This notice applies to individuals based in the UK interacting with the Bone Cancer Research Trust ("BCRT") whether a supporter, donor, fundraiser, shopper, campaigner, service user, volunteer or to apply for a job with us. This privacy notice is to inform you on how and why we use your personal information and how you can exercise your rights under data protection law.
The Bone Cancer Research Trust is a charitable incorporated organisation, registered charity number 1159590, and is committed to supporting people affected by bone cancer. BCRT is registered with the Information Commissioner's Office, registration reference Z255774X. The charity will collect and decide how to use your personal information. The legal phrase that's used to describe an organisation that makes these decisions is a 'data controller' and have specific obligations under data protection laws.
We collect and use the following information about you:
| Collection | Types of data | Lawful basis | Retention |
| When making a donation to us | Name, date of birth, address, email address, phone number. Bank account details for setting up a regular direct debit gift and contact preferences | We ask for your consent. | 7 years |
| When you post information on social media taking part in events | Name, social media account username | We use for our legitimate interests. | 2 years |
| When you register for one of our events or campaigns | Name, date of birth, address, email address, phone number, ethnicity, bank account details for setting up a regular direct debit gift and contact preferences. We may also request photos to share in our marketing | We ask for your consent | 7 years |
| When we receive personal information about you from third parties when you agreed to share e.g. JustGiving | Name, date of birth, address, email address, phone number, contact preferences, whether you are a UK taxpayer so we can claim Gift Aid | Third parties ask your consent to share with us | 7 years |
| When we conduct surveys, focus groups or interviews | Name, data of birth, address, email address, gender, ethnicity, health information, digital literacy, information level | We ask for your consent | 7 years |
| When you share your personal experience with primary bone cancer for support, fundraising and marketing | Name, names of family members where appropriate, address, email address, phone number, gender, ethnicity, images, health information, personal stories, date of birth | We ask for your consent | 7 years |
| When we conduct research on donors to support fundraising, BCRT uses publicly available information e.g. the Electoral Register, company websites, political registers, articles and publications | Personal information which has been published through these sites, registers and platforms | Information which is publicly available | 7 years |
| When you purchase items from our shop | Name, date of birth, email address and contact preferences | We form a contract with you | 7 years |
| To conduct bone cancer research | Name, date of birth, email address, gender, ethnicity, health information and education status | We use our legitimate interest to screen and conduct the research | 7 years |
| When we provide support to service users including requests for our patient information | Name, date of birth, email address, phone number, gender, ethnicity, health information | We use our legitimate interests to provide you with health and care support | 7 years |
| When you apply to work or volunteer opportunities | Name, date of birth, address, email address, ethnicity, gender | We use our legitimate interests to process your application and to de-identify the personal information to monitor recruitment | 2 years |
| When you provide feedback about the charity or its services | Name, type of service user, job title, location, experience with primary bone cancer, contact details (phone number or email) | We use it for our legitimate interests | 2 years |
How we use your information
We use your personal information for a number of purposes, including the following:
- To provide you with services, products or information you have requested;
- To process your donations;
- To provide information about our work, activities, volunteering, fundraising or events although this will only be where you have consented to being contacted for those purposes unless BCRT is in a position to rely on the Legitimate Interest basis for contacting you (see further information below under 'Legal Basis for Processing')
- To help show you relevant social media advertising as well as helping us to find people similar to you who might be interested in our work;
- To fundraise in a manner referred to in this Policy or that you would reasonably expect;
- To create an account for you if you register with us;
- To deliver products or services to you;
- To process orders from our shop or provide after-sales service;
- For administration purposes (for example we may contact you regarding a donation you have made, including in relation to Gift Aid or an event you have registered for);
- For internal management, such as record keeping of enquiries, feedback, or complaints;
- To invite you to participate in surveys, reviews, focus groups or research (although this is voluntary);
- To analyse and improve the services and resources we offer;
- We may collect personal information to conduct supporter research, and on this occasion through our existing network. We may also analyse information you provide with other freely available public information to create a profile of supporter interests, preferences and level of potential donations so that we can contact you in the most appropriate way and with the most relevant information;
- Where collecting and holding your information is required or authorised by law;
- We may use your personal information for the purposes of credit card risk reduction or fraud prevention (using external specialist agencies to help us); and
- Other specific purposes that you may agree to from time-to-time.
Legitimate interests
Where we have specified that we rely on the "legitimate interest" ground for processing where we believe it is in the legitimate interests of you, as the data subject, or of BCRT, to process your data. When we process your personal information in this way, we also consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We will not use your personal information for activities where our interests are overridden by the impact on you, for example where collection and use of your information would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by the law).
Children's information
Our campaigns don't specifically target children. However, there might be occasions where children will get in touch with us. They might, for example, want to fundraise for us, make a donation to support our work, help us review our resources or get in touch with us to speak to the BCRT Support Team. We do, from time to time, hold support events for children.
If you are under 18, you should ask permission of a parent or guardian before sending personal or sensitive information to anyone online, and you must let us know your age when you make contact with us if you are under 18. The charity will get consent from a parent or guardian before we collect information about children. However, in cases where we become aware that someone we are engaging with is below 18 only after we have already collected their data, we'll ask for the consent of a parent/guardian to continue communicating. If we are unable to get this, we will stop all contact and flag their record as a minor, not to be contacted.
Rights
Data protection law provides certain rights for individuals which include:
- Right of access
You have the right to access personal data the organisation holds about you
- Right to rectification
You have the right to have inaccurate data about you corrected
- Right to restriction
You have the right to us restricting the processing of your personal information for particular purpose
- Right to object
You have the right to object to us processing your personal data
- Right to erasure
You have the right to request that we delete your personal data
Please note that depending on some circumstances, not all rights are absolute, but we will inform you if this is the case when you send us you request. It will be free to exercise these rights and the organisation will respond within a period of one month.
Transfers
Your information is normally kept within the UK or within the European Economic Area (EEA) and this is a priority for the charity when selecting where we host and use your information.
On some occasions, we may have to use services of other parties that host your information outside of these areas. When this occurs, we will only ever use highly reputable suppliers that have gone through our information security due diligence, have contractual clauses about the high standard of data processing, and meet all the requirements that your information is looked after to a standard as if it were in the UK or the EEA.
Recipients
Sometimes we use third party suppliers to help us with our business operations. They are all under contract compliant with data protection laws and we inform them on how and when they use your personal data. We conduct assessments on these suppliers to make sure they process your information in a secure and lawful way.
When carrying out surveys, we use a specialist third party to help reach those who may want to participate in surveys and help us operate focus groups and interviews. Before we share any personal information with them, we carry out assessments to check their security controls and have specific contractual obligations on how they use personal information for these activities.
We may also carry out wealth screening to fast track research using our trusted third-party partners. You will always have the right to opt out of this. We may also carry out research using publicly available information to identify individuals who may have an affinity to our cause, but with whom we are not already in touch. We also use publicly available sources to carry out due diligence on donors to meet money laundering restrictions.
Contact
If you would like to contact us about how we use your personal data, please reach out to:
The Data Protection Lead
Bone Cancer Research Trust
10 Feast Field
Horsforth
Leeds
LS18 4TJ
0113 258 5934
Complaints
If you have a concern with how we use your personal data, please use the contact details above in the first instance. However, you have the right to lodge a complaint with the Information Commissioner's Office, the UK data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, SK9 5AF
0303 123 1113