RPFI privacy policy
Charity legal details
RPFI is a charity registered with the Charities Commission under charity number 1116206, and a company limited by guarantee and registered in England and Wales under company number 5794508.
1 Information we collect about you
RPFI collects information in the following ways:
Information from third parties: We receive information about you from third parties and from the public domain. This may include information such as your name, postal address, email address, phone number, your geographic location, credit/debit card details, national insurance details and whether you are a tax payer so that we can claim Gift Aid. We, like all charities and companies, are able to confirm what browser you are using, IP address and computer operating systems that are being used and this information may be used to improve the services we offer. We do not buy, sell or swap data with third parties or other charities.
Information you give us: - when you sign up for a service, engage with our social media or message boards to make a donation to us, register for an event or otherwise provide us with personal information. When you register, we'll ask for personal information, like your name, email address and telephone number to store with your account.
Information we get from your use of our website and digital services: We collect information about the services you use and how you use them, like when you watch a video on YouTube, visit our websites or view and interact with our ads and content. This helps us to understand your interests in our cause and information and to tailor our resources to be more focused on what supporters or service users need.
2 Sensitive personal data
Data Protection law and the GDPR recognizes that certain categories of personal information are more sensitive. This is known as sensitive personal data and covers health information, race, religious beliefs and political opinions.
Our main use for sensitive personal data will be to provide the services that we are commissioned to deliver and we will always make it clear to our service users what sensitive personal data we are collecting, why we are collecting this data and what purposes we may use it for.
We may also collect sensitive personal data if you make the information public or if you tell us about your health and care experiences relating to the support we provide you (for example, if you agree to act as a case study for us or volunteer to share your story); however, again, we will always make it clear to you when we collect this information from you what the sensitive personal data we are collecting is, and what purposes we may use it for.
We will not collect sensitive personal data about non- service users unless there is a clear reason for doing so. For example, to enable everyone to participate in a fundraising event or initiative, we may need this information to ensure that we provide appropriate facilities or support to enable your participation.
3 Use of Credit and Debit card information
Financial transactions relating to our website and services are handled by our payment services providers, Stripe and GoCardless. We will share transaction data with our payment services providers only to the extent necessary for the purposes of processing your payments, refunding such payments and dealing with complaints and queries relating to such payments and refunds. You can find information about the payment services providers' privacy policies and practices at :
- Stripe (URL https://stripe.com/gb/privacy)
- GoCardless (URL https://gocardless.com/legal/privacy/)
All purchases or donations should be completed through the donation page
4 Legal Basis for Processing Data
When we collect and use your personal information, we will make sure this is only done in accordance with at least one of the six legal grounds available to us under Data Protection legislation and the General Data Protection Regulations. One of these is where we have obtained your specific consent to use your information for a previously notified purpose, such as to send you email/text marketing or to provide you with a product, service or information at your request.
Another is where we have a legal obligation to use or disclose information about you for instance, where we are ordered by a court or regulatory authority or we are legally required to hold supporter transaction details for Gift Aid or accounting/tax purposes.
In certain instances, we may collect and use personal information where this is necessary in our legitimate interest as a charity, this includes being able to:
- Send direct marketing material to supporters by post or contacting them by telephone for fundraising purposes (subject to checking against the Telephone Preference Service and any existing marketing preferences).
- Conduct research to better understand who our supporters are and better target our fundraising activity.
- Monitor who we deal with to protect our charity against fraud, money laundering and other risks.
- Maintain and administer our supporter database and systems.
In all cases, we balance our legitimate interests against your rights as an individual and make sure we only use personal information in a way or for a purpose that you would reasonably expect in accordance with this Policy and that does not intrude on your privacy or previously expressed marketing preferences.
Where we process sensitive personal data (as mentioned above), we will make sure that we only do so in accordance with one of the additional lawful grounds for processing such as where we have your explicit consent or you have made that information manifestly public. This will be on the basis of legitimate interests of vital interests. When we do this, we will tell you what sensitive personal data we are collecting and why.
5 Marketing information
We provide direct marketing and fundraising communications to supporters which includes news, information and data about:
- RPFI and our work supporting adults and children in crisis, and related events and campaigns.
- Campaigns to support adults and children in crisis, and the issues that they encounter, in order to bring about positive change in their lives.
- Online and paper petitions relating to campaigns.
- Opportunities to volunteer
- Appeals and fundraising (including donations, competitions, raffles and similar promotional activities).
- Our events, activities, local groups and committees.
- Leaving a legacy.
RPFI relies on donations and support from others to continue its work on behalf of adults and children in crisis. Being able to contact you for marketing and campaigning purposes is an important part of our fundraising activity and purpose.
Fundraising is an important part of our marketing, but we will not share your data with any other organisation, individual or company to allow them to use your personal information for marketing or campaigning purposes, unless we have obtained your specific, freely given, informed and unambiguous consent to do so.
