ECPAT UK takes your privacy and the security of your information very seriously and views secure personal data protection as its social responsibility.

ECPAT UK is a charity registered in England and Wales with company number 05061385 and charity registration number 1104948. ECPAT UK is registered with the Information Commissioner for the United Kingdom and is the responsible party when it comes to processing your personal data under applicable data protection laws. 

Please read the following carefully to understand ECPAT UK's views and practices regarding your personal data.

1. How we use your Personal Data
   This privacy notice (“Privacy Policy”) governs how we use, protect and safeguard your personal information as defined by applicable local data protection or privacy laws and regulations (“Personal Data”).

We collect and process Personal Data about, inter alia, our donors, our supporters, our staff, individuals who are interested in our activities, legal persons and organisations who participate in and run our projects, courses and programmes, and individuals (including students) who take part in our projects, courses and programmes (together the “Data Subjects” or “you”).

2. What Personal Data may we collect from you?
   When you contact ECPAT UK regarding our activities, register as a supporter, send or receive information, attend one of our training courses or make a donation to us, you may provide us with Personal Data, including details such as your name, email address, postal address, telephone or mobile number, bank account details to process donations and whether you are a tax payer so that we can claim Gift Aid.

 We may collect Personal Data that you provide when you interact with us such as when you:

• subscribe to our newsletters and emails;
• donate or purchase one of our training programmes or e-learning courses;
• participate in our events and campaigns;
• contact us (e.g. via phone, email, letter) and subsequently correspond with us;
• apply for a job vacancy or volunteering opportunity with us;

 We collect Personal Data about you from the following sources:

• your subscription and donation history;
• your social media interactions with us (e.g. if you react to something you see on our social media platforms, whether through a “like”, “share” or comment);
• your visit and use of our website;
• technical information such as your IP address or the length of visits on our websites;
  
  

Social media

We may also use your email address to match to your account on Facebook or other social media sites to show you ECPAT UK content while using these services. We only do this where you have opted in to receiving marketing emails from us and we keep your data secure.

We may interact with you through our social media platforms as necessary for our legitimate interests to expand and retain our donor database and promote our activities and programmes via social media.

There are two ways to prevent this use of your data, you can either update your preferences regarding ECPAT UK by opting out of the relevant channel of communication or you can do this via the social media site:

Facebook: https://www.facebook.com/help/568137493302217
[LinkedIn: https://www.linkedin.com/help/linkedin/answer/62931
Twitter: https://business.twitter.com/en/help/troubleshooting/how-twitter-ads-work.html
Instagram: https://www.instagram.com/ecpatuk/  
Youtube: https://www.youtube.com/user/ECPATUK
Vimeo: https://vimeo.com/ecpatuk

Updating your preferences with ECPAT UK will not guarantee that you never see ECPAT UK content on social media, since the social media site may select to show you such content based on other criteria and without your data having been provided by ECPAT UK.

Sensitive Personal Data

When you successfully apply for a course or activity we may ask for information about your health, which is included as a “special category of personal data” under applicable data protection laws, and is more commonly referred to as “sensitive data”. We collect and process this sensitive data in order to ensure that we supply appropriate facilities and support during the course of your mission with us, and to ensure that our staff are prepared to respond to incidents appropriately. Clear notices will be given when sensitive data is collected. All sensitive data that we collect is stored securely, to which only relevant staff have access on a need-to-know basis. Any sensitive data collected is deleted when no longer relevant.

In the case of an incident where it is in the person’s vital interests for us to share sensitive data, for example with a hospital, we may share such sensitive data. Clear information on this processing activity will be available if you join one of our courses or activities.

We record photographs, audio and video which may be Personal Data under applicable data protection laws.

Financial information
In order to process financial transactions, we may ask you for your bank or credit card details, as well as a valid form of identification. We currently have an online transaction system on our website where you can purchase one of our training courses. Our website may also direct you to other websites that will process financial transactions, including JustGiving through which you can contribute to us, and Virtual College, through which you can register for our e-learning courses. For further information on their privacy policies, please go to https://www.justgiving.com/info/privacy-policy-versions/privacy-policy-v22 and https://www.virtual-college.co.uk/privacy-policy, respectively.

