Why does Back Up need personal information?
At Back Up, it’s our job to inspire people affected by spinal cord injury to get the most out of life. We use personal information to ensure we provide the best possible support to our service users and our donors. It helps us to contact you in the most appropriate way with information that is important to you.
You are under no obligation to provide us with personal data but ultimately, your information will help us to give you the best possible service.
This policy was last reviewed on 01/04/2022.
What information do we collect?
Information we collect may include:
If you are enquiring about our services, we may ask you details of a sensitive nature about your injury, health and mental wellbeing to ascertain how we might best be able to support you.
How do we collect your information?
We do not buy data from 3rd parties.
We collect information about you directly whenever you interact with us. For example, when you contact us regarding our services, register as a supporter, send or receive information, engage with our social media or make a donation to us, you may provide us with your personal information.
We may also receive information about you when you interact with third parties with whom we work. For example, where you’ve made a donation to us through a third-party website (e.g., Just Giving, Enthuse, Facebook) and given them permission to share your information with us.
We may receive your information from other partner organisations, (such as Aspire or the NHS), if you have specifically given them consent to pass your details on to us. You can find more details about this on the Aspire website.
We may receive information about you from NHS England where you have given them consent to share with us. This will be limited to your name and contact details which we will use to contact you about our services.
In order to ensure that our communication with you is relevant and tailored to your background and interests, we may supplement what we know about you with information that is available to the public. This allows us to better understand your interests, preferences, and level of potential engagement and/or donation, so that we can contact you in the most appropriate way and to ensure that we do not send you unwanted communications.
We may collect information about what interests you when you visit our website or interact with our e-newsletters and other online content.
For some digital content, such as our app or e-learning modules, we may offer you the opportunity to share your name and email address to enable you to save your place and return later. Where this option is given, the purpose will be made clear to you and/or an option given to continue without providing this information. Where we request any additional information, such as your telephone number, the purpose will be made clear and this information will only be used for this purpose unless you provide further consent for it to be used in other ways.
How is this information kept?
We securely store and process this information on a database. We make sure nobody has access to your information who shouldn’t have access to it.
How long is the information stored for?
Under new data legislation, everyone has “the right to be forgotten”. We will only keep your data as long as is reasonable and necessary. We also have a legal obligation to retain some types of data for set periods of time. If you would like to understand more about how long we retain data, you can request a copy of our data retention schedule by contacting us using the details below.
We will retain your information for 7 years to comply with legislation surrounding gift aid but if we have had no interaction with you after this time has passed, we will delete all personal information we store on you.
When you provide us with consent to contact you, we will regularly give you the opportunity to update or revoke that consent.
Do you share my personal data with any 3rd parties?
We will never sell your details to other organisations.
We may need to share your information with data hosting providers or service providers who help us to deliver our services, projects, or fundraising activities and appeals. These providers will only act under our instruction and are subject to pre-contract scrutiny and contractual obligations containing strict data protection clauses.
We may use your data for specific marketing through 3rd parties such as social media, this could include a specific social media marketing campaign using your email address.
We use 3rd party services such as printers and email service providers to assist with mailings and we provide them with encrypted files of names/addresses/email addresses. We enter into contracts with all these service providers that require them to comply with data protection laws and to ensure that they have appropriate controls in place to protect the security of your information.
We will specifically ask you if you consent to us sharing your details with partners or other charities for the purposes of offering services or support that may be of interest to you. Such services will complement ours and our partnerships allow us to maximise our support for people with a spinal cord injury.
If you attend one of our courses, we may provide your data to volunteer group leaders so they can manage your needs and aspirations on the course in order to maximise the impact of our services. This data will also be used to manage your care needs (if you have them) on the course.
If you enter into a mentoring relationship, we may provide information to your mentor regarding your background, your needs and your expectations in order to maximise your outcomes from the partnership. We may also share your data with trained volunteers for the purposes of evaluating our services.
If you engage with our education service, we may use your basic details to contact education establishments on your behalf. We will always ask your permission before sharing sensitive data with an education establishment.
If you attend one of our overseas courses, we may share your care needs with our travel and accommodation partners in order to ensure that adequate care is in place for your travel and stay.
Whenever we share data, we undertake data protection impact assessments to ensure that your data is safe and secure, and to make sure you are able to exercise your legal rights under the Data Protection Act 2018.
