Penny Appeal 

Privacy Notice

1.           Introduction

At Penny Appeal (“we, our”), we are committed to protecting the privacy and security of the personal data we collect about our donors, users of our services, community members and our customers (“you/your”). 

The purpose of this privacy notice is to explain what personal data we collect about you when you donate to our charity, purchase via our shop, sign up to newsletters, use the services of our charity or participate in our programmes and / or activities. 

When we do this, Penny Appeal is the data controller, unless otherwise stated. 

Our registered address is Penny Appeal Campus, Thornes Park, Wakefield, WF2 8QZ, UK.

We are registered with the Information Commissioner’s Office (ICO) Registration number ZB516197.  

Please read this privacy notice carefully as it provides important information about how we handle your personal information and your rights.

If you have any questions about any aspect of this privacy notice you can contact us using the information provided below or by emailing us at [email protected] or by phone on 03000 11 11 11.

2.           How we collect your personal data

Personal information or personal data, means any information about an individual from which that person can be identified and is generally referred to throughout this Privacy Notice as “personal data”. It does not include data where the identity has been removed (anonymous data).

We may collect and process personal data about you in a number of different ways, depending on the nature of our relationship with you. 

Some of the ways we collect and process personal data include:

• When you make a donation.
• When you make a purchase from our shop.
• When you are a service user or participant in our programmes or activities. 
• Viewing or subscribing to our websites and social media functions.
• Corresponding with us using services such as web contact forms, telephone, email or written letter.
• For marketing materials
• For service updates and / or newsletters
• Entering competitions.
• Applying for a job vacancy, including personal data collected from third parties as part of reference checking.
• Raising a concern or complaint about our services, programmes and activities, our staff and volunteers or those of our partners.

3.           Personal data we may collect about you

3. 1  We may process the following personal information about you which you share with us, such as your:

• Name
• Email address
• Residential address
• Telephone number
• Payment details
• Tax information and gift aid declarations
• Marketing preferences
• Correspondence with you and information contained within it
• Name, email address, residential address, phone number, and information about your/your child’s health / education or that of your family if using our services .

3. 2   This list is not exhaustive, and, in specific instances, we may need to collect additional data for the purposes set out in this Privacy Notice. For more information on the personal data we collect and how we use it, please see section 5. 

4.            If you fail to provide personal data 

Where we need to collect personal data by law, legitimate interest or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a service or you might not be able to participate in our programmes and / or activities, but we will notify you if this is the case at the time

5.           Lawful basis for processing

The UK GDPR (General Data Protection Regulation) requires that we must have at least one lawful basis for processing your personal data. The lawful bases we rely on include: 

1. Legitimate interests: we have legitimate interest to process your personal data.
2. Consent: where you have given us consent to use your personal data for one or more specific reasons.
3. Legal Obligation: where we have a duty to comply with a legal obligation.
4. Contractual obligation: we have a contract with you, and we need your personal information to perform that contract or to take steps towards performing that contract with you.

We have identified below the lawful basis for each processing activity we undertake.

6.            Categories of personal data and how we use your personal information 

As a charitable organisation, we will use the personal data you have provided us to perform our charitable activities. The table below describes the main processing activities we undertake with your personal data, the categories of your information involved and our lawful basis for doing so.