3. Purposes and Legal Grounds

When you supply information such as your name or email address to us, we are legally obliged to ensure that we only use this information for the purpose for which it was requested, and to ensure that it is kept securely. To comply with applicable data protection laws, we must have a legal justification for collecting and using your Personal Data.

The legal basis that we rely on will depend upon the circumstances in which we collect and use your Personal Data. In almost all cases, our processing will fall into one of the following categories:

Where you have provided your consent to allow us to use your Personal data in a certain way, we may:             

• Send you ECPAT UK newsletters, you may opt-out at any time, free of charge (see section 4 below for further information). 
• Process some of your Personal Data when you sign up to certain events such as the London Marathon or contribute to us via fundraising sites like JustGiving, so that we can record the money you raise. These independent third parties will pass your Personal Data to us. We will respect whether you opt-in or out of communications from us.

Where the processing of your Personal Data is necessary to carry out the performance of a contract with you, or necessary to take steps at your request prior to entering into a contract with you, we may:

• Take event, training programme or e-learning course bookings.
• Process donations and volunteering applications.
• Respond to your enquiries and complaints.
• Record correspondence in our database.
• Process job applications.
• Where the processing of your Personal Data is necessary to carry out the performance of a contract with you or, where applicable, it is necessary to protect your vital interest in the context of an incident, we may:
• Collect and process your sensitive data but only where you have given your explicit consent for us to do so.

Where the processing of your Personal Data is necessary for us to comply with a legal obligation to which we are subject, such as:

• Claiming Gift Aid on donations.
• Our legal duty to maintain accurate information and keep financial records for auditing purposes.
• Our legal duty to maintain participant Personal Data for insurance purposes.
• Our legal duty of care to our participants on ECPAT UK facilitated courses, experiences etc.
• Our legal duty to maintain an up-to-date suppression list to ensure that we do not contact you where you have asked us not to.
• Responding to or addressing enquiries or requests from law enforcement bodies, regulators or other public authorities.

Where the processing of your Personal Data is necessary for us to pursue our legitimate interests, such as our legitimate interest to:

• Contact you to raise funds and achieve our objective of protecting the rights of children.
• Show you content we think you will be most interested in.
• Establish and maintain a relationship with you, which is tailored to your needs.
• Constantly improve our activities and programmes through feedback and market research, including through internal reporting and analysis and sending you user experience surveys.
• Expand and retain our donor database and promote our programmes and activities via social media.

Where it is necessary for us to pursue our legitimate interests as listed above, we may:

• Send you information about ECPAT UK, our supporters and beneficiaries, and activities you can be involved in. You may opt-out at any time, free of charge.
• Show you content that is relevant and appropriate to your interests. You may opt-out at any time, free of charge.
• Ask you for feedback on activities and programmes in which you have participated in order to help us with market research and improving our operations.
• Thank you and inform you of the impact your donation has made.
• Record correspondence in our database, and keep relevant information for people who have informed us they do not wish to be contacted, so that we ensure we do not send unwanted information.
• Collect Personal Data about you from social media sources (as listed above), and interact with you on social media platforms.

Any processing of your Personal Data on the grounds of legitimate interest is done only after a thorough assessment of our legitimate interest relied upon against your privacy rights, and we will seek to carefully balance our legitimate interest against your rights to ensure that our processing is proportionate.

4. What are your choices regarding our communications with you?
   If you indicated that you are interested in receiving regular information about ECPAT UK’s work we will send you communications either electronically or otherwise. In order to continue receiving these communications, you must authorize ECPAT UK to send them by confirming your full consent in a follow-up communication (i.e. email from ECPAT UK or form where you will be instructed to tick a box).

In addition, we may send you direct mail that we feel may be of interest to you if to do so is in accordance with our legitimate interests as outlined above, including details of other ECPAT UK services and products which may be of interest to you and to which you may wish to subscribe. We may also offer you the opportunity to participate in surveys carried out by ECPAT UK or its agents which help our research into the types of service we offer. ECPAT UK will keep a record of your choices up-to-date. You may opt-out of any of these communications at any time, free of charge.

ECPAT UK will not sell or rent supporter information to anyone. From time to time, we agree with other like-minded organisations to write to some of each other's supporters, for the mutual benefit of both. Before sharing your Personal Data with any such organisation, ECPAT UK will ask again for your full and informed consent.

