Supporters’ Privacy Notice

OUR PROMISE

XLP is committed to respecting your privacy and ensuring the personal information you have entrusted to us is held securely. We process personal information in accordance with the Data Protection Act 2018, the Privacy & Electronic Communications Regulations 2003 and the General Data Protection Regulation 2016.
This Privacy Notice explains what to expect when XLP collects and uses your personal information. We encourage you to read this notice carefully and if you’d like to learn more about our data protection and privacy policies or get further clarification, please contact us and we will be happy to assist.
XLP is the data controller and data processor for the data we collect from you. To contact our Data Manager, please call us on 020 7256 6240 or email data@xlp.org.uk.
XLP is a charity, registered with the Charity Commission in England and Wales (1101095) and a company limited by guarantee, registered in England and Wales (04959458). Our address is XLP, All-Hallows-on-the-Wall, 83 London Wall, London EC2M 5ND.

HOW WE COLLECT PERSONAL INFORMATION

Directly from you when you:

  • Make a donation to the work of XLP;
  • Visit our website (please see our cookies policy for more information);
  • Sign up to receive news and updates on our work through newsletters, e-bulletins, etc.;
  • Register to take part in any conferences, events or fundraising activities that we organise;
  • Request resources to share about XLP;
  • Contact us with an enquiry;
  • Complete a survey.

From other sources:

  • When you register for a conference, event or fundraising activity, we use third party websites to collect information about you which is passed to us; these include booking websites such as EventBrite, websites to support fundraising events such as Virgin Money Giving, and website development platforms such as Wix;
  • When you sign up to receive news and updates from us through the third party website MailChimp, they collect information about you which is passed to us.

THE PERSONAL INFORMATION WE MAY COLLECT

  • Personal identifiers such as your title, name and date of birth;
  • Contact details including postal address, postcode, email and telephone number;
  • Financial information such as your bank details;
  • Your history of donations made to XLP, whether you are a UK tax payer and other information to enable us to claim Gift Aid on any eligible donations;
  • The event(s) that you take part in;
  • Records of your contact with us;
  • Records of communications we have sent to you, including whether you have opened emails or clicked on links within them;
  • Information gathered via cookies when you visit our website (please see our cookies policy for more information).

Sensitive personal data

The Data Protection Act recognises some information as ‘sensitive personal data’. This includes, but is not limited to, information which reveals your religious beliefs, health issues, race or ethnic origin.
XLP is a faith-based but not faith-biased organisation committed to working equally with people of all faiths and none. Where necessary and consented to, we may collect details about your religious affiliation.
Additionally, we collect details about any health concerns or disability with your consent, so we can make the necessary arrangements for your participation in an XLP event or where you have disclosed this so we can meet any additional customer service requirements.
XLP will always treat any sensitive personal data we process with greater care and process the information in accordance with the Data Protection Act.

HOW WE PROCESS YOUR PERSONAL INFORMATION

  • To reclaim tax on Gift Aid donations, if applicable;
  • To verify that you are over 18 and if not, obtain permission from your parent/guardian to process your information or accept any regular donations;
  • To process any financial donations;
  • When you visit our website, we may gather information about which pages you visit to help us improve and provide you with the best service;
  • To determine and improve the effectiveness of our website and marketing campaigns;
  • To organise and coordinate XLP events;
  • To keep you informed about our work. Please see more details in the Marketing Permissions section;
  • To manage and coordinate our volunteers;
  • To improve your experience on our website;
  • For compliance with employment law and other statutory requirements.

THE LAWFUL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION

We process your personal data in accordance with the requirements of the Data Protection Act and other relevant data protection laws. The lawful basis under which we process your personal information as a supporter of XLP will generally be consent (for example, when you ask us to keep you updated about our work), except where required by contract (for example, if you make a booking to attend an XLP event) or legal obligation (for example, to reclaim tax on eligible Gift Aid donations).

