PRIVACY STATEMENT

We want everyone who supports us to be confident and comfortable with how any personal data you share with us will be looked after or used. This privacy statement sets out how we collect, use and store your personal information.

Chris’s House Walk of Hope (“we”, “our” or “us”) is committed to protecting the security and privacy of all personal information or data collected from you and making every effort to ensure that it is processed in a fair, open and transparent manner. We therefore conduct our business in compliance with applicable laws on data privacy protection and data security including EU General Data Protection Regulation 2016/679 (“the GDPR”) and the Data Protection Act 2018 as amended from time to time (“the Data Protection Laws”). This privacy statement tells you what to expect when we collect and process your personal information.

We try to meet the highest standards when processing your personal information. The data controller who is responsible for how we handle your personal information is Chris’s House (charity Number SC045583 ) whose registered office is at 2-4 Belhaven Rd, Wishaw ML2 7NZ.

Any queries you have in relation to the same should be directed to info@chrisshouse.org

Information We May Collect from You

We may ask you to provide certain information about yourself when you use our website or our other social media platforms, contact us, about the services and activities we provide whether or not contact is by email, in writing, by telephone/SMS or face to face. You will know when we are collecting information intended to be kept for future use via our website because the web page will contain a link to this privacy statement. The information collected may include:

•                 Contact details including your name, postal/e-mail address and phone number
•                 Transaction details about services you specifically request from us including registration details about your participation in one     of our events or donations you may have made in relation to an event
•                 Financial details in relation to your registration for an event or services provided by us including addresses for invoices and     payment details
•                 Profile details from documents you complete on-line such as your user name and password, preferences, interests and your     transaction history
•                  Information that you provide to us for the purpose of subscribing to our email or text notifications, newsletters and/or website
•                 Information that you provide to us in relation to participating in any of our events and which will include contact and identity     details
•                Information that you provide to us in connection with volunteering with us such as your contact and identity details, experience     and qualifications (if applicable)
•                    Details of your visits to our website including but not limited to traffic data, location data, weblogs and other communication     data and the resources that you access or use

We will generally not collect sensitive data from you via our website. Sensitive data is personal information which includes your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic or biometric data, or information concerning your health or mental wellbeing or sexual orientation. It will also include criminal convictions. Where we do require to process such sensitive data to provide services to you, we will notify you in advance and will request your express consent in writing to process such sensitive data. This is most likely to include information about physical/mental conditions which may affect your participation in events or dietary requirements for those participating in our events and volunteer days.

If you do not wish us to collect any of the personal information stated above, you should discuss this with us. We can explain the reasons for collection and discuss the consequences of not providing the information or of providing partial or incomplete information and the effect this may have on our ability to provide our services.

Uses Made of Your Information

By law we can only process your information if we can demonstrate the lawful grounds we have for doing so. Currently there are six potential lawful grounds for processing personal information, namely

•                   we have your consent;
•                      it is necessary for performance of a contract to which you are a party or to take steps at your request prior to entering into       such contract;
•                  it is necessary for our compliance with a legal obligation;
•                  it is in the public interest;
•                  it is necessary to protect your vital interests; or
•                  that it is in our legitimate interest to do so but only where that interest does not override your interests or your fundamental rights and freedom.

If none of these grounds apply or ceases to apply we must cease processing your personal information immediately.

We may use personal information held about you in the following ways: -

Activity or purpose of processing

Type of Data processed

What is our Legal Ground for doing this?

Registering you as a participant in one of our events or supporter or volunteer

Your identity and contact details

Performance of a contract

 

Legal Obligation

Maintaining and keeping a record of our relationship with you

Your identity and contact and profile details

Performance of contract

 

Legal Obligation

 

Legitimate Interest i.e. to keep our records updated and identifying how you use our services

Ensuring that content from our website is relevant to you and is presented in the most effective manner for you 

Your identity, contact, profile and technical details

Legitimate Interest i.e. to review the services we supply to you and to inform our overall marketing strategy

Processing or delivering our services

Your identity, contact, financial and transaction details and health and dietary requirements where they impact on the delivery of programmes or events that you are participating in

 

Performance of a contract

 

Legal Obligation

 

 

Updating you with important administrative messages about an event you are participating in or your donation or other services you have requested from us

