PRIVACY POLICY

How we collect information about you

Direct Information e.g. personal information that you give us by filling in forms on our websites or offline (including signing up to our email communications, fundraising, purchasing products via our online shop, or making or proposing a donation), communicating with us by phone, email or letter

When you give information to us indirectly

Your personal information may be shared with us by our partners; sub-contractors in technical, payment and delivery services; and suppliers. We will notify you when we receive personal information about you from them and tell you how and why we intend to use that personal information.

When your information is available publicly

Your personal information may be available to us from external publicly available sources. For example, listed directorships, information from the electoral roll and press reports – we may obtain this personal information, for example, when undertaking due diligence on potential donors or fundraising partners to ensure they align with our mission and values, or when researching prospective donors (see “Donor profiling” below).

What personal information do we process?

We may collect, store and use the following kinds of personal information:

• name and contact details, including postal address, telephone number, email address and, where applicable, social media identity;

• financial information, such as bank and/or credit/debit card details;

• donation history and Gift Aid details;

• photographs, video or audio recordings;

• biographical information, such as your occupation (or employment history – for example if you apply for a job);

• any other information shared with us as per the section “How we collect information about you” above.

Do The Lady Garden Foundation collect/share sensitive personal information?

Data privacy law identifies certain categories of personal information as sensitive and therefore requiring more protection, for example information about your health or ethnicity. In limited cases, we may collect and/or use your sensitive personal information (also known as special category data). We will only do so where we have your explicit consent.

How and why we use your personal information

As a data controller, our lawful bases for processing your data are as follows:

We have a legitimate interest (see ‘Legitimate interest’ section)in processing your data for the purposes of improving our services and website to run our organization effectively and efficiently.

We ask for your specific and informed consent to communicate with you by email, SMS and telephone.

In order to comply with legal obligations, for example fraud prevention

Where necessary for the performance of a contract. For example we need your personal details in order to send you items ordered through our shop.

Legitimate interest

Personal information may be collected and used if it is reasonably necessary to achieve a legitimate interest (as long as that processing is fair, balanced and does not unduly impact your rights).

Where we rely on legitimate interests, depending on the activity, we may be relying on The Lady Garden Foundation’s legitimate interests.

Those legitimate interests include the following:

• Charity Governance, including delivery of our charitable purposes, statutory and financial reporting and other regulatory compliance purposes;

• Administration and operational management, including responding to solicited enquires, providing information, research, donor due diligence, events management, the administration of our programme and employment and recruitment requirements; and

• Fundraising and Campaigning, including administering campaigns and donations, and sending material by post, analysis, targeting and segmentation to develop communication strategies and maintaining communication suppressions.

In general, our legitimate interests include running The Lady Garden Foundation as a charitable entity and pursuing our vision and mission. However, “legitimate interests” can also include your interests, such as when you have requested information or services from us.

When we process your personal information to achieve such legitimate interests, we consider and balance any potential impact on you (both positive and negative), and your rights.

Donor profiling

To gain a better understanding of our supporters and identify prospective supporters, The Lady Garden Foundation may engage in ‘donor profiling’; identification of, and subsequent research into, prospective major donors and influencers – individuals, charitable trusts and companies.

This profiling, which may include identifying indicators of wealth and analysis of our database in future, will inform our fundraising strategy, helping us to provide you with relevant and effective communications and strengthening the relationship with our supporters in the most efficient way possible.

As a charity, this helps The Lady Garden Foundation make best use of its charitable funds in order to maximise the impact it is able to deliver.

You can opt out of your personal information being used in this way. If you do not wish The Lady Garden Foundation to undertake donor profiling on you, then please contact us.

Donor due diligence

Like many charities, we need to undertake checks on individuals who give or propose to give large donations to us, so that we are complying with our duties to protect charity funds, assets, and reputation, and to comply with the “know your donor” principles further to Charity Commission guidance, to prevent fraud, and also to ensure compliance with our own ethical policies (Due Diligence Purposes).

We may use third party suppliers to assist us with these checks, and we may obtain information from publicly available sources in order to do so.

Filming and photography at events

Please note that we (or our service providers) or third party event hosts may film or photograph those attending or taking part in our events.

We may use the footage or photographs for publicity and marketing/fundraising purposes. For example, in print and/or digital material (including social media) or via external advertising and press outlets, all of which may be made available to the public.

No personal details (e.g. names) of children under 16 will be used in such materials without consent from their parent or legal guardian, but we may use images where children are incidentally pictured (for example, as part of a crowd).

Campaign communications

We will obtain your consent to contact you via email and post, to use your contact details to provide you with information about our work, news and updates.

See the section “Our legal basis for processing your information” for more information about our use of legitimate interests.

We send the following marketing materials:

Updates about The Lady Garden Foundation’s work:

Campaigns – information about projects we have funded, including how you can support the projects, (for example by attending events or fundraising for them), and updates about the progress of these projects;

Events – including details of our challenges or other events in aid of our work. Note that if you sign up to an event we will also send you administrative communications about how you can take part. On occasion we will also send you a reminder about the same event in future years in case you want to participate in it again; and where possible we cleanse and remove out of date contact details. This helps us to improve the delivery rate of our mailings and minimise wasted expenditure.

Administrative communications

In addition to the campaign communications that you receive from us, we may also communicate with you by post, telephone and e-mail in relation to administrative matters. On occasion, we will also contact you about an event that you have signed up to participate in, for example, to check that fundraising pages have been set up and to provide any other necessary information. We may still need to communicate with you for administrative purposes even where you have opted-out of marketing communications from us.

Will we share your personal information?

The Lady Garden Foundation does not sell or rent your personal information to third parties for their own marketing purposes.

