Privacy Policy

Giveafew's

At Giveafew we are committed to protecting your personal information and being transparent about what we do with it. We are committed to using your personal information in accordance with all applicable laws concerning the protection of personal information and not to do anything with your information you wouldn't reasonably expect.

This Privacy Policy sets out how and why we obtain, use and protect your personal information.

Key points:

We will only send you marketing information electronically (eg. by email, text/SMS) if you specifically agree to us doing so.
You can change your marketing preferences at any time by emailing hello@giveafew.org.
If you ask us to stop sending marketing information we will update our records to stop further mailings as quickly as we can. However, for up to 28 days you may still receive further mailings which were already in progress prior to you asking us to stop.
We may send marketing information by post or call you for marketing purposes, unless you have previously opted out or said that you don't want to be contacted.
We collect personal data e.g. your name, postal and email addresses, when you give them to us for various purposes, such as donating, seeking advice, signing up for an event, or applying for a job. We carry out data matching on people who support us through donating, fundraising, or campaigning. This means that we will combine information you have given us, such as your postcode, with information from other sources.
We do data matching to:
- exclude people who we consider may be vulnerable from marketing communications;
- to build a better profile of our supporters so that we can more effectively target our communications;
- to tailor our communications to you and to predict the level at which you might be able to support us in future.
We will do data matching for these reasons unless you let us know that you don't want us to. We have lots more information about the types of profiling we do under the 'Building Profiles and Targeting Communications' section of this policy.
We gather information about traffic to and on our website to improve the site and for marketing purposes. We use cookies and tags on our website. Please see 'How do we use cookies?' for further information.
We provide links to other websites whose privacy practices are outside our control. You should check the privacy practices of any third party website before disclosing any personal information.
We use the information you give us for segmentation of our database, for example, by analysing information such as the postcodes of supporters, names, addresses. This enables us to tailor our communications to you and in a fundraising context, enables us to raise more funds.
If we rely on consent to process your data, you can withdraw your consent at any time.
This policy is written in accordance with the General Data Protection Regulation.

If you have questions about this Privacy Policy, please contact us by email hello@giveafew.org.

This Privacy Policy was last updated in August 2019.

How do we obtain your personal information?

We collect information in the following ways (this is more fully described in 'What information we collect'):

When you give it to us directly

You may give us your information in order to sign up for one of our events, when you contact us to ask about our activities, to tell us your story, order products and services from us, seek assistance, make a donation to us, fundraise on our behalf, apply for a job or otherwise give us personal information. When you support us, and your information is collected or processed by our organisation, we will be responsible for your information.

When you give permission to other parties to share it with us

Your information may be shared with us by independent event organisers, for example fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so with your consent when you have indicated that you wish to hear from us. You should check their privacy policies when you provide your information to understand fully how they will process your information. We may also obtain information about you from a family member or a friend who contacts us on your behalf, or if a volunteer or fundraiser passes on your details to us.

When your information is available publicly or from other external sources

We may combine information that we already have about you with information available publicly or information available from external sources, to gain a better understanding of you and to improve our fundraising methods, products, and services. Such information could be for example information about previous donations you have made. The information we get from other external sources may depend on your privacy settings or the responses you give, so you should regularly check them. For example, you may have provided permission for a company or other organisation to share your data with third parties including charities. This could be when you buy a product or service, register for an event or sign up with a comparison site. Depending on your settings or the privacy policies for social media and messaging services like Facebook, LinkedIn, WhatsApp, Instagram, YouTube, Google+ or Twitter, you might give us permission to access information from those accounts or services. We may also obtain information about you where it is publicly available and found in places such as Companies House, Land Registry website and information that is published in articles and newspapers. To understand how we use information about the communications devices you use, such as IP address (the location of the computer on the internet) and cookies, please see 'How we use cookies?'.

What information do we collect?

Personal information is any information that can be used to identify you. For example, it can include information such as your name, date of birth, email address, postal address, telephone number, IP address, credit/debit card details. The kind of information we collect, why we collect it, if we share it, and the legal basis for this data collection is set out below. To learn about how long we keep your data for, see 'How long do we hold your information for?'

