Privacy Policy

 


Introduction

Thank you for the support you give to victims of modern slavery through Medaille Trust. Your gifts, prayers and actions help to provide hope, prevent trafficking, protect victims and prosecute traffickers. 

We have updated Medaille Trust’s privacy policy to reflect new regulations and to explain how we collect, store and use your data securely. Medaille Trust has always sought to follow best practice, treat every supporter respectfully and in accordance with each supporter’s expressed preferences.


Our Pledge

  • We store your personal data securely
  • We ensure your data’s security when dealing with banks and the postal service
  • We won’t share your details with anyone else unless required to by law or as part of a contract with a supplier with rigorous data protection policies to deliver our commitments to you e.g. mailing the newsletter
  • We won’t call you asking for donations
  • You can change your preferences or opt out from communications at any time
  • If you have any questions, comments or want to change your mailing or contact preferences, contact comms@medaille-trust.org.uk or call 0800 069 99 16.

About Medaille Trust

Medaille Trust is a UK-based charity combatting modern slavery and human trafficking by offering safe housing, supporting victims, raising awareness and partnering with law-enforcement agencies. We are a registered charity (No. 1117830) and a company limited by guarantee (No. 5965380). Our correspondence address is: Medaille Trust, Cathedral Centre, 3 Ford Street, Salford, M3 6DP. 

For the purposes of this document, ‘us’, ‘we’ and ‘our’ refer to Medaille Trust.


About this policy

This policy pertains to the privacy of supporters and volunteers of Medaille Trust. We have developed separate policies concerning staff and client data. If you are a client please contact your Keyworker, if you are a member of staff all policies are stored on the policy drive which you have access to.


How we collect personal information from you

Personal information is collected directly from you when you interact with Medaille Trust. For example:

  • Making a donation
  • Purchasing a gift
  • Sending or receiving an email or letter
  • Making an enquiry
  • Visiting our website
  • Applying for a role at Medaille Trust
  • Taking part in an event or travelling with Medaille Trust / on Medaille Trust business
  • Volunteering for Medaille Trust
  • Gifting a legacy in your will
  • Signing up to a campaign or to receive a resource, regular emails or newsletters
  • Where we have a face to face relationship with you.

Information may be collected in person, over the phone, through our website, social media, email or from something you’ve posted to us.

We sometimes work in coalitions with other organisations. Where supporter data is collected as part of these coalitions it will be held on a common database but will only be used for the purposes and duration of specific campaigns and only used by any member agency with the consent of the supporter concerned, or we have a legal obligation or legitimate interest to process that data.


What information we collect about you

The information we hold will typically include some or all of the following:

  • Your name
  • Postal address
  • Email address
  • Phone number
  • Your year or date of birth

The activity that you have completed or the information you have requested. If you make a donation, we will collect as relevant:

  • Bank details
  • Credit or Debit card details
  • Gift Aid Declaration details.

If you interact with us online, we will also collect:

  • IP addresses
  • Details of pages visited
  • Details of files downloaded.

Website usage information is collected using cookies: see the section on Cookies below.

We collect information from third parties such as event organisers like London Marathon, donation sites like Virgin Money Giving, Amazon Smile and iZettle, marketing sites like Mailchimp, survey sites like Survey Monkey, or fundraising sites like Just Giving, when you have agreed to support Medaille Trust and have given your consent or we have a legal obligation or legitimate interest to process that data. You may wish to check their privacy policies to find out more information on how they will process your data.

Where you provide the information, we may collect personal data such as your denomination, church or religious beliefs to ensure we can communicate with you appropriately.

For employees and supporters travelling with Medaille Trust or on Medaille Trust business, we may store and share with a travel organiser or company your medical details, and if you participate in an event that we have organised, we may ask you to provide information to make sure we can manage the event safely and efficiently. We may also ask you for details of any accessibility needs you may have, so that we ensure our event is inclusive, in line with the provisions of the Equality Act 2010.

We may also receive information about you from other sources (including public sources). This is explained in the ‘How we might use your information’ section below.

How we might use your information

Depending on your interaction with us, we may use the personal data we collect to:

  • Keep you up-to-date on news and the impact of our work
  • Ask for financial and non-financial support, such as volunteering, campaigning or prayer
  • Process donations you give us, or to support your fundraising for us, including Gift Aid
  • Provide information or resources you have requested
  • Provide a personalised service, such as customised website content or personalised emails
  • Keep records of your relationship with us, e.g. feedback you have given or complaints you have made
  • Classify supporters by location, for example England or Wales
  • Conduct market research to aid our understanding of our supporters and their views, so we can provide a better service.

