Privacy Policy

1. Who we are

We are the Refugee Council (“we” or “us”), a registered company (Company no. 2727514) and a registered charity (Charity no. 1014576). We are registered with the ICO under reference Z9307390. We are subject to the UK General Data Protection Regulation (UK GDPR) in relation to the services we offer to individuals and our wider operations in the UK.

We are a data controller responsible for the personal data that we collect and process about you. This means that we determine what personal data we will collect about you and are responsible for what happens to it, where it goes, and who sees it, and you can hold us to account for this.

We want you to be familiar with how we collect, use and disclose your personal data. We are committed to protecting the privacy and security of your personal information.

The Refugee Council is a leading refugee charity. We help people who have fled war and persecution to rebuild their lives, integrate into communities, and play their part in Britain. Born in the aftermath of World War II, our frontline services support refugees to find safety, get to know their neighbours, and enter education, training or work

We work with thousands of women, men, and children each year who are desperately seeking safety. From the moment refugees arrive in the UK, we are here.

• We provide crisis advice, mental health counselling and practical support to help people settle and integrate into their new community.
• We are specialists in working with refugee children who arrive in the UK alone.
• We work with refugees and our partners to fight for improvements to the asylum protection system.
• We inspire change in attitudes towards refugees and people seeking asylum—speaking out for compassion, fairness and kindness.

As part of our work, we collect and process personal data about the people who interact with us, whether that’s getting information, advice or therapeutic support, or casework to secure benefits, housing or a job, supporting our campaigns, making donations, applying for a job or volunteering, amongst many other activities. We also process the personal data of people who we think may be interested in supporting our work – through our campaigns or via a donation.

If you are an employee, or a potential or past employee, please contact us for a copy of our separate Employee Privacy Notice.

2. Why this privacy notice is important

This privacy notice (“Notice”) outlines what data we collect, how we may use it, how we protect your personal data and your rights, and how you can exercise those rights.

This Notice covers the various different relationships we may have with you. For that reason, we may not use your personal data to the full extent described in this Notice. The personal data we collect and how we use it depends on your needs and your relationship with us.

We regularly check this Notice to make sure we are giving you the most up-to-date information on how we are processing your personal data. It is important that you read this Notice carefully, together with any other privacy notice or fair processing notice we may provide to you on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your personal data. This Notice supplements other notices and privacy notices and is not intended to override them.

If you need any further information or explanation though, we are happy to help.

If you have any questions about this Notice, please contact us using the details in section 3 below.

This Notice was last updated on 14 March, 2025.

3. Contact Us

If you have any queries about this Notice, to change the contact (or other) details we hold on you, how or the frequency with which we contact you, or if you wish to exercise any other of your rights (see section 19) or to make a complaint, please contact us at:

• data@refugeecouncil.org.uk
• +44 (0)20 7346 6700

You may also contact us by writing to us at our Head Office at:

• Data Protection Officer
  C/O Technology Team
  Alf Dubs House
  134-138 The Grove
  London, England
  E15 1NS

4. Our Data Protection Officer

The Refugee Council has appointed GRCI Law Limited to act as the company’s Data Protection Officer (DPO). Our DPO is responsible for overseeing questions in relation to this Notice.

The DPO can be contacted by sending:

• an email to dpoaas@grcilaw.com including “Refugee Council” in the subject line; or
• written correspondence to:
  • Refugee Council DPO
    GRCI Law Ltd
    Unit 3 Clive Court
    Bartholomews Walk
    Cambridgeshire Business Park
    Ely, Cambridgeshire, England
    CB7 4EA

5. What is meant by "personal data" or "personal information"?

Personal data (also sometimes called “personal information”) is information which identifies you as an individual. Examples of personal data include anything which may identify you, for example your name, address, bank account details, internet protocol (IP) address, username or another identifier.

Some personal data is unique to you and therefore requires greater protection. This kind of data is referred to as sensitive or special category data and includes data such as information regarding your health, political views, religious or philosophical beliefs, race or ethnicity.

6. Why do we collect personal information?

We collect and process personal data about the people who interact with us, who broadly fall into four categories:

The kind of personal data we collect about you depends on our relationship with you and / or your needs, and / or how you are using our services. For instance, we might collect personal data to communicate with you and send you information on services you would like to access, or to help us administer campaigns and donations, or to improve our services.

