This policy covers any data collected and processed for the purposes of fundraising at The Haven Wolverhampton, and includes both hard copy and electronic records including Internet and Intranet sites, databases, emails, films and videos

The type of personal information we collect

We currently collect and process the following types of information:

• Title and Full Name
• Postal Address
• Phone Number
• Email Address
• Gender
• Date of birth
• Deceased
• All Communications we have with you
• Groupings and Indicators on your interests
• Place of Work (linked via relationships)
• Relationship status with other donors
• Donation, payment and support history
• Photographs and/or video footage
• Services provided
• Access Requirements
• Dietary and Allergy Requirements

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:
Receipt of a donation – directly to The Haven Wolverhampton, or through someone fundraising for us

• Supported us as a volunteer
• Purchased fundraising items
• Attendance at one of our events
• To enable us to claim gift aid on your donation
• You’ve requested to join our mailing list

Data from third parties

• We may also obtain information from third parties – for example, if you purchase a ticket to one of The Haven Wolverhampton’s events via a third party such as Eventbrite, your data is shared with us in order for us to provide you with relevant event information. This is done securely through our own account management on their system.
• You opted in to be a part of photography / videography at events and we have utilised external suppliers for capturing such images/footage – this type of data will be shared from the supplier to us securely through platforms such as Dropbox.
• If you are looking to support us in a volunteer capacity, referees may provide information to us about your experience and competence
  Please note, we do not hold any personal payment/card details – all payments are made directly
  through third-party payment systems.

We use the information you have given us in order to

• Record and thank you for donations and support
• Create attendee lists to events
• To keep a record of the relationship we have with you, including all communications between ourselves and you
• To ensure we meet your individual needs and requirements (dietary/access) for events
• To inform you of any relevant information or changes to bookings you have made
• To fulfil on a purchase you have made i.e. to send you ordered Christmas cards
• To keep you up to date with volunteering arrangements
• To comply with policies, procedures and laws where appropriate
• To ensure we know how you prefer to be contacted by us
• Send you mailings to keep you up to date with our work and to provide further opportunities to support our work. We may keep information on your preferences and interests in order to tailor these to ensure you are getting relevant information
• If you have provided your email address when you purchased an item or booked to attend an event, from time to time we will send you recommendations by email for similar events and opportunities to get involved. Should you wish not to receive this information you will be given the option to opt-out when purchasing your item or event booking on our website, and you will always have the option to unsubscribe from future emails from us via a link embedded in the mailing. Alternatively, you can tell us directly by emailing give@havenrefuge.org.uk. If you have provided your telephone number when you purchased an item or booked to attend an event, or directly to The Haven Wolverhampton, we may use this to inform you of changes to the upcoming event or to gather further information we need for the event (i.e. dietary requirements). We may from time to time use this opportunity to talk to you about our services and other ways you can get involved. Should you wish to not discuss fundraising and service-related information via telephone, please let us know via give@havenrefuge.org.uk
• To claim Gift Aid
• To assist with our own reporting and analysis
• To analyse aggregated data that helps inform future fundraising marketing to potential new donors and supporters
• To promote the success of events and/or future similar events through the use of photography / videography via social media and other external media outlets – we will always make clear when photography or recording is taking place and you will have the opportunity to opt-out of this. We also have a takedown policy should you wish to be removed after the recording/photography – please note we only have control over The Haven Wolverhampton’s published content

 We may share this information with:

• HMRC, for the purposes of submitting a Gift Aid Claim
• CRM software and IT support – when we are having technical issues that need resolving
• Event organisers / venues – to ensure the space and event meets your individual needs
• Other attendees at specific events (whereby all attendees have opted in to sharing their information with other guests)
• Photos may be shared with third parties such as external media outlets (local newspapers / magazines) to promote success of events for example
• We may make anonymised data available to other agencies for analysis and research purposes (for instance, donation trends over time). This assists with reporting to funders, strategic planning, and helps us to make better fundraising decisions
• With auditors and other regulatory bodies to enable our work to be compliant and fulfil our legal and charity responsibilities

