In this Privacy Policy, “CRIS Cancer Foundation”, “CRIS Cancer”, “we”, or “our” means 

1. CRIS Cancer Foundation – Registered Charity Number 1140193 

2. CRIS Cancer Foundation (registered charity in England and Wales (Registered Charity No. 1140193), a company limited by guarantee in England (07493363) 

Information you provide to us indirectly 

You may give us your information in order to sign up for one of our events, make a donation, register as a volunteer, apply for research funding, use our cancer information services or otherwise communicate with us. 

In addition, in accordance with common website practice, we will receive information about the type of device you’re using to access our website or apps and the settings on that device may provide us with information about your device, including what type of device it is, what specific device you have, what operating system you’re using, what your device settings are, and why a crash has happened. Your device manufacturer or operating system provider will have more details about what information your device makes available to us. 

Information you provide to us indirectly 

Your information may be shared with us by third parties, for example: 

• if a friend or family member signs you up for one of our events 

• independent event organisers, for example the Royal Parks or fundraising sites like Just Giving, Instagram nonprofit fundraiser, Givergy, CAF, Charities Trust, or Enthuse; 

You should check any privacy policy provided to you where you give your data to a third party. 

Communication, engagement and actions taken through external social media platforms that we participate on are subject to the terms and conditions as well as the privacy policies held with each social media platform respectively. 

Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp, Instagram or LinkedIn, you might give us permission to access information from those services, for example when you publicly tag us in an event photo. 

You are advised to use social media platforms wisely and communicate / engage upon them with due care and caution in regard to your own privacy and personal details. 

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). 

We collect, store and use the following kinds of personal information: 

• your name; 

• your contact details (including home address, telephone number, email address); 

• your gender; 

• your workplace; 

• your job title; 

• your bank or credit card details where you provide these to make a payment; 

• your volunteer or job application and assess your suitability (which may include things like employment status, previous experience depending on the context, as well as any unspent criminal convictions or pending court cases you may have); 

• information about your activities on our website(s) or social media platforms when you interact with us, and about the device you use to access these, for instance your IP address and geographical location; 

• information about events, activities and products which we consider to be of interest to you; 

• information relating to your health (for example if you are taking part in or attending an event for health and safety purposes, as well as where you share your experiences of cancer with us); 

• information as to whether you are a taxpayer to enable us to claim Gift Aid; 

• any other personal information you provide to us.  

Certain types of personal information are in a special category under data protection laws, as they are considered to be more sensitive.  Examples of this type of sensitive data (known as “special category data”) would be information about health, race, religious beliefs, political views, trade union membership, sex life or sexuality or genetic/biometric information. 

We only collect this type of information if you make it public or volunteer it to us – for instance if you tell us you have cancer when contacting us or if you share your religious belief when outlining dietary restrictions. 

Wherever it is practical for us to do so, we will make clear why we are collecting this type of information and what it will be used for. 

As a charity, carrying out many different tasks we use personal data for a wide number of purposes.  We will use personal information to: 

• provide you with the services, products or information you asked for; 

• administer your donation or support your fundraising, including processing Gift Aid; 

• keep a record of your relationship with us; 

• respond to or fulfil any requests, complaints or queries you make to us; 

• understand how we can improve our services, products or information by conducting analysis and market research; 

• manage our events; 

• to protect the health and safety of you, our staff, volunteers and other members of the public; 

• further our charitable objectives; 

• send you correspondence and communicate with you, using traditional channels and via social media platforms 

• administer our websites and to troubleshoot, perform data analysis, research, generate statistics and surveys related to our technical systems; 

• test our technical systems to make sure they are working as expected; 

• display content to you in a way appropriate to the device you are using (for example if you are viewing content on a mobile device or a computer); 

• generate reports on our work, services and events; 

• safeguard our staff and volunteers; 

• conduct due diligence and ethical screening; 

• Identify potential supporters, donors, researchers or other partners; 

• process your application for a job or volunteering position; 

• conduct training and quality control; 

• audit and administer our accounts; 

• meet our legal obligations, for instance to perform contracts between you and us, or our obligations to regulators, government and/or law enforcement bodies; 

• carry out fraud prevention and money laundering checks; 

• undertake credit risk reduction activities; and/or 

• establish, defend or enforce legal claims. 

third parties to collect or share data about you. We do not control these third-party websites or how they use personal data. When you leave our website, we encourage you to read the privacy policy of every website you visit. 

