Privacy Policy

Compassiviste is committed to protecting all the personal information we obtain from and about you. From financial supporters and shoppers to those vulnerable individuals we support through our projects and appeals, we promise to look after your personal data from the moment we receive it. This Privacy Policy sets out how we’ll do so.

Who We Are

Compassiviste is a company registered in England and Wales with the company number 14317175.

We are a “data controllers” for the purposes of the Data Protection Act 2018 and the EU General Data Protection Regulation 2016. This means that Compassiviste is responsible for the processing of your personal information.

You can contact our mutual designated Data Protection Officer by:

Emailing our Data Protection Officer, Ali Horriyat, at: hello@compassiviste.com

What personal data we may hold

As a Data Controller, we hold and process “personal data”. This may include details such as your name, email address, age, marital status, date of birth, telephone number, postal address, credit or debit card details, and other information that you have provided in communications with us.

We may also hold more sensitive personal information (special category data), which can include information about a person’s sexual orientation, religious beliefs, political opinions, race, ethnic origin and health.

Compassiviste may also sometimes receive personal data about children and young people if those individuals are among those we are trying to help through our projects. Wherever possible, we will ask for consent from their parents or guardians.

If special category data is needed in order for us to assist you, we will tell you why we need it and how it will be used.

Personal data is also held about volunteers, staff members and trustees. A separate Privacy Policy for each of these roles will be provided by us.

Why we hold personal data

We process personal data for a number of reasons:

– To comply with legal obligations

– To process online and offline donations and keep a record of those donations

– To process purchases through our website and provide the goods you have requested

– To claim gift aid on donations

– To comply with the Charities (Protection and Social Investment) Act 2016 and follow the recommendations of the Charity Commission, which requires charities to identify and verify the identity of supporters who make major gifts so we can assess any risks associated with accepting their donations

– To contact applicants for volunteer, trustee and staff member roles and administer agreements (in which separate Privacy Policies are included)

– To manage our organisation and keep its representatives safe

– To undertake market research and website user experience (UX) and accessibility testing

– To ensure we do not send unwanted information to supporters or members of the public who have informed us they do not wish to be contacted or, conversely, to update those who have asked to be contacted about upcoming events, services, fundraising ideas, projects and new or urgent appeals

– To make financial donations to partner organisations and respond to urgent humanitarian appeals

– To respond to questions, feedback or suggestions we may receive through our website or social media channels

– To respond to enquiries about or submissions to Compassiviste Publishing

These reasons are underpinned by a “legal basis” under the GDPR, further details of which can be found below.

In the event that you work with us in another way – for instance, enrol in a specific event, program, apply for a job, or are a member of staff, there may be a separate Privacy Policy which describes why we collect and how we use that data.

We only keep personal data for as long as is reasonable and necessary for the relevant activity, which may be to fulfil statutory and contractual obligations (for example, the collection of Gift Aid).

How we collect personal data

We collect data through a variety of different means:

– Direct interactions, including instances when you create an account in our online shop; subscribe to our newsletter; apply for volunteering positions; take part in market research or UX website (including accessibility) testing; request resources or further information about our appeals or fundraising opportunities; enter a competition or prize draw; ask us a question or make a suggestion about our website or appeals via email or through our website contact forms; and make a donation.

– Automated technologies or interactions, including instances when you use our website and we may automatically collect technical data about your device, location and browsing behaviour. We collect this data through the use of cookies on our website. Please see our Cookie Policy for further details.

We may also collect personal data about you from other sources including Google Analytics (based outside of the EU); WordPress; Mailchimp; Twitter; Facebook; LinkedIn and other social media channels. Data about you may also be collected from third-party sources if:

– You make a gift to Compassiviste in your will and we need to liaise with a will-writing service or solicitor

– You make a sizeable donation to Compassiviste and, for reasons of due diligence, we run a background check using publicly available sources through a due diligence provider

– You support us through a third-party fundraising site and give your consent to share your personal data with us

Sharing Your Personal Data

Compassiviste will collect, process and store information you provide in a manner compatible with the General Data Protection Regulations. The information you provide will be held securely, subject to strict measures and procedures to minimise the risks of unauthorised access or disclosure and so as to not constitute an invasion of your privacy. The Trust aims not to be intrusive, and we undertake not to ask irrelevant or unnecessary questions.

We may share the personal data we collect with third parties, including those based outside of the European Economic Area (EEA):

– If we receive gift aid from you and are required to share your details with Her Majesty’s Revenues & Customs (HMRC)

– When required to do so by law enforcement agencies

– If you have consented to us sending you marketing materials and newsletters and we utilise a marketing or PR firm, or a service such as MailChimp, to conduct those activities on our behalf. Such third parties may be based outside of the EEA.

