Privacy Notice
Introduction
Encephalitis International is a charity registered in England and Wales (1087843) and Scotland (SC048210) and a company limited by guarantee and registered in England and Wales (04189027). Encephalitis International’s office is at 32 Castlegate, Malton, North Yorkshire, YO17 7DT, UK.
Encephalitis International is committed to keeping your information secure and will process it in accordance with UK data protection law. This privacy notice provides information about how we process your personal information. By using our services and engaging with us, you agree to the information you provide being collected, used and disclosed in the manner set out in this privacy notice.
‘Personal information’ means any information that identifies an individual. As a user of our services, we may process the following types of information:
• Personal contact details such as name, address, phone number, email address, family relationship (e.g. father).
• Emergency contact details.
• Photographs and videos.
• Employment status and occupation.
• Age / Date of birth.
• Financial information such as bank account details.
• Geographic location such as country and town.
• Social media account information and profiles.
• Details of visits to our websites including pages accessed and links visited.
• Communication records with you such as emails, telephone, social media.
• Donation transactions and history.
• Fundraising and other event details.
• Device information when you visit our website such as IP address, operating system, location.
We also collect and process more sensitive information about individuals as part of our support service for users. This may include information such as:
• Information about your race, gender, ethnicity or religious beliefs.
• Information related to your health and wellbeing.
• Information with respect to criminal convictions and offences.
This is commonly referred to as “special category” information.
We process your personal and sometimes special data for several purposes:
• To communicate with you as a supporter and service user.
• To respond to your support enquiries, or requests for information.
• To provide you with the support services you have requested.
• To keep a record of any contacts we have with you, so we can help you with future requests.
• To improve and assist you with navigating our website.
• To administer donations made (and claiming Gift Aid, if applicable).
• To process sales from our online shop, manage orders and deliver items.
• To enrol you as a member of our organisation and manage your membership.
• To enable you to attend our events.
• To advertise our services on social media and other online platforms.
• To share your stories on our website, newsletters, and social media platforms for the purposes of support or awareness.
• For the purposes of statistical research.
• To enrol you has a fundraiser, donor or volunteer and manage this relationship.
• To personalise the look and feel of our website (as well as our communications with users) to fit personal preferences which you have told us about or which we have inferred from your usage of our website or derived from market research.
• To provide users of or services with fundraising related news stories, event information, and updates on campaigns or fundraising.
• To help us prevent fraud associated with online payments.
• To improve the service we offer – for example you may be asked to complete one of our online user satisfaction surveys.
• To process employment and volunteer applications.
As an organisation we rely on the following legal bases for processing your personal data:
• Where we have obtained your consent for processing.
• Where necessary to fulfil a contract for services with you.
• Where necessary to meet our legal obligations.
• Where it is in our legitimate interests and such activities do not override your rights and freedoms.
Should we rely on legitimate interest when processing your information, this will be for the purposes of fulfilling our charitable aims and supporting service users.
As an organisation we rely on legitimate interest to undertake the following activities:
1. Responding to enquiries from health and social care professionals.
2. Communicating and signposting service users to other voluntary organisations.
3. Engaging and communicating with corporate sponsors.
4. Submitting funding applications to Trusts and foundations.
5. Engaging and communicating with research organisations.
6. Monitoring visitors to our websites to understand their activities and make improvements.
7. To respond to enquiries made through social media platforms.
Special category data (sensitive types of personal data as defined in Article 9(1) of the GDPR) must be processed only in the line with one of the conditions specified in Article 9(2). We will ask for your explicit consent to record and process Special Categories of Personal Data.
Where you have consented to receive updates about our work, encephalitis, news and events, we may send communications through your preferred channels e.g. e-mail.
We ensure you can opt-out from receiving communications by clicking the ‘unsubscribe’ link included in our emails or at any time by contacting us at communications@encephalitis.info or by calling +44 (0)1653 692583.
The accuracy of users’ personal information is determined by that which you supply us. Encephalitis International is not responsible for errors or problems that arise because of inaccurate information provided by users. If you have opted to receive communications from us, we may contact you from time to time to ensure your information is up to date.
When you use a social media platform to communicate with us, please be aware of the risks associated with sharing your personal and sensitive data. It is important to understand that these platforms are beyond our control and users utilising them for communication with us are responsible for any associated risks. Please check the respective platforms privacy policy for details about how they process and protect your information.
We may pass your personal information to third-party service providers contracted to the Encephalitis International. This is strictly for the purposes of providing services to you or improving them.
The categories of organisations we share your information with includes:
• Banks and payment providers to facilitate donations and payments.
• Hosts who provision our website and online chat facilities.
• IT Infrastructure and support suppliers – to support our back-office processes.
• Telecom’s providers.
