enable you to establish, exercise or defend legal claims. If for any reason we believe that we have a good legal reason to continue processing personal data that you ask us to stop processing, we will tell you what that reason is, either at the time we first respond to your request or after we have had the opportunity to consider and investigate it. Right to portability Where you wish to transfer certain personal data that we hold about you, which is processed by automated means, to a third party, you may write to us and ask us to provide it to you in a commonly used machine-readable format. Right to stop receiving communications Wherever possible, we will provide you with a choice about how we can contact you to share information about Family for Every Child. You can opt out of communications at any time. It may take several days for requests submitted this way to become effective on our systems, or by the methods described below. While all of our direct marketing communications contain details of how you can stop receiving them in the future you can either follow those instructions (such as using the unsubscribe link in an email or telling a telephone caller), or ask us directly using the contact details below. If you do the latter, please provide us with full details of the telephone numbers, postal addresses, email addresses and so on to which you wish us to stop sending communications to in order to help us deal with your request quickly and accurately. We will process any requests to stop receiving communications as quickly and comprehensively as is practical although there may in some cases be further communications already on their way to you which cannot be stopped. If you ask us to stop sending you information (e.g. by email, post, phone or SMS text), we may keep a record of your information to make sure we do not contact you again, up until the normal retention period for that type of data. Please note that this right to stop communications does not apply to emails that we send to you that are a necessary part of us providing a service to you (such as messaging you about your status as a member or donor) or us notifying you about how your personal data is being used. Email If you provide us with your email address and indicate that we may do so (e.g. by subscribing to an email distribution list or by ‘opting in’) we may send you further information about Family for Every Child in the future. These communications will take the form of emails promoting us and our work. You can request that you cease to receive these kinds of communications from us at any time. The easiest way to do so is to use the unsubscribe link provided at the bottom of any email messages that we send to you. SMS messaging If you provide your mobile phone number, we may call or send you SMS messages if you have given us permission to do so. You may request to stop receiving SMS messages at any point. You can stop receiving SMS text messages by following the instructions to opt out provided within that text message. It may take several days for requests submitted this way to become effective on our systems. Online advertising If you provide us with your email address or telephone number we may use it to ensure online adverts you receive from us are relevant to you. These communications will take the form of online adverts promoting us and our work. You can opt out of online advertising at any time. It may take several days for requests submitted this way to become effective on our systems. We will have to share your data with relevant service providers. You may still receive online advertising from time to time where providers are unable to remove you from lists or their systems do not permit exclusion lists. Exercising your rights When you contact us making a request to exercise your rights we are entitled to ask you to prove that you are who you say you are. We may ask you to provide copies of relevant ID documents to help verify your identity. It will help us to process your request if you clearly state which right you wish to exercise and, where relevant, why it is that you are exercising it. The clearer and more specific you can be, the faster and more efficiently we can process the request. If you do not provide us with sufficient information then we may delay actioning your request until you have provided us with additional information (and where this is the case we will tell you). How to contact us If you have any queries regarding the information set out here, if you wish to exercise any of your rights set out above or if you think that the above processes have not been followed, please contact: Family for Every Child 75 King William Street London EC4N 7BE Email: [email protected] Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behavior of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply: Your data will be made available to our website provider The data that may be available to them include any of the data we collect as described in this privacy policy. Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA. They will store your data for a maximum of 7 years. This processing does not affect your rights as detailed in this privacy policy.