When you contact Giveafew to:

Participate in a fundraising event
Make a donation
Apply for a volunteering role
Buy goods from us
Use the online community

1. Participate in a fundraising event

We will collect the following types of information: title, name, gender, address, email address, telephone number, bank details if there is a fee to enter the event, if relevant tax status for gift aid. If you choose to give it to us we also collect mobile number and the name of your employer. We use this information to: confirm your place, to send events information, to claim gift aid. We will share this information with: HMRC if you consent to gift aid. We work with payment processors such as Donorbox which provide card payment gateways on our behalf and provide us with information about you after you have made a payment to us. If a third party is organising the event, then your details will be shared with the third party. These companies are based in the European Economic Area (EEA) or where they are not based in the EEA we have put in place safeguards to ensure that your data is protected as if it were processed in the EEA. We rely on consent to process your information to enable you to take part in the event. We rely on legitimate interests for marketing to you by post or phone, and consent for other types of marketing.

2. Make a donation

We will collect the following types of information: title, name, address, consent for gift aid, bank details. If you choose to give it to us we also collect email, phone/ mobile number and your motivation for donating. We use this information to: process your donation, add you to our marketing lists so that we can inform you about other ways to get involved with us including other fundraising initiatives, volunteering and research opportunities, and to claim gift aid. We will share your information with: HMRC to claim gift aid, payment providers such as Donorbox for one off donations by payment card or Donorbox for regular direct debit donations. Where these companies are based in the US we use Privacy Shield or EU model clauses to ensure your data is protected. We rely on your consent to process your information to enable you to donate. We rely on legitimate interests for marketing to you by post or phone, and consent for other types of marketing. HMRC are legally obliged to process your name address and tax status for gift aid. For high value donations we rely on legal obligation to conduct additional due diligence on donors to ensure compliance with money laundering law and to ensure that there are no reputational or ethical risks associated with the donor or the donation. For further information on how we process data relating to high value donations refer to the 'Philanthropy' section.

3. Apply for a volunteering role

We will collect the following types of information: name, address, telephone number, email, work history/ experience/ your CV, emergency contact details, date of birth, referees, criminal convictions. If you consent to allowing your story to be featured as a case study, we will also collect photos and details about your charity experience. We will use this information to: process your application and to assess your suitability for the role. We collect details about race/ ethnicity, religion beliefs, sexual orientation for monitoring and inclusion and to enable us to identify trends. We initially rely on your consent to process information about you as a volunteer. However, once you start volunteering with us we rely on legitimate interests to process your information – this would enable us to use your information to investigate complaints or a serious incident even if you did not consent, for example.

4. Buy goods from us

We will collect the following types of information: name, address, phone, mobile number, bank account details. We will use this information to: fulfill your order and to send you marketing communications. We will share your information with our fulfillment companies who will ensure your order is sent to you. We also use a third party to manage our customer support line for the shop and to manage returns. We may share your information with credit reference agencies. We will share your information with HMRC for VAT relief and potentially for gift aid. We rely on the contract between us to process your information to fulfill your order. We rely on legitimate interests for marketing to you by post or phone, and consent for other types of marketing. HMRC are legally obliged to process your name, address and tax status for gift aid.

5. Use the online community

We collect the following types of information: title, name, email address when you register, age, gender, any online profile you create including information in your URL. We will use this information to create an account for you and to be able to identify you if there is a problem with your account, if you have a query, or if we need to enforce our website terms. We will share information with companies who provide us with an out of hours moderation service. We also share your URL and any information it contains (e.g. your name) with Google Analytics for statistical purposes. It will be saved in Google Analytics servers in a secure closed system. No use will be made of this data apart from statistical analysis. We rely on your consent to provide us with information to create an account, and also on contract as you must comply with the community and Giveafew website terms to register with the online community and to post. We will rely on the terms of our website if you do something that violates our terms. This could include banning you from the online community.

How long do we hold your information for?

