Privacy notice

We gather personal data from our supporters, volunteers, campaigners, clients and customers so that we can improve your experience, fundraise more efficiently and together achieve our vision.

The 'personal data' we collect is protected by specific data protection legislation i.e.

• The UK Data Protection Act 2018 and the Isle of Man Data Protection Act 2018 which incorporates the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679)
• The Privacy and Electronic Communications Regulations (PECR)

As the laws about personal data continue to develop, we will update our privacy notice accordingly and let you know about any changes.

Our services are not designed for, or intentionally targeted at, children 17 years of age or younger. We do not intentionally collect or maintain data about anyone under the age of 18.

It is really important to us that our supporters, volunteers, campaigners and clients can access and understand why and how we use their personal details and what your rights with regards your personal data and how we are processing it. It also sets out how to lodge a complaint with the Information Commissionaire's Officer (ico), should you have any concerns over how Leonard Cheshire are handling your personal data.

This privacy notice sets out:

• The name and contact details of our organisation
• The contact details of the data protection officer
• The rights available to individuals in how we handle your data
• The right to lodge a complaint with the Information Commissioners Office
• How to navigate the privacy notice to find out more detailed information about how we process your personal data for the range of purposes we collect it for.

There are a number of processing activities that apply across the whole organisation and these are set out below:

• IT systems management
• Archiving
• Secure destruction of information

You will note that throughout each service, if there are specific areas that relate to their processing, it will be explained specifically.

For the activities mentioned above, we use what’s known as a Data Processor to manage these areas.  In all cases we ensure that the data processor is fully compliant with all data protection legislation and have a contract in place to ensure this compliance.

Our name and postal address at Head Office is:

Regus 
The News Building 
3rd Floor 
3 London Bridge Street 
London 
SE1 9SG 
Email: info@leonardcheshire.org (use for general enquiries) 
Telephone: 020 3242 0200

Our Data Protection Officer and the Information Governance Team can be contacted at ig@leonardcheshire.org or via our postal address shown above. Please mark the envelope 'Data Protection Officer'.

Please use these contact details if you have any questions, issues or concerns, or if you wish to register a complaint.

You have a number of rights with regard to your data and how it can and can't be processed. Each of these specific rights is discussed in more detail below.

Right to be informed

You have the right to be kept informed about how we process your personal data. Our privacy notice has therefore been designed to provide you with specific information about how we use and work with your personal data. You can always contact us if you would like further information about your personal data or your rights.

Right of access

You have the right to see the personal data we hold about you. This is called a Subject Access Request. If you would like a copy of the personal data, we hold about you, please write to us using the contact details supplied above.

Right to rectification

You have the right to have personal data rectified if you believe we hold inaccurate or missing information, please let us know and we will correct it.

Right to object

You have the right to object to the way we process your personal data.

If you raise a general objection with us about the use of your personal information or about how we are processing it and it is concluded that you rights outweigh our interest in using your personal data, then we will at your request either restrict our use of it (see the right to restrict processing below) or delete it (see the right to be forgotten section below).

If you raise an objection in relation to direct marketing we will stop using your personal data for direct marketing purposes.

Right to restrict processing

There are several situations when you can restrict our use of your personal data, this includes (but is not limited to):

1. You have successfully made a general objection as discussed in the rights to object section above.
2. You are challenging the accuracy of the personal data we hold.
3. We have used your personal data unlawfully, but you do not want us to delete it.

Right to be forgotten

There are several situations when you can have us delete your personal data, this includes (but is not limited to):

• We no longer need to keep your personal data.
• You have successfully made a general objection (listed the right to object section above).
• You have withdrawn your consent to us using your personal data (and we do not have any other grounds to use it).
• We have unlawfully processed your personal data.

In some specific circumstances, however, we may need to keep your details and the right to be forgotten doesn’t apply. For example, it may be necessary to hold your details to comply with a legal obligation. If this is the case, we will always explain this and discuss it with you.

Rights related to automated decision making and profiling

You have the right to be told if we use any automated decision making processing or profiling. This will be indicated on the relevant privacy notice specific to the type and nature of the processing. At any point in time, you have the right to request that we do not use automated processing to make decisions about how we use your personal data.

Right to data portability

Data portability is your right to obtain and reuse the personal information that you have provided to Leonard Cheshire for your own purposes across different services. However, there are some situations where these rights may not apply. If this is the case, we will always explain why.

If you are not happy with how we are handling your data or how we have responded to any complaints you have raised with us, you also have the right to complain to the UK data protection regulator (the ICO) about how we have used your personal data.

For more specific detail about how we process your personal data for the various purposes for which we collect it, this privacy notice has been broken down into the following high-level processing areas:

• Marketing and fundraising
• Partnerships
• International
• UK social care services
• Finance
• Human resources

Under each of these high-level processing areas you will find more specific information about what, how and why we are processing your personal data:

• The purpose of processing
• The legal basis we use for  processing
• What data we need
• Why we need the data and what we do with it
• How long we keep the data
• What are your rights?
• Do we use any data processors?
• Do we make any overseas transfers?
• Do we use any automated decision-making including profiling?