SHELTERBOX PRIVACY POLICY
UPDATED MAY 2018
What this privacy policy covers
ShelterBox is committed to protecting your personal information and being transparent about what information we hold.
Developing a better understanding of our supporters through their personal data allows us to fundraise more efficiently, which ultimately helps us to ensure no family goes without shelter. We have made improvements to this policy so that transparency is at the core of what we do, especially around our policy on profiling and wealth screening.
The purpose of this policy is to give you a clear explanation about how ShelterBox collects and uses the personal information you provide to us and that we collect, whether online, via phone, email, in letters or in any other correspondence or from third parties.
We ensure that we use your information in accordance with all applicable laws concerning the protection of personal information. This policy explains:
- What information ShelterBox may collect about you;
- How we will use that information;
- Whether we disclose your details to anyone else;
- Your choices regarding the information you provide to us;and
- How we use cookies to provide services to you or to improve your use of our websites.
Our details
ShelterBox Trust is a charitable company limited by guarantee in England and Wales Company number: 04612652 Charity number: 1096479 ICO registration number: Z928330X
ShelterBox is a charity, independent of Rotary International and the Rotary Foundation.
Contacting us
If you would like to make an enquiry about data protection, update the information we hold about you, request or opt out of receiving marketing communications or change the way we process your information, you can let us know in the following ways:
- Email: [email protected]
- Phone: +44 (0)1872 302600
- Post: Supporter Care, ShelterBox, Falcon House, Charles Street, Truro, TR1 2PH
You can also use these details if you would like to make a request to access the information we hold about you (see ‘Your rights’ section at the end of this document).
To raise a concern about how your personal information has been used please contact us on the details listed.
If you would like to make a complaint, or would like more information about our complaints process please email [email protected]
Alternatively, you are entitled to raise a concern to the Information Commissioner’s Office (ICO) without first referring your complaint to us. See here for more information.
1. Information we collect about you
Personal information is collected directly from you when you interact with ShelterBox, for example making a donation, sending or receiving an email, making an enquiry, visiting our websites, applying for a role with us, participating in an event or when signing up for our newsletter.
Information may be collected in person, over the phone, through our websites, social media or from something you’ve posted to us. Some information is vital in order for us to process a donation and is legally required, other information will be used to ensure we communicate with you in the right way.
The information we hold will typically include some of, or all of, your name, postal and email addresses, your phone number, and may include information like your date of birth and your bank details if you are supporting us financially, for example through a regular monthly donation. We may on occasion also research information about you from other sources (including public sources). This is explained in the ‘How we might use your information’ section below.
Our legal basis for contacting you and using your personal information
When we collect and use your personal information, we will make sure this is only done in accordance with at least one of the legal grounds available to us under Data Protection law.
One of these is where we have obtained your specific consent to use your information for a previously notified purpose, such as to send you email/text marketing or to provide you with a product, service or information at your request.
Another is where we have a legal obligation to use or disclose information about you – for instance, where we are ordered by a court or regulatory authority or we are legally required to hold donor transaction details for Gift Aid or accounting/tax purposes.
In certain instances, we may collect and use personal information where this is necessary in our legitimate interest as a charity, this includes being able to:
- send direct marketing material to supporters by post or contacting them by telephone for fundraising purposes (subject to checking against the Telephone Preference Service and any existing marketing preferences).
- conduct research to better understand who our supporters are and better target our fundraising activity to ensure resources are used in the most cost effective way.
- monitor who we deal with to protect our charity against fraud, money laundering and other risks;
- maintain and administer our donor database and systems for audit trail purposes and to ensure we are communicating with you in your preferred way.
In all cases, we carefully consider your rights as an individual and make sure we only use personal information in a way or for a purpose that you would reasonably expect in accordance with this Policy and that does not intrude on your privacy or previously expressed marketing preferences. We always carefully balance our legitimate interests against your rights as an individual, to ensure the best possible outcome for the families who need our support.
Marketing Materials
We want to ensure you receive the level of information about ShelterBox that is right for you, and will ensure that we honour your communication preferences.
