We understand that the privacy and security of your personal information is an important issue to you. There are a number of ways in which you might share your information with us and we are committed to protecting your privacy. We have developed this Privacy Policy to explain the ways in which we might use your personal data, what we do to keep it safe and the extent to which we share it.　

Scope

At The Spine Foundation (Charity) we are committed to protecting your privacy. This Privacy Policy (Policy) is prepared in compliance with the requirements of the Data Protection Act 1998, as replaced and superseded by the General Data Protection Regulation (EU) 2016/679, as in force from time to time (Data Protection Law). If you have any queries about this Policy or how we use your personal data, please contact us using the details at the end of this Policy.

What Personal Data do we collect and how do we use it?

We collect Personal Data as defined by Data Protection Law(see the summary of definitions at the end of this Policy). The Personal Data we collect might include name, date of birth, email address, postal address, and telephone number. We record your requests for information and any feedback we receive from you. We may also collect technical information relating to your use of our Site, including your browser type or the Internet Protocol (IP)address used to connect your computer to the internet.

We want to ensure that your Personal Data is accurate and up to date. If any of the information that you have provided us with changes, for example if you change your email address or postal address, please let us know using the contact details at the end of this Policy.

We legally require your express consent to use your information for certain purposes, but The Spine Foundation also relies upon its right to hold and process data in pursuit of its legitimate interests (ie furthering its charitable objects, which may include fundraising) without always getting your express consent. Where we rely upon this in order to contact you, we will always remind you or your right to unsubscribe from any future contact.

By positively accepting this Policy, you consent to our processing your information for the following purposes:

• administering the Site and keeping you informed about the activities of the Charity;
• undertaking the marketing of the Charity’s aims (which include fundraising), which may include marketing to you using mail and email services (NB the Charity does not undertake telephone marketing);
• considering any application for a grant from the Charity, including investigation to establish that the criteria for an award are met, whether it relates to you personally, the person on whose behalf you are applying or your organisation;
• monitoring the progress and outputs of bursaries;
• achieving the charitable objectives of the Charity; and
• administering the activities of the Charity.

If you submit your Personal Data other than through theSite, the Charity may issue you with a supplementary statement explaining further processing which it undertakes in relation to your Personal Data.

By communicating with us in person or using any media, using this Site, making a donation, submitting a bursary application or signing up to our newsletter you are consenting to our processing your Personal Data for the above purposes. If you would prefer that the Charity does not use your PersonalData for the purposes of direct marketing (fundraising) please let us know using the contact details at the end of this policy.

If you supply any visual image or sound recording containing your personal data to the Charity, or the Charity obtains such image or recording by photographing or recording you, this image or recording may be used for the Charity’s marketing and promotional activities. The purpose for which we may use your image or recording will always be set out in our consent form and/or on our website.

We also gather general information about the use of thisSite but we use aggregated or anonymous information which does not identify you as an individual visitor. We track which pages users visit most often and which services, events or facilities are of most interest. We may also track which pages users visit when they click on links in emails. We may use this information to personalise the way our Site is presented when users visit, to make improvements to our Site and to ensure we provide the best service for users.

Do we share your information with anyone else?

Please note that we do not share your Personal Data with any other organisation for marketing purposes.

We will only share your Personal Data in the following circumstances:

• with agencies whom we use to carry out online or print campaigns to help us communicate our work to existing supporters and enable us to reach new ones;
• with Her Majesty’s Revenue and Customs in order to process Gift Aid claims;
• with responsible authorities if the Charity reasonably believes that criminal activity is taking place or it believes that an individual or a group of individuals are at risk of harm, or if we are required to do so by law or as expressly permitted under Data Protection Law.

We may need to share your information with our service providers, associated organisations and agents for the purposes described above.

Special Categories of Personal Data

The Charity collects Special Categories of Personal Data(see the summary of definitions at the end of this Policy) only if permitted todo so by Data Protection Law.

We have in place additional measures to protect your SpecialCategories of Personal Data and their confidentiality. We will only disclose your Special Categories of Personal Data to the third parties as referred to in this Privacy Policy or where we consider it is necessary, if we are permitted to do so under Data Protection Law.

Continued processing

The Charity continues to process your Personal Data following your initial interaction with us, such as:

• processing your bursary application or monitoring your bursary award;
• sending you any information requested by you;
• processing your donation;
• informing you of the Charity’s work;
• managing your volunteering
• analysing our historic grants portfolio

We retain all information in accordance with our DataRetention Policy, a copy of which is available on request.

Your rights

You have the right to ask us not to process your PersonalData for marketing purposes.

