At BookTrust, we are committed to protecting your personal information and privacy. This policy tells you about how we collect, use and store your personal information.
Why we collect your personal data
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We need to collect some personal details so we can respond appropriately to your contact with us. For example, as part of our work in delivering our programmes to you, to make sure we can process your donation, thank you for your support or send you information you have requested. We also collect statistical information to see how our website, social media channels and emails are performing in order to improve our communications.
When you get in touch with us directly, we may ask you for personal information. For example, if you are setting up a regular payment by direct debit, we may ask for your name, address, email address, telephone number, and your bank account details. We only collect other information, such as relevant medical information, if it is necessary – for example, to ensure your safety when you register for a challenge event.
What personal information we collect
We collect, store and use the following kinds of personal information:
- your name
- your contact details (including postal address, telephone number, e-mail address and/or social media identity)
- your employer and your job title if you have purchased items for us on their behalf
- your bank or credit card details where you provide these to make a donation or payment
- if you apply for a job with us, information necessary for us to process these applications and assess your suitability (which may include things like employment status, previous experience depending on the context, as well as any unspent criminal convictions or pending court cases you may have)
- age, nationality and ethnicity information for monitoring purposes
- if you start employment with us, your personal information will be processed in accordance with your employment contract and other applicable HR policies we have from time to time.
- information about your activities on our website(s) or social media platforms when you interact with us, and about the device you use to access these, for instance your IP address and geographical location
- information about events, activities and programmes which we consider to be of interest to you
- information relating to your health (for example if you are taking part in or attending an event for health and safety purposes)
- where you have left us a legacy, any information regarding next of kin with which you may have provided us to administer this
- information as to whether you are a taxpayer to enable us to claim Gift Aid
- any other personal information you provide to us.
Special Category Data
Certain categories of personal information are regarded by the law as more sensitive than others. This is known as 'special category' or 'sensitive personal data' and covers things like information about your health, ethnic origin, religious beliefs, political opinions or any genetic or biometric data that is used to identify you.
We do not usually collect ‘sensitive personal data’. We will only record this data where we have your explicit consent unless we are permitted to do so in other circumstances under data protection law. For example, we may make a record that a person is in a vulnerable circumstance to comply with requirements under charity law and the Code of Fundraising Practice to ensure that we do not send fundraising communications to them.
We will always make it clear when we collect this information from you what sensitive personal data we are collecting and why.
How we use your personal information
We will use personal information to:
- provide you with services, products or information you’ve asked us for
- provide further information about our work, services, activities or products
- allow you to purchase goods
- process your donations
- further our charitable aims, including for fundraising activities
- research the impact and effectiveness of our work and services
- register, administer and personalise online accounts
- register and administer your participation in events you’ve registered for
- administer and keep our website safe and secure and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes
- improve your interactions with our website, for example by making sure that content is presented in the most relevant and effective manner for you and for your computer/mobile device
- report on the results and impact of our work, services and events
- analyse and improve our work, services, activities, products or information (including our website) or for our internal records
- use IP addresses and monitor website use to identify locations, block disruptive use, record website traffic or personalise the way information is presented to you
- to process your application for a job role with us
- to work within our employment contract and HR policies
- to deliver training and/or quality control
- audit and/or administer our accounts
- satisfy legal obligations which are binding on us, for example arising from contracts entered into between you and us or in relation to regulatory, government and/or law enforcement bodies with whom we may work
- prevent fraud, misuse of services or money laundering and to perform due diligence in respect of larger donations
- reduce credit risk
- where you have agreed we may use videos, photos of you, or testimonials to promote our work including fundraising and marketing
- If you take part in a competition run by BookTrust we will only keep your data for the time period in which we are administering the competition, and we will only contact you for the purposes of the competition and if you are a winner unless you have indicated otherwise.
- If you take part in a survey run by BookTrust we will either contact you directly or use a service provider such as Snap Survey or Microsoft Forms. We will only hold your data for the purpose of completing our work on the specific survey and will only hold your data after this period with your consent for a period of 24 months unless you have indicated otherwise. We will only re-contact you following a survey if you have expressed consent.
- communicate with you in any other legally permissible way.
We may occasionally conduct research and analysis in respect of current or potential donors, either on an anonymous or identifiable basis in order to better understand who our supporters are and to continually strive to make our fundraising efforts as relevant and effective as possible.
