How we keep fundraising supporters' personal information safe
Please read this privacy policy carefully as it contains important information on who we are, how and why we collect, store, use and share any information relating to you (your personal data) in connection with your use of our website A website is a page you can go to on the internet like Google or YouTube. and. It also explains your rights Rights are the things everyone should be allowed to do like have a say, or go to school. in relation to your personal data and how to contact us or a relevant regulator in the event you have a complaint.
This privacy notice was last updated in November 2023.
Our privacy promise
We promise to respect Respect means showing someone you think about someone's feelings, wishes or rights. all personal information that you share with us, or we receive from other organisations Organisations are groups like companies and businesses. , and keep it safe. We will be clear when we collect your personal information and we will not do anything you would not reasonably expect us to.
Our privacy promise
At Mencap, we are committed to respecting your privacy and protecting your personal information.
We promise to respect all personal information that you share with us, or we receive from other organisations, and keep it safe. We will be clear when we collect your personal information and we will not do anything you would not reasonably expect us to.
This privacy notice, together with our terms and conditions and cookie policy, will explain how and why we use your personal information, to ensure you remain informed and in control of your information.
This privacy notice is divided into different sections; please read the relevant section(s) below for further information.
Controller of personal information
We are Royal Mencap Society (registered company in England and Wales no. 00550457) and we are the UK’s leading charity for people with a learning disability A learning disability is to do with the way someone's brain works. It makes it harder for someone to learn, understand or do things. . Our registered charity numbers are 222377 in England and Wales, and SC041079 in Scotland.
Royal Mencap Society is registered as a data controller with the Information Commissioner’s Office under the Data Protection Act 2018 and our registration number is Z5709720.
Mencap Trust Company Limited (registered company in England and Wales no. 01233201) is a wholly owned subsidiary of ours which trade on our behalf. That means they are part of Royal Mencap Society and we are their 'parent'.
Within the context of this privacy notice, ‘we’, ‘us’, ‘our’ or ‘Mencap’ refers to Royal Mencap Society or Mencap Trust Company Limited. So whenever you see these words, we are talking about both of these companies.
Lawful Basis for Processing
We may only collect and process your personal information when the law Laws are the rules that everyone in the country has to follow. If you don't follow the rules you can get in trouble with the police. allows us to. Most commonly, we will use your personal information in the following circumstances:
- Where we need to process your personal information for our legitimate business needs or those of a third party;
- To comply with a legal obligation;
- To protect your vital interest;
- Under the performance of a contract; or
- With your consent Consent is when you say yes to something, like an operation, or Mencap using your photo for a story. You may have to sign something to say yes. If you can't make your own decisions, someone else can say yes or no for you. They must think about what is right for you.
We will only use your information for the purpose it was collected for, or for closely related purposes. Should the reason for processing change, we will let you know in advance.
Legitimate Interest
Legitimate interests means the interest of Mencap in the way we carry out our work to enable us to give you the best service/products and the best and most secure experience Experience is when you have learned or tried something before. .
For example, if we have a legitimate interest in making sure that any marketing we send to you is relevant, we may process your information to enable marketing that is of particular interest to you.
When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you and your rights under the Data Protection law and GDPR. We will always ensure that your personal data will not be used where our interests are overridden by the impact on you, unless we have your consent or are required by law.
Consent
We may seek consent as the lawful basis to process your information at the time it is collected. We will ask you to tick a box or provide a signature to confirm that you agree to Mencap processing your data. We will let you know:
- What the information will be used for;
- Who will have access to it;
- Who it will be shared with;
- How long we will hold it before deleting it;
- How we will ensure the data is stored safely and securely
Where the processing of your data is based upon consent, you have the right to withdraw that consent at any time.
Why we collect your personal information
Our vision is a world where people with a learning disability are valued equally, listened to and included. We need you to help us make this a reality, and collecting your personal data enables us to learn what different choices of communication work best. This also means we save money that can be used to directly support people with a learning disability. Find out more about how we fundraise in our fundraising promise.