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

(a) Your consent. You are able to remove your consent at any time. You can do this by contacting our fundraising team via give@havenrefuge.org.uk

(b) We have a legitimate interest (except where such interests are overridden by the interests, rights or freedoms of the individual)

(c) We have a legal obligation

Data from children

Under UK Data Regulations, only children aged 13 or over can consent to having their personal data processed and stored – this includes having their photograph taken. For children aged 12 and under, The Haven will get permission from whoever holds parental responsibility before processing and storing their data.

We do not share any personal data we collect from anyone aged under 14 without consent from their parent or guardian, unless we must do so by law (for example, during a police investigation).

How we store your personal information

We take steps to ensure that data is accurate and up to date, and we regularly review our data in line with our retention policy (see below). If you wish to correct any inaccuracies in your data, please email give@havenrefuge.org.uk

Your information is securely stored on our CRM database, locally stored on a Haven Wolverhampton server with appropriate levels of password protection and permissions.

To access the CRM database, all users must have a unique log in to The Haven Wolverhampton’s systems in the first instance. They then require an additional unique log in to the CRM database. Only staff with a need to use and access this database can do so. Other personal information is stored on files within The Haven Wolverhampton’s server which have a range of permission levels attached to each file meaning access will only be granted to individuals where there is a specific need; thus further protecting your data.

Data stored within Office 365 has additional security in the way of multi-factor authentication which all staff must authorise to be able to access the data; again this is limited and controlled to relevant members of staff only.

We ensure that any third parties we use for processing your personal information also have relevant GDPR polices in place to protect your data.

We transfer personal data to our email provider Mailchimp, which has servers in the USA. Mailchimp is compliant with the EU-U.S. Privacy Shield Framework. More information can be found here.

Opt- out
If a supporter chooses to opt out of communications from us, The Haven Wolverhampton’s fundraising team act on this within no more than 28 days. The consent is updated on our CRM Database to ‘opt-out’ status. If applicable, the original scanned in opt in form is also permanently deleted.

Data Retention and Cleansing
As a Charity, the actual period for records to be kept will depend on a number of factors, including:

• legal requirements
• storage costs
• the Charity’s need to access the document
• historical value
• industry standards or best practice
• archival needs (permanent preservation)
• decision by senior management (in the absence of guidance on the above)

 Retention Schedule:

Information connected to donations will be retained until six full financial years have elapsed since a donors’ last gift OR two full financial
years have elapsed from our notification of their death. Thereafter all data relating to the data subject will be amended to remove personal
data whilst retaining donation amount, date and reason information, anonymising the CRM record for the purposes of future analytics. These
become Analytics records. Prior to anonymising these records, the donor will be contacted to advise of the process and given the opportunity (1 calendar month) to remain on The Haven’s CRM for the purposes of future interaction.

Supporter data held on Mailchimp will be cleansed annually, archiving any contacts with a 1 or 2-star rating. Subscribers’ records will be updated on The Haven’s CRM to reflect their removal from our mailing system. In the event that this subscriber is only engaging with The Haven through its mailing list, they will consequently be permanently deleted from the CRM system without any notification from The Haven 1 full year from the date of being archived.

Exceptions: The names and addresses of people who ask not to be mailed will be kept indefinitely to ensure that they are not mailed again. The records of Donors who have expressed an interest in leaving a gift in their Will to The Haven Wolverhampton will be retained until they expressly state that they will not be leaving such a gift or until two full financial years have elapsed from our notification of their death. This will enable us to identify the correlation between expressions of interest and subsequent actions.

Information required for the purpose of “gift in Will” administration will be retained until two full financial years have elapsed since the full gift has been received. This involves the deceased, and any individual linked to the administration of the gift.

Your data protection rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at give@havenrefuge.org.uk if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at give@havenrefuge.org.uk

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk