Your privacy is important to us. When we process your personal data we comply with the UK GDPR and the Data Protection Act 2018, together with any other applicable data protection and privacy legislation.

Your personal data includes all the information we hold that identifies you or is about you. More information about the types of personal data we process about you is set out below.

Everything we do with your personal data counts as processing it, including collecting, storing, amending, transferring and deleting it. We will comply with the relevant legislation to make sure that your information is properly protected and used appropriately.

This privacy policy provides information about the personal data we process about you, why we process it and how we process it. It applies to customers and suppliers as well as candidates contacting us in relation to job vacancies.

Our responsibilities

Yorkshire Children’s Charity (with registered address at 116-118 Harrogate Rd, Chapel Allerton, Leeds LS7 4NY and registered charity number 1196738) is also referred to as “we”, “us”, or “our” throughout this privacy policy, is the controller of the personal data you provide.

If you have any questions, would like more information about the ways in which we process your data or wish to exercise any of your rights detailed below, please contact hello@www.yorkshirechildrenscharity.org.

What data do we process about you?



Website contacts and donors
We process personal data about you when you submit an enquiry to us, ask us to send you marketing or contact us, make a donation, enrolling to attend any of our events or for any other reason. If you use are website for any of these reasons, we may ask you to provide your name, the details of the company for which you work (if applicable), your address, email address and a contact telephone number, payment details (bank card details) and details of your enquiry.

We will also process any additional personal data you provide as part of your message to or communications with us.



Beneficiaries/Potential Beneficiaries
Where you are making an application for a grant either as a beneficiary or on behalf of a potential beneficiary, we may ask you to provide yours/the beneficiaries name, address, email address, bank details, contact telephone number, details of any relevant medical condition, contact details for your GP or occupational therapist and in certain situations medical records.



Business Contacts
We may also process your personal data if you are one of our business contacts (including attendees at any event we host), in which case it will usually consist of your name, email address and contact number as well as information about the organisation at which you work.



Candidates
Personal data that we are likely to process about you includes:

identity data such as your first name, middle names, last name, marital status, title, date of birth and gender;
contact data such as your postal address, email address and telephone numbers;
background data such as your education, career background and work experience;
personal information such as your skills and qualities;
a copy of your passport; and
any other information that you include on any CV, application or covering letter you send to us.
Why do we process your personal data?

Website contacts and Business Contacts
We will process your personal data if you provide your personal data to us through are website or as a business contact in order to maintain our relationship with you, to investigate and respond to any query you may have raised, to provide information about any upcoming events and provide or receives products and/or services from your organisation.

In these circumstances we process your information on the grounds of our legitimate interests and/or the fulfilment of a contract with you (or the organisation for which you work).

Donors
We will process your personal data provided by you where you are making a charitable donation to us in order to administer your donation or support your fundraising (including processing Gift Aid), and we will process such information on the grounds of legitimate interests and/or the fulfilment of a contract with you (or the organisation for which you work).

Beneficiaries/Potential Beneficiaries
We will process your personal data (whether provided by you or a third party) to assess whether you are an appropriate beneficiary to receive our support. If an application to become a beneficiary is approved, we will also process such personal data in order to provide support to you whether this is financial, through the purchase of equipment or services or otherwise. We will process this information on the grounds of our legitimate interests.

Where we are required to process special category data (e.g. medical history) we will process this information on the grounds of your consent which will be obtained prior to receiving any special category data.



Candidates
We will process your information on the grounds of our legitimate interests to determine whether or not we have a suitable vacancy for you. To the extent we need to process special categories of data about you (for example, to ensure our premises are suitably equipped for you if you attend for an interview or to assess your right to work), we will do so in accordance with our legal obligations. If you provide special categories of data to us which we have not requested, we will process it on the grounds of your consent because you have voluntarily provided the information to us.

Marketing
We will get your express opt-in consent before we send you any marketing material or share your personal data with any third party for marketing purposes.

Our collection of your personal data

We use different methods to collect data from and about you including through:

Direct interactions
You may give us your personal data by filling in forms on our website or by corresponding with us by post, phone, email or otherwise. This includes (but is not limited to) personal data you provide when you: submit a query about/sign up to attend an event we are hosting whether on our website or by email or phone; request for marketing to be sent to you; give us feedback or raise a query; make a donation or contact us for other business relationship management purposes.

