The Purim Trust Privacy Policy WE ARE THE PURIM TRUST, AN ENGLAND AND WALES CHARITABLE INCORPORATED ORGANISATION CHARITY NUMBER 1178057. WE RELY ON THE GENEROSITY OF OUR FRIENDS AND PARTNERS TO FUND OUR PROJECTS WHICH DELIVER HOPE TO THOSE IN NEED. We take our duty to process your personal data very seriously. This policy explains how we collect, manage, use and protect your personal data. If you would like more information or would like to change the way we communicate with you, please contact us here: Email info@thepurimtrust.org (or by clicking on “update your preferences” or “unsubscribe from this list” at the end of emails we send to you) Post Supporter Contact, The Purim Trust, 18 Little Green, Elmswell, Bury St Edmunds, Suffolk IP30 9FB Phone: 0300 365 0305 GDPR Officer: Can be contacted using the above contact details Your personal data is protected by UK legislation, specifically the Data Protection Act 1998, and the Privacy and Electronic Communications (EC Directive) 2003. How does The Purim Trust collect my personal data? a) Your personal data is collected directly from you when you interact with The Purim Trust in any of the following ways: when you sign up to become a Sponsor or Partner, when you make a one-off donation, when you register your interest in our Church Connect and/or Corporate Connect programmes, when you act as a Hope Ambassador, when you sign up to our mailing list via our website, when you contact us via our website, when you enquire/and participate in an event, become a volunteer, apply for employment, apply for Mission Trip, or enter a competition or giveaway on our social media channels. b) Your information may be collected in person, over the phone, online, via social media, on paper, or by SMS. What personal data does The Purim Trust collect from me? a) If you interact with us in any of the ways mentioned above, we may collect and process the following data: your name, postal and email addresses, phone number, date of birth, and your bank/card details ONLY if you choose to make a financial contribution. b) Very occasionally we may need to collect information that the Data Protection Act considers to be ‘sensitive’. On such occasions, we would be very clear with you that we wished to collect such information and our reasons for doing so. We would only proceed with your expressed consent. c) Whether you registered for Gift Aid contributions. How is my personal data used? a) UK Data Protection law provides six legal bases for processing your information. We will therefore only process your data under the following three bases: Consent (where you give us express permission to process your data according to how you have interacted with us) Legitimate interest (where consent is not necessary and our processing is expected in accordance with your relationship with us and is considered non-intrusive) Contract (when you apply for employment or a volunteer role within the charity) Legal Obligation (There are instances where we must handle your personal information due to legal mandates. For instance, it is legally mandated to report employee salaries to HMRC. Furthermore, we process details such as your name, house name or number, postcode, and donation history for Gift Aid compliance, as stipulated by HMRC. b) We will process your data in accordance with this policy and with any applicable data protection laws and regulations, for one or more of the following reasons: to process your donations, purchases, and verify financial transactions to process Gift Aid donations for marketing purposes to provide you with information about us, our products/merchandise, our events, any other activities or services that we provide to provide you with updates on our overseas work and reports from our appeals to provide you with updates and activities in accordance to your relationship with us, e.g. if you are a Sponsor, receiving updates about your Sponsor Child to invite you to participate in emergency appeals/campaigns that you have indicated you are happy to be notified about to keep a record of your contact with us and to help us ensure we provide you with the most appropriate communications to notify you of any changes to our policies or processes to check on your preferences from time to time to ensure that they are up to date to ask for your feedback on how and what we communicate with you where you have given expressed consent, to publish your testimonial or story on our website or social media channels to provide you with information about volunteer/employment opportunities to ensure that content from our site is presented clearly and efficiently for you and for your computer/device How secure is the information I give you? The Purim Trust takes the care of your data seriously and undertakes to protect your personal information in a range of ways including secure servers, firewalls and SSLencryption. We follow payment card industry (PCI) security compliance guidelines when processing credit card payments and any personal information transferred between locations will be both encrypted and password protected. Unfortunately, the transmission of information using the internet is not completely secure. Although we will do our best to protect your personal data sent to us this way, we cannot guarantee the security of data transmitted to our site. Who has access to my personal data? a) We may allow our staff, consultants, and/or external providers acting on our behalf to access and use your data for the purposes which you have provided it to us or as outlined above. We will only provide them with the information they need to carry out the relevant services agreed upon. We will ensure your data is transferred/accessed securely and treated with the same due diligence. We also have contracts in place between us and any external providers to make sure they uphold the same data protection standards. b) We do not sell your data to any third-party organisations for the purposes of marketing. If there is any other reason this might be necessary, we would only do so with your permission. c) We may disclose information to other organisations or agencies if we have a legal obligation to, e.g. sharing your information with HMRC for the purposes of processing Gift Aid. d) To comply with our Safeguarding Policy and our duty of care to the vulnerable children we work with, we may share details, including personal data, relating to serious breaches of our Safeguarding Policy and Procedures with statutory authorities such as the police, the National Crime Agency (NCA), the Child Exploitation and Online Protection Agency (CEOP) and the Charity Commission. Where is my data stored? a) Your data is submitted through our website – www.thepurimtrust.org, which is supported and managed by Zephi who is a UK-based marketing and website design agency. b) Your information is then managed through our Customer Relationship Management system. This system has been carefully chosen to ensure it has the necessary security settings and is compliant with our current data protection regulations. c) Your card payment details are submitted by the transactions you make through our website and will be passed through an online payments handling platform. This platform has been chosen to ensure they are certified to the highest compliance standards. d) Your financial data is also stored and processed in an accountancy software package. This system has also been selected based on its security features and compliance with privacy legislation. How long will you keep my information? a) In accordance with UK data protection laws, we will only store your data for as long as we need it. This will depend on the type of data in question and the purpose it was collected for. b) If you have claimed Gift Aid on your donations, we will keep a record of your Gift Aid declarations for 6 years as legally required by HMRC. For more information, please see here – Claiming Gift Aid as a charity or CASC: Gift Aid declarations – GOV.UK (www.gov.uk) c) If you request to have your data permanently deleted from our database using your ‘right to erasure’, you must do so in writing or verbally over the phone. We will honor that request within one month if it does not conflict with our legal obligations. If for whatever reason we are not able to honor that request, we will inform you. Will my information ever go outside Europe? a) The Purim Trust is aware that countries outside the European Economic Area (EEA) have different approaches to data privacy laws, and that enforcement may not be as robust as it is within Europe’s borders. If your data is sent outside the EEA we will take reasonable steps to ensure that our staff implements GDPR-compliant measures to protect your information. By submitting your details you agree to this use of your data. b) If you are a Child Sponsor, some of your personal data will be shared with our staff in our Sponsorship programmes relating to the location of your Sponsor Child to facilitate your relationship with the child. This information does NOT include financial details and is only ever shared in this way for defined purposes, namely to send child messages or programme updates from the country relating to your support. How do you use my information if I apply for a job or to Volunteer? a) When you apply to work or volunteer at The Purim Trust, we will only use the information you give us to process your application and monitor recruitment statistics. b) If there is an instance in which we need to disclose your details to persons outside of The Purim Trust organisation, for example, when taking up references or credit checks, we will inform you in advance of doing so, unless we are required to disclose this information by law. c) All candidates applying to work or to volunteer at The Purim Trust will automatically have their application details saved and retained on our Customer Relationship Management system. If you would like for us to remove your details from our database at any time, please write to info@thepurimtrust.org to let us know. Your details will then be removed from our database within one month. d) We always keep anonymous statistical information about applicants to develop our recruitment processes and for equality and diversity monitoring but this does not contain any information that could be used to identify individual job applicants. e) If you begin employment or volunteer with us, we will put together a staff/volunteer file which will contain your information. We keep the information in this file secure, and will only use it for matters that apply directly to your employment/volunteering with The Purim Trust. f) Once you stop working for or volunteering with us, we will keep this file according to our Data Storage Policy. You can contact us to find out more about this. What are my rights? a) The Purim Trust recognises the UK Data Protection Act and UK General Data Protection Regulation – which afford you the following rights: The right to access – you have the right to see any information that we hold about you The right to be informed – you have the right to be informed about the collection and use of your personal data The right to rectification – you have the right to ask us to correct or rectify any information about you that is wrong, inaccurate, or incomplete The right to erasure – you have the right to request that your data be deleted and erased from our records (provided we are legally able to do so) The right to restrict processing – you have the right to request your data is not processed or used for certain purposes The right to object – you have the right to object to certain types of processing, such as direct marketing Right to data portability – you have the right to have the data we hold about you transferred to another organisation Rights in relation to automated decision making and profiling – we do not carry out automated decision making and profiling. b) You can exercise your data protection rights by contacting us using the details provided above c) In the event of exercising your data rights, we will require suitable identification such as a copy of your passport or driver’s license. d) If you are unhappy with the way we have processed your personal data, please contact our GDPR Officer using the contact details set out in section 1 (b) of this privacy notice. e) If you remain unhappy with how your complaint is dealt with you should contact the Information Commissioner’s Office (https://ico.org.uk/). Alternatively, you are entitled to make a complaint to the Information Commissioner’s Office without first referring your complaint to us. What are my rights? We do implement the use of cookies on our website. Please refer to our Cookie’s Policy for more information. Policy updates This policy was last updated in January 2024.