We use your personal data to tailor the marketing you receive via email post, phone call or SMS, and to measure it’s effectiveness.  We will only include supporters in these if they have opted in to receiving our marketing. 

The contract terms, under which they act as our processor for this purpose, do not permit them to make any further use of the details we provided. Data is deleted once it is no longer in use. 

We believe we have a legitimate interest in customising our social media communications in this way. 

We think it’s important to let our supporters know how their money is being spent and to say thank you for their generosity.  We send information to individuals who have supported us to say thank you and provide updates on our work.   We will tailor the amount and type of these communications depending on the ways in which you have provided support. 

If you ask for details of, or register for, a CRIS Cancer event or fundraising activity, we will send you information including, where relevant, ideas for fundraising and key information about the activity and reminders to submit prize donation as per contract. 

Where you have signed up for an event with a third party (for example the Royal Parks) and told the event organiser that you wish to fundraise for us, we may contact you with information and support for your fundraising for that event. 

If you take part in a CRIS Cancer or third party event, we may contact you to let you know that the event is happening again and how you can register, unless you have specifically opted out of further marketing. 

Being able to contact previous supporters to ask them to consider supporting us again is a very cost effective way of raising funds.  Our marketing communications include information about our latest breakthroughs, campaigns and lifesaving work and requests for donations or other support. Occasionally, we may include information from partner organisations or organisations who support us in these communications.  When you provide your details to us, you will be asked to opt in or opt out of receiving marketing. 

We may use information we hold about you, for example the record of your previous donations to and/or relationship with us, your location and demographics, as well as the type of activity you have been involved with, to tailor our communications with you about future activities. 

If you’ve decided you don’t want to be contacted for marketing purposes, we may still need to contact you for administrative purposes. This may include where we are processing a donation you’ve made and any related Gift Aid, thanking you for a donation or participation in an event, or keeping in touch with you about volunteering activities you are doing for us. 

We will never sell or rent your information to third parties for marketing purposes. 

Data protection laws mean that each use we make of personal information must have a “legal basis”. The relevant legal bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK data protection legislation. 

Specific consent 

Consent is where we ask you if we can use your information in a certain way, and you agree to this (for example when we send you marketing material via post, phone, text or e-mail). Where we use your information for a purpose based on consent, you have the right to withdraw consent for any future use of your information for this purpose at any time. 

Legal obligation 

We have a basis to use your personal information where we need to do so to comply with one of our legal or regulatory obligations. For example, in some cases we may need to share your information with our various regulators such as the Charity Commission, Fundraising Regulator, Information Commissioner or Gambling Commission, or to use information we collect about you for due diligence or ethical screening purposes. 

Performance of a contract / take steps at your request to prepare for entry into a contract 

We have a basis to use your personal information where we are entering into a contract with you or performing our obligations under that contract. Examples of this would be if you are buying something from us (for instance some branded merchandise or an event place), applying to work/volunteer with us, or being funded to undertake research. 

Vital interests 

We have a basis to use your personal information where it is necessary for us to protect life or health.   For instance if there were to be an emergency impacting individuals at one of our events, or a safeguarding issue which required us to contact people unexpectedly or share their information with emergency services. 

Legitimate interests 

We have a basis to use your personal information if it is reasonably necessary for us (or others) to do so and in our/their “legitimate interests” (provided that what the information is used for is fair and does not unduly impact your rights). 

We consider our legitimate interests to include all of the day-to-day activities CRIS Cancer Foundation carries out with personal information.  Some examples not mentioned under the other bases above where we are relying on legitimate interests are: 

• analysis and profiling of our supporters or potential supporters; 

• use of personal information when we are monitoring use of our website or apps for technical purposes; 

• use of personal information to administer, review and keep an internal record of the people we work with, including supporters, volunteers and researchers; 

• sharing of personal information between relevant teams and committees within CRIS Cancer Foundation as well as service suppliers e.g. event service organisations, fundraising partners; 

We only rely on legitimate interests where we consider that any potential impact on you (positive and negative), how intrusive it is from a privacy perspective and your rights under data protection laws do not override our (or others’) interests in us using your information in this way. 

