With the changes to General Data Protection Regulations (GDPR), we’re required to clarify what personal information you have provided to us, why we store it and how we store it. All data captured will be used and held in accordance with the requirements of the Data Protection Act 1998. The Act For Change Project (TAFCP) is committed to protecting and respecting your privacy. This policy sets out what personal data we collect from you, or that you provide to us, and how it will be used. Please read it through carefully and if you have any queries please contact firstname.lastname@example.org
Where we collect information from
When you give data to us directly:
- Purchase a ticket, make a donation
- Sign up to our mailing list
- Complete one of our surveys
- Participate in one of our events
- Contact us on one of our online platforms such as (but not exclusively )our website www.act-for-change.com, Twitter, Facebook, Instagram.
- Contact us directly by telephone, electronically, post or in person with feedback
- When you give your consent for filming and/or photography at one of our participatory events
- Purchase items through a third party for one of our events
- Open and/or follow links and interact with emails and marketing you receive
- Interact with us or mention us on social media sites
- Attend a public event when there is a photographer or videographer present
When you give permission to other organisations to share your data, or it is publicly available such as:
- Information publicly available such as Companies House, on the internet or published in newspapers and magazines
- Third party organisations when you have provided permission for your details to be shared. This could be other organisations we have worked with or a purchased list based on your preferences and profile
- Your likes and preferences on social media and some websites (depending on your privacy settings on those platforms)
What we collect and how it is used
Personal data includes your contact details, your contact preferences, details of communications with you, images of you taken at participatory and public events, details of your transactions and your access requirements. This enables us to conduct business with you and provide you with the best service for your needs, and to keep you informed about TAFCP. It may also be shared with selected suppliers who we contract to deliver a service, for example a bulk emailing service to distribute our newsletters.
Sensitive Personal Data
Sensitive Personal Data may be asked for in certain instances; this includes your bank details (if you set up a regular payment), ethnicity, gender identity, medical information and next of kin.
This information is available to a restricted number of the team for whom it is deemed necessary. It is used to process some transactions, in the case of an emergency, or aggregated and anonymised for monitoring and reporting as required by public funding bodies.
Purposes of use
You give us Personal Data, such as your name and contact details and on some occasions your date of birth so we can administer purchases (tickets, subscriptions, merchandise and donations) made online, in person or over the telephone. If you choose to save the details of your card for future purchases on your account, these details are captured by Charity Checkout our payment provider, and a token is stored on our system in place of the full card number. All transactions are conducted in accordance with the Payment Card Industry Data Security Standard. More details can be found on this here: https://www.pcisecuritystandards.org/security_standards/index.php.
If you make a donation and choose to make a Gift Aid declaration this will be stored against your record and your contact details shared with HMRC.
We may store notes about your previous bookings and your feedback to enable us to address your needs and requirements for future bookings.
We use Personal Data you give us when you purchase a ticket, merchandise, make a donation, join our mailing list or participate in a class or event to carry out fundraising activity.
If you make a donation, we may ask if you would like your name to be credited in publicity materials and donor attribution boards displayed in public areas at TAFCP events.
We may conduct further research or use profiling or wealth screening techniques to ensure communications are relevant and timely and to provide an improved experience for our supporters. Profiling also allows us to target our resources effectively. We do this because it allows us to raise more funds, sooner, and more cost-effectively than we otherwise would.
When building a profile we may analyse geographic, demographic and other information relating to you in order to understand your interests and preferences. In doing this we may use third party sources. We build a profile using the information you have given us and publicly available information. Data gathered from this research is stored as Personal and Sensitive Personal Data.
You can opt out of your data being used for this purpose at any time by contacting: email@example.com
Electronic and postal
Based on your contact preferences we use your details to keep you up to date about forthcoming events and your purchases at TAFCP. You can opt out of this at any time by contacting firstname.lastname@example.org.
On occasion we may obtain your details from a third party that you have given permission to share your details. If we contact you based on this, we will always state where this information comes from in the first communication and give you a clear opt-out option.
Depending on your device’s privacy settings and those on other websites and apps you use, we may aggregate information you give us directly or indirectly to target online advertising and social media posts.
