How we collect information about you Llamau collects information in the following ways. Expand We collect information in the following ways: When you give us information directly – this might be when you sign up for one of our events, when you donate to us, when you fundraise for us, when you sign up to receive communications from us, when you communicate with us or when you apply to volunteer with us. When we collect it as you use our website – Like most websites we use “cookies” which help us to improve our website and the way you use it. The cookies we use mean that our website will remember you and may pre-populate fields such as your name and address when you’re filling them in. Cookies are small text files that websites transfer to your device (computer, phone or tablet) and provide us with information such as what type of device you’re using, what specific device you have, what operating system you’re using, what your device settings are and why our website might have crashed on your device. Your device manufacturer or operating system provider will have more details about what information your device makes available to us. You can find more information about our use of cookies in the section ‘Cookies’. 3. When you give it to us indirectly – your information may be shared with us by third parties, including: Third Party fundraising sites like Just Giving, Everyday Hero or Charities Aid Foundation Third party event organisers, for example Cardiff Half Marathon or London Marathon Professional fundraising agencies who have been instructed to act on our behalf External volunteering sites such as Volunteering Wales Your information will only be shared with us by these organisations if you have given your consent for your information to be passed to us. We recommend that you check the other organisation’s Privacy Policy to understand how they will process your data. We may also receive data about you from agencies acting on our behalf to provide payment services, technical services and analytics providers on our website. Information from other sources – We may also use information from the following sources: Social media – If your settings on social media and messaging services (including Facebook, Twitter, WhatsApp) allow, we may have permission to access information from those services, for example when you publically tag us in a photo on social media Information which is publically available – We may supplement our data with information about you which is publically available in order to give us a better understanding of you and to improve our communications with you. This could include information from media sources, from Companies House, public social media accounts, corporate websites. This could include socio-demographic information, previous donations to charities and information about your lifestyle and interests.
What personal information we collect If you choose to support us by donating, fundraising for us, signing up for an event or by volunteering we will collect the following information. Expand What personal information we collect If you choose to support us by donating, fundraising for us, signing up for an event or by volunteering we will collect the following information: Your name Your contact details, including address, email address, phone number, social media identity Your date of birth Emergency contact name and contact details (particularly if you are signing up for an event) Your bank or credit card details where you provide these to make a payment Information related to your health (for example, if you are signing up for an event such as Sleep Out) Why you have decided to donate to us Information about your activities on our website and about the device you use to access our website, for example your IP address and geographical location Information as to whether you are a taxpayer to enable us to claim Gift Aid If you are applying to volunteer for us, your National Insurance Number and information which allows us to assess your suitability to volunteer for us, including your skills and strengths, your work or voluntary experience, your qualifications and references. We will also collect information on any unspent criminal convictions or criminal investigations If you are applying to volunteer for us we will also collect information which allows us to monitor our recruitment processes to ensure we are providing equal opportunities, including your gender, nationality, marital status, sexual orientation, ethnic origin, religious beliefs and any disabilities Some of the information we collect is Special Category data under the General Data Protection Regulations, such as race, ethnic origin, religious beliefs, sexual orientation and information about your health. We only collect this type of information about our supporters and volunteers where there is a clear reason for us to do so, as outlined below: We collect information about your health when taking part in challenge events to ensure that you are able to take part and to inform any measures that we need to put in place to support you to participate in the event safely We collect information about your gender, nationality, marital status, sexual orientation, ethnic origin, religious beliefs and any disabilities to allow us to monitor our recruitment processes to ensure we are providing equal opportunities and to ensure we are aware of any adaptations we may need to make to allow you to volunteer for us. Wherever possible, we will make it clear to you why we are collecting any Special Category data and what it will be used for.
