Privacy statement

1. At Barts Charity we are committed to protecting your privacy. This Privacy Statement is prepared in compliance with the requirements of the UK General Data Protection Regulation (UK GDPR) and in line with the Code of Fundraising Practice (issued by the Fundraising Regulator). If you have any queries about this Statement or how we use your personal data, please contact us using the details at the end of this Statement.
2. We have developed this Statement as we understand that the privacy and security of your personal data is an important issue to you. We are committed to protecting the privacy of everyone who shares their data with us, however that may be. Examples of how you interact with us might be as a visitor to the Barts Charity website, through social media or responding to paper collateral as a donor, fundraiser, volunteer, or a grants applicant/recipient.

This Statement explains how we use the Personal Data we collect. We have a separate Grants Privacy Statement that explains how we use Personal Data if you enquire about funding opportunities, if you apply for a grant, and if you receive a grant.

Barts Charity (‘we’, ‘us’) is the controller of the Personal Data that we collect. We are a registered charity and our registration number is 212563. We are also a private company limited by guarantee registered in England and Wales under company number 7168381. Our registered address is 12 Cock Lane, London EC1A 9BU.

We collect Personal Data as defined by UK GDPR. Personal Data we collect might include name, email address, postal address, and telephone number. If you make a donation to Barts Charity we will also collect information necessary to process the donation, ie. the amount of the donation and a record of your Gift Aid declaration if you make one. We record your requests for information and any feedback we receive from you. We may also collect technical information relating to your use of our Site, including your browser type or the Internet Protocol (IP) address used to connect your computer to the internet.

We want to ensure that your personal data is accurate and up to date. If any of the information that you have provided us with changes, for example if you change your email address or postal address, please let us know using the contact details at the end of this Statement.

We legally require your express consent to use your information for certain purposes, but Barts Charity also relies upon its right to hold and process data in pursuit of its legitimate interests (ie furthering its charitable objects, which may include fundraising) without always getting your express consent. Where we rely upon this in order to contact you, we will always remind you or your right to unsubscribe from any future contact.

We will process your information for the following purposes:

• Administering our website, and to ensure content is of most relevance to users. Our basis for doing this is that it is necessary for our legitimate interests in operating the website and publicising our work effectively through the website.
• Keeping you informed about the activities of the Charity and about our fundraising campaigns. We may do this via email, telephone or text message if you opt-in to receiving information that way, and our basis for doing that is your consent. We may contact you by post, on the basis that it is necessary for our legitimate interests in promoting our work and fundraising to support our work in future. If you would prefer that we do not use your Personal Data for the purposes of direct marketing (fundraising and other promotional work) please let us know using the contact details at the end of this Statement. (Please note that the charity will aim to update communication preferences within 28 days).
• Processing your donations. We will use your Personal Data to process any donations you make to us, including making a Gift Aid claim if you make a Gift Aid declaration. We do this on the basis that this is necessary for our legitimate interests in receiving your gift and any Gift Aid funds.
• Responding to your queries. Our basis for doing this is that it is necessary for our legitimate interests in responding to enquiries and managing our relationship with you.
• Using photographs, video or sound recordings. If you supply any visual image or sound recording containing your personal data to the Charity, or the Charity obtains such image or recording by photographing or recording you, this image or recording may be used for the Charity’s marketing and promotional activities. We will only do this where you have given your consent, and the purpose for which we may use your image or recording will always be set out in our consent form and/or on our website.
• Complying with our regulatory obligations. We may need to use your personal data to comply with our regulatory obligations. For example, if you make a donation we will need to keep a record of the donation for our accounts. We do this on the basis that it is necessary to comply with our legal obligations.

We also gather general information about the use of this Site but we use aggregated or anonymous information which does not identify you as an individual visitor. We track which pages users visit most often and which services, events or facilities are of most interest. We may also track which pages users visit when they click on links in emails. We may use this information to optimise the way our Site is presented when users visit, to make improvements to our Site and to ensure we provide the best service for users.