General Practitioner or Occupational Therapists
In certain situations, for example where you are applying for a grant for equipment to assist with a medical condition or where your GP is requesting our support to purchase such equipment, we may obtain your personal data from health practitioners such as your GP or occupational therapist.

Automated technologies or interactions
As you interact with our website, we may automatically collect personal data about you. You can find out more information in our cookie policy available [here].

Recruitment agencies
We may utilise the services of recruitment agencies to assist in recruiting for any vacancy and they may provide your personal data to us.

Who will receive your personal data?

Your personal data is only transferred to the extent that this is necessary. Recipients of your personal data may include:

the Charity Commission;
partner charities who have similar charitable objects to us;
suppliers and manufacturers of equipment we are purchasing on your behalf;
third parties who assist with the hosting and organisation of our fundraising events including but not limited to: event committees, venues, printing companies, catering companies, volunteers and other charities;
legal advisers to the extent they need to see your personal data to provide us with legal advice; and
if you are a candidate, we may provide feedback to you via the recruiter that recommended you to us.
In addition to the above, suppliers who provide IT services and manage the operation of our website to us may have access to your personal data when they take control of our IT systems remotely in order to resolve any technical issues we are experiencing or to run any system updates.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

We do not transfer your personal data outside of the EEA.

How long will we keep your personal data?

Website contacts, donors, suppliers and business contacts
Your personal data is retained for no more than 6 years. It is retained for this period in case any issues arise or in case you have any queries. Your information will be kept securely at all times. Following the end of the retention period, your files and personal data we hold about you will be permanently deleted or destroyed. If we are required to obtain your consent to send you marketing communications, any information we use for this purpose will be kept until you withdraw your consent, unless we have other legitimate reasons to retain the data.

Beneficiaries
We will not retain your personal data for any longer than we need to retain it to achieve the purposes for which it was collected. Generally speaking, we will retain your personal data for 6 years following the later of the date an application to become a beneficiary was made or the last date on which we provided support to you as a beneficiary. In certain circumstances, information may be retained for longer than 6 years where we have purchased equipment for you which is likely to last longer than 6 years.

Candidates
If you are successful, we will retain your personal data in line with our employee facing privacy policy, a copy of which will be provided to you. If you are unsuccessful, we will retain your application, CV and/or covering letter and any other personal data you provided to us for 1 year from the date we reach our decision in case any other suitable roles arise in which we think you may be interested, or in case you have any questions about our decision. After that date, your personal data will be permanently deleted or destroyed.

What are your rights?

You benefit from a number of rights in respect of the personal data we hold about you. We have summarised your rights below, and more information is available from the Information Commissioner’s Office website (https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/). These rights apply for the period in which we process your data. There are certain caveats and exemptions to those rights which mean that in some circumstances you may not be entitled to exercise them, if we believe that is the case upon receipt of a request from you, we will let you know.

Access to your data
You have the right to ask us to confirm that we process your personal data, as well as access to and copies of your personal data. You can also ask us to provide a range of information, although most of that information corresponds to the information set out in this fair processing notice.

Rectification of your data
If you believe personal data we hold about you is inaccurate or incomplete, you can ask us to rectify that information.

Right to be forgotten
In some circumstances, you have the right to ask us to delete personal data we hold about you.

Right to restrict processing
In some circumstances you are entitled to ask us to suppress processing of your personal data. This means we will stop actively processing your personal data but we do not have to delete it.

Data portability
You have the right to ask us to provide your personal data in a structured, commonly used and machine-readable format so that you are able to transmit the personal data to another data controller.

Right to object
You are entitled to object to us processing your personal data:

if the processing is based on legitimate interests or performance of a task in the public interest or exercise of official authority;
for direct marketing purposes (including profiling); and/or
for the purposes of scientific or historical research and statistics.
We do not intend to use your personal data to send you direct marketing nor for scientific or historical research and statistics.

Automated decision making

Automated decision making means making a decision solely by automated means without any human involvement.

We do not carry out any automated decision making using your personal data.

Your right to complain about our processing

If you think we have processed your personal data unlawfully or that we have not complied with GDPR, you can report your concerns to the supervisory authority in your jurisdiction. The supervisory authority in the UK is the Information Commissioner’s Office (“ICO”). You can call the ICO on 0303 123 1113 or get in touch via other means, as set out on the ICO website – https://ico.org.uk/concerns/.

Changes to this privacy policy and your duty to inform us of changes

We keep this policy under regular review and reserve the right to update it at any time.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes