When you complete a Direct Debit or Credit Card donation with us, we asked you for some personal information. GDPR ensures you know how we use it, who we share it with, as well as what your rights are, and how we protect it.
GDPR has brought personal data, and what people and companies do with it, more into the spotlight for both donors and organisations like ours that use the data. Here are the top things you should know:
GDPR is an EU regulation designed to help people better control their personal data. It also aims to ensure that all companies, such as us, are open and transparent about the personal information that is collected and how it is used.
It came into force on 25 May 2018 from when companies must be compliant; otherwise, they risk significant fines, up to €20m or 4% of their turnover!
GDPR limits how we can use your data and how we must obtain explicit consent before using your data for certain activities, such as marketing.
As a donor to the Charity you will also have additional rights, which include the ‘Right to Erasure’ (the right to be forgotten in certain circumstances) and the right to portability, which will allow you to move your data more easily to another organisation.
We have appointed a Data Protection Officer to ensure that we are keeping to the new regulation, so if you have any queries regarding your rights in relation to your personal data, please just contact us.
We have never, and will never, pass on your details to other companies for marketing purposes, or any other reason. If we want to share any information with you then we will ask your permission before we do so.
Who are we?
The Learning Foundation. We are a registered charity that manages donations on behalf of schools that are providing a, donation supported, one2one programme, where every child has a computing device to use in class and at home. We are the organisation that you should contact should you wish to change any aspect of your donation or have any related query.
In the sections that follow, we cover these topics:
- What information do we collect about you?
- How will we use your information?
- Who do we share your information with and why?
- How long do we keep your data?
- Your rights relating to your personal data.
- Changes to our Privacy Notice.
- How to contact us.
What information do we collect about you?
To enable us to collect and manage your donations by Direct Debit or Credit/debit Card, we need to collect certain information. If you are unable to provide this information requested then we will be unable to process or manage it. The information required is as follows:
- Donors name, address, telephone and email (if available)
- Financial information such as bank or Credit card details,
- Your ‘Agreed Donation Plan’ – which includes the amount you wish to donate, the frequency of the donations and the total number of donations you wish to make
- Your child’s: Name, Date of birth
- Your child’s School name, Year Group
- Details of missed donations, changes to the bank or credit card account details, changes to the amount, frequency or total number of donations
You, as the donor, will be our primary point of contact in relation to any queries and any notification of changes in the ‘Agreed Donation Plan’. You:
- Will have access to all documentation, information and personal data relating to your ‘Agreed Donation Plan’.
- You can notify us at any time if you wish to make changes to your ‘Agreed Donation Plan’. Can cancel the ‘Agreed Donation Plan’ at anytime
- Can raise a complaint if you are unhappy in any way with your ‘Agreed Donation Plan’.
Any person given permission to handle the donor’s affairs can cancel or amend the ‘Agreed Donation Plan’ or raise a complaint if you are unhappy in any way with your ‘Agreed Donation Plan’. We do however require prior permission from you in writing to deal with a third party on your behalf.
Remember, by giving us data about another person, you are confirming they have given you permission to provide it to us and you have told them who we are and what we will use their data for, as set out in this notice.
How will we use your information?
We will use your data for:
- Processing your donation
- Providing you with relevant documentation via email or post
- Administering your donation, including taking the donation payments and advising your child’s school that we have done so
- This may be done by third parties on our behalf
- Creating records in financial systems for accounting and management information reporting purposes
- Fraud prevention and detection
- Verifying your identity when required
- Dealing with any queries or complaints raised
- Validating and claiming Gift Aid from HMRC
- Improving our service to schools by analysing Donation Plan trends etc.
Who do we share your information with and why?
We may share your information with:
- Your child’s school (but always excluding your bank and credit card details)
- Third parties that supply financial services to us to process information on our behalf (for example, taking payment, collecting your information via the online Direct Debit form. We will ensure that they keep your information secure and do not use it for purposes other than those that we have specified in this notice
- Auditors, regulators and ombudsman, as required by legal obligation
- Another organisation – only if we sell or buy (or negotiate to sell or buy) any business or assets
- Another organisation to whom we transfer our agreement with you
We will share your information if we are required to by law. We may share your information to enforcement authorities if they ask us to, or to a third party in the context of actual or threatened legal proceedings, provided we can do so without breaching data protection laws.
How long do we keep your data?
We will keep your personal data for as long as is necessary for the purposes for which it was originally collected. These purposes can be found in the section ‘How will we use your information?’
To ensure the financial integrity of our records held in our databases, we will retain your personal data within those systems indefinitely unless it is deemed unlawful to do so.
Where information has been created based on the data held in those databases, for example reports, documents and spreadsheets, we will retain those records for seven years from the date that your last donation was made or as required by the HMRC and financial law. This also enables us to help you should there be any issues after your Donation Programme has completed.