The sections below which outlines how and why we may collect your personal data and why we process it, depending on how you interact with us.

Some of the reasons why we might collect your personal data include:

• to provide you with advice, support or legal services that you have requested or have been referred to;
• to record personal details shared during conversations with one of our helplines;
• to communicate with you regarding Refugee Council’s work, fundraising, and campaigning activities;
• to process donations and administer Gift Aid information for any donation you make to Refugee Council;
• to manage your communication preferences;
• to process job applications or volunteer placements;
• to comply with applicable laws and regulations, and requests from statutory agencies;
• to comply with our contractual obligations to our funders.

7. The personal data we collect about you and how we use it

7.1 Our service users

7.1.1 How we get your personal information and why we collect it

If you are receiving services, advice or support from us, or if someone else has referred you to us for such a service, we will need to process your personal data because we will not be able to provide you with services unless we have all the correct information needed to deal with your case.

We will ask you to consent to us storing and using your personal data when you first use our services, and we will renew this consent from time to time, especially if we offer you different services.

7.1.2 The types of personal information we collect

As well as your name, address and contact details, the following personal data may be collected about you so that our advisors are able to provide appropriate support to you as a service user in relation to your current circumstances and your journey through the refugee protection system in the UK:

• Case Study Data: such as service user biographical information, country of origin, information relating to service user experience of engaging with our service and supports.
• Communication Data: such as records of your contact with us, including in relation to queries, compliments or complaints and any other information you voluntarily provide, including online or through other communication methods;
• Contact Data: such as email address, postal address and/or telephone number;
• Employment Data: inclusive of employment status, history and skills;
• Financial Data: such as income, income claims and hardship allowance information;
• Gender Data: includes information relating to gender and gender identity;
• Housing Data: including address, accommodation type and housing status;
• Identity Data: such as your name, date of birth, nationality and country of origin, passport information and any other information contained within identification documentation;
• Images: including video film and photographs taken at or for events and images found on identification documentation such as driving licence and passports;
• Immigration Data: including immigration status information, pre-action protocol information; immigration claim details, date and place of entry into the UK, NI, Home Office and other immigration related numbers and information;
• Language Data: including information as to languages spoken and interpreter requirements;
• Location Data: including country, state, county, region and /or local authority location data as well as other geolocational data including postcode;
• Relationship Data: including Information about family and other relationships;
• Sensitive or Special Category Data: Sensitive or special category data is personal data that needs more protection because it is sensitive. We may process sensitive personal data about you only where processing is necessary for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes in accordance with applicable data protection laws. We will only process that sensitive personal information about you in such jurisdictions and if and to the extent permitted or required by applicable law. Subject to the above, we may process the following kinds of sensitive personal data about data subjects as follows:
  • Race and/or ethnic origin
  • Political opinions
  • Religious and/or philosophical beliefs
  • Data concerning health
  • Data concerning sex life and sexual orientation
• Service Requirements and Usage Data: including needs assessment information; support case notes, outcomes information, service referrals information;
• Support Data: such as information relation to access needs, dietary needs, information relating to safeguarding service needs and concerns, information relating to donated items received;
• Technical Data: we may collect your IP address, your login data, browser type and version, time zone setting and location, browser plugin types and versions, operating system and platform, and other technology on the devices you use to access and browse our website;
• Usage Data: includes information about how you use our website.

As well as the initial data received from you or via a referral to our services through a third party, throughout the period of support – whether one-off or ongoing support – advisors/practitioners will record full case notes about all contacts with you and about the assistance provided, including referrals made to other support and legal services.

Every interaction with you in the course of offering or providing services is likely to add to the data collected about you.

7.1.3 Case studies/sharing your stories, and refugee involvement

We share case studies/stories two ways:

• With funders where this is part of a contractual agreement with them. In this case, we will always anonymise the information you have given to us so that it cannot be attributed to you in any way.
• Only where you have explicitly consented to us doing so, we share some stories publicly. We talk to people who have left their home countries and share their stories to try to help other people understand what it's like to be in this situation, how things could be better, and what needs to improve. We will never do this without your consent and there is never any obligation to share your story publicly.