– If you have consented to us contacting you for the purposes of publicity and promotion and we utilise a marketing or PR firm to undertake those activities on our behalf. Such third parties may be based outside of the EEA.

– If you apply for a volunteering or trustee role and we need to share your details with other volunteers, trustees, event organisers, and partner organisations (some of which may be located outside of the EEA) for health and safety, administrative and managerial purposes

– If you make a sizeable donation to the Trust and, for reasons of due diligence, we run a background check using publicly available sources through a due diligence provider

– If you make a donation or a purchase on our website, your personal data will be processed by a third-party processor (namely Stripe and PayPal) that may store some of your personal data outside of the EEA.

– If doing so is necessary to protect human life.

We only share personal data with third party organisations if we have a legal basis to do so and only ever in situations where recipients have the security requirements in place to protect it. Whenever we transfer your personal data out of the EEA, we do our best to ensure a similar degree of security of data by ensuring that we use reputable organisation that have been deemed to provide an adequate level of protection.

The legal basis for collecting and using your information

The lawful bases for processing data are set out in Article 6 of the UK GDPR. At least one of these must apply to legally collect and process personal data. In our case, we collect and use personal data when:

a. We have your consent. For example, we will only send you marketing emails, contact you by telephone or respond to enquiries vie email if we receive your consent to do so. We will do this through a clear statement on our website. For instance, if you donate online to one of our appeals, you will be asked if you would like to receive notifications from us about our other appeals and projects. You can withdraw this consent at any time (See ‘Your Rights’, below).

b. There is a contract. For example, we will use your personal data to enter into or fulfil the terms and conditions of a contract with you. This includes online purchases, employment and volunteering agreements, and online donations.

c. We have a legal obligation to do so. For example, we will disclose your personal data to a law enforcement agency if we are required to do so.

d. There are vital interests. For example, we will process and disclose personal data if doing so is necessary to protect someone’s life. This may apply to vulnerable people in conflict zones whose lives would otherwise be at risk if we did not share their details with UK or international law enforcement or social care agencies.

e. Where it is in the public interest. In limited situations we may use data to prevent crime or dishonesty or to safeguard the wellbeing of people with whom we work.

f. There is a legitimate interest. Examples of where we have a legitimate interest to process data include contacting you about our work via post; improving our services; and complying with guidance from the Charity Commission. Whenever we process data under the ‘legitimate interest’ lawful basis we make sure that we take into account your rights and interests and will not process your personal information if we feel that there is an imbalance.

Keeping Your Data Safe

Compassiviste take data protection seriously. We have appropriate physical, organisational and technical measures in place to protect the information we obtain, both on and off-line, from improper use, loss, access and alteration. However, the transmission of information on the internet is not always secure and although we do our best to protect data sent to us in this way, we cannot guarantee the security of data transmitted to our website.

Additionally, the Compassiviste website contains links to other third-party websites. While we try to link only to sites that share our high standards and respect for privacy, we are not responsible for the content or the privacy practices employed by other sites and this privacy policy does not cover the information practices of those third parties.

Your Rights

You have various rights regarding the personal information we hold about you. These rights may include:

– Accessing your personal information: You have the right to request access to a copy of the personal information that we hold about you, along with information on what personal information we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can make a Subject Access Request for access free of charge by contacting us via email, by telephone, or through the contact form on our website.

– Changing consent: If you have given us your consent to use personal information (for example, for marketing), you can withdraw your consent at any time. You can withdraw consent by contacting us via email, by telephone, or through the contact form on our website.

– The right to erasure: You have the “right to be forgotten” by asking us to delete your personal information where it is no longer necessary for us to use it, after you have withdrawn consent, or where we have no lawful basis for keeping it. To do so, please contact us via email, by telephone, or through the contact form on our website.

– A right to object: You can object to our processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes. You can contact us via email, by telephone, or through the contact form on our website.

– A right to rectification: You can ask us to change or complete any inaccurate or incomplete personal information held about you by contacting us by email, telephone or website form.

– Preventing automated decision-making: You can ask that we no longer process your data automatically to decide whether particular marketing activities are likely to be of interest, or suggest an appropriate donation level based on your previous donation history. This is known as profiling, and helps us to ensure that our marketing is relevant and appropriate. We do not currently carry out any automated decision-making.

How to make a complaint

If you are unhappy about how we have processed your personal data or have a privacy concern, we want to know about it. To make a complaint or raise a concern please contact our Data Protection Officer, Ali Horriyat, via email at hello@compassiviste.com.

If you are unhappy with how our Data Protection Officer deals with your complaint you should contact the UK data protection authority, the Information Commissioner’s Office (ICO). The ICO can be contacted at: https://ico.org.uk/global/contact-us/

Changes to this Privacy Policy

We keep our privacy statement under regular review and we will place any updates on this web page. This Policy was drafted in October 2022.