Category of personal data	Processing activity	Our lawful basis
Email address.	To send emails/newsletters. If donors have donated to us during the past five years, or attended our events / third party events we are involved with, we may contact them on a seasonal basis to feedback on campaigns, appeals, events and similar to the ones they have kindly supported. Active donors to Penny Appeal may receive quarterly feedback communications.	Consent. Legitimate interest of Penny Appeal in fulfilling the donation. Legitimate interest to providing feedback to one-off and direct debit donors over the past five years.
Name, email address, Postal address, cheques, card, bank or other payment details.	Processing of donations.  Purchasing items from the Penny Appeal Shop.  If donors have donated to us during the past five years, or attended our events / third party events we are involved with, we may contact them on a seasonal basis to feedback on campaigns, appeals, events and similar to the ones they have kindly supported. Active donors to Penny Appeal may receive quarterly feedback communications. Active donors to Penny Appeal may receive quarterly feedback communications.	In some cases, where necessary in order to perform a contract with a donor. Legitimate interest to providing feedback to one-off and direct debit donors over the past five years.
Personal contact information collected from donors.	Creating and maintaining a database of donors and potential donors, their relationship with us, responding to complaints, queries, etc.	Legitimate interest of Penny Appeal in ensuring it can manage donor relationships effectively.
Name, house address and marketing preferences.	Maintaining our donor database to contact our former, current and prospective donors from time to time, through direct postal mail, to ask if they would like to make a donation to an appeal.	Consent Legitimate interest of Penny Appeal in raising funds for its charitable activities.
Name, email, phone number, other electronic contact details and marketing preferences.	Maintaining our donor database to contact our former, current and prospective donors from time to time, through a range of digital methods such as email, SMS or social media to ask if they would like to make a donation to an appeal.	Consent of the donor. Legitimate interest of Penny Appeal.
Name, address, email, phone number and other contact details.	Contacting donors of a particular project/ appeal from time to time to update them on information about their donation, including how your donation was/ is being used, the success of our appeals, our activities on the field.	Legitimate interest of Penny Appeal and the donor in showing how funds were used effectively.
Name, address, email, correspondence and notes of conversations, phone number and other contact details.	Responding to queries from donors/general public/beneficiaries.	Legitimate interest of Penny Appeal in ensuring effective administration of the charity.
Name, address, gift aid declaration.	Processing gift aid claims.	Legitimate interest of Penny Appeal in obtaining funds for its charitable obligations.  Legal obligation and tax compliance.
Name, contact details, records of consent, gift aid information, records of correspondence.	Keeping records for the purposes of effective administration of the charity.	Legitimate interests of Penny Appeal in ensuring effective administration of the charity.  In some cases, legal obligation.
Images / videos / letters from children / 'child profile', as well as consent forms from children / adults.	To highlight Penny Appeal work through the “Your Story” initiative to inspire support and donations.	Consent of Participants.
Political opinions, ethnic origin, religious beliefs, health, medical conditions.	To highlight Penny Appeal work through the “Your Story” initiative to inspire support and donations.	Consent of Participants.

If for any reason we would like to process your personal data for any other purpose different from the purposes listed above, we will provide you with appropriate additional privacy information and we will ensure we have an appropriate legal basis for processing.

7.           Withdrawing consent

7. 1  Where you have provided consent to the processing of your personal information for a specific purpose, you have the right to withdraw consent at any time. Once we have received notification that you have withdrawn consent, we will no longer process your information for the purpose or purposes originally agreed to, unless we have another legitimate basis for doing so in law. 

7. 2   When we send you marketing communication by email, text message or by telephone, we are regulated by the Privacy and Electronics Communications Regulations (PECR). If you have given your consent to receive marketing emails you can withdraw this at any time, or if we are relying on our legitimate interests to send you marketing you can object. If you have received a direct marketing email from us and no longer wish to do so, the easiest way to let us know is to click on the unsubscribe link at the bottom of our marketing emails. 

7. 3   You can update your contact preferences for receiving marketing communications at any time by contacting us. When we send you text or email marketing communications, we will include options for you to opt out or unsubscribe if you no longer want to receive that type of communication. When you withdraw your consent for marketing communications, we will withdraw you from our mailing lists. 

8.           Sharing your data

8. 1   We may share your data internally with other services within Penny Appeal and other Penny Appeal Offices, where it is necessary for us to carry out our core activities and operations as a charity, provide you with products and services that you may have requested, respond to enquiries from you, and so on. 

8. 2   Penny Appeal implements programmes and activities in communities through engaging local partners and organisations, both in the UK and abroad. They help us to deliver our appeals, campaigns, events, challenges and projects we are working on at any time. We have an agreement in place with them and they act only to our instructions on the use of your personal data we have shared with them. We will under no circumstances, sell your personal data to any other business or third party for any marketing purposes. We will only share your personal data where it is necessary to perform our core charitable services. 

8. 3   In some circumstances, we may share your data where it is necessary to perform our core charitable services for the following reasons: 

• We are under a legal duty to comply with any legal obligation or to enforce or apply our terms and conditions; or
• We need to disclose data to protect our rights, property or safety of our customers or others, including the exchange of information with other companies, organisation and/or governmental bodies for the purposes of fraud protection and credit risk reduction.
• Charitable organisations in the same group of organisations as us: for the purpose of providing a service to you.
• Payment processors to facilitate donations you have made.
• Text and email marketing platforms to undertake fundraising appeals.
• For adoption and fostering, with local authorities in the region where you live, social workers and other independent adoption providers.
• His Majesty's Revenue and Customs (HMRC) for Gift Aid processing, our regulators and other government agencies where we are required to do so by law or to assist with any investigation or enquiry.
• Our professional advisers, where it is necessary for our advisers to advise the charity on its operations.
• Police, law enforcement agencies, security services as well as social services: to assist with the investigation and prevention of crime, the protection of national security and the protection of children and / or at risk adults. 

9.           Transferring your data internationally

It is unlikely that we ever share your personal data outside the UK, European Union or European Economic Area. If, however, it becomes necessary for the purposes of providing our services to you, we will only share it with organisations in countries benefiting from a UK or European Commission adequacy decision or on the basis of Standard Contractual Clauses approved by the UK or European Commission which contractually oblige the recipient to process and protect your personal data to the standard expected within the EU/EEA. Where necessary we will implement Data Transfer Agreements (IDTAs) and conduct Transfer Risk Assessments (TRAs). Any transfer of your personal data will follow applicable laws and we will follow the guiding principles of this Privacy Notice.

10.           How long we keep your personal information for

10. 1    We will only keep your personal data for as long as we need it to fulfil the purposes we collected it for. Retention of your data varies depending on what we need it for and other statutory requirements. We will review our Retention Policy and any schedules from time to time to ensure that we do not keep data for longer than is necessary. 

10. 2   It is important to ensure that the personal information we hold about you is accurate and up to date. You should let us know if anything changes, for example if you move house, change your phone number or email address. If you want to update your personal data, please contact us at [email protected].

10. 3   We may use information from external sources such as the post office national change of address database and/or the public electoral roll to identify when we think you have changed address so that we can update our records and stay in touch. We do this so we can continue to contact you where you have chosen to receive marketing messages from us and contact you if we need to make you aware of changes to our terms or assist you with problems with donations. This activity also prevents us from having duplicate records and out of date preferences, so that we don’t contact you when you have asked us not to. You may object to any data processing we undertake which involves direct marketing 

11.           How we protect your data 

11. 1   We work hard to keep your information and personal data safe. We have implemented and maintain appropriate technical and organisational measures to protect data we process, from unauthorised disclosure, use, alteration or destruction. 

11. 2  All information you give to us is stored on secure servers.

11. 3  Any payment transactions are processed by our third party supplier Worldpay

12.           Your Rights in relation to personal information  

12. 1  You have the following rights in respect of your personal data:

• You have the right to be informed. We aim to be transparent within our Privacy Notice and provide you with information about how we use your personal data.
• You have the right of access to your personal data and can request copies of it and information about our processing of it.
• If the personal data we hold about you in incorrect or incomplete, you can ask us to rectify or add to it.
• Where we are using your personal data with your consent, you can withdraw your consent at any time.
• Where we are using your personal data because it is in our legitimate interests to do so, you can object to us using it this way.  
• Where we are using your personal data for direct marketing, including profiling for direct marketing purposes, you can object to us doing so.
• You can ask us to restrict the use of your personal data if:
  1. It is not accurate.
  2. It has been used unlawfully but you do not want us to delete it.
  3. We do not need it any-more, but you want us to keep it for use in legal claims; or
  4. if you have already asked us to stop using your data but you are waiting to receive confirmation from us as to whether we can comply with your request.
  
  
• In some circumstances you can compel us to erase your personal data when it is no longer necessary, you withdraw consent, or you object to its processing. Please note that we are unable to erase information where we are required by law to hold it for a period of time.
• You have the right to request a machine-readable copy of your personal data be transferred to another service provider or third party.
• You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. You will be notified if we a solely automated decision which produces a legal effect or significantly affects you.

If you make a request, we have one month to respond to you. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you wish to exercise your rights, please contact us at [email protected].  

13.          How can we help? 

13. 1   If you have any questions, about the way Penny Appeal is managing your personal data (including any comments or complaint about fundraising activity), please contact us using the details below:

Email:  [email protected] 

Phone:  03000 11 11 1 

Post:  Penny Appeal, Penny Appeal Campus, Thornes Park, Wakefield, WF2 8QZ, UK. 

13. 2   For further information on data protections please contact the UK Information Commissioner’s Office (ICO). Their contact details are below: 

Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, UK

Phone: 0303 123 1113

Email: [email protected]

Website: https://ico.org.uk

14.          Changes to this Privacy Notice

This Privacy Notice will be monitored regularly and updated when there is a change in our processing activities, the data we hold or any regulatory changes relating to the processing of personal data. Any changes we make to our Privacy Notice in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our Privacy Notice.

Last updated October 2024.