If you are interested in being involved in projects with Refugee Council as someone with lived experience, we will keep information about your lived experience, skills, interest and availability to help us share opportunities and updates with you.

7.2 Our supporters (and prospective supporters)

7.2.1 How we get your personal information and why we collect it

We may collect personal information about you in the following ways:

(a) When you give your personal information to us directly:

You may give us your information in order to sign up for one of our events, fundraise on our behalf, sign up to a campaign, make a donation, leave a gift in your will or communicate with us. Sometimes when you support us, your information is collected by an organisation working for us (e.g. a professional fundraising agency), but we are responsible for the personal data they collect about you on our behalf.

(b) When you give your personal information to us indirectly:

We may collect information about you from your browsing activity while on our website; we will usually collect information indirectly using the technologies explained in the section on “Cookies and other tracking technologies” set out below.

Your information may also be shared with us by third party fundraising sites (e.g. JustGiving, or a payroll giving agency). These independent third parties will only share your personal data with us when you have indicated that you wish to support Refugee Council and with your consent.

(c) When you give permission to other organisations to share your personal data with us or it is available publicly:

The Refugee Council uses Fundraise Up as an online donation platform. All donation data collected is subject to the provisions of the General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act of 2018 (“CCPA”), and other applicable privacy laws. Non-Personal Information that is collected remains anonymous or non-personally identifiable. All Personally Identifiable Information (PII) is encrypted. Financial information, such as banking information or credit card number, name, CVV code, or expiration date, is collected and stored by a third-party payment processor. Financial information is not stored by Fundraise Up.

We may combine information you provide to us with information available from external sources (including, but not limited to, Companies House and depending on your privacy settings, social media sites such as Facebook) in order to gain a better understanding of our supporters to improve our fundraising methods, products and services.

The information we get from other organisations may depend on your privacy settings or the responses you give, so you should regularly check them.

We may collect information from other organisations but only when you have given them permission to do this. You may give these organisations permission at various times, for example when buying something from a mail order catalogue or joining certain membership organisations. The data we receive depends on your agreement with the organisation.

We may also collect information from online social media and messaging services you use, such as Facebook, WhatsApp or Twitter, where you have given us permission to do so, or if you post on one of our social media pages.

We do not knowingly accept donations from or hold/process any personal information of anybody that is under 16 years of age.

7.2.2 The types of personal information we collect

In relation to our supporters (including prospective supporters), we may collect the following types of personal data:

• Biographical Data: such as name, age, address.
• Business Contact Data: this includes business contacts details including business email address, postal address and telephone number, relevant team and/or department;
• Communication Data: such as records of your contact with us, including in relation to queries, compliments or complaints and any other information you voluntarily provide, including online or through other communication methods;
• Contact Data: such as email address, postal address and/or telephone number;
• Donation & Philanthropic Data: such as information in relation to prospective donations, history of donations to or associations with the Refugee Council and/or other charities; connections to us and other charitable organisations; areas of interest; stature in field of expertise; gift capacity; affiliations with not-for-profit or philanthropic bodies;
• Donor Financial Data: inclusive of financial information such as and financial characteristic information, net worth information, employment status, payment card information, bank account information and other information relevant to the processing of Gift Aid claims.
• Identity Data: such as date of birth, nationality and country of origin, passport information and any other information contained within identification documentation;
• Images: including video film and photographs taken at or for events and images found on identification documentation such as driving licence and passports;
• Location Data: including country, state, county, region and/or local authority location data as well as other geolocational data including postcode;
• Marketing and Communications Data: Includes your preferences in receiving marketing from us, and your communication preferences;
• Publicly Available Data; includes information freely available on the internet and social media platforms such as LinkedIn; may include information from other third party sources such as Google, FAME, Factiva; Pearlfinders and Companies House; published biographies about executive board members and relevant news articles;
• Relationship Data: including Information about family and other relationships;
• Technical Data: we may collect your IP address, your login data, browser type and version, time zone setting and location, browser plugin types and versions, operating system and platform, and other technology on the devices you use to access our website;
• Usage Data: includes information about how you use our website.

7.3 Applicants for job and volunteer opportunities

7.3.1 How we get your personal information and why we collect it

We will collect personal data about you if you contact us through the Careers link on our website.