If you take part in one of our fundraising challenges or events, we may share personal details with venue and third-party event organisers to ensure your safety and that your needs are met. We enter into contracts with these organisations to ensure your data is secure.
We share anonymised data, without names, addresses or personal details, to funders or potential funders to demonstrate the impact of our services. Where we have your explicit permission, we may also use names and photos to support our funding applications.
How do we use your information?
We may use your information in a number of ways to fulfil a contractual or legal obligation, or where we feel it is in your vital interests, including:
We may contact you for marketing purposes by email or text message if you have agreed to be contacted in this manner. We may also send you service communications via email or text, for example where you place an order for goods or services on our website, or you have made a donation by text.
If you have provided us with your postal address or telephone number, we may send you information about our work or other communications of the kinds described above by direct mail or contact you by telephone unless you have not consented to be contacted in this way. We provide information about how you can change your marketing preferences below.
In some circumstances, we may feel we have legitimate interest to contact you when you have not specifically given us permission to do so. We take your preferences seriously so we have given a lot of thought to how you might feel receiving communications like these. In some cases, we feel it would be strange not to contact you e.g., to thank you for a donation. In other cases, we feel we have a legitimate interest which is not overridden by your personal preferences. We may still contact you in the following circumstances:
Building profiles of supporters
Our vital work is only made possible through the incredible generosity of our supporters; therefore, we need to ensure our fundraising is as effective as possible. Developing a greater understanding of our supporters through researching them using publicly available sources we can tailor and target our fundraising events, communications and volunteering opportunities. This allows us to be more efficient and allows us to reduce the risk of someone receiving inappropriate information.
What information do we collect?
We use information we hold on supporters to research their potential to be a significant donor to Back Up, this includes collecting additional details relating to their employment and any philanthropic activity. We may also estimate their gift capacity, based on visible assets and history of charitable giving and how connected they are to Back Up.
Which information do we use?
We use existing data on our own database and combine this with publicly available information. We only use reputable sources where someone would expect their information may be read by the public. We avoid any data that we believe has not been lawfully or ethically obtained, and we do not use information sources which have not been broadcast or made public.
We want to always ensure you are in control of your data and you’re free to opt out of this activity at any time. Please contact the Data Protection Officer.
Do we process ‘sensitive’ personal information?
If you enquire about and/or access our services, we collect information about your health, physical and mental welfare in order to tailor the service we provide to best suit you.
We collect information about ethnic background, religion, age, marital status, and sexual orientation in order to track which sections of the population we are reaching.
We collect sensitive personal information where we need this information to ensure that we provide appropriate facilities or support to enable you to participate in an athletic event like a marathon.
Can I have access to the information you hold about me?
Yes. You can make a written request to access all the personal information we hold about you.
Who do I contact about the information you hold on me?
The Data Protection Officer
Address: Back Up
4 Knightley Walk
Phone: 020 8875 1805
If you let us know about any information that is inaccurate or incorrect, we’ll correct it.
How can I withdraw my consent to processing my personal data?
If you do not wish us to use your personal data for marketing purposes, you can use the relevant box on our forms to indicate your preferences when you initially provide us with your details.
At any subsequent time:
You can enter your details on the Fundraising Preference Service (FPS) website. Once you have made a request through the FPS, we will ensure that your new preferences take effect within one calendar month of your request
If you have indicated that you do not wish to be contacted for marketing purposes, we will maintain your details on a suppression list. However, we may still need to contact you for administrative purposes, including (but not limited to):
If your contact details have changed, you can always update or correct the information we hold about you by contacting the Data Protection Officer at the address listed above.
Similarly, if you have more specific requests about how we use your data, you can contact the Data Protection Officer.
What other data protection rights do I have?
You can make a complaint or raise a concern about how we process your personal data by contacting our Data Protection Officer. In some circumstances, you have the right to object to our processing of your personal data or to stop us from continuing to make active use of personal data that we retain in our records. Please see our complaints policy here.
If you are not happy with how we have handled your complaint, you can contact the Office of the Information Commissioner, which oversees the protection of personal data in the UK, or the Fundraising Regulator, which is responsible for overseeing fundraising activities carried out by charities in the UK.