Email/text marketing
If you actively provide your consent to us along with your email address and/or mobile phone number, we may contact you for marketing purposes by email or text message. By subscribing to ShelterBox emails or opting in to email communication from ShelterBox, you grant us the right to use the email for both email marketing purposes and advertisement targeting.
Post/telephone marketing
If you have provided us with your postal address or telephone number we may send you direct mail or telephone you about our work unless you have told us that you would prefer not to receive such information in this way. We also actively check telephone numbers against the Telephone Preference Service. We will only make telephone calls to you where your telephone number is listed on the TPS if you have specifically told us that you do not object to such calls and have consented to receive them.
We will only write to your postal address if you have provided your address and not opted out of receiving communications, or if we judge it to be in your legitimate interest to be written to, for example to provide a receipt for your donation. You can up-date your preferences and opt out of receiving communication to your postal address at any time, see Contacting us section above.
Your choice
It is always your choice as to whether you want to receive information about our work, how we raise funds and the ways you can get involved. If you do not want us to use your personal information in these ways please indicate your preferences on the form on which we collect your data.
You can let us know at any time if you’d prefer to change how we share this information with you or stop it altogether. Simply use the details we’ve provided in the ‘Contacting us’ section to let us know your preferences. If you receive our e-newsletters, you can also use the unsubscribe link in the emails we send.
We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted by us for such purposes. However, we will retain your details on an unsubscribe list to help ensure that we do not continue to contact you.
How we might use your information if you are a supporter who receives marketing materials or makes donations
We may use your information for administration purposes.
When you make a donation or other payment to ShelterBox, we will use your payment and contact details, payment amount, date and time of payment; to process that payment and take any follow-up administrative action needed (for example, sending a receipt).
If you choose to include Gift Aid with a donation to us, then we will also ask for your address and UK taxpayer status as this information is required by law. You can read more about how Gift Aid works here. This information is needed for us to fulfil our obligations under tax (sections 413 to 430 Income Tax Act 2007) and charity law. Information associated with Gift Aid declarations must be retained for 7 years. This information will be shared with HMRC for tax regulation purposes and may also be shared with the Fundraising Regulator and the Charity Commission in the event of an enquiry or investigation.
Responding to enquiries
Conversations with you matter to us. If you contact us with a question, comment, compliment or complaint then we will keep a record of this correspondence and any associated documents so that we have the information available in the event of a follow-up, dispute or investigation, and so that we can be as helpful as possible in quickly and efficiently providing you with any information you might be seeking.
Notifying you of changes to policies
If we make significant changes to our policies which may affect you, we will use your contact details to inform you of the changes.
Requesting information if you are attending our events
If you participate in an event that we have organised, we may ask you to provide information to make sure we can manage the event safely and efficiently. We may also ask you for details of any accessibility need which you may have, so that we ensure our event is inclusive (in line with the provisions of the Equality Act 2010).
If you participate in an event organised by an external party or make a donation through a processor like JustGiving, then your information may be passed to us by the processor. We would only use it for marketing purposes if you have given your consent for this.
We may use your information to invite you to become involved with us in new ways, raise funds and grow our supporter base.
Targeting our communications and researching our supporters
We are committed to spending your donations wisely, and that means being as informed and targeted with our decisions as possible. We want to send the most effective messages that we can in the most efficient way possible. In order to do this, we may carry out the following activities:
Email or SMS marketing
If you have opted in to receive email updates from us, we will contact you from time to time to share information with you about where we’re working, who you’re helping, and how you can get involved. If you change your mind and no longer wish to receive our marketing emails, you can click the ‘unsubscribe’ link at the end of our marketing emails at any time. You can also contact our Supporter Care team on [email protected], or by calling 01872 302600.
We will not market to you via SMS without your consent. You are able to unsubscribe at any time by replying to the message with the word STOP or contacting our Supporter Care team on [email protected], or 01872 302600.
Analysing how emails are opened and read
We track emails which we have sent to you to see which messages have the highest response rates and whether there are messages that resonate with particular groups of people. We do this by logging whether emails we send have been opened, deleted and interacted with (for example, by clicking on links within the emails). Although we only use this information to look at general patterns, it is still personal information because it is linked to your email address.