How we use your personal information Llamau will use your personal information in the following ways Expand We will use your personal information to: Provide you with information, products or services you have requested or information relating to the product or service to which you have signed up. For example, if you have signed up to take part in Sleep Out we will use your information to send you communications about Sleep Out Process your donation or support your fundraising, including processing Gift Aid or sending you a communication to wish you luck with your fundraising event Keep a record of your relationship with us, so we don’t forget what support you’ve previously given us Deal with and respond to any requests, complaints or queries you make to us Understand how we can improve our communications, products and services through data analysis or market research Manage our fundraising events Analyse the success of our fundraising activities and identify ways to improve our fundraising activities Keep your personal information up to date by checking against third party sources. For example we may check your details against the Post Office National Change of Address register to check if you have moved Send you communications Administer and improve our website by analysing statistics and data from our website analytics tools Display our online content to you in a format that suits the device you are using, for example if you are using a mobile device to access our website Contact you if you enter your details into one of our online forms and you don’t submit or complete the form to see if you are having problems completing the form and whether we can provide any help Process your application for a volunteer position and assess your suitability for that position Conduct training and quality assurance processes Meet our legal obligations, for example to regulators and government If you submit personal information for publication on our website, we will publish and otherwise use that information in accordance with the license you grant to us. Processing payments All our website financial transactions are handled through our Payment Services Providers – Stripe and Go Cardless. You can review their Privacy Policies at https://stripe.com/gb/privacy https://gocardless.com/legal/privacy/
How we use your information to tell you about our work Llamau will use your information to tell you about our work in the following ways. Expand Marketing Communications Our marketing communications include information about our work, the progress we’re making towards our mission of ending youth homelessness and homelessness for women. We may also include information about our latest campaigns and ask you to donate or support us in other ways. We operate an ‘opt-in’ policy for our communications which means that we will only send you marketing communications where we have explicit consent to send them to you, except where we have a legitimate interest to communicate with you about a specific activity. For example if you have registered an interest in a specific fundraising event or activity, we have a legitimate interest to send you communications about that event or activity but will not send you communications about other areas of our work without your explicit consent. Managing your communications preferences If you decide that you no longer want to receive certain types of communications from us, you can let us know at any time by emailing [email protected] or calling 029 2023 9585 and asking for the fundraising team. We will also give you information on how to opt out of receiving communications from us whenever we send you marketing communications. Even if you decide that you don’t want to receive marketing communications from us, we may still need to send administrative communications to you. This could include contacting you about a donation you have made, about processing Gift Aid, thanking you for supporting us or keeping in touch with you about a fundraising or volunteering activity with which you are currently involved. Building profiles of supporters We do not currently use profiling and screening techniques, but may do so in the future. These techniques would allow us to send you more relevant and timely communications and provide a better experience for our supporters. This also allows us to ensure that the money we spend on communications is targeted efficiently. Profiling and screening would allow us to understand the backgrounds and situations of our supporters, and may help us to identify people who may be able to give more than they already do, and therefore allow us to raise more money to deliver our mission sooner. Building a profile would involve us collecting and analysing geographic, demographic and other information such as employment details, visible assets and other philanthropic activity. This information may be used to give us an idea of your giving capacity to Llamau. We will do this by combining the data we hold about you on Llamau’s supporter database with publically available information, such as information published by other charities, corporate websites, public social media accounts, the electoral register and Companies House. We will only use information which is publically available and will not use information which has not been broadcast or made public. If you do not wish us to use your data in this way, you can opt out of this activity at any time by emailing [email protected] or phoning 029 2023 9585 and asking for the fundraising team.
How we use cookies Our website uses cookies to help us to improve our website and the way you use it. Here is how we use that data. Expand Our website uses cookies to help us to improve our website and the way you use it. The cookies we use mean that our website will remember you and may pre-populate fields such as your name and address when you’re filling them in on our website. Cookies do not typically contain any information that personally identifies a user but personal information that we store about you may be linked to the information stored in and obtained from cookies. The names of the cookies we use on our website and the purpose for which we use them are set out below: Cookie Name Used by Description Expiration _utma Google Analytics Stores the amount of visits of a user, the time of their first visit, the previous visit, and the current visit. It does not contain any personal information and is used only for analytical purposes 2 year from set / update _utmz Google Analytics This performance cookie stores where a user came from, eg search engine, search keyword, link 6 months from set / update _ga and_gid Google Analytics Used to distinguish between website users in Google Analytics 2 years and 2 hours _gat_UA-27093031-1 Google Analytics Used to moderate calls to the Google Analytics Service 1 minute _unam ShareThis Set as part of the ShareThis service and monitors “click-stream” activity, eg web pages viewed, navigation from page to page, time spent on each page etc. The ShareThis service only identifies a user if they have separately signed up with ShareThis for a ShareThis account and given them consent. Checks how long you stay on a site: when a visit starts and ends. It does not contain any personal information and is only used for analytical purposes. 14 months cc_cookie_accept Website Stores whether the user has accepted the cookie message or not. 365 days ASP.NET_SessionId Website Used for authenticating a user’s session after logging in. Closes when you exit in the browser. End of session ARRAffinity Website Tells our infrastructure which server to handle the request. End of session MemberLoggedIn Website A binary flag which stores whether a user is logged in or not. End of session ai_session and ai_user Website Tracks users as the navigate the website predominantly for infrastructure performance insights. 1 day DisplayName Website Keeps track of a donor’s preference to show their name during a Direct Debit. End of session IDE, DSID, _ct_rmm Doubleclick.net These cookies are managed by DoubleClick, an advertising platform we use to display adverts. They help us identify which visitors to our website have seen or clicked one of our adverts. 2 years from set / update _cfduid CloudFlare Identify individual clients behind a shared IP address and apply security settings on a per-client basis. 365 days Most browsers allow you to refuse to accept cookies, but blocking cookies may have a negative impact on the usability of our website and you will not be able to use all the features on our website.