If you would like to contact the Information Commissioner, please use our reference number Z6130006. To contact the Information Commissioner’s Office please either call 0303 123 113 or visit https://ico.org.uk/make-a-complaint/.
Alternatively, you may choose to contact either the Information Commissioner or the Fundraising Regulator directly about your complaint, regardless of whether you have raised it with us first.
Job and volunteer applicants and current and former employees
If you apply to work at Back Up, we will only use the information you give us to process your application and to monitor recruitment statistics. If we want to disclose information to someone outside Back Up – for example, if we need a reference or need to get a ‘disclosure’ from the Disclosure and Barring Service (DBS) – we will make sure we tell you beforehand.
If you are unsuccessful in your job application, we will hold your personal information for 1 year after we’ve finished recruiting the post you applied for. After this date we will destroy or delete your information.
If you begin employment with us, we will put together a file about your employment. We keep the information in this file secure, and will only use it for matters that apply directly to your employment.
Once you stop working for us, we will keep this file for 6 years from your leaving date.
Your credit/debit card information
If you use your credit or debit card to donate to us, buy something or make a booking online, we pass your card details securely to our payment processing partner as part of the payment process. We do this in accordance with the Payment Card Industry Security Standard, and don’t store the details on our website or databases.
Emails aren’t always secure, and they may be intercepted or changed after they’ve been sent. Back Up doesn’t accept liability if this happens. The contents of emails reflect their author’s views and not necessarily those of Back Up.
Please do not send Back Up any financial data through email.
The information in emails is confidential, so if you’ve received one by mistake, please delete it without copying, using, or telling anyone about its contents.
Do you take photos of service users?
Yes, we take photographic images (moving and still) on our courses and activities to enhance and illustrate our communications.
Do I have to have my photo taken?
No, this is not a pre-condition of accessing any service or partaking in any Back Up activity. We will always ask for your consent before taking photos and there is no expectation for you to provide it if you do not wish to do so.
What do you use these photos for?
We produce a wide range of materials to tell people affected by spinal cord injury about our services and to raise money for our work.
Examples of materials may include, but are not limited to, our printed publications; adverts; audio-visual and electronic materials; external media and publicity such as television, print, radio or online news; display materials; emails, e-newsletters, blogs, web pages, social media posts, presentations, speeches, research or policy reports and any other materials.
Back Up cannot guarantee or be held liable for use of this information or image by a third party.
If a photographer or videographer is present on the behalf of Back Up, the copyright of any material which is generated as a result of this photographic session shall be assigned and shall be the property of Back Up.
Can I withdraw my consent to use these images at a later date?
Yes, consent can be withdrawn at any time by contacting the Data Protection Officer. If you withdraw your consent, Back Up will no longer use any photographs or information you have provided previously. However, any published materials that already include your information or image cannot be recalled.
How long will you keep these images for?
We will retain and may use the images for up to five years unless you have revoked your consent in the meantime..
In special cases (i.e., where a photo is of particular use to the charity) we would like to continue using the image beyond 5 years. In these cases, we will seek your renewed consent to continue using the image.
How will you use photos of me at fundraising events?
We use photos of our supporters to enhance and illustrate our fundraising materials, inspiring others to get involved in fundraising activities and events. People attending Back Up fundraising activities and events can expect that photos might be taken to be used in fundraising and marketing materials. As supporters will not be identified in photos, without their express permission, we are not using their data in ways that could be considered intrusive or harmful. We will offer an opt out, and ensure that people can access and request erasure of their photographs at any point. Our communications to supporters will include a photography notice, and this information will also be displayed on our website.
A cookie consists of information sent by a web server to a web browser, and stored by the browser. The information is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser.
We may use both “session” cookies and “persistent” cookies on the website. We will use the session cookies to: keep track of you whilst you navigate the website. We will use the persistent cookies to: enable our website to recognise you when you visit.
We use Google Analytics to analyse the use of this website. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users’ computers. The information generated relating to our website is used to create reports about the use of the website. Google will store this information.
Most browsers allow you to reject all cookies, whilst some browsers allow you to reject just third-party cookies. For example, in Internet Explorer you can refuse all cookies by clicking “Tools”, “Internet Options”, “Privacy”, and selecting “Block all cookies” using the sliding selector. Blocking all cookies will, however, have a negative impact upon the usability of many websites