Anonymised data
We may aggregate and anonymise personal information so that it can no longer be linked to any particular person. This anonymised data can be used for a variety of purposes (such as recruiting new supporters) or to identify trends or patterns within our existing supporter base. This data helps inform our actions and improve our campaigns, products, services and materials.
In accordance with our legal and regulatory obligations and our internal policies and procedures, we may also use personal information to carry out due diligence on potential or actual donors. If you opt out of analysis of your data for due diligence purposes, we may not be able to accept donations from you.
6 Fundraising
As a charity, we have a legitimate interest in generating both community support and financial donations to deliver our work. After carrying out a balanced assessment, we rely on Legitimate Interests for the processing of your Personal Data for direct marketing purposes, whether you are an active supporter to RPFI, or when we approach you as a potential new supporter to the charity.
In all our fundraising communications, we will give you clear opportunities to opt-out of future communications. We will provide easy to understand information on our appeals making you aware that we are processing your data based on legitimate interests, including how to contact our Fundraising Team and request to be removed from specific or all future communications from RPFI.
7 Recipients of your personal data
RPFI may disclose your personal information in the following circumstances:
To other RPFI entities, trading subsidiaries, suppliers or service providers only to provide the products or services you've requested from our site(s) for instance, where we might use an external fulfilment company to deliver goods to you.
To third parties who provide a service to us and are data processors. This would include our trusted partners that work with us in connection with our charitable purposes, and other entities that act as fundraisers for RPFI, sell RPFI products or provide RPFI information and marketing (subject to your communication preferences and our internal policies and procedures). We require these third parties to comply strictly with our instructions and data protection laws and we will make sure that appropriate controls are in place. We enter into contracts or robustly assess their terms and conditions to ensure GDPR compliance with all of our data processors and regularly monitor their activities to ensure they are complying with RPFI policies and procedures.
Where we are under a duty to disclose your personal information in order to comply with any legal obligation (for example to government bodies and law enforcement agencies), or in order to enforce or apply our rights (including in relation to our website or other applicable terms and conditions) or to protect RPFI, for example in cases of suspected fraud or defamation.
We will never share, sell or swap your details with any third parties for the purposes of their own marketing or the monetizing of your data.
8 Web site offensive behavior
If you post or send any content on RPFI digital channels that we believe to be inappropriate, offensive or in breach of any laws, such as defamatory content on our social media pages, we may use your personal information to inform relevant third parties such as your internet provider or law enforcement agencies.
9 How do we store your information?
We use a range of tools and third party suppliers to store your information. In all cases we work to ensure that the measures we take and suppliers used are GDPR compliant. We are working to ensure, where we can, that we do not keep paper copies of information and only scan and store information electronically, however in some circumstances, particularly under our statutory requirements, we will need to have available paper copies of documents and ensure these are stored securely.
10 Data security
We take appropriate technical and organisational measures against unlawful or unauthorised processing of personal data and accidental loss or destruction or damage to personal data.
11 How long do we keep your information?
We keep your personal information only for as long as required to operate the service in accordance with legal requirements, tax and accounting rules. Where your information is no longer required we will ensure it is disposed of or anonymised in a secure manner.
In line with the GDPR, we will review personal information held with us periodically.
12 Privacy assessments
RPFI will always assess and plan for how personal data and processing will be managed when new projects are being developed. This will occur when the charity is thinking about using a new tool or service with which to process data for example.
13 Your rights to access your personal information
Under the GDPR you have a right to request a copy of the personal information we hold about you and to have any inaccuracies corrected.
You also have the right to request us to erase your personal information, request us to restrict our processing of your personal information or to object to our processing of your personal information.
Should you wish to exercise these rights, we promise to respond. There will be no charge for this action.
Please address requests to RPFI, and we will respond within 30 days, of receipt of your written or verbal request and confirmed ID. The email address to send is: info@RPFI.org
Please provide as much information as possible about the nature of your contact with us to help us locate your records.
Where you have provided your consent for our use of your personal information, you always have a right to withdraw your consent at any time.
14 Complaints
If you are not satisfied with our work or something that we have done or failed to do, we want to know about it. We also welcome your views on what we do well. Your comments enable us as a charity to learn and continuously improve our services.
Please send any complaints to this email: complaints@rpfi.org.
15 Contacting us
We welcome any queries, comments or requests you may have regarding this Privacy Policy and any other relevant policies. Please do not hesitate to contact us.
If you prefer to write, contact RPFI, The White House, 91 Heath field North, Twickenham, TW2 4QN.
Email: info@rpfi.org
Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behavior of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply:
- Your data will be made available to our website provider
- The data that may be available to them include any of the data we collect as described in this privacy policy.
- Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA.
- They will store your data for a maximum of 7 years.
- This processing does not affect your rights as detailed in this privacy policy.