We have worked on behalf of children growing up in poverty in the UK since 1965. Today more than one in four children are living in poverty and many families need to visit food banks in the UK, one of the richest countries in the world.
It doesn’t have to be this way. We use our understanding of what causes poverty and the impact it has on children’s lives to campaign for policies that will prevent and solve poverty—for good. We provide training, advice and information to make sure hard-up families get the financial support they need. We also carry out high profile legal work to establish and protect families’ rights.
When we are carrying out our work, we process personal data about people who receive advice or legal services from us; about those who attend our training courses or buy our books; and about those who support us through campaigning, giving donations, or volunteering.
At Child Poverty Action Group, we are committed to protecting your personal information and being transparent about what information we hold. We have developed the following policy to help you understand how your personal information will be treated as you engage with us both online and off. It’s important that you know how we record your personal data when you do things like visit our website, donate to us or use our services so that you can trust us with that information.
- what information we may collect about you;
- why we collect it;
- what we do with it;
- when we may share it with others; and
- how you can access and update your information.
You are in control of how we contact you. If you want to stop receiving email, click the ‘unsubscribe’ link at the bottom of any of our mass emails. If you would like to make changes to the type of communications you get from us, or if your personal details change, please get in touch using the details in the ‘Contact us’ section below.
Changes to this policy
This policy may change, but we will always have the latest version available for you on our website. It there are any major changes, we will add a notice on our website or contact you. This policy was last updated on 4 May 2018.
Who we are
Child Poverty Action Group is a charity registered in England and Wales (registration number 294841) and in Scotland (registration number SC039339). Child Poverty Action Group is also a company limited by guarantee registered in England (registration number 1993854). Our registered offices are at 30 Micawber Street, London N1 7TB.
Where we collect information about you from
We collect information in the following ways:
When you give it to us DIRECTLY
We collect personal information for many reasons, including to provide you with services, communicate with you and send you information that you have requested, and to run campaigns and process donations. Depending on how you interact with us, we may process data when you:
- register on our website to receive updates from us;
- request a service from us such as calling our advice line;
- become a member or subscriber;
- buy our publications or sign up to our training courses;
- fundraise on our behalf;
- donate to us or allow us to claim Gift Aid on your donations;
- campaign for us;
- apply for jobs or volunteer placements, or act as a freelancer for us;
- complete a survey or take part in research; or
- give personal data to us.
This information may be collected via any paper forms you complete, telephone conversations, emails, face-to-face interactions, digital forms completed via our website, online surveys, third-party companies and websites such as JustGiving, publicly available sources, or communication via social media. Our donations and payment pages are provided by third-party secure payment processors.
When you give it to us INDIRECTLY
When you give permission to OTHER ORGANISATIONS to share or it is available publicly
We may combine information you provide to us with information available from external sources in order to gain a better understanding of our supporters to improve our fundraising methods, products and services. The information we get from other organisations may depend on your privacy settings or the responses you give, so you should regularly check them. This information could come from social media accounts, for example Twitter or Facebook. We may also access information available publicly, such as via Companies House or information that has been printed in newspapers.
When we collect it as you use our WEBSITE
All browsers allow you to control which cookies you accept and which you delete. For more information about cookies, please see http://www.allaboutcookies.org/.
What types of information do we collect?
This type of information does not tell us who you are, but it does help us to improve our services. When you visit and look around our website, we record things like your IP (internet protocol) address – the unique number of the device you are using to access our website, which pages you visit (on our website only), when they were visited, and the type of device you were using. This information helps us create a better experience for everyone who uses our website. Examples of the type of information that can be collected using your IP address include the type and version of your browser, and the location from which you are accessing our site. This helps us improve how our page templates appear and change content to make it relevant to our website visitors.
This means any information that may be used to identify you, such as your name, telephone number, postal and email addresses, and your bank details if you are supporting us financially.
- Your full name
- Contact details including your postal address, telephone number(s) and email address
- Records of your correspondence and engagement with us and any subscriptions or membership you hold or have held with us
- Donation history and Gift Aid details
- Information you may enter on the CPAG website
- Occupation or other biographical information
- Other information you share with us
- Details of your case when providing you with advice or services
We sometimes also collect sensitive information about individuals. This includes information about health, religion, sexuality, ethnicity, political and philosophical beliefs, and criminal records. We will normally only record this data where we have your explicit consent, unless we are permitted to do so in other circumstances under data protection law. For example, we may make a record that a person is in a vulnerable circumstance to comply with requirements under charity law and the Fundraising Regulator to ensure that we do not send fundraising communications to them.
How we use your personal data
We would love to keep you up to date with our campaigns and fundraising activity. We use a range of methods to contact our supporters, including our website, email, direct mail, and occasional telephone calls.
We will always gain your consent to contact you by email for marketing purposes. We will send you marketing by post, on the basis of it being within our legitimate interests (see below section on ‘Our legal basis for processing your data’ for more information) to do so, unless you opt out. And we will also contact existing supporters by phone on this basis, unless they are registered with the Telephone Preference Service or they have opted out of receiving marketing communications.
Why should you sign up for supporter communications from us?
- You’ll still hear from us! If you don’t let us know your contact preferences, you could miss out on hearing about ways to get involved, campaigns, success stories, and updates on the incredible work you’re supporting.
- You’ll hear from us how you want to, whether by post, phone, or email. You could choose all of these options, or just one or two. It’s up to you.
We send the following supporter marketing email communications from time to time:
- updates about CPAG’s work, including newsletters, magazines, and other publications informing you about our work;
- information about our campaigning activities, including how you can support these campaigns, for example by lobbying your MP or signing a petition, and updates about campaign progress;
- appeals and fundraising activities, including requests for donations, information about how you can leave us a gift in your will, how you can raise money on our behalf, and invitations to attend or take part in fundraising events;
- shop products, for example Christmas cards and other merchandise;
- information about how you can support CPAG by volunteering.
We will never share or sell your personal data to a third-party organisation for its campaigning, marketing or fundraising purposes.
You can withdraw your consent, unsubscribe, or update your marketing preferences at any point by using the contact details in the ‘Contact us’ section below. If you make any changes to your consent, we will update your record as soon as we possibly can. Marketing email communications will be stopped immediately if you click unsubscribe. Updates to contact preferences sent by email may take up to one week to process. It may take up to 28 days to stop any postal communications from being sent to you. If you tell us you do not want to receive supporter communications, you may still receive communications related to products or services, as described below. You can also opt out of receiving supporter communications from us by signing up to the Fundraising Preference Service.
Administrative communications to supporters
In addition to the supporter communications that you receive, we will also communicate with you by post, telephone, and email to deal with any administrative matters. Even if you opt out of supporter communications from us, we may still need to communicate with you occasionally for administrative purposes. For example, we may contact you when you set up or cancel a Direct Debit to confirm your details. We may also need to contact you if there is a problem with a payment or in relation to your Gift Aid declaration. If you sign up to an event, we may contact you to provide all the information you need and to ask for details of your fundraising pages.
Business services and professional contacts
We may collect data about the professional contacts and partners we work with, or who have used our services such as attending training courses or buying publications. Personal data collected in this way will be processed according to data protection law and this policy.
We may send our professional contacts information and updates about our work by email and by post. You can opt out of receiving this information at any time. You can withdraw your consent, unsubscribe, or update your preferences at any point by using the contact details in the ‘Contact us’ section below. If you make any changes to your consent, we will update your record as soon as we possibly can. Email communications will be stopped immediately. It may take up to 28 days to stop any postal communications from being sent to you.
We keep a record of information relating to MPs, Peers, and other holders of public office, to help us carry out our campaigning activity. This will include keeping a record of contact details such as address, telephone number and email address, as well as publicly available information such as voting records and committee memberships.