We have a records retention policy which sets out how long we will keep your information for. In some cases the retention periods are governed by law, in other cases it is best practice. For fundraising and events information, we will hold onto your details as below (we set this out in the format of record type, length held and the reason):

Change of address – we will hold for 2 years – for Best Practice
Consent to direct marketing – we will hold for 6 years – for compliance with data protection law and privacy law
Correspondence about donations – we will hold for 6 years from the end of the fiscal year – for compliance with Companies Act / Charities Act
Deeds of covenant (donee) – we will hold for 6 years after final payment due but up to 12 years if any payments are still outstanding or there is any dispute regarding the deed - for compliance with Tax/Limitation Act 1980 s8
Gift aid claims - we will hold for 6 years from the end of the fiscal year in which the last payment under the declaration was made – this evidence required by HMRC inspections/ Limitations Act 1980
Gift aid declarations - we will hold for 6 years from the end of the fiscal year in which the last payment under the declaration was made – for compliance with Finance Act 1988 Sch 18 (Declarations continue in force until revoked or cancelled)
Legacies – we will hold for 6 years after the estate has been wound up for legal and contract reasons
Lotteries returns – we will hold for 3 years after the draw in accordance with Best Practice
Parental consent forms - Based on a child's age – we will hold until they are 21 +3 years for Public Liability purposes
Raffle tickets - we will hold for 3 years from the end of the fiscal year to comply with the Gambling Commission requirements
Registration forms - we will hold for 6 years – for contract law purposes and Public Liability
Requests to be removed from direct marketing lists – we will hold for 6 years to demonstrate compliance with data protection and privacy law
Requests for information from Data Subjects – we will hold for 6 years in accordance with Best Practice
Sponsor forms – we will hold for 6 years from end of fiscal year – to comply with Finance Act 1988
Supporter credit card numbers - we do not retain these in accordance with Payment Card Industry Data Security Standards (Requirement 3)
Supporter credit card verification codes (3 or 4 digit number on the front or back of the credit card) – we do not retain these in accordance with Payment Card Industry Data Security Standards (Requirement 3)

For Recruitment and Volunteering information, we will hold onto your details as below (we set this out in the format of record type, length held and the reason):

Bank details of future employees – we hold onto these for the duration of the time that you work with us for the purpose of paying you – to comply with the Data Protection Act 2018
CCTV images – we hold these images for 30 days before overwriting them (or in the event of an incident, longer) – in accordance with Best Practice
Consent to process special category data – we will hold this information for as long as you work with us and for 6 years after you stop working with us to comply with the Data Protection Act 2018
Contractor time sheets - we will hold for 3 years from the end of year in which contract terminated in accordance with Best Practice
Contracts of employment, written particulars of employment and any changes (original) we will hold for 6 years after employment ceases - in accordance with Limitation Act 1980 s.5
CVs – of successful applicants we will hold for 6 years after employment ceases in accordance with Best Practice
CVs – of unsuccessful applicants we will hold for 15 months after the end of the recruitment process in accordance with Best Practice
Equal opportunities/diversity/fair employment (NI) monitoring forms we will hold for 3 years from date of application in accordance with Best Practice
Job applications – if successful we will hold for 6 years after employment ceases - in accordance with Best Practice
Job applications – if unsuccessful we will hold for 1 year after notification then destroyed – to demonstrate compliance, if necessary, with the Equality Act
Job descriptions – we will hold for 3 years after employment ceases in accordance with Best Practice
Medical and health records of employees we will hold these for 30 years after employment ceases in accordance with Best Practice
Qualifications evidence – we will hold for 6 years after employment ceases in accordance Limitation Act 1980 s.5
References we will hold for 6 years after employment ceases in accordance with the Limitation Act 1980 s.5
Time sheets we will hold for 2 years after they are created to demonstrate compliance with the Working Time Regulations
Working time opt-out forms- we will hold for 2 years after employment ends to demonstrate compliance with the Working Time Regulations 5 & 9
Driver declaration forms – we hold for 1 year and these are renewed annually

For other records, we will hold onto your details as below (we set this out in the format of record type, length held and the reason):

Complaints Correspondence - we will hold for 6 years from completion of action in accordance with Best Practice
Fraud case files - we will hold for 6 years – to comply with the Limitation Act 1980
Litigation files – we will hold for 10 years – as our lawyers have advised
Powers of attorney – we will hold on to these indefinitely in accordance with the Limitation Act 1980
Subject access requests – we will hold for 6 years after last action for contract purposes and in accordance with the Data Protection Act 2018
Service user records we will hold for 3 years after the last action (or 7 years if there has been an accident or safeguarding issue) in accordance with Best Practice
Call recordings - we will hold for 3 years in accordance with Best Practice

How do we use your information?