If you do not wish to receive further communications of a particular type or no longer wish ECPAT UK to contact you at all please contact us as indicated below (Contact Us). We will always respect your privacy and any personal communication between you and ourselves.

5. Will we disclose Personal Data to outside parties?
   ECPAT UK may need to make your Personal Data available to trusted third parties for services to be provided to you, for example, when we contract out some of our services or functions. Please note that any information you provide to ECPAT UK will never be supplied to third parties without first obtaining your consent. If you consent to the use of your information in such a way we will not authorise such third parties to use your Personal Data in any other way and will require them to protect your Personal Data to the same degree that we do.

We have a legal duty to ensure that we hold up-to-date Personal Data about our supporters (e.g. if you move to a new house, we have a duty to remove your old address). From time to time we will ask a trusted third party to ‘clean’ the data that we have for our supporters. This means that our trusted supplier will use records that are in the public domain such as the Postcode Address File and registers of people deceased to remove out-of-date Personal Data. 

In certain circumstances, we may be required to disclose or share your Personal Data in order to comply with a legal or regulatory obligation (for example, we may be required to disclose Personal Data to the police, regulators, government agencies or to judicial or administrative authorities). We may also disclose your Personal Data to third parties where disclosure is both legally permissible and necessary to protect or defend our rights, for matters of national security or law enforcement, to enforce our contracts or to protect your rights or those of the public.

When you successfully apply for a programme or activity we may ask for information about your health, allergies and dietary requirements. We share this sensitive data with only our contracted facilitators and accommodation facilities.

We require third parties (including other members of the ECPAT International network) with whom we may share your Personal Data to protect the confidentiality of such Personal Data and to use such Personal Data only for the purposes for which we disclose the Personal Data to them. We also have appropriate agreements in place with these third party individuals to provide assurance that they will comply with their duty of confidentiality and will keep your Personal Data secure in accordance with applicable data protection laws.

Personal Data may be transferred to entities situated or operating in territories outside of the European Economic Area (“EEA”) and the United Kingdom, including any territory which does not offer a level of protection for the rights and freedoms of Data Subjects which is equivalent to the data protection standards afforded by applicable data protection laws. Where such transfers occur, these will be done in compliance with applicable data protection laws, such as pursuant to the European Commission’s model clauses or any other valid data transfer mechanism. The Data Subjects have a right to request copies of the relevant document for enabling the Personal Data transfers towards such countries by requesting such copies from ECPAT UK using the address indicated below (Contact Us).

6. How long do we hold your Personal Data?

We will hold your Personal Data only for as long as is necessary for the purpose for which such Personal Data was collected and to the extent permitted by applicable laws. When we no longer need to use your Personal Data, we will remove it from our systems and records or take steps to anonymise it so that it is no longer linked to your Personal Data (unless we are required to keep the Personal Data to comply with our obligations under applicable law).

7. Aggregated Data

As a charity, ECPAT UK relies on funding from generous donors and trusts. We may share aggregated and anonymised data about our community to prove our impact and show why funders should choose us. This is no longer linked to any Personal Data that can identify you or any individual person.

We may also analyse aggregated and anonymised data about our community to help us improve our operations. This is no longer linked to any Personal Data that can identify you or any individual person.

8. Children's data

Children need particular protection when we collect and process their Personal Data because they may be less aware of the risks involved. We have thought about the need to protect them when designing our systems and processes. Compliance with the data protection principles set out in applicable law (and in particular fairness) is central to all our processing of children’s Personal Data.

When children register with us as a supporter, join our campaigns or subscribe to our services, they must be over the legal age of majority set out in applicable data protection laws (e.g. 13 in the UK) and confirm that any information they provide to us about them upon registration or at any time is accurate. If you are under this legal age, you must have obtained your parent's or legal guardian's permission before providing ECPAT UK with such information. Children under this legal age must not provide us with Personal Data without this permission.

9. Do we use cookies?
   The ECPAT UK website does not automatically capture or store Personal Data from visitors to the site, other than to log the user's IP address and session information such as the duration of the visit to the site and the nature of the browser used. This information is used only for administration of the site system and in the compilation of statistics used by ECPAT UK to assess the use of the site.