To summarise: when you use our website or services, you are agreeing for us to store and process your personal data. This helps us to improve the way we communicate and work with you The ways we do that are explained in this notice – it is a guide for us to follow to ensure that we are compliant with the Data Protection Act.
Where we collect your personal information from
There are 2 main ways in which we collect personal information about you: directly or indirectly, including the use of third parties.
When you give your personal information to us directly:
You may give us your information in order to sign up for one of our events, tell us your story, register on our website, request a service from us, fundraise on our behalf, sign up to a campaign, donate goods to our charity shops and add Gift Aid to your donation, make a donation, purchase our products or communicate with us. Sometimes when you support us, your information is collected by an organisation working for us (e.g. a professional fundraising agency), but we are responsible for your data at all times.
When you give your personal information to us indirectly:
Your information may be shared with us by independent event organisers, for example the London Marathon or fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so when you have indicated that you wish to support Mencap and with your consent. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.
When you give permission to other organisations to share or it is available publicly:
We may combine information you provide to us with information available from external sources in order to gain a better understanding of our supporters to improve our fundraising methods, products and services.
The information we get from other organisations may depend on your privacy settings or the responses you give, so you should regularly check them. This information comes from the following sources:
Third party organisations
This means other organisations that we collect data from, but only when you have given them permission to do this. You may give these organisations permission at various times, for example when buying something from a mail order catalogue or joining certain Certain means you are sure about something. membership organisations. The data we receive depends on your agreement with the organisation.
We may also collect information from online social media and messaging services you use, such as Facebook, WhatsApp or Twitter, where you have given us permission to do so, or if you post on one of our social media pages.
Information available publicly
When building a profile, we may analyse geographic, demographic and other information relating to you in order to better understand your interests and preferences to contact you with the most relevant communications. In doing this, we may use additional information from third party sources when it is available. Such information is compiled using publicly available data about you, for example: addresses, listed Directorships or typical earnings in a given area.
Our profiling methods and analysis activities can be categorised in the following five ways:
- Data Matching
We may use the personal information an individual has given us in conjunction with data that has been obtained indirectly from external sources in order to infer likely social, demographic and financial characteristics. This allows us to tailor communications with a better degree of relevancy to better meet the expectations and desires of the individual and other individuals in similar circumstances. We will not use this data in any way that might intrude upon an individual’s rights or be considered inappropriate. - Segmenting
We analyse supporters by group, post code or geodemographic area where more generous supporters may be situated. This enables us to better tailor relevant campaigns and mailings for those most likely to be interested and get involved Involved is being included in something or taking part in something. . This is not designed to identify any specific individuals, but rather many individuals who may lie in a particular segment of supporters. - Major Donor Analysis
We may research Research is a way of finding out information which could come from books, or asking people what they think. prospective supporters to determine whether the individual could potentially become a major donor. We may utilise publicly available information from third party sources, such as Google, news articles, Companies House, published literature and social networking platforms. This information can include: history of donations to or associations with charities; how the individual is connected to us and other charitable organisations; areas of interest; stature in their field of expertise; gift capacity; any publicly known affiliations with not-for-profit or philanthropic bodies. - Event Planning
We may use profiling to create short biographies of individuals who are attending events of ours or are due to meet with members of our leadership for the purpose of understanding more about the people we are engaging with. - Ethical Screening and Minimising Risk
We are subject to many legal and regulatory obligations and standards. Considering it is our mission to improve the lives of people with learning disabilities, the public naturally expects us to operate in an ethical manner. We employ appropriate due diligence of donors and donations as well as implementing robust financial controls that help protect Mencap from abuse Abuse is when someone bullies you and does or says something to you that makes you feel hurt, upset or scared. , fraud and money laundering. We may ethically screen supporters to minimise the risk of associating ourselves with an individual or organisation that conflicts with the high standards we have set ourselves in our ethical policy. We do not accept donations from or hold/process any personal information of anybody that is under 16 years of age.