Fundraising

Tailoring our communications

We have a duty to make sure that we’re spending your donations wisely, and that means doing some research and analysis to ensure we send you the most appropriate communications, including acknowledging your past support and actions, demonstrating accountability and impact. In order to work out whom to contact, what to say and when to get in touch, we carry out the following activities:

  • We look at information such as postcodes and ages of supporters
  • We look at whether donations have been given regularly
  • We look at how donations are given 
  • We look at the size of donations given.

This helps us to tailor appropriate communications to you, to demonstrate the impact of your support, as well as improve your experience as a supporter.

We may use your information to invite you to become involved with us in new ways or raise funds.

Responding to significant financial donations.

Major gifts require a higher level of accountability both in presenting funding proposals and demonstrating impact. We are a member of the Fundraising Regulator and therefore adhere to all its policies and procedures relating to GDPR. 

If you make a major gift to our work, you will be offered a conversation with our Fundraising Team who will discuss and agree with you any concerns you may have about the personal data we hold and the methods of contact suitable for you. (We define a ‘major gift’ as anything over £1,000, but would try to converse with as many donors as possible in line with good stewardship and respect for our donors.) We will do this at the earliest convenient opportunity. Where you do not wish to pursue such a relationship with us, we will not retain any additional, publicly sourced, personal data about you that we have used for this purpose.

For significant corporate financial donations, we also use publicly available sources to carry out due diligence on individuals who control companies and trusts and foundations to meet money laundering regulations, plus checking the corporate’s modern slavery statement.

We are committed to working in a transparent, ethical, responsible and honest way. To reflect this commitment, we are registered with the Fundraising Regulator and are committed to the Regulator’s Code of Practice and the Regulator’s Fundraising Promise. For more information, please read Medaille Trust’s Fundraising Promise and Medaille Trust’s Fundraising Complaints Policy.

If you would rather your personal data was not used in this way, you can email our staff at comms@medaille-trust.org.uk or call 0800 069 99 16.


Social media

Your settings or the privacy policies for social media and messaging services might give permission to access information from these sources. If we do access this data, for example to assess the effectiveness of our communications, we will not currently add this to your personal details that we hold. We advise you to check the privacy settings on your social media provider to ensure you are happy with the level of privacy you have chosen.


Basis of processing your data

Consent for direct marketing

If you are a new supporter, on or after 25 May 2018, we will process your personal data for the purpose of sending marketing communications about our work, fundraising and campaigns on the basis of the consent you provide us with. You are free to request a change to your contact preferences at any time by contacting us by telephone, post or email, as shown in the section ‘Your choices and telling us when things change’ below.

Contract Performance

We will send you whatever you’ve asked for, e.g. a resource you’ve ordered – or write a letter to acknowledge a gift or process Gift Aid. This doesn’t affect your other communications preferences.

Legitimate Interest

  • If you are an existing supporter, as at 25 May 2018, and had previously requested emails or postal mailings, we continued to send emails and postal mailings to you. The General Data Protection Regulation (GDPR) call this ‘legitimate interest’.
  • We may also contact you by post or telephone where we have a legitimate interest to do so – for example, to follow up a request you have made or to inform you about how your gift has been processed. We will never call to seek a donation. Where you have previously asked us not to contact you in this way, we will continue to respect your contact preferences.
  • You can amend your preferences at any time by contacting us by via telephone, post or email as shown in the section ‘Your choices and telling us when things change’ below.
  • When you make a donation or a series of donations, express an interest in our work, or show a potential to give to our work, we will rely on our legitimate interest in order to collect additional information as noted in the Fundraising section above. This helps us to identify those supporters who would benefit from an initial discussion with our Fundraising Team and to ensure we demonstrate appropriate levels of accountability for how we use donors’ funds.
  • Legacies are an important way in which many supporters choose to remember victims of slavery. As an organisation we have policies that document the need to keep data, and, in turn the need to delete data. With regard to legacies, we may be required to keep data you provide indefinitely to carry out the administration of legacies – sometimes we have to prove for how long someone has supported Medaille Trust – and to communicate with the families of those leaving us legacies. In this case the deletion of personal data would not be appropriate. This is explained further in the “How and where we store your information” section below.

Legal Obligation

Medaille Trust has a legal duty to forward information if it is required by law or by a regulatory body. For example, a Gift Aid audit by the HMRC, or if required to disclose information because of a court order. 