To help keep job and volunteer applicants’ information secure, we ask that you create user accounts on our website in order to complete your applications. This enables you to save and return to your application prior to submission.

7.3.2 The types of personal information we collect

In relation to applications for job and volunteer opportunities, we may collect the following types of personal data:

• Application Data: this may include job title, role, organisation membership, and any other identity data that may be included in professional or employment-related records, as well as any information that you may include in your CV or a job application that you submit to us;
• Business Contact Data: this includes business contacts details including business email address, postal address and telephone number, relevant team and/or department
• Candidate Data: includes information you have provided to us in your curriculum vitae, covering letter and/or application form, including name, title, address, telephone number(s), personal email address, date of birth, job title, job role, location, employment history, educational background and qualifications, areas of specialisms and registrations with professional bodies;
• Communication Data: such as records of your contact with us, including in relation to queries, compliments or complaints and any other information you voluntarily provide, including online or through other communication methods;
• Contact Data: such as email address, postal address and/or telephone number;
• Identity Data: such as your name, date of birth, nationality and country of origin, passport information and any other information contained within identification documentation;
• Images: including video film and photographs taken at or for events and images found on identification documentation such as driving licence and passports;
• Location Data: including country, state, county, region and/or local authority location data as well as other geolocational data including postcode;
• Professional and Employment Data: employer information, skills and specialisms, referee and reference information in relation to any application that you may submit for employment with us;
• Publicly Available Data; includes information freely available on the internet and social media platforms such as LinkedIn; may include information from other third-party sources such as Google, FAME, Factiva; Pearlfinders and Companies House; published biographies about executive board members and relevant news articles;
• Reference Data: references from previous and current employers and other relevant references;
• Sensitive or Special Category Data: Sensitive or special category data is personal data that needs more protection because it is sensitive. We may process sensitive personal data about you only where processing is necessary for archiving purposes in the public interest, or for scientific or historical research purposes, or for statistical purposes in accordance with applicable data protection laws. We will only process that sensitive personal information about you in such jurisdictions and if and to the extent permitted or required by applicable law. Subject to the above, we may process the following kinds of sensitive personal data about data subjects as follows:
  • Race and/or ethnic origin
  • Political opinions
  • Religious and/or philosophical beliefs
  • Data concerning health
  • Data concerning sex life and sexual orientation
• Technical Data: we may collect your IP address, your login data, browser type and version, time zone setting and location, browser plugin types and versions, operating system and platform, and other technology on the devices you use to access our website;
• Usage Data: includes information about how you use our website.

We may also collect information when you agree to provide it to us via third parties such as recruitment agencies.

7.4 Commercial relationships, journalists and politicians

7.4.1 How we get your personal information and why we collect it

There are two main ways in which we collect personal information about you: directly or indirectly, including the use of third parties.

(a) When you give your personal information to us directly:

We will collect personal data about relevant contacts when we interact with you to enquire about, enter into or administer a commercial arrangement with you and / or the supplier or other entity you represent for the supply or receipt of products or services.

You may also give us your information in order to communicate with us about our work or matters relating to our operations.

(b) When you give your personal information to us indirectly:

We may collect information about you from your browsing activity while on our website; we will usually collect information indirectly using the technologies explained in the section on “Cookies and other tracking technologies” set out below.

We may also gather Publicly Available Data as part of our due diligence activities, for example when considering and managing our engagement with commercial and service partners, including suppliers of products or services to us, journalists and/or politicians.

7.4.2 The types of personal information we collect

In relation to our commercial relationships and relationships with journalists and politicians, we may collect the following types of personal data:

• Business Contact Data: this includes business contacts details including business email address, postal address and telephone number, relevant team and/or department;
• Communication Data: such as records of your contact with us, including in relation to queries, compliments or complaints and any other information you voluntarily provide, including online or through other communication methods;
• Contact Data: such as email address, postal address and/or telephone number;
• Identity Data: such as your name, date of birth, nationality and country of origin, passport information and any other information contained within identification documentation;
• Location Data: including country, state, county, region and/or local authority location data as well as other geolocational data including postcode;
• Marketing and Communications Data: Includes your preferences in receiving marketing from us, and your communication preferences;
• Publicly Available Data: includes information freely available on the internet and social media platforms such as LinkedIn; may include information from other third-party sources such as Google, FAME, Factiva; Pearlfinders and Companies House; published biographies about executive board members and relevant news articles;
• Technical Data: we may collect your IP address, your login data, browser type and version, time zone setting and location, browser plugin types and versions, operating system and platform, and other technology on the devices you use to access our website;
• Transactional Data: information about the services we provide and those we purchase;
• Usage Data: includes information about how you use our website.