FOR SCHOOLS & OTHER ORGANISATIONS
To enable us to keep you advised of the status of:
- Your e-learning programme
- Any developing educational opportunities that technology can offer education
- Changes in the services we provide, etc
we will need to collect the following information:
- School / organisation name, address, general telephone and email
- School profile information
- Names, job titles, responsibilities, telephone and email of relevant staff within the organisation
- Notes of all communications made with the school / organisation including the individuals involved, the date and contact type
Where we are working with a school or organisation we will identify the key contacts we would work with and the primary point of contact, in relation general contract management and for any queries or notification of operational changes. You:
- Will have access to all documentation, information and personal data
- Can notify us at any time if you wish to have your record updated or removed
- Can raise a complaint if you are unhappy in any way
Your rights relating to your personal data
Our obligations to you
We are obliged to provide you with information on any actions that we have taken in response to any of the following requests in relation to your rights to:
- Have access to your personal information
- Have your personal data corrected or removed if it is inaccurate
- Have your personal data deleted from our systems
- Restrict the processing of your personal data
- Object to the processing of your personal data for communications and marketing
- Have your personal data transferred to another company
- Lodge a complaint with the regulator and/or seek a judicial remedy
We will respond to you within one month of the receipt of a request unless the number and complexity of the requests made are deemed sufficiently high for us to extend this time by a further two months. We will inform you if we need to make use of this additional time and why we need to do so.
We will not charge you for responding to any of these requests unless it can be demonstrated that you are making an excessive amount of repetitive requests or that your request is not based on fact, realistic considerations, or the like. In this exceptional case, we may charge you a reasonable fee or choose to refuse your request.
If you disagree then you may raise your concerns with the Information Commissioner’s Office. https://ico.org.uk/concerns
To assist us in responding to these requests, we may ask you to verify your identity to make sure that we do not give your personal data to the wrong person, update your data with details you did not provide or take action on your data that you did not request.
Right to have access to your personal information
You have the right to request a copy of the personal information that we hold about you. If you would like a copy of some or all your personal information, write to the Data Protection Officer, Learning Foundation, Index House, Index House, St George’s Lane, Ascot, Berkshire SL5 7ET with details of your request.
Right to have your personal data deleted from our systems
You can request that we delete your personal data from our systems if you believe that:
- We no longer need to process your personal data in order to provide you with appropriate insurance products and services or;
- We no longer need to process your personal data in order to process any claims you make or;
- We have processed your personal data in a manner which you believe is unlawful or;
- We have to delete your personal data to comply with another piece of legislation.
We may choose to refuse your request if we believe that:
- We have a legal obligation to keep your data or;
- It is required for the purposes of processing outstanding insurance claims or;
- It is required for establishing or defending a legal claim. If you disagree then you may raise your concerns with the Information Commissioner’s Office. https://ico.org.uk/concerns
Right to have your personal data corrected or removed if it is inaccurate
It is important to us that your personal information is accurate and up to date. If you believe that some information is inaccurate or should be removed, you may either update your information by writing to the Data Protection Officer Data Protection Officer, Learning Foundation, Index House, Index House, St George’s Lane, Ascot, Berkshire SL5 7ET with details of your request.
Right to restrict the processing of your personal data
You can request that we temporarily halt your donations and/or the processing of your personal data if you believe that:
- We should not process your data whilst we are in discussions with you regarding a disagreement over the accuracy of your personal data or;
- We have processed your personal data in a manner which you believe is unlawful but rather than wanting us to delete your data you would prefer us to take another course of action to rectify your issue or;
- We no longer require the data, but you do not wish us to remove it from our systems as you require it for establishing or defending a legal claim. If such a restriction is put in place, then we will not process your data without informing you first that the reason for the restriction has been lifted.
Exceptions to this are that we can continue to process your data as follows:
- Storing your data or;
- Using it for the purposes of establishing or defending a legal claim or;
- Using it for the protection of the rights of another person. If you disagree then you may raise your concerns with the Information Commissioner’s Office. https://ico.org.uk/concerns
Right to object to the processing of your personal data for communications and marketing
You have a right at any time to stop us from contacting you and, if you wish to do so, please;
- Email or telephone us on: 01344 636413 or email us at: firstname.lastname@example.org
- Use the OPT-OUT option that you will find at the bottom of all our marketing emails
- Write to the Data Protection Officer, Learning Foundation, Index House, Index House, St George’s Lane, Ascot, Berkshire SL5 7ET with details of your request with details of your request.
Right to have your personal data transferred to another company
You have the right to receive a copy of the personal data that you have provided to us and that we process using our computer systems, in a format that can be read by another person’s or company’s computer system.
You have the right to transfer that copy of your personal information or can request that we do it for you, where it is technically feasible for us to do so.
This right of transfer can be refused if we feel that it would adversely affect the rights of another person.
If you disagree then you may raise your concerns with the Information Commissioner’s Office. https://ico.org.uk/concerns
Right to lodge a complaint with the regulator (Information Commissioner’s Office) and/or seek a judicial remedy
If we do not act on your request within one month of its receipt and do not provide you with reasons why then you may lodge a complaint with the Information Commissioner’s Office. https://ico.org.uk/concerns
If you believe that the way that we have processed your personal data is not in keeping with current Data Protection legislation then you may lodge a complaint with the Information Commissioner’s Office. https://ico.org.uk/concerns
If you believe that your rights under current Data Protection legislation have been infringed as a result of the way that we have processed your personal data then you may seek a judicial remedy via the courts. https://ico.org.uk/for-the-public/compensation
Changes to our Privacy Notice
We keep our Privacy Notice under regular review. This Privacy Notice was last updated on 10th May 2018.
How to contact us
Data Protection Officer,
St George’s Lane,
Berkshire SL5 7ET
Tel: 01344 636413