Your identity and contact and profile details

Performance of a Contract

Processing payments related to events you participate in and/or donations made in respect of the same

Your identity, contact, financial and transaction details

Performance of a contract

Administration of our website and business (including webhosting and support)

Your identity, contact and technical data

Legal Obligation

 

Legitimate interest i.e. running business, ensuring security and performance of the website, admin and support, monitoring for viruses or malicious software

To make suggestions that may be of interest to you such as forthcoming activity days

Your identity, contact, profile and technical data

Legitimate interests i.e. to develop our services

To comply with charities legislation and to follow the recommendations of the official regulator or charities OSCR which require us to identify and verify the identity of supporters who make major gifts so we can assess any risks associated with them

Your identity, contact and profile details

Legal Obligation

Where you volunteer with us to administer the volunteering arrangement

Your identity, contact and profile details

Performance of a Contract

 

We will only retain your personal information for as long as is necessary in line with the purposes for which it was originally requested or collected or where we are required to do so for some legal or reporting purpose.

In working out how long we retain personal data we look at the type of personal data involved, the purpose of processing, how sensitive or confidential the data is and any legal and commercial considerations including any legal obligations we have. By way of example by law we are required to keep accounting records for six years after the end of the year in which the last transaction occurred. This means that we will be required to keep some basic details for that purpose even although our relationship with you may be at an end. However, it should be noted that the requirement is basic details and therefore it is not legitimate to also keep information such as your preferences for that period of time.

 

If you have any questions relating to either retention periods or require more detail on the purposes of processing or the specific reason or legal grounds, we are relying on for that processing then please contact us for additional information.

Sharing Your Information

The personal information we collect about you will be mainly used by our staff and volunteers at Chris’s House so that they can support you. We will not sell the personal information that we collect from you and will only use it for the purposes set out in this privacy statement. We may share your personal information with the following parties: -

•                    Service providers who provide us with IT and administration services such as our IT Support and back up provider, CRM and     marketing provider, webhosting company and any payment processor we use for taking payments from you.
•                 Other service providers we refer to or work in partnership with such as transport providers in relation to getting you to a         event venue where you are participating in an event, and processors of payments on our behalf, but only to the extent        necessary for the provision of our services;
•                   HMRC and other regulatory authorities who require reporting of our activities by law;
•                   Professional advisers such as our lawyers, accountants, bankers and insurers; and
•                   Third parties to whom we sell, transfer or merge our business or any part of it.

All third parties with whom we share your data are required to protect your personal data, treat it confidentially and to process it in accordance with the law. Where we use third parties we will take all reasonable steps to ensure that: -

•                 they have adequate technical capabilities and other measures in place to ensure the security of your personal information;
•                  that they only use it for specified purposes;
•                   that any employees or contractors who have access to the information are adequately trained and deal with it on a need to know basis only;
•                  and that they act only in accordance with our instructions.

In relation to provision of information to your nominated charity, that charity will be a data controller and not a data processor and the information passed to them is done so strictly for the purposes of the administration of the event you are supporting them through. They should never market their services to you without your consent.

IP Addresses and Cookies

When you visit our website we automatically collect certain information about the device you use to do so (“your device”), including information about your web browser, IP address, time zone and some of the cookies that are installed on your device. Additionally, as you browse the website we collect information about the individual webpages or products that you view, what websites or search terms referred you to the website and information about how you interact with the website. We refer to this automatically-collected information as Device Information.

We collect Device Information using the following technologies:

“Cookies” are data files that are placed on your device and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.

“Log files” track actions occurring on the website and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.

“Web beacons”, “tags” and “pixels” are electronic files on the website used to record information about how you use the website.

Full details on what cookies we use and how to disable them are included in our Cookies Policy.

 

Marketing Information

We may provide you with information on events and/or new services or any merchandise related to events that we may provide. This is regarded as marketing activity. We will only market to you where you have: -

•                 Specifically requested marketing information from us; or
•                    Previously acquired similar services/goods from us; or
•                       Consented by way of ticking a box or opting in to receiving marketing from us.

If you have opted out of marketing, we will not send you any future marketing without your consent.

Each time we market to you we will always give you the right to opt out of any future marketing but  would point out that you have the right at any time to ask us not to market to you at any time by emailing us at info@chrisshouse.org rather than waiting on a specific opt out.