CREDIT AND DEBIT CARD PROCESSING INFORMATION

When you make a donation to us online or over the phone, XLP ensures that this is done securely and in accordance with the Payment Card Industry Data Security Standard. All credit or debit card details are entered directly with Global Payments and never recorded or stored in any of our systems on completion of your transaction. You will never be asked to send credit or debit card details by email.

MARKETING PERMISSIONS

We love sharing news about how your support is changing the lives of children, families and communities. This includes sending you information about our work, news, appeals, campaigns, events, information on volunteering and requests for other support.
Email and text marketing:
We will ask for your consent to contact you by email or text for marketing purposes.
Postal marketing:
From time to time we may send you information about our work unless you have told us you would prefer not to receive this information by post.
XLP is committed to respecting your choice to receive marketing information. You have the right to object to XLP processing your personal data for direct marketing purposes and can update your permission and contact preferences at any time by:

  • Calling our office on 020 7256 6240;
  • Emailing data@xlp.org.uk;
  • Clicking the ‘unsubscribe’ link included in each email communication we send.

WHO WE SHARE YOUR INFORMATION WITH

XLP does not sell or share your personal data with any other organisations for marketing purposes. We use trusted third parties as service providers to help us manage your data and our communications with you. Where these third parties are outside the European Economic Area (EEA), we require our third party providers to process your personal information only on our instructions and in accordance with applicable data protection and privacy laws. We primarily use MailChimp to manage our email database and distribute news updates by email, Highrise HQ LLC to manage our postal database, and Global Payments to process any donations or payments by debit or credit card. We provide these organisations with only the data they need to perform these tasks for our purposes. We may be under duty to disclose your personal information where required in order to comply with any legal obligation (for example, when we provide HMRC with your personal details in order to reclaim tax on eligible Gift Aid donations).

HOW LONG WE KEEP YOUR DATA

XLP only keeps your personal information for as long as it is required and in accordance with statutory requirements. For example, HMRC requires that we keep a record of your name, address and Gift Aid declaration for six years from the date of your last donation. Where the information is no longer required, we will ensure that it is disposed of in a secure manner.
If you have indicated that you do not wish to hear from us in the future, we will keep only the minimum information necessary to ensure we avoid contacting you any further, or as required by legal obligations.

YOUR INFORMATION RIGHTS AND CHOICES

The Data Protection Act (DPA) gives you the following rights:

  • To request and securely obtain copies of the personal information XLP holds about you;
  • To correct or update your personal information processed by XLP;
  • To ask XLP to erase personal data held by us;
  • To ask XLP to restrict the processing of your personal data;
  • To withdraw your consent where that is the legal basis of our processing;

You also have the right to object to XLP processing your personal data for direct marketing purposes.
The Privacy and Electronic Communications Regulations (PECR) gives you the right:

  • To choose whether or not to receive marketing communication from us by email, text or telephone (please see the Marketing Permissions section for more information about how to change or update your contact permissions and preferences).
  • To know about the cookies XLP uses, so that you can decide whether to give us permission to store a cookie on your device (please see the cookies policy for more information).

For more information about your information rights, visit www.ico.org.uk. If you wish to exercise any of these rights, please contact us.

REPORTING CONCERNS OR COMPLIMENTS

Please contact us if you wish to raise a concern about XLP’s handling of your personal information (or compliment what you think we have done well!).
You also have the right to lodge a complaint with the Information Commissioner’s Office about how we manage your data.

CHANGES TO THIS PRIVACY NOTICE

XLP will review our privacy notice regularly. The terms of this notice may be updated at any time, for example, in the event of changes in law and how we operate - please do check our website from time to time. If there are any significant changes in the way we process your personal information, we will ensure a prominent notice is displayed on our website or send a notification.
If we plan to use your personal data for any new purposes, we will update this privacy notice and provide you with a copy prior to commencing the processing, setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

Thank you from everyone at XLP for your amazing support!

This notice was last updated on 21st June 2018.