​LEGAL BASIS FOR PROCESSING 

 

In many of the countries where we operate, data protection law requires us to process personal data only where we have an approved basis under the law. You have the right to understand what our legal bases are, so we explain them here. We use the following bases, depending on the activity we undertake: 

 

Performing a contract

In most cases, the data we collect and how we use it are necessary for us to provide our services.

 

Complying with the law

Some of the activities we undertake are necessary to comply with our legal obligations as a charity. 

 

Meeting our legitimate interests

We use personal data as necessary to meet our legitimate business interests. When we do, we make sure we understand and work to minimise its privacy impact. For example, we limit the data to what is necessary, control access to the data, and where we can, aggregate or de-identify the data. 

 

What is legitimate interest?

Under UK GDPR Article 6(1)(f), companies have the ability to engage in activities without consent under a balancing test. In other words, questioning whether we have legitimate interest in engaging in the activity that is not outweighed by the interests or fundamental rights and freedoms of the data subject.

​

​OUR MARKETING AND YOUR CHOICES

​

We have a legitimate interest in engaging in marketing activities if: 

• You have requested information from us 

• Purchased a product or a service

• Provided us with your details

• Entered a competition or registered for a promotional activity

 

We respect your right to opt out of these activities, which you can do at any time by clicking the “unsubscribe” link in one of our emails or asking us to take you off our marketing list by contacting us at [email protected]. You can ask us at any time not to carry out direct marketing, or to stop using profiling and marketing cookies through contacting [email protected].

​

YOUR RIGHTS AND CHOICES

​

You have rights under the GDPR and UK GDPR. These include the following:
 

• Right to access – you have a right to ask us for a copy of your personal data. 

• Right to erasure – you have a right to request that we delete your personal data, under certain conditions. 

• Right to rectification – you have a right to request that we correct any information that we believe is inaccurate. Your also have a right to request that we complete information that you believe is incomplete. 

• Right to restrict processing – you have a right to request that we restrict processing of your personal data, and to obtain personal data in a format you can share with external parties, under certain conditions. 

• Right to object to processing - this right may be limited in some citations - for example, where we can demonstrate that we have legal requirements to process your data. 

• Right to data portability – you have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions. 

 

We may need to request specific information from you to help us exercise your privacy rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request to speed up our response.

 

You will not have to pay a fee to access your personal data (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

 

We try to respond to all legitimate requests within one (1) month from receiving the request from you. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated on expected timeframes.

You can contact our privacy representative to ask a question about our privacy practices or exercise your rights at [email protected] or via our website. If you have unresolved concerns, you have the right to complain to a data protection authority or other regulator where you live or work, or where you believe a breach may have occurred.

​

HOW IS YOUR PERSONAL DATA SHARED?

​

We don't sell personal data. We share personal data with recipients under lawful conditions as required to perform our services or operate our charity. 

 

Service providers

Other companies help us conduct the activities described in this privacy notice. 

 

We work with service providers, for business purposes in our legitimate interests who have access to personal data when they provide us with services, like technical infrastructure, web and app development, and marketing, analytics and survey tools. We impose strict restrictions on how service providers store, use and share data on our behalf. We also work with companies who provide consulting, administrative support, legal and financial advice for us.​