At times we use profiling and screening techniques to ensure communications are relevant and timely, and to provide an improved experience for our supporters. It also allows us to target our resources effectively. We do this because it allows us to understand the background of the people who support us and helps us to make appropriate requests to supporters who may be able and willing to make a major gift. Importantly, it enables us to raise more funds, sooner, and more cost-effectively, than we otherwise would.
When building a profile we may analyse geographic, demographic, and other information relating to you in order to better understand your interests and preferences in order to contact you with the most relevant communications.
We use data which has been provided directly to BookTrust and combine this with information from publicly available sources such as charity websites and annual reviews, corporate websites, public social media accounts, the electoral register and Companies House in order to create a fuller understanding of someone’s interests and support of BookTrust. We only use reputable sources, where someone would expect their information may be read by the public. We avoid any data that we believe has not been lawfully or ethically obtained, and we do not use information sources which have not been made public. We do not seek consent to conduct this research but rely on legitimate interest as our lawful basis.
If we do conduct research on you we will notify you at the first available opportunity so that you have the opportunity to view the information we have collected and request its deletion. If we are unable to notify you within six months, then our policy is to proactively delete this information from our records.
We’re committed to putting you in control of your data and you’re free at any time to opt out from this activity. To find out more, please contact 020 7801 8800 or email@example.com or you can write to us at BookTrust, G8 Battersea Studios, 80 Silverthorne Road, Battersea, London SW8 3HE
Our lawful grounds for processing your personal information
The law requires us to set out the lawful grounds on which we collect and process your personal information as described in this policy. Depending on the purposes for which we use your data, one or more of the grounds listed below may be relevant:
Consent is where we ask you if we can use your information in a certain way, and you agree to this (for example when we send you marketing material via, phone, text or e-mail). Where we use your information for a purpose based on consent, you have the right to withdraw consent for any future use of your information for this purpose at any time.
In some cases we must collect personal information in order to comply with one of our legal or regulatory obligations. For example, may need to share your information with our various regulators such as the Charity Commission, Fundraising Regulator or Information Commissioner or to use information we collect about you for due diligence or ethical screening purposes.
Performance of a contract
We have a basis to use your personal information where we are entering into a contract with you or performing our obligations under that contract for example, if you are applying to work/volunteer with us.
We must use your personal information where it is necessary for us to protect life or health. For instance if there were to be an emergency impacting individuals at one of our events, or a safeguarding issue which required us to contact people unexpectedly or share their information with emergency services.
We rely on the legitimate interest basis for processing where we believe it is in the legitimate interests of you, as the data subject, or of BookTrust, to process your data. When we process your personal information in this way, we also consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We will not use your personal information for activities where our interests are overridden by the impact on you, for example where collection and use of your information would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law). We will only use your information in accordance with the purposes described in this policy.
Examples of processing based on the legitimate interests ground are:
- Sending direct marketing material to supporters by post for fundraising purposes
- Communicating with you about programmes you receive from us;
- Conducting research to better understand who our supporters are and better target our fundraising activity;
- Measure and understand how our audiences respond to a variety of marketing activity so we can ensure our activity is well targeted, relevant and effective;
- Administering events;
- Sending relevant communications to you
- Staff recruitment and taking applications
How long we keep your information for
We only keep your information for as long as we need to and we take into account various criteria when determining the appropriate retention period for personal data including:
the purposes for which we process your personal data and how long we need to keep the data to achieve these purposes:
- how long personal data is likely to remain accurate and up-to-date;
- how long the personal data might be relevant to possible future legal claims;
- any applicable legal, accounting, reporting or regulatory requirements which specify how long certain records must be kept.
How we keep your data safe
We take all appropriate measures to ensure your personal information is kept secure. Personal information stored electronically is kept on secured servers with limited access from appropriate staff for as long as is necessary for the fulfilment of our legal obligations or our obligations to you. To ensure our staff understand and are able to keep your data secure, all BookTrust staff receive data protection training.
We sometimes use agencies and suppliers to process personal information on our behalf. Your personal information may therefore be transferred or stored outside, and/or otherwise processed by contractors operating outside, the UK who work for us or for one of our suppliers.
Some countries outside of the UK have a lower standard of protection for personal information, including lower security requirements and fewer rights for individuals.
Where your personal information is transferred, stored and/or otherwise processed outside the UK, we’ll take all reasonable steps necessary to make sure the recipient implements appropriate safeguards (such as by entering into standard contractual clauses) designed to protect your personal information and to ensure that your personal information is treated securely and in accordance with this policy.
Please note that while we have taken every appropriate measure to secure your data, transmission of information over the internet is never 100% secure so while we take all possible precautions, we can’t 100% guarantee the security of any information you submit to us via our website.
Who we share your personal information with
We will never sell or share your personal information with other organisations who can contact you except where we are required to by law. We work with suppliers or professional agents to process your data, for example in order to process direct debits or to send out book parcels. When we do this, we always put in place legal agreements with these third parties governing how your data will be used. These third parties have been carefully chosen.
These may include (among others):
- business partners, suppliers and sub-contractors
- independent event organisers, for example fundraising sites like JustGiving
- advertisers and advertising networks
- analytics and search engine providers
- email marketing tools, which uses a tracking pixel to monitor when you interact with our emails, such as open, click or unsubscribe
- IT service providers
- other beneficiaries, executors and legal advisers, when administering a legacy.
We reserve the right to disclose your personal information to third parties if we are under any legal or regulatory duty to do so.
How you can update your contact details and preferences
You can update your contact information and contact preferences by getting in touch with our Supporter Care Team:
020 7801 8800
BookTrust G8 Battersea Studios, 80 Silverthorne Road, Battersea, London SW8 3HE
To stop receiving emails from us at any time please contact the Supporter Care Team using the details above or you can click the unsubscribe link at the bottom of an email from us. Remember: if you make a donation or request information online you will receive a one-off transactional email about that activity for your records.
Your rights under the current data protection laws
Under UK data protection law, you have rights over personal information that we hold about you:
Right to access your personal information
You have a right to request access to the personal data that we hold about you. You also have the right to request a copy of the information we hold about you, and we will provide you with this unless legal exceptions apply.
Right to have your inaccurate personal information corrected
You have the right to have inaccurate or incomplete information we hold about you corrected. If you believe the information we hold about you is inaccurate or incomplete, please provide us with details and we will investigate and, where applicable, correct any inaccuracies.
Right to restrict use of your personal information
You have a right to ask us to restrict the processing of some or all of your personal information in the following situations: if some information we hold on you isn’t right; we’re not lawfully allowed to use it; you need us to retain your information in order for you to establish, exercise or defend a legal claim; or you believe your privacy rights outweigh our legitimate interests to use your information for a particular purpose and you have objected to us doing so.
Right to erasure of your personal information
You may ask us to delete some or all of your personal information and in certain cases, and subject to certain exceptions, you have the right for this to be done.
Right for your personal information to be portable
If we are processing your personal information (1) based on your consent, or in order to enter into or carry out a contract with you, and (2) the processing is being done by automated means, you may ask us to provide it to you or another service provider in a machine-readable format.
Right to object to the use of your personal information
If we are processing your personal information based on our legitimate interests or for scientific/historical research or statistics, you have a right to object to our use of your information.
If we are processing your personal information for direct marketing purposes, and you wish to object, we will stop processing your information for these purposes as soon as reasonably possible.
If you want to exercise any of the above rights, please contact us by post to Data Protection Officer, G8 Battersea Studios, 80 Silverthorne Road, Battersea, London, SW8 3HE, by email firstname.lastname@example.org or by phone 020 7801 8800
We may be required to ask for further information and/or evidence of identity. We will endeavour to respond fully to all requests within one month of receipt of your request, however if we are unable to do so we will contact you with reasons for the delay.
Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office.
If you're concerned about the way your personal data is handled, please contact the Data Protection officer by email email@example.com, by phone on 020 7801 8800 or in writing to Data Protection Officer, BookTrust G8 Battersea Studios, 80 Silverthorne Road, Battersea, London SW8 3HE
You can find out more about how we respond to complaints by reading our policy here
The Information Commissioner's Office (ICO) regulates data protection and privacy matters in the UK. They make a lot of information accessible to consumers on their website and they ensure that the registered details of all data controllers such as ourselves are available publicly. You can access them here: https://ico.org.uk/your-data-matters/
You can contact the Information Commissioner’s Office on 0303 123 1113, via their website www.ico.org.uk or via post:
Information Commissioner’s Office