We keep a database of journalists and politicians, which includes contact details. We believe the privacy impact on journalists and politicians is small and we only use this information to build relationships with journalists and politicians who can help us to promote our charitable aims.

8. The legal bases on which process and use your personal data

We need your personal data to enable us to provide our services to you to meet our charitable aims. Most commonly, the Refugee Council will use the following lawful bases for collecting and processing your personal information:

• You have consented to us processing your personal data
• There is a contractual relationship with you.
• We are legally obliged to process your personal data
• It is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• It is in the public interest to process your data and this interest is supported by applicable laws.

It is important that any personal information the Refugee Council obtains is held, used, transferred and otherwise processed in accordance with relevant legislation and we will only collect, process and/or use the personal information where we are satisfied that we have an appropriate legal basis to do so.

You are not required to provide your consent where we ask for that to allow us to collect and process your personal data. However, where consent is not provided, we may not be able to collect and process certain personal data about you to assist us in providing services or other support to you.

Please note, we also need your personal information to be able to assess your application for our vacant volunteering or job roles and will be unable to do so where necessary personal data is not provided to us.

For more information on how we process your personal data and the various legal bases upon which we do so, see section 18 below.

9. Photography, video footage and images

9.1 The Refugee Council uses photography and images in a wide range of media, including but not limited to:

• our own website
• newspapers, magazines and other publications
• on social media
• in printed or online fundraising materials including films.

These various forms of media help us to raise awareness and also help us raise money to support our mission.

9.2.1 Individual photography

Photography, images and film created for the uses outlined above is taken and used only with your consent.

We will discuss with you how your image and (if relevant) information is going to be used and ensure you are happy for it to be used in this way before we use it. You can ask us to stop using your image any time and we will refresh your consent on a periodical basis. If we wish to use your photograph to accompany a case study or story on you, this will be done only with your consent and in line with our policy on Sharing Your Experiences with the Public.

9.2.2 Event photography & recording of video footage

We may capture photographs and videos during events for promotional and archival purposes, including use in print and digital media. Notice of photography will be provided where possible via event materials and on-site signage.

If you prefer not to be photographed or recorded, please inform us at the event or contact us in advance. To request the removal of your image after an event, email supporter@refugeecouncil.org.uk with details of the event and date. While we will honour requests to cease future use, we may not be able to retract materials already published.

10. Information Sharing

Insofar as reasonably necessary for us in delivering our services and carrying out our activities for the purposes set out in this Notice, we may share your personal information with other companies (e.g. subcontractors, suppliers) who provide services on our behalf, including third parties who:

• deliver postal mail;
• send emails;
• carry our donor research;
• analyse data;
• process donations including payments made via credit card;
• provide other services to help us operate and run our activities, including (but not limited to) providers of support services including marketing agencies or website hosts;

Who we may need to disclose your personal data will depend on our relationship with you. In the case of our service users, we may also need to disclose and discuss your personal information to third party individuals or organisations if this is necessary to help you. This may include:

• The Home Office and local authorities;
• Solicitors;
• social services;
• landlords where we are helping you find housing;
• prospective employers and training providers;
• NHS services; and
• Partner agencies who work with us to provide our services to you.

We will discuss this with you as we work with you and will only act with your express consent unless one of the other legal bases in data protection legislation applies.

The specific kind of information we share will depend on your activities with us and only to the extent as required or permitted by law, and/or with your consent. We will only provide these parties/companies with the information they need to deliver the relevant service and/or provide the relevant liaison and/or support.

We only allow those parties / organisations to handle your personal information if we are satisfied, they take appropriate measures to protect your information. We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and to you.