When we use special category personal data (please see the “What personal information we collect” section above), we require an additional legal basis to do so under data protection laws, so will either do so on the basis of your explicit consent or another route available to us at law for using this type of information (for example if you have made the information manifestly public, we need to process it for employment, social security or social protection law purposes, your vital interests, or, in some cases, if it is in the public interest for us to do so). 

We ensure that there are appropriate technical and organisational controls (including physical, electronic and managerial measures) in place to protect your personal details.  For example our online forms are always encrypted and our network is protected and routinely monitored. 

Some of our suppliers run their operations outside the United Kingdom, including within the European Economic Area (EEA). This includes countries which do not have the same data protection laws as in the UK.  In these circumstances, we will make sure they provide an adequate level of protection in accordance with UK data protection law, and confirm that appropriate safeguards are in place. 

We take into account various criteria when determining the appropriate retention period for personal data including: 

• the purposes for which we process your personal data and how long we need to keep the data to achieve these purposes; 

• how long personal data is likely to remain accurate and up-to-date; 

• for how long the personal data might be relevant to possible future legal claims; 

• any applicable legal, accounting, reporting or regulatory requirements which specify how long certain records must be kept. 

We retain your personal data for no longer than necessary and will anonymise it after a maximum of six years of inactivity to meet our legal and regulatory requirements. 

Sharing your information with other organisations 

We may disclose your information to third parties in connection with the other purposes set out in this policy.  These third parties may include: 

• business partners, suppliers and sub-contractors who may process information on our behalf; 

• if you are a researcher, volunteer advisory panels, any joint funders of research, host institutions and external members of our committees; 

• advertisers, social media platforms and advertising networks 

• analytics and search engine providers; 

• IT service providers. 

Where we are under a legal or regulatory duty to do so, we may disclose your details to the police, regulatory bodies or legal advisors, and/or, where we consider this necessary, to protect the rights, property or safety of CRIS Cancer Foundation, its personnel, visitors, users or others. 

You have a right to request access to the personal data that we hold about you. You also have the right to request a copy of the information we hold about you, and we will provide you with this unless legal exceptions apply. 

Right to have your inaccurate personal information corrected 

You have the right to have inaccurate or incomplete information we hold about you corrected.  If you believe the information we hold about you is inaccurate or incomplete, please provide us with details and we will investigate and, where applicable, correct any inaccuracies. 

Right to restrict use of your personal information 

You have a right to ask us to restrict the processing of some or all of your personal information in the following situations:  if some information we hold on you isn’t right; we’re not lawfully allowed to use it; you need us to retain your information in order for you to establish, exercise or defend a legal claim; or you believe your privacy rights outweigh our legitimate interests to use your information for a particular purpose and you have objected to us doing so. 

Right to erasure of your personal information 

You may ask us to delete some or all of your personal information and in certain cases, and subject to certain exceptions, you have the right for this to be done. If we are unable to delete your information, we will explain why this is the case. 

Right for your personal information to be portable 

If we are processing your personal information (1) based on your consent, or in order to enter into or carry out a contract with you, and (2) the processing is being done by automated means, you may ask us to provide it to you or another service provider in a machine-readable format. 

Right to object to the use of your personal information 

If we are processing your personal information based on our legitimate interests or for scientific/historical research or statistics, you have a right to object to our use of your information. 

If we are processing your personal information for direct marketing purposes, and you wish to object, we will stop processing your information for these purposes as soon as reasonably  possible. 

If you want to exercise any of the above rights, please contact us on Admin team, CRIS Cancer Foundation by email to info@cricancer.org.uk.  We may be required to ask for further information and/or evidence of identity. We will endeavour to respond fully to all requests within one month of receipt of your request, however if we are unable to do so we will contact you with reasons for the delay. 

Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office (ICO). 

If you are unhappy with any aspect of how we are using your personal information we’d like to hear about it. We appreciate the opportunity this feedback gives us to learn and improve.  

You also have the right to lodge a complaint about any use of your information with the Information Commissioners Office, the UK data protection regulator. 

We may change this Privacy Policy from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on the CRIS Cancer Foundation Website or by contacting you directly. 

If you have any requests, questions, comments or suggestions, please let us know by contacting our team info@criscancer.org.uk or

CRIS Cancer Foundation also has a Data Protection Officer, who can be contacted at: 

The Data Protection Officer 

CRIS Cancer Foundation 

3A Harrington Road 

London 

SW7 3ES 

Email info@criscancer.org.uk