Applying for a job or volunteering with us

If you apply for a job or volunteer opportunity with us, and you provide personal and sensitive personal data such as the information on your CV or Application Form, we will process and store the personal data we collect to:

  • Support the recruitment and selection process
  • Answer any questions you may have
  • Use third parties to provide services such as references, qualifications, verification of information you have provided, health screening and psychometric evaluation or skills tests
  • Undertake Enhanced Disclosure & Barring Checks
  • Provide anonymised data to monitor compliance with equal opportunities policy.

If you submit your personal information to a job board, online recruitment tool, social media platform, headhunting agency etc. your details could then be passed to Medaille Trust. We recommend that you ensure you have read the privacy information of that organisation who may share your data. If we receive your details via a third party and are unclear about the lawful basis for the transfer, we may either check with you before using your data further or fully delete the information.

If you do not join us as an employee or volunteer for any reason, your data will be stored for a proportionate length of time in line with our Data Retention Policy to ensure compliance with best practice, fairness and legislation. If you do join us as an employee or volunteer, we will retain your data for the duration of your employment or volunteering activity and for a proportionate length of time after conclusion of your employment or volunteering activity in line with our Data Retention Policy to ensure compliance with best practice, fairness and legislation.

If you volunteer or travel on a trip with us, and provide personal and sensitive data, such as dietary, mobility requirements or specific health information, we will store, process and disclose the personal information we collect to:

  • Deliver a safe trip or event for you and others involved, including the disclosure of sensitive data, such as medical information, to our partner(s) where necessary
  • Provide the administration of these events or opportunities to serve
  • Monitor the quality of the volunteering opportunity or trip provided
  • Answer any questions or feedback you may have
  • Provide anonymised data to monitor compliance with our equal opportunities policy.

Legal basis of processing your data

If you provide personal and sensitive data when applying for a job or to volunteer with us, we will process that data based on legitimate interest.


How and where we store your information

We will keep your personal information only for as long as we consider it necessary to carry out each activity. We have a Data Retention Policy to manage this.

In the course of carrying out the day-to-day operations within Medaille Trust, a wide range of recorded information is created. Records need to be properly retained to enable Medaille Trust to meet its business needs, legal requirements and obligations, accounting and tax considerations, as well as realising what is required to evidence events or agreements in the event of allegations or disputes and to ensure that any records of historic value are preserved.

The untimely destruction of records could affect:

  • The conduct of Medaille Trust business
  • The ability of Medaille Trust to defend or instigate legal actions
  • The reputation of Medaille Trust and
  • The ability to comply with statutory obligations.

Conversely, the permanent retention of records is undesirable and disposal is necessary to free up storage space, reduce administrative burdens and to ensure that Medaille Trust does not retain records for longer than necessary (particularly those pertaining to personal data).

If you have any questions about our Data Retention Policy, please contact us in writing at:

Data Protection Lead
Medaille Trust
Cathedral Centre
3 Ford Street
Salford
M3 6DP

Email: comms@medaille-trust.org.uk 


Security

We ensure that we have appropriate technical controls in place to protect any personal data you provide. For example, we ensure that any online forms are encrypted and our network is protected and routinely monitored. Despite all our efforts, the internet cannot be guaranteed to be 100 per cent secure, and there is always a risk when you submit data. Nevertheless, we continue to invest in protecting your data in full compliance with best practice.

We ensure that access to personal data is restricted only to those staff members or volunteers whose job or voluntary roles require such access and that suitable training is provided for these staff members and volunteers. All employees sign The Official Secrets Act form when they commence working with Medaille Trust. All volunteers fulfilling a staff-like role also sign The Official Secrets Act form when they commence volunteering with Medaille Trust. All other volunteers or visitors sign a confidentiality agreement. 

We may make limited use from time to time of trusted external companies to collect or process personal data on our behalf, such as fulfilling orders or processing donations. When we do so, we carry out checks on these companies, and to ensure they will handle personal data securely and safely we have contractual arrangements with the companies to ensure our requirements are clear. When we do use external companies, we remain responsible for the storing and processing of your personal data and the contract with the companies will not permit them to retain and use your data for their own purposes.

Credit / Debit card security

We do not process credit / debit card donations on our website. Instead, we signpost suppporters to Virgin Money Giving to process credit or debit card donations. You may wish to check their privacy policies to find out more information on how they will process your data. We do not store your debit or credit card details once your transaction has been completed.

Where we store your personal information

The data we process and store is within the European Economic Area (EEA). It may be that some of our suppliers use cloud-based storage; however, we take steps to make sure they provide an adequate level of protection in accordance with UK data protection law. We ensure that personal data is held in compliance with European data protection legislation. We take all reasonable steps to ensure that your data is stored and processed securely in accordance with this policy. By submitting your personal data you agree to this transfer, storing and processing of your information.