We will use third party trusted partners that work with us in connection to our charitable purposes. They support us to deliver fundraising appeals, campaigns or store your data on our behalf eg event management companies, mailing houses and printers.

We actively screen these companies to maximise the protection of your privacy and security. they are only permitted to use data in accordance with GDPR.

In general, the personal information that we collect from you will be stored at a destination within the UK or European Economic Area (EEA). However, we use agencies and/or suppliers to process personal information on our behalf. Your personal information may therefore be transferred or stored outside, and/ or otherwise processed by contractors operating, outside, the UK or EEA who work for us or for one of our suppliers.For example, your personal information is only accessible by appropriately trained staff and contractors, and stored on secure servers. In these cases we will take all steps reasonably necessary to ensure that the recipient implements appropriate safeguards to protect your personal information (for example, by entering into a contract approved by the European Commission or, if the company is based in the US, checking that it is certified under the EU-US Privacy Shield).

The transmission of information via the internet is never completely secure, and although we do our best to protect it, we cannot guarantee the security of personal information transmitted via the internet.

Security of and access to your personal information

We keep all your information in a confidential record that is specific to you. We use a customer relationship management system (CRM) to support our activity. This means that we can keep the information you provide us, so we are able to see the history and relevant details of your relationship with us.

We take information security very seriously. No one is allowed access to our system or files unless they need this in order to provide a service to you or for one of the other purposes discussed in this notice.

We will only keep your information for as long as needed to ensure that we can effectively carry out your wishes, for example to process your donation, respond to your enquiry and make sure that we are only sending you communications that are relevant to you and are in line with your preferences. If you have supported us with a donation we will keep your contact, donation and communication details, as well as why you have donated if you have decided to give us this information.

When we no longer need to retain your information we will ensure it is securely disposed of, at the appropriate time. You can request for us to delete this information at any time and we will do so immediately.

We do not store your credit or debit card details at all, following the completion of your transaction. All card details and validation codes are securely destroyed once the payment or donation has been processed. Only staff authorised to process payments will be able to see your card details.

If we receive an email containing any credit or debit card details, it will be immediately deleted, no payment will be taken and you will be notified about this.

We will not use your information for marketing purposes if you have asked us not to.

How long do we keep your personal information?

Whatever your relationship with us, we will only store your personal information for as long as necessary to fulfil the purposes we collected it for, including the purposes of satisfying any legal, accounting or reporting requirements.

Usually this will be for a specified amount of time in accordance with our internal retention policy. That length of time may vary depending on the reasons for which we are processing the personal information and whether we have a legal (for example under financial regulations) or contractual obligation to keep it for a certain amount of time.

Subject to the above, generally, we typically retain personal information relating to donors and people who have taken campaign actions or signed up to our mailing lists for 6 years after their last donation or interaction with us.

Once the retention period has expired, personal information will be confidentially disposed of or permanently deleted.

If you object to further contact from us (see ‘Your rights’, below), we will keep some basic information about you on a “suppression list” in order to avoid sending you unwanted communications in the future.

Your rights

You have a number of legal rights in relation to our use of your personal information. These rights include:

Right to object – you have the right to object to processing where we are (i) relying on the legitimate interests as a legal basis, (ii) using your personal information for direct marketing or (iii) using your personal information for statistical purposes.

Right to withdraw consent – where we are using your personal information on the basis of your consent, you can withdraw that consent at any time.

Right of access – you can ask for confirmation of what personal information we hold about you and request a copy of that personal information. Provided we have successfully confirmed your identity (we need to be sure we are only releasing your personal information to you), we will provide you with your personal information subject to any exceptions that apply.

This is sometimes called a “subject access request” and can be done by writing to us at the email or postal address in the “Contact us” section below.

Right of erasure – in some cases, you can ask us to delete your personal information from our records (or to anonymise it). We may retain some limited personal information in order to ensure you are not contacted by us in the future.

Right of rectification – if you believe our records concerning you are inaccurate, you have the right to ask us to update them. You can ask us to check the personal information that we hold about you if you are unsure.

Right to restrict processing – in certain situations you have the right to ask us to restrict the processing of your personal information if there is disagreement about its accuracy or legitimate usage.

Right to data portability – where we are processing your personal information using automated means on the basis of consent, or to perform a contract, you may ask us to transfer it to another service provider in a usable format.

To exercise any of these rights, please send us a description of the personal information in question, along with an explanation of the rights you wish to exercise, using the contact details in the “Contact us” section below. In some cases we may ask for proof of identification or further information before we can process your request.

Please note that these rights only apply in limited circumstances. For more information, we suggest that you consult guidance from the Information Commissioner’s Office (ICO) – https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/ – or please contact us using the details in the “Contact us” section below if you are unsure.

Third party websites

Due to the collaborative nature of our work, www.ladygardenfoundation.com may contain links to other sites, including those of our delivery partners. This Notice does not cover those external websites and we are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policies of any external websites you visit via links on our website.

Changes to this Notice

We keep this Notice under regular review and may update it from time to time, so we recommend that you check it regularly. This Notice was last updated on 8th October 2020.

Contact us (including complaints)

If you have any questions or concerns about this Notice or about the way in which your personal information is being used please let us know by contacting us in the following ways:

• By email: info@ladygardenfoundation.com

• By telephone: 0207 349 2502

• By post: The Lady Garden Foundation, 17 Gresse Street, 6 Evelyn Yard, London, W1T 1QL

You are entitled to make a complaint at any time to the Information Commissioner’s Office, the UK regulatory authority for data privacy. However, please note that we are always grateful for the opportunity to resolve your concerns before you approach the ICO, so appreciate it if you would contact us in the first instance.

Any alterations to our policy on the collection or use of data will be posted on this website.