How we use your information would largely depend on why you are providing it (see 'What information do we collect'). As an overview, we may use your information in the ways set out below. We use your personal information to give you the information, support, services, or products you ask for. We use your information to gain a full understanding of your situation so we can develop and offer you the best possible personalized services. We use your information to keep a record of your relationship with us and for internal administrative purposes (such as our accounting and records), and to let you know about changes to our services or policies. We use your personal information to look into, and respond to, complaints, legal claims or other issues. We use your personal information to claim Gift Aid on your donations. We use personal data to carry out statistical analysis and research in order to help us to understand how we are performing and how we can improve our services and meet the needs of people that require our help. We may also use your personal information for other purposes which we specifically notify you about and, where appropriate, obtain your consent.

Direct Marketing

We use your information to send you communications about our work and how you can help us, for example, information about our campaigns, volunteering, fundraising activities and how you can donate to us. Occasionally, we may include information from partner organisations or organisations who support us in these communications. We rely on your consent for marketing communications by electronic means – including text, email and social media. We rely on legitimate interests for other means of marketing including post and live calls. You can let us know if you would prefer not to receive these communications at any time by emailing hello@giveafew.org. We also use your information for profiling purposes – see 'Building profiles and targeting communications' and in certain circumstances, we may pass your information to 'Facebook'.

Building profiles and targeting communications

Profiling is gathering information about an individual or a group of individuals and analysing their characteristics or behaviour patterns in order to place them in a certain category or group, and/ or to make predictions or assessments about their ability to perform a task, their interests or likely behaviour. We use several types of profiling and analysis, including: data matching, segmentation and high value donor analysis. You can object to us profiling you by email at hello@giveafew.org. We use profiling techniques to ensure communications are relevant and timely, and to provide an improved experience to our supporters. For example, we use profiling to send information about campaigns and services in your area, or to find potential new supporters and invite you to be involved in supporting our cause through tailored communications which may be of interest to you. We do this because it allows us to understand the background of the people who support us and use our services and helps us to make appropriate requests to supporters who may be able and willing to give more than they already do or to tailor our services to better suit them. We also use profiling to exclude people who may be vulnerable from marketing. Profiling enables us to provide you with a service that is more relevant for you, while raising more funds, sooner, and more cost-effectively, than we otherwise would. Profiling allows us to be more efficient with our resources, which donors consistently tell us is a priority for them. In order to create a profile for you, we (or our trusted service providers) may use the information which you give us and which we collect from external resources, including information that is publicly available about you. This sort of profiling can include us using information such as your age, property prices and average earnings where you live, your job, directorships, your financial circumstances, networks, any previous donations you have made, your philanthropic interests (trusteeships and/ or support to other charities), and your estimated wealth, to assess how likely it is that you would be interested in donating to us and the level of donation that you may be able to give. We use this information in our analysis of high value donors.

Philanthropy

Giveafew, like many other charities, undertakes research in order to engage with suitable high value donors. This helps us identify people who have an interest in our cause and could potentially make a substantial donation. We process personal data on existing and potential high value donors to help us support more coffee and cocoa-producing farmers. We can achieve this aim by increasing the number of people we engage with who have the capacity to give £5,000 or more to Giveafew in a single donation. Researching potential high value donors enables us to focus our fundraising resources whilst ensuring that our requests for support are tailored to each individual. Our personalized approach helps us to provide the best possible donor experience that is aligned with an individual's interests and capacity to give. We identify potential high value donors in a number of ways:

By carrying out research on donors who have given £1,000 or more to Giveafew.
By asking our existing high value donors to give again.
By inviting potential high value donors to attend our supporter events as a way of engaging them with Giveafew. We also identify potential new donors by researching event attendees who were previously unknown to Giveafew.
By researching people who have not given to Giveafew in the past but who we believe may have a connection to our cause and have the capacity to give at a high level.
By asking our donors and influencers to open up their networks to us.
By asking our donors and influencers to introduce us to potential donors we have identified through our research and that they have a link to.