Legal basis for processing Under the General Data Protection Regulations we must have a ‘legal basis’ for any processing of personal information. This section outlines the legal bases on which we process information about our supporters and volunteers. Expand Under the General Data Protection Regulations we must have a ‘legal basis’ for any processing of personal information. This section outlines the legal bases on which we process information about our supporters and volunteers. Legal Obligation We have a legal obligation to collect, process and store information about our supporters for the purposes of processing Gift Aid claims, and we must keep this information for six years after a Gift Aid claim has been made to HMRC. We have a legal obligation to collect and process information about any criminal convictions or pending investigations of anyone interested in volunteering for us to allow us to safeguard the people we support, and ensure that any risks identified are appropriately managed. Under GDPR, we also have a legal obligation to keep your personal information up to date by checking against third party sources. For example we may check your details against the Post Office National Change of Address register to check if you have moved. Legitimate Interest We have a legitimate interest to process personal information about our supporters in the following circumstances: For providing you with information, products or services you have requested or information relating to the product or service to which you have signed up. For example, if you have signed up to take part in Sleep Out we will use your information to send you communications about Sleep Out For processing your donation or supporting your fundraising, including sending you a communication to wish you luck with your fundraising event For keeping a record of your relationship with us, so we don’t forget what support you’ve previously given us For dealing with and responding to any requests, complaints or queries you make to us For understanding how we can improve our communications, products and services through data analysis or market research For managing our fundraising events For analysing the success of our fundraising activities and identifying ways to improve our fundraising activities For analysis and profiling of our supporters, using information we already hold For administering and improving our website by analysing statistics and data from our website analytics tools For displaying our online content to you in a format that suits the device you are using, for example if you are using a mobile device to access our website For contacting you if you enter your details into one of our online forms and you don’t submit or complete the form to see if you are having problems completing the form and whether we can provide any help For conducting training and quality assurance processes We only rely on legitimate interests where we have taken your rights into account, considered how intrusive the processing is and conducted a balancing test to ensure that your rights do not outweigh our rights to process the data. Consent We operate an ‘opt-in’ policy for our communications which means that we will only send you marketing communications where we have explicit consent to send them to you, except where we have a legitimate interest to communicate with you about a specific activity. Outside of any legitimate interests, we will seek explicit consent from you to send you communications by email, post, SMS and phone. You can withdraw your consent at any time by emailing [email protected] or calling 029 2023 9585 and asking for the fundraising team. You will also be given the opportunity to withdraw your consent whenever we send you marketing communications.
How we keep your information safe The following explains how Llamau works to keep your information safe Expand We will always ensure that we have technical controls in place which protect any personal details which you provide online. For example, our online forms are encrypted and our network is protected and routinely monitored. We will store all of your personal information on our, and where applicable our suppliers’, secure password-protected and firewall protected servers. This may include data storage services provided in the Cloud. We regularly review who has access to the information we hold about our supporters and make sure that only fully-trained staff and volunteers have access to information about you. Some of our suppliers and our database provider run their operations outside of the European Economic Area (EEA). Although they may not be subject to the same laws as companies based in the UK, we will take steps to ensure they the protection they provide is at an equivalent level to the laws of the UK. Our database provider has certified to the US Department of Commerce that it adheres to the EU-US Privacy Shield principles. The European Commission adopted The EU-US Privacy Shield as a replacement for the Safe Harbour mechanism. The Privacy Shield bridges the gap between US privacy laws and the EU’s and permits the transfer of data from the EU to US companies who are certified under the Privacy Shield. By submitting your information to us you agree to this transfer, storing or processing at a location outside the EEA. We may need to disclose your data, if required, to the police, regulatory bodies or legal advisors.