Segmentation
This is where we analyse information such as postcodes of supporters, and whether donations have been given regularly. This helps us to tailor appropriate communications to you, as well as improve your experience as a ShelterBox supporter. For example, if we see that you have only ever donated to us at a time of major disaster, we may only contact you in future in the event of another major disaster, rather than including you in updates about other aspects of our work.
Digital advertising
Where you have agreed to receive email or SMS marketing communications from us, we may provide your email address or mobile phone number in an encrypted format to:
- social media companies, such as Facebook, Instagram, Twitter or YouTube, or
- digital advertising networks that are providing services to us by displaying our advertising to you on those social media platforms and other websites, as well as identifying audiences with interests similar to yours.
You can opt out of your data being used to display advertising to you by contacting our Supporter Care Team at [email protected], or by calling 01872 302600. However, this will not prevent our advertisements being shown to you on a randomised basis or based on cookie data.
Analysing our supporter base to send different communications to people who might give higher amounts or in different ways
We undertake research to help us identify people who may give higher amounts or in other ways, for example by leaving a gift in a will. Most of that research is conducted in-house but we may also use research from external organisations like Experian or Factary. Whether done in-house or with the help of trusted third parties, our goal is to communicate with you in the most interesting, relevant and effective way.
Examples of sources we might use:
- Public registers (such as the Electoral roll, Companies House, and Charity Commission) and aggregators that collate info from same sources (Duedil, 192.com and Directory Enquiries for example)
- Subscription services (Directory for Social Change and Trustfunding.org are two examples.)
- Public records of other charities or organisations you might support, for example, if you are patrons of the British Museum.
- Professional registers, posts on professional networking sites like LinkedIn, and company websites and annual reports.
- Articles about you in newspapers or magazines
- Internet search engine results
Finding other people like you who might like to hear from us
We may use the email address you give us to help find more people like you, so that we can grow our supporter base through our online channels. We use third party services to do this which you are likely to be familiar with, including Google, Facebook and Twitter.
We may also use publicly available information about you to help find other likeminded people who may be interested in supporting ShelterBox. These sources provide broad demographic information based on where you live, for example geographic location, type of household, media consumption, likely interests and hobbies. If we understand these common interests we can invest our resources more efficiently to reach people who are more likely to be interested in supporting our work.
When might we add information to your record that you may not have given to us directly?
We may also add information or update your record with us, from publicly available sources. This may include address related information, information from death registers, age or the information mentioned in the section above ‘Targeting our communications and researching our supporters’. We use this information to tailor our communications with you and send you more appropriate information and be as efficient as possible. For example, if you have moved house but forgotten to tell us, we may add this information from external publicly available sources to avoid sending mail to the wrong address.
These activities form a vital part of keeping support for our work going. You can request more information on these activities, or change your preferences, by using the information in the ‘Contacting us’ section at the beginning of this document.
We may use your information to enforce and comply with the law
As with all charities, we ensure that our activities comply with the law. Therefore, we may need to share or use your personal information if we are required to do so by law (for example, in response to a warrant or court order) and we may use information from other sources for the purposes of fraud prevention, for example to comply with money laundering regulations, or to protect people’s rights, property or safety.
If certain levels of donation are made, the Fundraising Regulator’s Code of Fundraising Practice requires us, and all charities in the UK, to perform checks. More details can be found at www.fundraisingregulator.org.uk
Your debit and credit card information
If you use your credit or debit card to donate to us, or pay for a registration online or over the phone, we will ensure that this is done securely and in accordance with the
Payment Card Industry Data Security Standard. You can find our more information about PCI DSS here – https://www.pcisecuritystandards.org/security_standards/index.php
We do not store your credit or debit card details at all, following the completion of your transaction. All card details and validation codes are securely destroyed once the payment or donation has been processed. Only staff authorised and trained to process payments will be able to see your card details.
If we receive an email containing any credit or debit card details, it will be immediately deleted, no payment will be taken and you will be notified about this.