How a website tracks you depends on the privacy settings on the device you are using and any privacy settings you have set up with individual sites and apps. To find out more about this, what types of tracking we use and how you can opt out.
Reporting and analysis
We use the data you give us directly and indirectly to report on participation at TAFCP and to improve your experience. This reporting is created from aggregated data and is not attributable to individuals.
When you visit our website we may automatically collect technical information about your session including the Internet Protocol (IP) address that connects your device to the internet, the type of device you use, your browser, operating system, whether you made a purchase and from where you have arrived at our site. We do not link this information to anything that identifies individuals. This information enables us to analyse how the website is used, where improvements can be made and to report to funding and public bodies.
We use essential and non-essential cookies on our website. A cookie is a small text file of letters and numbers that gets put onto your computer when you visit a website. This allows the site to distinguish you from other users. Essential cookies are required to login or to purchase items from our website. Non-essential cookies are used to track how you use and interact with our website and for analytical purposes and to monitor the efficacy of digital advertising. Cookies are not normally linked to information that allows us to identify individuals. Alongside cookies we use tracking pixels which follow your activity after clicking a link from a third party site. This does not allow us to personally identify you, but may be used by the third party site.
Surveys and promotions
We carry out promotions and surveys on a regular basis; as part of these we may ask you to disclose personal information. Participation is entirely voluntary and you have a choice whether to disclose Personal or Sensitive Personal Data. The data you supply is aggregated for reporting purposes and not attributed to individuals.
If you apply for a job, work experience or volunteer opportunity at TAFCP, we collect Personal Data and Sensitive Personal Data as part of your application. Your Equal Opportunities form is separated and immediately destroyed once the data has been logged.
How we keep your data safe and who has access
In addition to processing data at TAFCP, we contract external companies to supply services or process data on our behalf such as our donations collector and our bulk email provider. These organisations only hold the data for the reason contracted by TAFCP and do not sell, share or use your data for any other purpose. We carry out comprehensive checks on these companies and take all steps reasonably necessary to ensure that your data is treated securely and in accordance with General Data Protection Regulation (2016) and the Privacy and Electronic Communications Regulations (2003).
While most of our suppliers store data at a destination within the European Economic Area (EEA), it may be transferred outside the EEA. We, and our contractors, use strict procedures and security features to try to prevent unauthorised access to your data. Suppliers that handle financial data as part of your transaction with TAFCP are PCI DSS compliant.
Paper files with Personal and Sensitive Personal Data are kept to a minimum and are stored securely when not in use.
If legally required we may disclose your information to the police, regulatory bodies or legal advisors. We will only share your data in other circumstances with your consent.
If there is a breach of data that is likely to have a detrimental effect on individuals, for example, result in discrimination, damage to reputation, financial loss, loss of confidentiality or any other significant economic or social disadvantage, TAFCP will notify the Information Commissioners Office within 72 hours of becoming aware of the breach. Any individuals affected will also be notified within this timeframe.
Keeping your information up to date
Please let us know when your details change so we can make sure that our information is current. However, we do have other processes in place to ensure that we keep our records up to date:
- If we find a record on our system that matches another one and we are sure it is the same person, we may merge the two accounts so we have all your information in the same place.
- We will deactivate your account if there has been no purchase/donation with an expiry date in the last 10 years and will delete any Sensitive Personal Data.
- Images and film taken of public and participants may be used for up to ten years for marketing and publicity purposes by TAFCP. After this point it will either be deleted, or if deemed to be of historical and public interest, added to our archive.
You can update your contact preferences at any time by contacting email@example.com.
If you wish to amend your data, ask us to stop using your Personal and Sensitive Personal Data for reasons other than processing your transaction, or erase your Personal and/or Sensitive Personal Data please contact us at firstname.lastname@example.org
You have a right to ask for a copy of the information we hold about you. To request this please send an email to email@example.com. We do not make a charge for this, but may charge a reasonable administrative fee if we deem the request to be unfounded or excessive. We endeavour to respond to requests within 30 days.