You can manage cookies through your computer browsers, smartphones and other web-enabled devices. If you wish to amend your cookie preferences for this website or any other websites, you can do this through your browser settings. Your browser’s ‘help’ function will tell you how to do this. If you do not want the benefit of cookies, there is a simple procedure to manually delete your cookies. Visit http://www.allaboutcookies.org/manage-cookies/stop-cookies-installed.html to see this.

However, please remember that cookies are often used to enable and improve certain functions on our website. If you choose to switch certain cookies off, it is likely to affect how our website works.

10. Confidentiality and security
    We have implemented technical and organisational security measures to safeguard the Personal Data in our custody and control. Such measures include, for example, limiting access to Personal Data only to employees and authorised service providers who need to know such information for the purposes described in this Privacy Policy, as well as other administrative, technical and physical safeguards.

However, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we strive to protect your Personal Data, ECPAT UK cannot ensure or warrant the security of any information you transmit to us electronically, and you do so at your own risk. Once we receive your transmission, we make our best effort to ensure its security on our systems, including by limiting access only to employees and trusted service providers who need access to such Personal Data for the purposes described in this Privacy Policy.

We cannot be held responsible for the privacy of data collected by websites not owned or managed by ECPAT UK.

11. What are your rights concerning the Personal Data you provide to ECPAT UK?

Subject access request

You may request a copy of the Personal Data relating to you which is kept on file by ECPAT UK and, provided that we were able to verify your identity, we will provide you with such Personal Data in a timely manner and free of charge.

Right to correct or update the information

Should your personal details change, please help us to keep your information up to date by contacting us using the details below (Contact Us). In addition, if you find that any of your Personal Data we hold is incorrect or incomplete, please notify ECPAT UK and the necessary corrections will be made in a timely manner.

Right to rescind consent

You have the right to withdraw consent to our processing of your Personal Data at any time, free of charge. This includes cases where you wish to opt out from marketing messages that you receive from us as set out in this Privacy Policy.

Right to be forgotten

You may have Personal Data effectively erased when that information is no longer necessary for its initial purpose and when you have clearly rescinded previously given consent. However, we are not obliged to erase the Personal Data if we need to retain it in order to comply with a legal obligation or to establish, exercise or defend legal claims.

Right to restrict

You have the right to restrict our processing of your Personal Data where you believe that Personal Data is inaccurate, that our processing is unlawful, or that we no longer need to process the Personal Data for a particular purpose unless we need to retain it to comply with a legal or other obligation or because you do not want us to delete it.

Right to data portability

You have the right to obtain the Personal Data we hold about you in a structured, electronic format and to transmit the Personal Data to another controller where this is: (a) Personal Data that you have provided to us; and (b) we are processing that data on the basis of your consent or to perform a contract with you.

Right to object to processing based on legitimate interests

Where our legal ground for processing your Personal Data is our legitimate interest, you have the right to object to our processing on grounds relating to your particular situation. We will comply with your request unless we have compelling legitimate grounds for the processing which override your interests and rights, or if we have to continue to process the Personal Data for the establishment, exercise or defence of a legal claim.

Please note that these rights are not exercisable in all circumstances. For example, Personal Data might not have to be erased if it is needed in the interests of public health, or to support legal claims, compliance and scientific or historical research.

You may exercise any of the above rights by contacting us as indicated below at 'Contact Us'.

For more information about these rights, please read the guidance issued by the Information Commissioner’s Office. If you believe that we have not complied with applicable data protection laws, you may also contact the Information Commissioner’s Office to lodge a complaint on 0303 123 1113 or visit https://ico.org.uk/concerns/.

12. Notification of change of Privacy Policy
    ECPAT UK reserves the right to amend this Privacy Policy. You are advised to visit this website section periodically in order to keep up to date with the changes in our Privacy Policy. However, we will notify you of any material changes to this Privacy Policy by way of a prominent notice on our website. If at any point we decide to use Personal Data in a manner different from that stated at the time it was collected, we will notify you by way of an email. Users will have a choice as to whether we use their Personal Data in this different manner.
13. Contact Us

If you have any questions, comments, or concerns regarding our Privacy Policy, please contact us as follows:

• by post: Attn CEO
               ECPAT UK
               81A Endell Street
               London
               WC2H 9DX

• by email: [email protected]