• Mobile application providers – To provide access to our mobile apps such as Braingames.
• Training providers – to facilitate education of users, trustees, volunteers, and employees.
• Survey providers – To allow us to conduct survey of our users and employees.
• Website analytics and optimisation providers.
• User relationship management platforms – to record and manage user details / interactions.
• HMRC – To meet our legal obligations with respect to Gift Aid and accounts.
• Research organisations - We collaborate with researchers and institutions in the encephalitis research field, and we may share anonymised data about the illness and its after-effects.
• Social media platforms – To share your stories and experiences.
• Law enforcement, regulators and other third parties where disclosure is legally required.
• Other service users where you have chosen to engage in such communications such as Connection Scheme.
We will not sell or rent your information to third parties for marketing purposes.
We may also share your personal information where you have consented to do so. E.g. Consent to share contact details with a legal or medical expert, consent to share your story with one of our partners.
The information we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA") to third-party suppliers. Examples of which include hosting and IT infrastructure suppliers based in the United States.
We will take all necessary steps to ensure your information is treated securely and in accordance with the Data Protection Act 2018.
We will only transfer your data to a recipient outside the EEA where we are permitted to do so by law and adequate safeguards are in place, for instance – using standard contractual clauses. We will always ensure that any transfer of your personal information complies with data protection laws.
For the transfer of special category data, we will obtain explicit consent to facilitate such transfers.
We are committed to protecting the personal information you entrust to us. While we take reasonable precautions to safeguard the personal information we collect, no system is impenetrable.
Unfortunately, sending information via e-mail is not completely secure; anything you send via this medium is done so at your own risk. Once received, we will secure your information in accordance with our procedures and controls.
The organisation implements security controls to prevent information about you being subject to loss, theft, misuse, unauthorised access, disclosure, alteration, and destruction. For example, we store the personal information you provide to us on computer systems that have limited access and are in controlled facilities. We also ensure that our third-party suppliers provide adequate security measures.
Please notify us of any changes to your personal information which you have provided to us. There is also a link on our website which you can use to change your details. www.encephalitis.info/communication-preferences
You also have the right to object to any of our methods of contact at any time by using unsubscribe option of any contact at any time. You can also do this by contacting us using the details below.
We will only keep your data for as long as required to provide services to you, meet our charitable aims and operate in accordance with any legal, tax and accounting requirements. Where your information is no longer required, we will ensure it is disposed of in a secure manner and, where required by applicable law we will notify you when such information has been disposed of. In some circumstances we may anonymise personal information so that it can no longer be related to you as an individual to facilitate our research and analysis.
Our website uses cookies (which includes third party cookies to support social media, personalisation and analytics functionality).
Cookies are small computer files which are downloaded onto your device and collect information about the way in which you navigate and use our website and the internet. Cookies do not collect information which allows us to identify individual users. The information provided by cookies helps us to provide you with a more personal experience and allows us to make improvements to our services over time. You may delete and block all cookies or decide to just block certain types of Cookies via your browser setting. However, if you choose to block or delete Cookies, this may affect the functionality of the website.
For more information, please refer to our separate Cookies Policy.
GDPR provides individuals with rights which can be exercised under the correct conditions. This includes:
• You have the right to request copies of the information we hold about you.
• If you think any of the personal information, we hold about you is inaccurate or incomplete, you may request its correction.
• You have the right to request the removal and erasure of your personal information.
• You have the right to object to the processing of your information where such activities rely on the legal basis of legitimate interest.
• You have the right to withdraw consent for processing activities which rely on this legal basis and mechanism.
• You have the right to the portability of your data, if you wish to transfer your data to another service provider you are entitled to make such a request.
• You have the right to object and restrict to processing activities under certain circumstances.
If you wish to exercise any of these rights, please contact us.
If you have a complaint about how we have handled your personal information you may contact us using the details below and we will investigate your complaint. If you are not satisfied with our response or are dissatisfied with our processing activities, you are entitled to make a complaint to the UK supervisory authority (The Information Commission). Who contact details can be obtained from there website https://ico.org.uk/
This Policy only applies to the Encephalitis International website. If you land on our site from other websites (or move to other sites from our website) you should read their separate privacy policies. We are not responsible for the privacy practices of external websites.
We keep this privacy notice under regular review and may update it from time to time. When updates occur, we will communicate these changes. To see the date this notice was issued please check the bottom of this notice.
The Data Protection Officer at Encephalitis International is the Director of Services. If you have any questions about this Policy, or would like to exercise your rights with respect to your personal information, please contact us via admin@encephalitis.info , +44(0)1653 692583 or write to Encephalitis International, 32 Castlegate, Malton, YO17 7DT, UK.
This document was reviewed on 19th July 2024.