Privacy Notice for Donors

We want to make sure that you feel confident about how your data will be collected and reasonably used as part of our charitable mission. If you have any questions about how we use your personal data or believe any of your rights have been infringed, please contact our Data Protection Officer by emailing dataprotection@nct.org.uk.

This privacy notice (v1.1) was updated July 2024.

Who we are

NCT is a registered charity (in England and Wales, no. 801395 and in Scotland, no. SC041592), and a company (in England and Wales, no.2370573). Our registered address is NCT, 27 Old Gloucester Street, London, WC1N 3AX.

We are registered with the Information Commissioner’s Office (ICO) as an organisation that collects and uses personal data.

Personal data we collect about you and how we obtain it

Personal data is information that can be used to identify you or another person. For example, if you donate money or register your information to receive news about our charitable mission, we will keep the information that you directly provide. This may include:

• Name;
• Contact details (which may include all or a combination of postal address, telephone numbers (landline and mobile) and email address);
• Financial details (e.g. credit or debit card information);
• Taxpayer status for claiming GiftAid;
• Information which helps us understand our relationship with you and your reasons for supporting NCT.

We may also receive information about you when you interact with third parties with whom we work. For example, where you’ve made a donation to us through a third-party website (e.g., Just Giving, Big Give or DonorBox) and given them permission to share your information with us.

How we use your personal data

It’s important to us that you receive the right level of communication, engagement and opportunities from NCT in accordance with your wishes.

We need your personal data to allow us to:

• Process your charitable donation in accordance with financial and other legislation;
• Thank you and share news of the impact of your donation
• Contact you with information about other opportunities to help new and expectant families.
• On occasion, we may undertake prospect research using publicly available information, alongside the information that you have provided, to understand whether there are further opportunities, services or news that may be of interest to you.
• Check that NCT can accept your donation as part of our Commercial and Charitable Activities Policy.
• To improve our fundraising activities and the services that we provide to parents. This could be done by looking at demographics as statistics, but will not identify you as an individual.

If our purposes of processing change

We will only use your personal data for the purposes set out above, unless we reasonably consider that we need to use it for another purpose that is compatible with the above. If we need to use your personal data for an unrelated purpose, we will always inform you about this and explain the lawful ground which allows us to do so.

The GDPR lawful grounds we rely on to collect and use your personal data

Consent

We will only collect your personal data for charitable donation purposes when you have given your consent. We always ask you to opt in to receive fundraising and donation related marketing from us. This may be at the point of donation or when signing up to other NCT activities such as Courses, Events, Membership or Volunteering.

You have the right to withdraw your consent at any time if you no longer wish us to process your personal data for donation purposes. Any processing of your data prior to your withdrawal of consent remains valid processing. When you withdraw your consent, we will no longer use your personal data and will delete your personal data if we there is no other lawful ground for us to continue processing your personal data.

Legal Obligation

As a national charity, we are required to comply with UK charitable law including regulations around the processing of donations and supporter information.

We may also be required to collect and use your data in order to deliver a service that you have requested, for example, providing information about an event that you have registered to attend or fulfilment of Membership services.

Data Sharing

On occasion, we may work with trusted third parties (such as the Royal Mail) to improve the quality of our data to improve your experience of engaging with NCT.

If you choose to donate or fundraise through third party sites (such as JustGiving, Big Give, Enthuse or Donorbox), those sites will share your information with NCT in accordance with your wishes. Depending on your choices, we may not be aware of any changes in circumstances expressed via a third party site. Please do contact fundraising@nct.org.uk directly if you would like to make any updates to your records or have any questions.

Data Processors

There may be times when we need to work with other trusted businesses to help us undertake our donation processes. These other businesses are known as “data processors” as they are acting on our behalf and under strict instruction from us on what they can and cannot do with the personal data.

When we do use other businesses to process personal data on our behalf, we always ensure we have appropriate UK GDPR compliant contracts in place with each one.

A data processor is not allowed to do anything with your personal data other than what we have instructed them to do with it. They will not share your personal data with any other business apart from us, unless they are required to do so by law. They will hold it securely and retain it for the period we instruct.

Transferring personal data outside of the UK

Sometimes it is not possible for us to process and store your personal data solely in the UK. When your personal data does need to be transferred or stored outside of the UK, we make sure we comply with the specific requirements set out in UK GDPR for us to undertake this. We will only transfer personal data outside of the UK when one of the following provisions are in place to safeguard your personal data:

• An “adequacy decision” is in place with the country where the personal data is being transferred to.
• An “appropriate safeguard” as set out in UK GDPR is in place. These include using Standard Contractual Clauses and the UK’s International Data Transfer Agreements.
• An “exception” as set out in UK GDPR can be relied on if there is no adequacy decision or appropriate safeguard in place. For example, we could rely on your explicit consent to make the transfer of personal data.

How long we keep your personal data

We keep donation records for 6 years plus the current financial year to comply with finance and tax legislation.

There may be times when we anonymise personal data, this means you can no longer be identified. We retain anonymized personal data for longer so that we can use it for long term trend analysis and reporting.

Your rights

Depending on the purpose and legal bases we rely on for processing your personal data, there are various rights available to you. You can:

• access the personal data we keep about you and be given specific information about the processing. This right always applies regardless of the processing activity we undertake.
• ask us to rectify personal data we hold about you that you think is inaccurate. This right always applies regardless of the processing activity we undertake.
• ask us to delete your personal data. This right only applies in specific circumstances.&
• ask us to restrict the processing of your personal data. This right only applies in specific circumstances apply.
• object to the processing when we have relied on the “legitimate interest” lawful ground to undertake the processing activity and you believe we have infringed your rights.
• transfer your personal data from us to another service provider or give it to you. This right only applies to personal data you have given to us and when the processing is based on your consent or contractual basis and the processing is automated.

We do not undertake any solely automated decision making, including profiling, about you.

To find out more about how to exercise your rights please refer to the guidance on the Information Commissioner’s Office website.

Who do I contact when I want to exercise one of my rights?

If you want to exercise one of your rights, please contact our Data Protection Officer by emailing dataprotection@nct.org.uk. We shall respond to a valid request within one month of receiving it.

Let's keep in touch

We want to keep in touch with you and make sure that your information is up to date. Please do let us know if there have been any changes by emailing enquiries@nct.org.uk.

How to make a complaint about us to the Information Commissioner’s Office

If you are not happy with how we are processing your personal data, or you believe we have not dealt with one of your rights correctly, you are entitled to make a complaint to the Information Commissioners Office (ICO). The ICO has several ways in which you can contact them, including post, email, and online forms. For full details of how to make a complaint please refer to their website.

Changes to our Privacy Notice

We keep our Donors Privacy Notice under review to ensure it remains accurate and up to date and we reserve the right to modify it at any time. We will notify you when the privacy notice is updated.