When we collect personal information as you use our websites or apps:
Like most websites, we use “cookies” to help us make our site – and the way you use it – better. Cookies mean that a website will remember you. They’re small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier – for example by automatically filling your name and address in text fields. There are more details in our Cookie Policy.
In addition, the type of device you’re using to access our website or apps and the settings on tha.t device may provide us with information about your device, including what type of device it is, what specific device you have, what operating system you’re using, what your device settings are, and why a crash has happened. Your device manufacturer or operating system provider will have more details about what information your device makes available to us.
When you visit and look around our website, we record things like your IP (internet protocol) address – the unique number of the device you are using to access our website, which pages you visit (on our website only), when they were visited, and the type of device you were using. This information helps us create a better experience for everyone who uses our website.
Examples of the type of information that can be collected using your IP address include the type and version of your browser, and the location from which you are accessing our site. This helps us improve how our page templates appear and change content to make it relevant to our website visitors.
How we use your personal information
Personal information means any information that may be used to identify you, such as your name, telephone number, email address, or your postal address.
We may process your personal information for our legitimate business needs. We collect your personal information because we need it to help us fulfil your requests, keep in touch with you, and offer you communications that are relevant to you.
This includes things like:
- Where processing enables us to enhance, modify, personalise or otherwise improve our services/communications for the benefit of our supporters
- To better understand how people interact with our website
- To provide postal communications which we think will be of interest to you
- To determine the effectiveness of promotional campaigns and advertising
- Providing any information or services you have requested
- Processing financial transactions such as donations, entering a paid event or setting up a Direct Debit. This includes processing gift aid with HMRC if relevant
- Keeping a record of any communications between us, for example emails and phone calls, or other interactions such as requests for leaflets or attending an event
- Managing and improving how we communicate with you – how you prefer to be contacted, and what information you want to receive. We might contact you about our campaigns, events, appeals, volunteering, news, information and advice, and games, as well as other ways you can support Royal Mencap Society
- Researching the interests, behaviours, demographics (for example, age, sex, income), and trends of the people who are using our information, and range of services, both support and non-support related. We may ask if you wish to take part in more research, such as surveys or focus groups Where a group of people meet to talk about a topic, and a researcher asks them some questions. , but this will be voluntary (your choice)
- Creating a profile of what we think might interest you, so that we can offer you relevant communications. We may use your previous activities or interactions with us to try and predict how you may respond to different activities
- Getting more information about you from third parties, such as your age, telephone number, email address, or new address if you move. This helps us keep our records up to date, ensuring we continue to send you the most relevant communications – if you have chosen to receive them
- Responding to complaints or queries and look into any legal claims.
HealthUnlocked - our online
community
A community is the people and places in an area.
When you join our online community you agree to HealthUnlocked's terms and conditions and their privacy policy. You cannot post on Mencap's online community unless you register with HealthUnlocked.
HealthUnlocked manages all the login details for Mencap's online community. Mencap does not have access to your email address, but can send you a direct message via the online community. If you have any questions about your account please contact HealthUnlocked.
Sensitive personal information
Sometimes, we may ask you for more sensitive information, such as your personal connection to learning disability or your health condition if you are taking part in a sporting event. We will only collect this information with your permission and we will always take extra care of it.
Building profiles of supporters and targeting communications
We use profiling and screening techniques to ensure communications are relevant and timely, and to provide an improved experience for our supporters. Profiling also allows us to target our resources effectively, which donors consistently tell us is a key priority for them. We do this because it allows us to understand the background of the people who support us and helps us to make appropriate requests to supporters who may be able and willing to give more than they already do. Importantly, it enables us to raise more funds, sooner, and more cost-effectively, than we otherwise would.
When building a profile, we may analyse geographic, demographic and other information relating to you in order to better understand your interests and preferences in order to contact you with the most relevant communications. In doing this, we may use additional information from third party sources when it is available. Such information is compiled using publicly available data about you, for example addresses, listed Directorships or typical earnings in a given area.