We will only share your Personal Data in the following circumstances:

• (if you are an online donor) with our payment processor. (By paying via our payment processor you agree to accept their terms and conditions for the use of their services, including their privacy policy. We suggest that you read their privacy policy when using their service. See the Stripe Privacy Policy for one off donations or the Access Group Privacy Statement for regular donations.);
• with our contractors and suppliers who provide services on our behalf to the extent necessary to enable us to receive those services, such as our IT providers or for the fulfilment and distribution of fundraising materials;
• with agencies whom we use to carry out online or print campaigns to help us communicate our work to existing supporters and enable us to reach new ones;
• with Her Majesty’s Revenue and Customs in order to process Gift Aid claims;
• with responsible authorities if the Charity reasonably believes that criminal activity is taking place or it believes that an individual or a group of individuals are at risk of harm, or if we are required to do so by law or as expressly permitted under Data Protection Law;
• with social media platforms in order to better refine our marketing campaigns and digital advertising, or to ensure you don’t receive unnecessary marketing communications; and
• with our regulators for the purposes of complying with our regulatory obligations.

We may need to share your information with our service providers, associated organisations and agents for the purposes described above.  We don’t share your data with third parties to allow them to contact you for their marketing purposes.

We keep your personal information in accordance with our Retention Policy, which takes into account:

• the purpose(s) for which the information was collected and how long we need to keep the information to achieve the purpose
• any applicable legal, accounting, reporting or regulatory requirements to keep the information.

Our Retention Policy is available on request.

We may transfer your Personal Data out of the UK. For example, we may need to do this where our service providers referred to above are based outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring one of the following safeguards is implemented:

• We ensure that the country we are transferring the data to has been deemed under UK data protection laws to provide an adequate level of protection for personal data.
• If the country has not been deemed to provide an adequate level of protection we use specific contracts approved for use under UK data protection laws which give personal data an equivalent level of protection as it has in the UK.

You have the right to ask us not to process your Personal Data for marketing purposes.

Where we are relying on your consent as the basis for processing your Personal Data you have the right to withdraw consent at any time.

You have a right to seek the erasure of your data (often referred to as the ‘right to be forgotten’). You may wish to exercise this right for any reason, for example where it is no longer necessary for us to continue holding or processing your personal data you may withdraw your consent. This right is not absolute, as we may need to continue processing this information, for example, to comply with our legal obligations, or for reasons of public interest.

You have a right to ask us to confirm whether we are processing information about you, and to request access to this information (‘right of access’).

You may ask us, or we may ask you, to rectify information you or we think is inaccurate, and you may also ask us to remove information which is inaccurate or complete information which is incomplete (‘right to rectification’). If you inform us that your personal data is inaccurate, we will inform relevant third parties with whom we have shared your data so they may update their own records.

We want to ensure that your personal information is accurate and up to date. If any of the information that you have provided us with changes, please let us know using the contact details at the end of this Statement.

You have a right to obtain your personal data from us and reuse it for your own purposes, perhaps for another service, without hindering the usability of the data (‘right of portability’).

You have a right to ask us to restrict our processing of your information (‘right to restriction’) if:

• you contest its accuracy, and we need to verify whether it is accurate
• the processing is unlawful and you ask us to restrict use of it instead of erasing it
• we no longer need the information for the purpose of processing, but you need it to establish or defend legal claims
• you have objected to processing of your information being necessary for the purposes of our legitimate interests. The restriction would apply while we carry out a balancing act between your rights and our legitimate interests.
• you exercise your right to restrict processing, we would still need to process your information for the purpose of exercising or defending legal claims, protecting the rights of another person or for public interest reasons.

If you would like to exercise any of your rights above, please let us know using the contact details at the end of this Statement. We will normally respond to your request within one month, but if your request is complex we may need to extend that timescale. If we do, we will write to you to explain why. There is normally no charge for exercising your rights. However, if a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse to act on the request.

If you believe we have not used your Personal Data properly you have the right to lodge a complaint with the Information Commissioner. We would appreciate the opportunity to try to address your concerns directly before you decide to make a complaint.

We use cookies and similar digital tracking technologies (e.g. tags) on our website to:

• ensure our website works
• provide a more personalised web experience
• measure how the website is used so that we can continuously improve it for you
• analyse the effectiveness of our content.
• improve the speed/security of the site
• target our advertising, ensuring it is as relevant and cost-effective as possible

For the purposes of our Privacy Statement, the term ‘Cookies’ covers all types of tracking.  Cookies are small text files that are downloaded onto your device when you visit a website. Your browser sends these cookies back to the website every time you visit the site again, so it can recognize you and your preferences.

You can choose to accept or decline cookies through the popup cookies banner that appears when you first visit this site. You can also always withdraw your consent by clearing cookies from the cache in your device and rejecting them next time you visit our website.