We or the third parties mentioned above occasionally also share personal data with:

• our internal and our and their external auditors, e.g., in relation to the audit of our or their accounts, in which case the recipient of the information will be bound by confidentiality obligations;
• our funders and our and their other professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations;
• law enforcement agencies, courts, tribunals, and regulatory bodies such as the Office of the Immigration Service Commissioner to comply with our legal and regulatory obligations;
• other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised, but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations.

We may use your data for general statistical reports including funder reports. These statistics will not include any information that could be used to identify any individual.

We will not share your personal data with any other third party without your consent.

Please note however that this Notice does not apply to sharing of personal information by third party providers who may collect personal information from you and may share it with us. In these situations, we strongly advise you to review the applicable the third party provider’s privacy notice before submitting your personal information.

11. Transferring your personal data overseas

Given the nature of the services we provide, we may have to share and transfer your personal information from one country to another, or even across multiple jurisdictions. Your personal information may therefore be subject to privacy laws that are different from those in the country where the personal information is collected or those in your country of residences.

We will ensure your personal information has an appropriate level of protection and will undertake appropriate due diligence and risk assessments prior to transferring the information. We will ensure the transfer of your personal information in line with applicable data protection law. Often, this protection is set out under a contract with the party or organisation that receives your personal information. You can find more details of the protection given to your information when it is transferred overseas by contacting us.

12. Withdrawing consent

If we rely on your consent to process your personal information, which may be express or implied consent according to the applicable law, you have the right to withdraw consent at any time. You can withdraw your consent by contacting us at info@refugeecouncil.org.uk

Please note that this will not affect the lawfulness of the processing before the withdrawal, nor when applicable law allows, will it affect the processing of your personal information on the basis of any other lawful ground other than consent.

13. Keeping your personal data safe

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We will review, monitor and update these security measures to meet our operational needs, changes in technology and regulatory requirements. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties that have a professional need to know. They will only process your personal information on our instructions, and they are subject to a duty of confidentiality.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we do not have any control over what happens between your device and the boundary of our information infrastructure. You should be aware of the many information security risks that exist and take appropriate steps to safeguard your own information.

We have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

14. How long do we keep your data for?

We have specific criteria to determine how long we will retain your information, which vary according to the legal bases under which we process it. For example, we are required to keep some personal information for tax or health and safety purposes, as well as keep a record of your interactions with us.

As a general rule of thumb, we keep client data for at least seven years after the last interaction we have had with you. For supporters, we generally keep data for a maximum of seven years after your last interaction with us unless you have expressed an interest in leaving a legacy, in which case we would keep it for longer.

To find out more please contact us (see section 2 above) with your specific circumstances so that we can advise further.

15. Marketing and Opting out of Marketing Communications

We do not sell your personal information to third parties for the purposes of marketing or fundraising activities.

If you provide us with your contact details (e.g., email address), we may contact you to let you know about the products, services, and events offered that we think you may be interested in.

If you are a Refugee Council supporter you can update your contact information and contact preferences by getting in touch with our Supporter Care Team:

• Supporter Care Team
  Alf Dubs House
  134-138 The Grove
  London, England
  E15 1NS
• supporter@refugeecouncil.org.uk
• +44 (0)20 7346 1205

To stop receiving emails from us at any time please contact the Supporter Care Team using the details above or you can click the unsubscribe link at the bottom of an email from us. You will then be removed from the marketing list; however, we may still communicate with you for example to send you service related messages that are necessary to respond to your requests or for other non-marketing related purposes. For example, if you make a donation, take part in a campaign activity or request information online you will receive a one-off transactional email about that activity for your records.

16. Cookies, social media and other tracking technologies

Each time you interact with our website, we may, depending on the consent provided and your jurisdiction, automatically collect personal information, including technical data about your device, your browsing actions and patterns, content and usage data. We collect this data using cookies, server logs and other similar technologies like pixels, tags and other identifiers in order to remember your preferences, to understand how our website is used, and to customise our marketing offerings.

No personally-identifiable data is collected. Examples of the sort of information that is collected via session cookies are provided below. This list is not exhaustive:

• The last search term that you used within the site
• Your preference in terms of accessible viewing options
• A unique ID to track your session from page to page, which is vitally important should you sign in to the site
• Which page you have looked at within a multi-paged index of content, or search results.