How we use social media
We operate a number of social media pages (including Facebook, Twitter, LinkedIn, Instagram and YouTube). This policy covers how we will use any data collected from those pages. It does not cover how the providers of social media websites will use your information. Please ensure you read the privacy policy of the social media website before sharing data and make use of the privacy settings and reporting mechanisms to control how your data is used.
2. How we might use your information if you are applying for a role within shelterbox
Your CV, covering letter and application form for any position with ShelterBox will be used during the recruitment process to short-list suitable candidates who will be invited to proceed to the interview stage, and to select the final candidate that the role will be offered to.
We sometimes use third-party job application platforms to publish and receive applications for roles at ShelterBox. When you apply through these portals the organisation’s privacy information will be available to you. We only work alongside other organisations in this way if we are satisfied that they will keep your information safely and use it only in the same legal ways that we would.
During the recruitment process, we will perform some checks on your identity, your right to work in the UK, your eligibility to work with vulnerable people and your past employment references. If we deem a DBS check necessary for your role, in order to process the check, we will send an applications via the Cornwall County Council portal. This keeps confidential, electronic records for a maximum of seven years. This portal’s privacy information will again be available to you.
If your application is successful, this information will then form part of your personnel file.
We delete the personal information of unsuccessful applications six months after the application process ends in case there are follow-up queries about the process, unless a candidate requests that we keep their details for longer. After these six months all details are deleted from our own records, as well as from the external recruitment platform. Statistical information like ethnicity, sexuality and disability is kept to ensure that our recruitment processes are inclusive and not discriminatory, but this is completely anonymised.
If we are required by law to share your information, (for example; in response to a warrant or court order), we will do so.
All employee information is kept securely and only if we have a legitimate interest for keeping it (for example payroll requirements). This information is stored securely internally and also via an external HRIS platform (CIPHR). All standard employee records will be deleted after six years.
3. How we might use your information if you have visited our website
Cookies and IP address
We may collect information about your computer, including where available your IP address, operating system and browser type, for system administration. This is statistical data about browsing actions and patterns, and does not identify any individual.
We log the IP address of the computer you are using in order to protect our servers against abuse and malicious activity. The logs are deleted every 60 days. Other information is used to measure the performance of the website, the volume of traffic that the site receives, how users move around the site and what sort of users the site attracts. This is statistical data that help us identify actions and patterns, and does not identify and individual.
When you access our website, some cookies are saved to your computer, for example if you have chosen a particular language setting or created a user account. Cookies are small text files that are automatically placed onto your device by some websites that you visit. They are widely used to improve the performance of a website, for saving different options and to provide website owners with information on how the site is being used.
Cookies enable us to:
- estimate our audience size and usage pattern.
- store information about your preferences, and so allow us to customise our site according to your individual interests; and
- recognise you when you return to our site.
We use cookies to enhance the experience of the website, to increase the performance, to identify how the website is being used and where we can make improvements and to monitor how our advertisements perform. Some of our cookies are vital for the website to operate effectively and others are optional, but may decrease the usability or performance of the website.
You can turn off your cookies so that we can’t access that information. However if you select this setting you may be unable to access certain parts of the website.
Analytics
We use Hotjar, a service that analyses the online behaviour of visitors to our website.
It uses a combination of analysis tools and feedback tools that allow Hotjar and ShelterBox to measure and observe what you do on our site, and hear what you have to say. This site uses a tracking code which contacts Hotjar’s servers and provides a script to the computer or device accessing our website. The script captures non-personal information including standard internet log information and details of your behavioural patterns on the site. This information is then sent to Hotjar’s servers for processing. When collecting data with Recordings, Hotjar also has various automated suppression features in place and data is suppressed in your browser, meaning personally identifiable information never reaches our servers keeping your session private.
We use this tool to provide you with a better experience, identify preferences, diagnose technical problems, analyse trends and generally to improve the website. You can opt out from Hotjar here.
Other information that might be collected
- information that you provide by filling in forms on our site www.shelterbox.org. This includes information provided at the time you sign up for our newsletter. We may also ask you for information when you report a problem with our site;
- if you contact us, we may keep a record of that correspondence; and
- details of your visits to our site and the resources that you access.