 

Security of Personal Data

We take information security very seriously.  Your information and records will be stored securely to ensure privacy of your personal data. We take all reasonable steps to ensure that there are technical and organisational measures of security in place to protect your personal data from unauthorised access to or disclosure of it, and against loss or accidental damage or unauthorised alteration of it.

Staff handling your personal data are also adequately trained in relation to the legal requirements for handling personal data. These include robust procedures for dealing with breaches including incident reporting and notifying the Information Commissioner, and where appropriate to you, of any breaches, the consequences of the same and the remedial action taken.

Where possible the information you provide us with will be held within the European Economic Area (“EEA”) or within the UK.

Overseas Transfers

Countries outside of the EEA do not always have similar levels of protection for personal data as those inside the EEA. The law provides that transfers of personal data outside of the EEA is only permitted where that country has adequate safeguards in place for the protection of personal data.  Some types of processing may use cloud solutions which can mean information may sometimes be held on servers which are located outside of the EEA or may use processors who are based overseas.

 

Where we use cloud-based services or third-party providers of such services and in either or both circumstances the data is processed outside of the EEA that will be regarded as an overseas transfer. Before instigating an overseas transfer, we will ensure that the recipient country and/or processor has security standards at least equivalent to our own and in particular one of the following permitted safeguards applies: -

•                     The country in question is deemed to have adequate safeguards in place as determined by the European Commission; or

•                     There is a contract or code of conduct in place which has been approved by the European Commission which gives your personal information the same protection it would have had if it was retained within the EEA; or

•                     If the overseas transfer is to the United States, then the transferee is a signatory to the EU-US privacy Shield as all Privacy Shield signatories are obliged to give your personal information the same degree of protection it would have had if it was retained within the EEA.

If none of these safeguards exist, then we may seek your explicit consent for an overseas transfer. In line with your rights as an individual you are free to withdraw this consent at any time.

Your Rights

You have rights as an individual which you can exercise in relation to the information we hold about you. These rights are:

•                     the right to restrict processing of your personal data;

•                     the right to rectification or correction of your personal data;

•                     the right to object to processing of your personal data;

•                     the right of erasure of personal data (also referred to the right to be forgotten);

•                     the right not to be subject to a decision based solely on automated processing or profiling;

•                     the right to transfer your personal data (also referred to as the right of portability)

•                     the right to withdraw your consent to processing your personal data; and

•                     the right of access to your personal data.

Additional information about these rights can be found on the Information Commissioner’s website at www.ico.org.uk/for-organisation/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

If you have provided consent and we are relying on that as the legal ground of processing your personal information and wish to exercise your right to withdraw that consent you can do so at any time by contacting us at info@chrisshouse.org

Access to Personal Information

We try to be as open as we can in giving people access to their personal information. You can make a subject access request at any time about the personal information we process about you. Any request requires to be in writing and is not subject to any charges or fees. If we do hold any personal information about you, we will:

•                     give you a description of it;

•                     tell you why we are holding it;

•                     tell you who it has or will be disclosed to;

•                     the source of the information (if not you);

•                     where possible, the period for which it will be stored; and 

•                     let you have a copy of the information in an intelligible form

 

We will respond to a subject access request within 30 days. On occasion we may need additional information from you to determine your identity or help us find the information more quickly. Where the information you have requested is complex, we may take longer than this but shall keep you advised as to progress should this be the case.

If you believe that any information we hold about you is incorrect or incomplete, you should email us at info@chrisshouse.org. Any information which is found to be incorrect will be corrected as soon as possible.

Complaints

We would prefer to resolve any issues or concerns you may have direct with you. If you feel you are unable to resolve matters by contacting us direct or are you are unhappy or dissatisfied with how we collect or process your personal information you have the right to complain about it to the Information Commissioner who is the statutory body which overseas data protection law. They can be contacted through www.ico.org.uk/concerns.

Contact

Questions, comments and requests regarding this privacy statement are welcomed and should be addressed to info@chrisshouse.org

Changes to this Privacy Statement         

We keep our privacy statement under regular review and it may therefore change from time to time. This privacy statement was last updated in March 2021. Where we have made any changes to this Privacy Policy we will make it clear on our website or contact you about any significant changes.

 

---

Booking for this event is also subject to the LIVE IT Terms and Conditions