Under the new data protection law starting in May 2018 we have a number of lawful reasons that we can use (or ‘process’) your personal information. One of the lawful reasons is called ‘legitimate interests’.
Broadly speaking Legitimate Interests means that we can process your personal information if:
• We have a genuine and legitimate reason and we are not harming any of your rights and interests
So, what does this mean? When you provide your personal details to us, we use your information for our legitimate business interests to carry out looking after children and families in North Wales, Cheshire, Wirral, Liverpool and Merseyside. Before doing this, though, we will also carefully consider and balance any potential impact on you and your rights.
Some typical examples of when we might use the approach are for preventing fraud, direct marketing, maintaining the security of our system, data analytics, enhancing, modifying or improving our services, identifying usage trends and determining the effectiveness of our campaigns and fundraising.
2.0 OUR VISION
The ambition of Claire House is:
Together, we can help every child who needs us.
Claire House Children’s Hospice helps seriously and terminally ill children live life to the full by creating wonderful experiences and bringing back a sense of normality to family life. By providing specialist nursing care and emotional support Claire House helps families smile again when life couldn’t get any tougher.
Claire House will use various ways to achieve our ambition and to support our objectives: we believe that people whose information we hold on our database are fully aware of the nature of their relationship with us and the mutually beneficial reasons for staying in contact. We will process the personal information you have supplied to us to conduct and manage our business to enable us to give you the most appropriate marketing, fundraising, information, service and products and provide the best and most secure experience. These are what we consider to be our ‘Legitimate Interests’.
3.0 OUR INTERESTS
The following are some examples of when and why we would use this approach in our work helping local children and families:
• Direct Marketing: We will contact you by post and telephone with marketing and fundraising asks which further the aims and objectives of Claire House. We will make sure our communications are relevant to you, tailored to your interests.
• Ordering online: In order for us to process an order, payment has to be taken and contact information collected, such as name, delivery address and telephone number, provided. The seller would also need to record the transaction.
• Your best interest: Processing your information to protect you against fraud when transacting on our website, and to ensure our websites and systems are secure.
• Personalisation: Where the processing enables us to enhance, modify, personalise or otherwise improve our services/communications for the benefit of our supporters.
• Research: To determine the effectiveness of promotional campaigns and advertising and to develop our products, services, systems and relationships with you. We may also carry out research on donors and prospective donors using information that is publicly available e.g. company websites, news articles, LinkedIn, Twitter or Companies House.
• Due Diligence: We may need to conduct investigations on supporters, potential customers and business partners to determine if those companies and individuals have been involved or convicted of offences such as fraud, bribery and corruption.
We will also hold information about you so that we can respect your preferences for being contacted by us.
Without these contact opportunities, Claire House’s income generation potential is put at risk, endangering the long term survival of the organisation:
• The income generation opportunity is greatly increased among the current donor base if fundraising appeals are sent by post – direct mail appeals generate higher response rates
• The supporter experience is enhanced, new opportunities are promoted, if previous visitors who are happy to be contacted can be told about events and new attractions by both post and email
• Lottery membership benefits are heavily weighted towards post: renewals are often sent by post; winners’ cheques are posted out and associated products e.g. raffles are sent out by post.
Articles 47 and 48 of the GDPR say that direct marketing activity is a legitimate interest; in particular, in the context of a relevant and appropriate relationship between the organisation (Claire House) and the individual (the recipient), there would be a reasonable expectation that postal details are used for these purposes.
The legitimate interests of third parties
In order to deliver the direct marketing described above, Claire House may provide individuals’ personal contact details to mailing and fulfilment houses, supplied from our own secure database.
We may also occasionally brief suppliers to carry out analysis, sometimes using personal data and at other times anonymised data, to help determine market trends and opportunities around fundraising and retail. This insight enables us to provide the best possible experience for our supporters and customers.
We make every effort to ensure the data we send to suppliers is secure at every point of transfer and during all the stages of data processing. Our reputable suppliers are required to provide their security protocols on demand. Personal data will always be held on servers within the EU and is securely deleted by our suppliers as soon as each mailing activity has been completed.
4.0 YOUR INTERESTS
When we process your personal information for our legitimate interests, we will consider and balance any potential impact on you and your rights under data protection and any other relevant law. Our legitimate business interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Rights and freedoms of the individual
Claire House will do the following with the personal information it holds. None of these activities infringe the rights or freedoms of individuals under the terms of the GDPR:
• Securely transfer data to third party suppliers for the purposes of producing personalised direct mail materials (see above)
• Send both generic and personalised content by post – and, where the individual has given explicit permission, by e-mail
• Retain the individuals’ data for as long as the active relationship lasts with Claire House, for marketing, business analysis and administration purposes
• Retain the individuals’ data for a period after the relationship has ceased, for the same purposes (i.e., lottery membership has lapsed; no donations have been received). This will be for a maximum of 7 years after the last recorded activity by the individual. These timings are consistent with Claire House’s statutory responsibilities to retain data for Gift Aid and other tax purposes.
• We will only record and store personal data with the knowledge of the individual
• We will not send promotional or marketing information to children. We will thank them for any fundraising activity they have done, but we will not actively promote any other fundraising activities to them.
• We may use external data sources to enhance the personal data we store as permitted by Article 22 of the GDPR
• We will not use marketing data obtained from a third party without proof of third party consent for mailing having been obtained by the data owner
5.1 Primary Relationships
The individuals whose details Claire House holds fall into these primary categories. They may be active or lapsed. Claire House claims legitimate interest as outlined above for the purposes of communications, via post, to reactivate lapsed members or supporters for income generation purposes.
Former employees’ and former volunteers’ data will be dealt with according to the requirements of GDPR:
• Service users
• Non-transactional supporters
5.2 Business to business and corporate partnership relationships
Claire House is claiming legitimate interest to keep in touch, using their business addresses, with named individual business and corporate partnership contacts with whom the organisation already had a relationship prior to the introduction of the General Data Protection Regulation on 25 May 2018.
This legitimate interest does not extend to contacting these individuals using their personal contact details unless, as private individuals, they fall into one of the categories listed above in ‘Primary relationships’, in which case Claire House claims legitimate interest for contact by post and telephone and will only make e-mail or SMS contact if the appropriate consents are in place.
For new relationships in these categories created with named individuals after 25 May 2018, consent for future contact will be sought and managed in full compliance with the General Data Protection Regulation.
Remember, you can change the way you hear from us or withdraw your permission for us to process your personal details at any time by using our contact form on the Contact Us page, by ringing us on 0151 343 0883 or emailing on firstname.lastname@example.org