Use of children's data
We are committed to protecting the privacy of children and young people that engage with us, whether through our website, at fundraising events, through a project facilitated by Mencap, where we provide a care, support or youth service or where we provide information and advice.
We collect and store personal information about children and young people where we are contracted to provide a care and support service to them. We are required to process this personal information in order to fulfil the requirements of the care and support contract and to meet our regulatory obligations.
Where we are providing an information and advice service to children and young people, we will only process their personal information if we have written parental consent and if we need the data in order to provide a service to them.
If you sign up to Mencap's online community, HealthUnlocked, you must be aged 16 or over. Take a look at the online community terms and conditions.
If you want to participate in an event organised by Mencap, or a project facilitated by us, consent must be provided by the parent, guardian or carer if you are under the age of 16.
How we keep your personal information safe and who has access to it
We ensure that there are appropriate technical controls in place to keep your personal information safe and prevent unauthorised access to it. For example, our online forms are always encrypted (this prevents other people from accessing them) and our network is protected and regularly checked and tested.
Any payment card details (such as credit or debit cards) we receive on our website are passed securely to our payment processing provider according to the Payment Card Industry Data Security Standards (PCI DSS).
Electronic data and databases are stored on secure computer systems and we control who has access to them. All staff receive data protection training and we have data protection policies and procedures in place which teams are required to have knowledge Knowledge is knowing a lot about something. of and adhere to.
We regularly review who has access to information that we hold to ensure it is only accessible Accessible means something is easy for people to use or join in with. For example: Accessible writing means the writing is easy to read and understand. by trained staff, volunteers and contractors.
Where we use external companies to collect or process personal data on our behalf, we undertake comprehensive checks on these companies before we work with them, and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they have collected or have access to.
When we share your personal information
We will not sell or rent your personal information to third parties for the purposes of marketing, and we will not share your personal information for others to use in their marketing or fundraising activities.
We may share your personal information with other companies (e.g. subcontractors, suppliers) who provide services on our behalf, including delivering postal mail, sending emails, analysing data and processing credit card payments. We will only provide those companies with the information they need to deliver the relevant service, and we will make sure that your data is treated with the same level of care as if we were handling it directly. These activities will be carried out under a contract which imposes strict requirements on our suppliers to keep your information confidential Confidential means something is private. and secure.
We undertake comprehensive checks on these companies before we work with them and then work closely with them for the duration of our working relationship.
We may need to disclose your personal information if required to the police, regulatory bodies or legal advisors.
We will only ever share your data in other circumstances if we have your explicit and informed consent or if there is a legal requirement for us to do this.
Some of our suppliers may run their operations outside the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection laws.
How long we keep your personal information for
How long personal information will be retained for depends on the type of information it is and what it is being used for. For example:
- we will keep your personal data for 15 years after your last donation or meaningful interaction
- if you are someone who receives support from Mencap, we will keep your data for 6 years after we stop providing you with support
- personal data used in relation to a safeguarding Keeping people safe from being hurt, abused, or neglected is called Safeguarding. incident will be kept for a minimum of 75 years
- if you ask us not to send you marketing emails, we will stop storing your emails for marketing purposes (although we will keep a record of your preference not to be emailed).
The time periods for which we keep information are stipulated in our data retention policy. We review our data retention periods for personal information on a regular basis.
We continually review the information that we hold, and delete anything that is no longer required. We never store payment card information.
Your legal rights
Under GDPR you have rights regarding the personal data that Mencap hold and process about you. We want to ensure that you are always in control of your personal information.
Part of this is making sure that you understand your legal rights. Specifically you have the right;
- to be informed
- of access
- to rectification
- to erasure
- to restrict processing
- to data portability
- to object
- in relation to automated decision making and planning
We have outlined these below, together with details as to how you can exercise them.
The right to access your personal information
You have a right to obtain confirmation that your personal information is being processed. You also have the right to request a copy of the personal information that we hold about you. You can do this by completing our request form and you will need one piece of ID to complete the form.