Some cookies are absolutely necessary/essential for the website functionality and security. These are the only cookies we use without your consent.

We are currently in the process of updating our cookies policy and implementing a new cookie management platform. Once implemented you will be able to decide your cookie preferences, determining what cookie types are set and we will provide a breakdown of different cookie types that we use.

We use social media to communicate with you and share information about our campaigns, events and how we’re supporting Barts Health NHS Trust patients and staff. We both post on our own social media channels and use social media advertising.

We currently use Facebook, Instagram, Twitter, LinkedIn and TikTok accounts.

We use social media pixels on our website from the social media platforms; these are a type of tracking cookie which share information with the social media platforms and let them know you’ve been on our website.

We use online advertising to promote our aims and activities, including via Facebook, Instagram, Twitter, LinkedIn and Google platforms. We may also place adverts on other websites (e.g. local newspapers) or online platforms.

Social media pixels on our website from advertising and help us track the success of our online advertising and ensure you see adverts that are most relevant to you.

When we advertise we may ask platforms to show our ads to a particular group of individuals and we may share your email with the platform (e.g. Facebook) if you have given consent to hear from us by email. This enables the platforms to match you with their own cookie information. We do this to ensure that you are either only delivered only adverts relevant to you or ensure you do not receive certain ads. If we share any email addresses with platforms for these will be ‘hashed’, a security measure where the information is encoded.

We rely upon legitimate interest for this processing as we believe that we have a legitimate interest in identifying the most appropriate target audience for our advertising content. This helps us to fundraise and be able to better support our community.

The Site contains links to other websites. The Charity is not responsible for the privacy policies and practices or the content of any websites which are linked to the Site.

The Charity encourages parents and guardians to use the parental control tools available from online services and software manufacturers to help supervise their children’s online activities.

Any Personal Data you send to us will be treated in the strictest confidence. We take appropriate measures to ensure that the information disclosed to us is kept secure, accurate and up to date.

The Charity is committed to protecting the security of your Personal Data. The Charity uses a variety of security technologies and procedures to help protect your Personal Data from unauthorised access, use or disclosure.

The Charity uses a secure service when you make a donation through the Site, via a virtual gateway operated by iRaiser. No card details are taken or held by the Charity, and iRaiser, who does collect and use the personal data associated with the card payments is compliant with the Payment Card Industry Data Security Standard in its treatment of such data.

You should be aware that the use of the Internet is not entirely secure and although we will do our best to protect your Personal Data we cannot guarantee the security or integrity of any Personal Data which is transferred from you or to you via the Internet. Any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features such as encryption to try to prevent unauthorised access.

This Privacy Statement has been approved by the Charity’s Board of Trustees; it represents the standard to be applied by the Charity when using individuals’ Personal Data.

Please check this page periodically for changes as the Charity reserves the right, at its discretion, to change, modify, add, or remove portions of the Privacy Statement and the Site at any time. Your continued interaction with the Charity following the posting of any changes to this Statement will mean that you accept such changes.

Questions, comments and requests regarding this Statement are welcomed and should be addressed to hello@bartscharity.org.uk, 0207  618 1720

Barts Charity, 12 Cock Lane, London EC1A 9BU

Please find below definitions of some of the terms used in this Privacy Statement for your information and assistance.

1. Processing
   “processing” means obtaining, recording, or holding the information or data or carrying out any operation or set of operations on the information or data, including:
   • organisation, adaptation or alteration of the information or data,
   • retrieval, consultation or use of the information or data,
   • disclosure of the information or data by transmission,
   • dissemination or otherwise making available, or
   • alignment, combination, blocking, erasure or destruction of the information or data.
2. Personal Data
   Personal data is:
   • any data from which the identity of a living individual can be determined, either by itself or with other data processed by data controller;
   • any information such as name and address, email address, telephone number and general contact details, personal data includes images on film (e.g. CCTV images), photographs and telephone voice recordings.
3. Special Categories of Personal Data
   Special Categories of Personal Data means personal data consisting of information as to:
   • the racial or ethnic origin of the data subject;
   • the data subject’s political opinion;
   • the data subject’s religious beliefs or other beliefs of a similar nature;
   • whether the data subject is a member of a trade union;
   • genetic data;
   • biometrics (where used for ID purposes);
   • the data subject’s physical or mental health or condition; or
   • the data subject’s sexual life or sexual orientation.