As a member, we will send you information about your membership, including any voting opportunities and/or member meetings, eg. the Annual AGM. If you sign up to become a member of CPAG, we have a contractual obligation to provide you with the membership benefits you have signed up for. If you do not wish to receive these benefits, let us know by getting in touch using the details in the ‘Contact us’ section below.
Services for beneficiaries and advice workers
If you have let us know that you are interested in particular kinds of information or if you have signed up to specific newsletters, for example about welfare rights or our Early Warning System, you will only receive communications relating to the newsletter you have signed up for. You can withdraw your consent, unsubscribe, or update your preferences at any point by using the contact details in the ‘Contact us’ section below. If you make any changes to your consent, we will update your record as soon as we possibly can. Email communications will be stopped immediately. It may take up to 28 days to stop any postal communications from being sent to you.
If you are receiving advice or representation from us, we will need to process your data because of your specific relationship with us. We use a customer relationship management system (CRM) to support our work. This means that we can keep the information you provide to see the history and relevant details of your case. This ensures that we can provide you with appropriate and accurate advice and representation. Sometimes individuals’ cases are escalated with other bodies such as the Department for Work and Pensions or HMRC: we always keep you up to date with the actions and progress on your case. We take information security very seriously and no one is allowed to access our system or files unless they need this to provide the service to you or to regulate the quality of the service.
When you call or email our advice service for advisers to seek help with your casework, our advisers take notes on the information you give us and record it on our database. This is used for training purposes, quality assurance, complaint investigations, to collect the data needed to fulfil our obligations to our funders, and to support our policy work. You are informed of this before any data collection occurs.
To ensure that our services meet a high standard, client files are regularly checked by external auditors, such as the Legal Aid agency and Recognising Excellence Ltd, the contract holders for the Specialist Quality Mark. All auditors are bound by confidentiality policies.
We may use your data for statistical reports. These statistics will not include information that could be used to identify any individual.
Job applicants and volunteers
When you apply for a job or volunteer placement with CPAG, your personal data will be collected to monitor the progress of your application. Where we need to share your data, for example to gather references, you will be informed beforehand unless the disclosure is required by law. These checks are only done after a position has been offered to the successful candidate. Personal data about unsuccessful applicants is held for 12 months. You can ask for us to remove your data before then if you do not want us to hold it.
Our legal basis for processing personal data
We need a lawful basis to collect and use your personal data under data protection law. The law allows for six ways to process personal data (and additional ways for sensitive personal data). Five of these are relevant to the types of processing that we carry out at CPAG. This includes information that is processed on the basis of:
- a person’s consent, for example, to send you direct marketing by email;
- a contractual relationship, for example, to provide you with goods or services that you have purchased from us including a membership subscription
- processing that is necessary for compliance with a legal obligation, for example accounting data, information needed to process a Gift Aid declaration, or to carry out due diligence on large donations;
- CPAG’s legitimate interests: please see below for more information.
Personal data may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, if its use is fair and does not adversely impact the rights of the individual concerned. When we use your personal information, we will always consider if it is fair and balanced to do so, and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that are not unduly intrusive or unfair. Our legitimate interests include:
- charity governance: including delivery of our charitable purposes, statutory and financial reporting and other regulatory compliance purposes;
- administration and operational management: including responding to solicited enquiries, providing information and services, research, events management, administrating recruitment processes for staff, volunteers and freelancers; and
- fundraising and campaigning: including administering campaigns and donations, and sending direct marketing by post (and in some cases making marketing calls), sending thank you letters, analysis, targeting and segmentation to develop communication strategies, and maintaining communication suppressions (which we use to avoid sending materials to those who don’t want them).
If you would like more information on our uses of legitimate interests, or to change our use of your personal data in this manner, please get in touch with us using the details in the ‘Contact us’ section below.