Should you travel overseas with us, we may share personal information with partners who deliver our work in overseas locations. For example, this may include sensitive personal data such as medical information and passport details. When we do so we will make you aware of the data being transferred.


Third parties

Our service providers and third parties

From time to time we may employ trusted suppliers to carry out tasks on our behalf, such as fulfilling orders, managing events, supporting our systems, or processing donations. These agents are bound by contract to protect your data and we remain responsible for their actions.

In some circumstances we may work with suppliers who may hold your data outside of the EU in the US and who also subscribe to the US-EU Privacy Shield. In some cases, supporters who use these services may become a customer of the third party in conjunction with being a customer of Medaille Trust. If this is the case either we or they will make it clear on the web page, and to exercise your rights to be forgotten or to access your data you will need to make these requests directly to these third parties.

We may provide third parties with general information about users of our site, but this information is both aggregated and anonymous. However, we may use IP address information to identify a user if we feel that there are or may be safety and/or security issues or to comply with legal requirements.

We do not share or swap your information with any other charities or organisations for the purposes of their marketing.


How we treat children and vulnerable persons

Young people

We do not actively seek to collect data for children under the age of 12, but we are committed to protecting the privacy of the young people who engage with us through our website, at events and at schools. If you are under 18, please ensure you have gained the consent of your parent or guardian before giving us your personal information.

Supporters in vulnerable circumstances

We recognise the importance of identifying and protecting people in vulnerable circumstances. 

We provide training to our staff and volunteers who come into regular contact with supporters to be aware of, and to identify signs of, people in potentially vulnerable circumstances. We work in accordance with our safeguarding policies at all times and have included vulnerable people in our Fundraising Promise and Complaints policies. Personal information will be recorded so that we may respond appropriately in future, for example by ceasing fundraising requests or no longer making calls.


Your choices and telling us when things change

Preferences

You can change your preferences on which communications you receive from us, including marketing and fundraising materials, or how we contact you, by mail, phone or email, at any time.

You can do so by:

Calling us on: 0800 069 99 16

Emailing us on: comms@medaille-trust.org.uk 

Write to us at:
Medaille Trust
Cathedral Centre
3 Ford Street
Salford
M3 6DP

Updating your details

We want to communicate with you effectively. It’s much easier if your details are up to date, so we really appreciate it if you let us know when your details change. You can do so in the same way as updating your preferences (above).

If we are unsure of the details you have entered on a form, or if you have changed address and given the Post Office permission to share this, we may use Post Office address search, postcode lists or other available sources to confirm data that you provide us with.

However, if you continue to give regularly and items such as the Medaille Trust newsletter are returned to us, we may use external sources to update your address details, if we are unable to reach you in any other way. This is so that we may update you on how your money has been spent through our news and stories.

How to have your information deleted

The General Data Protection Regulation introduces a right for individuals to request to have personal data erased and this can be requested verbally or in writing to the data protection lead. If you have donated to us and requested that we Gift Aid your donation, we are legally required to keep your information for at least six years after the date of your last gift, and in these circumstances we cannot delete your data. However, we can and will remove your consent to be contacted by us.

How your data will be deleted

Where we are able to do this, we will delete your information from our database. However, in some circumstances we need to keep details to meet auditing and money laundering protocols. 

What about data you share with other organisations - will this be deleted?

We do not share your information with third parties except where we need to fulfil a contract, e.g. a Gift Aid claim or if you travel with us, and this data is subject to our need to retain this information, or where the third party is fulfilling a contract for us, e.g. fulfilling a postal order. In these instances, our contract with these third parties ensures that they will not retain any of the data provided for the completion of their contract. 


Your information - your rights

For any of the following areas, please contact the Data Protection Lead:

Data Protection Lead
Medaille Trust
Cathedral Centre
3 Ford Street
Salford
M3 6DP

Telling us to stop processing

You have the right to ask us to stop using your personal information for marketing purposes or for any other purpose where there is no legal requirement for continued processing.

How to ask us to amend or delete your information

If your information is out of date, or if there is no longer justification for us to hold it, you can ask for it to be updated, removed or blocked by contacting the Data Protection Lead in writing.

How to request your information

You can ask for a copy of all the information related to you that we hold. We will provide it in a clear and easy to follow format and respond within one month.


Changes to this policy

This policy was last updated in December 2019. We may amend this policy from time to time to take account of changes to our processes or changes to data protection or other associated legislation. If we make any significant changes to this policy we will show this clearly on our website, and/or by contacting you directly.

RENATE COATNET National Crime Agency Look up Member caritas Modern Slavery Partnership