You have a right to seek the erasure of your data (often referred to as the ‘right to be forgotten’). You may wish to exercise this right for any reason, for example where it is no longer necessary for us to continue holding or processing your personal data you may withdraw your consent. You should note that we are entitled to and reserve the right to retain your data for statistical purposes. This right is not absolute, as we may need to continue processing this information, for example, to comply with our legal obligations, or for reasons of public interest.

You have a right to ask us to confirm whether we are processing information about you, and to request access to this information(‘right of access’).

You may ask us, or we may ask you, to rectify information you or we think is inaccurate, and you may also ask us to remove information which is inaccurate or complete information which is incomplete (‘right to rectification’). If you inform us that your personal data is inaccurate, we will inform relevant third parties with whom we have shared your data so they may update their own records.

We want to ensure that your personal information is accurate and up to date. If any of the information that you have provided us with changes, please let us know using the contact details at the end of this policy.

You have a right to obtain your personal data from us and reuse it for your own purposes, perhaps for another service, without hindering the usability of the data (‘right of portability’). This right does not apply where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

You have a right to ask us to restrict our processing of your information (‘right to restriction’) if:

• you contest its accuracy and we need to verify whether it is accurate
• the processing is unlawful and you ask us to restrict use of it instead of erasing it
• we no longer need the information for the purpose of processing, but you need it to establish or defend legal claims
• you have objected to processing of your information being necessary for the performance of a task carried out in the public interest, or for the purposes of our legitimate interests. The restriction would apply while we carry out a balancing act between your rights and our legitimate interests.
• you exercise your right to restrict processing, we would still need to process your information for the purpose of exercising or defending legal claims, protecting the rights of another person or for public interest reasons.

If you would like to exercise any of your rights above, please let us know using the contact details at the end of this Policy. We willa ct in accordance with your instructions as soon as reasonably possible and there will be no charge.

Links to other websites

The Site contains links to other websites. The Charity is not responsible for the privacy policies and practices or the content of any websites which are linked to the Site.

The Charity encourages parents and guardians to use the parental control tools available from online services and software manufacturers to help supervise their children’s online activities. 

Security and confidentiality

Any Personal Data you send to us will be treated in the strictest confidence. We take appropriate measures to ensure that the information disclosed to us is kept secure, accurate and up to date and kept only for so long as is necessary for the purposes for which it is used in accordance with our Data Retention Policy.

The Charity is committed to protecting the security of yourPersonal Data.

You should be aware that the use of the Internet is not entirely secure and although we will do our best to protect your Personal Data we cannot guarantee the security or integrity of any Personal Data which is transferred from you or to you via the Internet. Any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features such as encryption to try to prevent unauthorised access.

Status, approval and changes to our privacy policy

We are a registered charity with charities commission ofEngland and Wales and our registration number is 1194851. Our registered address is 20 Hillcrest Road, Loughton IG10 4QQ.

This Privacy Policy has been approved by the Charity’s Board of Trustees; it represents the standard to be applied by the Charity when using individuals’ Personal Data.

Please check this page periodically for changes as theCharity reserves the right, at its discretion, to change, modify, add, or remove portions of the Privacy Policy and the Site at any time. Your continued interaction with the Charity following the posting of any changes to thisPolicy will mean that you accept such changes.

Contact

Questions, comments and requests regarding this Policy are welcomed and should be addressed to:

enquiries@thespinefoundation.org.uk

‍

Definitions

Please find below definitions of some of the terms used in this Privacy Policy for your information and assistance.

1. Processing
“processing” means obtaining, recording, or holding the information or data or carrying out any operation or set of operations on the information or data, including:

• organisation, adaptation or alteration of the information or data, retrieval, consultation or use of the information or data,
• disclosure of the information or data by transmission,
• dissemination or otherwise making available, or
• alignment, combination, blocking, erasure or destruction of the information or data.

2. Personal Data
Personal data is:

• any data from which the identity of a living individual can be determined, either by itself or with other data processed by data controller;
• any information such as name and address, email address, telephone number and general contact details, personal data includes images on film (e.g. CCTV images), photographs and telephone voice recordings.

3. Special Categories of Personal Data
Special Categories of Personal Data means personal data consisting of information as to:

• the racial or ethnic origin of the data subject;
• the data subject’s political opinion;
• the data subject’s religious beliefs or other beliefs of a similar nature;
• whether the data subject is a member of a trade union; genetics;
• biometrics(where used for ID purposes);
• the data subject’s physical or mental health or condition; or
• the data subject’s sexual life or sexual orientation.

The Spine Foundation Charity‍

August 2022