When you are requesting a copy of the personal information that we hold about you, we will endeavour to provide you with the information you have requested without delay and in any event within one month of receiving your request.
We will not charge a fee for complying with a request unless the request is deemed to be manifestly unfounded or excessive.
The right to edit and update your personal information
The accuracy of your personal information is important to us. You have the right to request that your personal information is rectified if it is inaccurate or incomplete.
We will endeavour to comply with your request without delay and in any event, within one month of receiving your request.
The right to request to have your personal information erased (also known as the ‘right to be forgotten’)
You do not have an automatic right to have your personal information deleted. You do, however, have the right to request the deletion or removal of your personal information where there is no compelling reason for its continued processing. We will review each request on a case by case basis.
We will endeavour to comply with your request without delay and in any event, within one month of receiving your request.
The right to restrict the processing of your personal information
You have the right to ‘block’ or suppress processing of your personal information. However, we will continue to store your personal information but will no further process it. We do this by retaining just enough of your personal information so we can ensure that the restriction is respected in the future.
We will respond to your request within 21 days of receiving it, stating what we intend to do and, if we do not intend to comply with the objection, the reasons for our decision.
The right to object to your personal information being used for direct marketing (including profiling) and processing for the purposes of scientific/historical research and statistics
You have the right to object to your personal information being processed for direct marketing purposes (including profiling) and scientific/historical research and statistics. From the very first communication from us and every marketing communication we send after, you will have the right to object to marketing.
We will stop processing your personal information for direct marketing purposes as soon as we receive an objection from you.
The right to complain to a supervisory authority if you believe we have not handled your personal information in accordance with the data protection laws
You can make a complaint, raise a concern about how we process your personal information or exercise any of the rights outlined in this section by contacting our Data Protection Officer at the following address:
Data Protection Officer
Royal Mencap Society,
6 Cyrus Way,
Peterborough,
PE7 8HP
Or send an email to: dpo@mencap.org.uk.
If you are not happy with how we have handled your complaint, or you believe that your data protection or privacy rights have been infringed, you have the right to complain to the Information Commissioner's Officer (ICO), which oversees the protection of personal data in the UK.
Alternatively, you may choose to contact the Fundraising Regulator which is responsible for overseeing fundraising activities carried out by charities in the UK directly about your complaint.
Making changes to your personal information
Where possible, we use publicly available sources to keep your records up to date; for example, the Post Office’s National Change of Address database and information provided to us by other organisations.
If your personal details change, please help us to keep this information up to date by getting in touch and telling us:
Data Protection Officer
Royal Mencap Society,
6 Cyrus Way,
Peterborough,
PE7 8HP
Or send an email to: dpo@mencap.org.uk.
Updating your preferences or unsubscribing
You are in control of how we contact you, for example by post or email. And you can control this by contacting us or by creating an account on Royal Mencap Society’s website.
If you want to stop receiving emails, click the ‘unsubscribe’ link at the bottom of any of our emails. We would rather you didn’t miss out, but we respect that this is your decision!
To make changes to the type of communications you get from us and how often you get it, please log in to your account or contact our Supporter Care Team on supportercare@mencap.org.uk or 0845 077 0777.
Posting or sending inappropriate content
If you post or send any content that we believe to be inappropriate or content in breach of any laws, such as defamatory content, we may use your personal information to inform relevant third parties such as your internet provider or law enforcement agencies.
Update or changes to the privacy notice
This privacy notice was last updated in November 2023.
We reserve the right to make changes to this privacy notice. Each time you visit this site, you should check this privacy notice to check that no changes have been made to any sections that are important to you. The latest version of our Privacy Policy will always be available on our website.
What are your data protection rights?
This video explains the rights you have with your personal details that Mencap uses.
These rights are part of data protection law in the UK.
Privacy notice for the people we support
If you are someone who receives support from Mencap, this notice explains why we need information about you, what we do with this information and what your rights are about how this is used.
We also have a version of this notice in easy read Easy Read is a way of making written information easier to understand. Pictures are usually added next to the writing. .