Certain cookies are persistent, meaning that they last beyond your session, enabling an enhanced user-experience when you return to the site. Again, a non-exhaustive list of examples of the use of persistent cookies includes the option to “Remember my username” when signing-in to the site

Third-party cookies

• Google Analytics This site uses Google Analytics to allow us to track how popular our site is and to record visitor trends over time. Google Analytics uses a cookie to help track which pages are accessed. The cookie contains no personally-identifiable information, but it does use your computer’s IP address to determine where in the world you are accessing the site from, and to track your page visits within the site. However, Google does not permit us to access this data. Read Google’s privacy policy.
• Embedded content From time to time, we may embed external content from third-party websites (e.g. posts from Facebook or videos from YouTube) within our website. These websites may utilise cookies and the Privacy Policy that will apply to such third-party content will be that published on the website of that third-party content provider. Read Facebook’s privacy policy and YouTube’s privacy policy.
• Facebook Facebook is a social media platform we use to communicate with our supporters through our organisational paid, via posts and advertising. We use cookies to measure the effectiveness of paid advertising and to include or exclude people who have visited our website. Read Facebook’s privacy policy.
• HotJar HotJar is a website analytics tool we use to see how our supporters are using our website, so that we can make improvements to its content, layout and structure. Read Hot Jar’s privacy policy.
• AdRoll AdRoll is an online advertising platform that we may use to promote our content and fundraising. We use cookies to measure the effectiveness of advertising and to include or exclude people who have visited our website. Read AdRoll’s privacy policy.

Changing cookies settings

You can change your cookie settings at any time via your web browser settings.

Changes to our privacy policy

This privacy policy may change from time to time in line with legislation or industry developments. We will not explicitly inform our clients or website users of these changes. Instead, we recommend that you check this page occasionally for any policy changes. Specific policy changes and updates are mentioned in the change log below.

17. Third party service and websites

Please note, this Notice does not apply to sharing of personal information by third party providers who may collect personal information from you and may share it with us. In these situations, we strongly advise you to review the applicable the third party provider’s privacy notice(s) and cookie notice(s) before submitting your personal information.

You should be aware that information about your use of our website (including your IP address) may be retained by your ISP (Internet Service Provider), the hosting provider and any third party that has access to your internet traffic.

19. Your Data Protection Rights

Under UK data protection law, you have rights over personal information that we hold about you:

Right to be Informed

You have a right to be told what we are doing with your data. This Privacy Policy sets this out for you and further information can be sought by contacting us on the details set out under Section 2 above.

Right to Rectify Inaccurate Information

You have the right to have inaccurate or incomplete information we hold about you corrected. If you believe the information we hold about you is inaccurate or incomplete, please provide us with details and we will investigate and, where applicable, correct any inaccuracies.

Right to Restrict Processing

You have a right to choose what personal information held about you is processed and limit the information that you no longer want us to process.

Right to Portability

You have a right to ask us to send a copy of the information we hold about you to another organisation.

Right of Access

You have a right to request access to the personal data that we hold about you. You also have the right to request a copy of the information we hold about you, and we will provide you with this unless legal exceptions apply.

Right to Erasure

You may ask us to delete some or all of your personal information and in certain cases, and subject to certain exceptions, you have the right for this to be done.

Right to Object to Processing

You have the right to object to the processing of your information where:

• this is carried out by us under the basis of public interest or legitimate interests;
• this is processed for direct marketing purposes;
• this is processed for scientific/historical research or statistical purposes.

If we are processing your personal information for direct marketing purposes, and you wish to object, we will stop processing your information for these purposes as soon as reasonably possible.

Right not to be subjected to Automated Decision Making

You have a right not to have your information processed using solely automated means with no human intervention, including any profiling activity.

You can exercise any of these rights at any time by contacting us on the details provided above in Section 2. We may be required to ask for further information and/or evidence of identity. We will endeavour to respond fully to all requests within one month of receipt of your request, however if we are unable to do so we will contact you with reasons for the delay.

Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office.

Questions or concerns

If you are unhappy with the way your information is being processed, please contact us in the first instance using the contact details given at section 3 of this Notice.

You may also lodge a complaint with the UK's Supervisory Authority, the Information Commissioner. They can be contacted on 0303 123 1113 or via their website.