Our initial research is undocumented and involves some basic checks looking at publicly available information, e.g. using Google, a public LinkedIn profile. If our initial research is promising, or if someone has donated £5,000 or more to us, we will create a research profile of the individual using information sources such as Companies House, The Charity Commission, JustGiving and Twitter etc. We also use these information sources to identify potential new donors who have a propensity to give at a high level and may have an interest in our cause. If we discover that someone in our network knows a potential donor that we have identified, we might ask them to facilitate an introduction. We sometimes ask existing supporters whether they would be prepared to open their networks up to us. An existing supporter may tell us about an individual previously unknown to us and facilitate an introduction. In this scenario we would advise our existing supporter about our data responsibilities and ask them to ensure that the individual in question is happy for an introduction to take place. Following the introduction, we would direct the individual to this privacy policy and confirm their marketing consent preferences. In the two scenarios above, we may create a research profile on someone who we have never had any contact with before. In this case, we plan to make contact within 30 days to direct the researched individual to this privacy policy. If we attempt to make contact but are unable to do so, we will try again within the next 30 days and delete the research profile if we are still unsuccessful. Our Supporter team foster long term relationships with our existing and potential donors. However, we are committed to only keeping data on individuals with whom we have an active relationship. We therefore remove the data captured in the ways described above if the existing or potential donor has not interacted with the our Supporter team in the previous four full calendar years.

Who do we share your information with?

We will not sell your details to any third parties, but in many cases we share your information with our trusted service providers who are authorised to act on our behalf, our trading companies, and associated organisations who work on our behalf, or whom we work with in partnership to deliver and improve services for future generation of coffee and cocoa farmers. This includes organisations who fundraise on our behalf. As part of our commitment to maintaining accurate data, we use trusted third-party service providers to ensure that we keep our record of you up to date. If you participate in our lotteries or raffles, your information will also be processed by our trading companies who administer and run these on our behalf. In addition, from time to time we may exchange your personal information with other organisations for the purposes of fraud and credit risk reduction. We may also share information with our financial and legal advisers for the purposes of obtaining advice and protecting our legal rights. We may also share your information with the emergency services if we think there is a risk of serious harm or abuse to you or someone else. When we collect your personal information we use strict procedures and security features to prevent unauthorised access. However, no data transmission over the Internet is 100% secure. As a result, while we try to protect your personal information, Giveafew cannot guarantee the security of any information you transmit to us and you do so at your own risk. Where we share your information with companies based outside the EEA we will put in place safeguards to protect your data. In most cases we rely on Privacy Shield to protect your data. However, there are some occasions where we rely on EU Standard Model Clauses. We also share some information with 'Facebook' as described below.

Facebook

Remarketing (or retargeting)
Facebook have tags on some pages of our website which allows them to collect information about pages you’ve visited on our website, they will then serve you advertising on Facebook based on this information. Please see the Tags section in 'How do we use cookies?' for further information.

Lookalikes

We sometimes share with Facebook the email addresses of people who have registered to take part in one of our major fundraising events. The emails are used by Facebook to define a type of audience with similar characteristics, and then Facebook will serve adverts to people that match that type of audience - but not (necessarily) the people in the original email file. We do this to increase registrations to our events and to raise more funds. We sometimes share this information with our media planner agencies who may also share email addresses with Facebook on our behalf.

Custom Audiences

We sometimes use Facebook Custom Audiences for operational support.

Saved Audiences
We use Facebook Saved Audiences to remember which supporters on Facebook are most likely to respond to our fundraising, campaigning and marketing requests.

How do we use cookies?

Giveafew uses cookies to give you a more personalised web service. To see 'How we use cookies', what they are, and which ones we use please go to our How we use cookies page. This page also includes instructions on how to disable cookies if you don't want them to be used.

Links

The Giveafew website may include links to other sites, not owned or managed by us. We cannot be held responsible for the privacy of information collected by websites not managed by us.

Privacy and our Online Community

Our online community is moderated and we do not display the full names of individuals nor addresses. When you post personal information on a discussion board on our Online Community or other messaging board on our websites, your information is publicly accessible. Such information can be viewed online and collected by third parties. We are not responsible for the use of information by such third parties. When contributing to a discussion we strongly recommend you avoid sharing any personal information that can be used to identify you (such as your name, age, address, name of employer). We are not responsible for the privacy of any identifiable information that you post in our Online Community or other public pages of our websites. For more information see the relevant section in 'What information do we collect?'