When we may disclose your personal data
We will not share any of your personal data to any third party – except where:
- the transfer is to a secure data processor, which carries out data processing operations on our behalf, for example to process a Direct Debit or credit card payment or to manage a fundraising mailing;
- we are required to do so by law, for example to law enforcement or regulatory bodies where this is required or allowed under the relevant legislation;
- it is necessary to protect the vital interests of an individual – i.e. to protect someone’s life; or
- we have obtained your consent.
We will never share or sell your personal data to a third-party organisation for marketing, fundraising or campaigning purposes.
How we keep your data secure
We use appropriate technical and organisational measures and precautions to protect your personal data and to prevent the loss, misuse or alteration of your personal data. For example, we use trusted third-party suppliers to provide secure pages for financial transactions taking place on our website, meaning that your details are safe when you buy products from our shop or give us a donation.
Unfortunately, sending information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of the data sent to our website on standard pages (any pages other than when you are buying products or when you’re making a donation). Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
We encourage you to review the privacy statements of websites you choose to link to from the CPAG website, so that you can understand how those sites collect, use and share your information.
How we use data processors
We use third-party suppliers to provide secure pages for transactions and donations, website hosting and database hosting. This means that your data will be captured and processed by these suppliers. We may also use a third-party supplier to manage campaigns and fundraising appeals, or conduct surveys. We actively check these companies to ensure your privacy and security is protected. These third-party suppliers are only permitted to use the data in accordance with data protection law, under instruction from us, and in accordance with a data processing agreement made between CPAG and the supplier.
It may sometimes be necessary to transfer personal information overseas. When this is needed, any transfers made will be in full compliance with all aspects of data protection law.
You can find out more about the suppliers we use by getting in touch with us using the details in the ‘Contact us’ section below.
How long we keep your data
Whatever your relationship with us, we will only store your information for a limited amount of time.
The length of time we keep your data may depend on the reasons we are processing it, on the law or regulations that the information falls under, such as financial regulations, Limitations Act, Health and Safety regulations, or on any contractual obligation we might have, such as with government contracts. For business case data, we will anonymise the data so no individual is identifiable.
Once the retention period has expired, we will confidentially dispose of or permanently delete your information.
If you ask not to be contacted by us, we will keep some basic information about you on our suppression list to avoid sending you unwanted materials in the future.
Your rights to your personal information
You have a right to request a copy of the personal information we hold about you, and to have any inaccuracies corrected. You also have the right to request that we erase your personal information, restrict our processing of your personal information or to object to our processing of your personal information.
If you wish to exercise these rights, we may need you to prove your identity with two pieces of approved identification. Please submit requests using the contact details below and we will respond within 28 days. Please provide as much information as possible about the nature of your contact with us to help us locate your records, including all of the email addresses you have used when in contact with us. We reserve the right to charge a fee of £10 for this process.
Where you have provided your consent for us to use your personal information, you always have a right to withdraw your consent at any time.
Your ability to edit and delete your account information preferences
The accuracy of your personal information is important to us. You can edit your account information, including your address and contact details at any time. If you would like to change your preferences or update the details we hold about you other than online, please get in touch using the details in the ‘Contact us’ section below. If you would like changes to be made to your personal details, please tell us all of the email addresses you have used when in contact with us so we can locate all of your details.
How CPAG protects children's privacy
We collect and manage information from children, and aim to manage it in a way which is appropriate to the age of the child. Information is usually collected when we are acting in legal cases on behalf of children, which may be sensitive personal data, or when children or young people are sitting on an advisory panel or part of a children’s network.
Where possible and appropriate we will seek consent from a parent or guardian, if the child is under 13, or consent from the young person, if they are aged 13-17, before collecting information.
How you can find out more about your rights
The way we collect and use personal data on this site is in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act. Your rights will be observed and honoured at all times. Please visit the Information Commissioner’s Office for further information at www.ico.org.uk.
If you have any questions about this policy, would like more information, or want to exercise any of your rights in relation to data protection, you can get in touch with us in the following ways:
• Email us at email@example.com
• Telephone us at 020 7837 7979
• Write to us at Supporter Care, CPAG, 30 Micawber Street, London N1 7TB