How long we keep your information for The following explains how long Llamau will keep your information on our records depending on how you have engaged with the organisation. Expand We will keep data on our supporters for at least six years in order to allow us to fulfil our legal obligations for Gift Aid claims to HMRC. If you are still actively supporting us or volunteering for us, we will keep your data for longer than six years in order to ensure that we are able to provide the best possible supporter experience. If you are no longer actively supporting or volunteering for us after six years of holding your data, we will anonymise your record and retain information such as your giving history for analysis purposes and to allow us to improve our fundraising activities. If you have signed up to receive job alerts from us, we will check with you once a year if you still want to receive job alerts from us by asking you to re-submit your information for job alerts. If you do not provide us with your information again at that point, we will delete your personal information.
Sharing your information with other organisations We will never share, rent or sell your information with other organisations for use in their marketing communications. Expand We will never share, rent or sell your information with other organisations for use in their marketing communications. We may however share your information with third party suppliers to enable us to carry out data processing outlined in this policy. This includes: Suppliers and sub-contractors who process information on our behalf. Any data processing carried out by third parties will be subject to a contract which ensure that their processing also complies with General Data Protection Regulations Analytics and search engine providers IT service providers
Keeping your information up to date Where possible, we use information which is publicly available to keep the information we hold about you up to date. Expand Where possible, we use information which is publicly available to keep the information we hold about you up to date. This could include, information provided to us by other organisations. We do this to ensure that you can continue to receive marketing communications from us and so we are able to contact you about any issues with any donations you make or fundraising you are involved with. By doing this, we can also make sure that we don’t hold duplicate records for you on our supporter database which helps us to avoid having out of date preferences and contacting you when you’ve asked us not to. If you do not want us to keep your information up to date using external publically available information, you can let us know by emailing [email protected] or calling 029 2023 9585 and asking for the fundraising team. If you let us know that your contact details have changed, we will update our records to reflect the change. If your contact details do change please email us on [email protected] or phone 029 2023 9585 and ask for the fundraising team.
Your rights under GDPR Under UK data protection law you have rights over the personal information we hold about you. Expand Under UK data protection law you have rights over the personal information we hold about you. These are: Right to access your personal information You have the right to request access to the personal information that we hold about you. We will provide you with this information unless legal exceptions apply. If you want to access your information, email [email protected] with a description of the information that you would like to have access to. Right to have your inaccurate personal information rectified You have the right to challenge any information, which you consider to be incorrect. This may lead to some information being amended / clarified or to a note being added explaining the reasons it is not felt appropriate to change the information. Right to restrict use of your personal information You have the right to request that we restrict processing of your information. If you request that we restrict the processing of your personal information, we will contact you to discuss your request before any action is taken. Right to erasure of your personal information You have the right to ask to have any personal information we hold about you deleted. Wherever possible, a request should be made in writing to allow us to confirm you are the data subject. If you request that we erase the personal information we hold about you, we will contact you to discuss your request before any action is taken. Right for your personal information to be portable You have the right to request that any information we hold electronically is provided to you, or another agency, in a secure electronic format. Wherever possible, such a request should be made in writing to allow us to confirm you are the data subject. If you request that we provide your personal information in a portable format, we will contact you to discuss your request before any action is taken. Right to object to the use of your personal information You have the right to object to us processing your information, unless we have a legal or contractual obligation to do so. If we are using your information for direct marketing purposes and you object to the processing, we will stop processing your information as soon as reasonably possible, and definitely within one calendar month of your request. Right not to be subject to automated decision-making including profiling You have the right to object to automated decision-making including profiling. Wherever possible, such a request should be made in writing to allow us to confirm you are the data subject. If you request that we do not process your personal information in this way, we will contact you to discuss your request before any action is taken. You can exercise any of your rights by contacting [email protected] You can also find more information about your rights as a data subject on the Information Commissioner’s Office website.
Complaints If you are unhappy with the way in which we are processing your data, we’d like you to get in touch to let us know. Expand If you are unhappy with the way in which we are processing your data, we’d like you to get in touch to let us know. You can make a complaint by following our complaints procedure. You also have the right to lodge a complaint about any use of your information with the Information Commissioner’s Office.
Changes to our Privacy Notice We may occasionally make changes to this Privacy Notice Expand We may occasionally make changes to this Privacy Notice. If we make any significant changes to the way we collect, process or store your personal information we will make this clear on the Llamau website or we may contact you to let you know.