If you're 16 or under

If you're aged 16 or under, you must get your parent/guardian's permission before you provide any personal information on our websites.

Your rights - Accessing and updating your personal information

You can request access to any information we hold about you by contacting by email hello@giveafew.org. Equally, please let us know of any changes to your personal information. If you would prefer us not to profile you for the purposes of targeting or tailoring our fundraising efforts, let us know by emailing hello@giveafew.org. If you are unhappy with how we've used your data please tell us so we sort it out. However, if you are still unhappy you have the right to complain to the ICO. The ICO can investigate your claim and take action against anyone who has misused personal data.

Further details are here: here

Your rights – more details

Right to be informed - you have the right to be informed about the collection and use of your personal data. This is a key transparency requirement under the GDPR.
Right of access - you have a right to ask us to confirm whether we are processing information about you, and to request access to this information. You can do this by writing to us by email at hello@giveafew.org.
Right to object - you have the right to object to processing based on legitimate interests or performance of a task in the public interest/ exercise of an official authority (including profiling); direct marketing (including profiling) and processing for the purposes of scientific, statistical or historical research. We must comply with any request to stop processing for the purposes of direct marketing. The right to object is not absolute in relation to processing for legitimate interests and research purposes.
Right to rectification - you have the right to require us to rectify information about you that is inaccurate, and you may also ask us to remove information which is inaccurate or complete information which is incomplete. If you inform us that your personal data is inaccurate, we will inform relevant third parties with whom we have shared your data so they may update their own records. We want to ensure that your personal information is accurate and up to date. If any of the information that you have provided us with changes, for example if you change your email address, name, payment details, please let us know: hello@giveafew.org. We will update your details as soon as possible and within one month. We may refuse a request for rectification in certain circumstances, such as where we need to keep an audit trail.
Right of portability - you have a right to obtain your personal data from us and reuse it for your own purposes, perhaps for another service, without hindering the usability of the data. This includes the right to require us to pass on information we obtained from you to another data controller. This right applies when we process your data with consent, pursuant to a contract and we are carrying out processing by automated means.
Right to be forgotten - you have a right to seek the erasure of your data. You may wish to exercise this right for any reason, for example where it is no longer necessary for us to continue holding or processing your personal data you may withdraw your consent. This right is not absolute, as we may need to continue processing this information, for example, to comply with our legal obligations, or for reasons of public interest. We may also need to keep some information about you in order to, for example, comply with an instruction not to contact you again. We will respond to a right to be forgotten request within one month.
Right to restriction - you have a right to ask us to restrict our processing of your information ('right to restriction') if:

you contest its accuracy and we need to verify whether it is accurate;
the processing is unlawful and you ask us to restrict use of it instead of erasing it;
we no longer need the information for processing, but you need it to establish or defend legal claims;
you have objected to processing of your information being necessary for the performance of a task carried out in the public interest, or for the purposes of our legitimate interests. The restriction would apply while we carry out a balancing act between your rights and our legitimate interests. If you exercise your right to restrict processing, we would still need to process your information for exercising or defending legal claims, protecting the rights of another person or for public interest reasons.

This is an alternative right to the right to be forgotten and it is not an absolute right. If we refuse a request for restriction we will explain why. We will respond to requests for restriction within one calendar month.

Rights in relation to automated decision making, including profiling - you have the right not be subject to a decision based solely on automated processing, including profiling, where this has a legal or similar effect on you. If we carry out profiling that does not meet this definition we can continue to carry out profiling if we comply with the General Data Protection Regulation.

If we rely on consent as the legal basis for processing (as set out in 'What information do we collect?') you can withdraw your consent to that processing. However, we often rely on different legal bases for different aspects of processing. This means that we may not be able to act on your request if we have a compelling legal reason not to. For example, if we originally collected your data with your consent, but we later need to investigate a complaint, we may be able to rely on legitimate interests to continue processing your information.

Changes to this policy

We may change our privacy policy from time to time so please check back periodically.

This Privacy Policy was last updated in August 2019.