We (Work for Good Limited, company no: 09844955, registered office: Waggoners Wells Cottage, Waggoners Wells Lane, Grayshott, GU26 6DTW) have created this policy in order to demonstrate our commitment to preserving your privacy and safeguarding any personal details you provide to us, whether on this website www.workforgood.co.uk (“the Website”) or by another means. This policy explains how we collect and use your information.
We may update this policy from time to time without notice to you, so please check it regularly. If there are significant updates we will notify you where reasonably practicable to do so.
When will you need to provide your details?
We may collect personal information (for example your name, job title, address, e-mail address or telephone number) from you if you:
a) Register an account on the Website;
b) Make a donation to a charity through the Work for Good platform;
c) Subscribe to newsletters or updates;
d) Request information about Work for Good, including the service and the charities we support;
e) Are a customer of a participating business that is donating money to a charity through the Work for Good platform;
f) Contact us or become involved with us in another way.
Except where permitted by law, we will never collect special category (sensitive) data about you without your consent.
On each of your visits to our Website we may automatically collect the following information:
- technical information, including the Internet protocol (IP) address used to connect your computer to the internet, your login information, browser type, and version, time zone setting, browser plug-in types, and versions, operating system and platform; and
- information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our site (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page.
Why do we need your details and how do we use them?
There are different reasons why we might need your personal details. The main ones are:
- To build a Work for Good profile for your business, where customers and charities can see your activity. You have the option to suppress some of the data, including the donation amounts and the charity names, if you want to;
- To register your charity as a participating charity on the Work for Good platform;
- To track and administer donations to charities;
- To provide information to you and your customers about how your fundraising is going;
- To inform customers that the donation has been made;
- To allow charities who are registered with us to see how much money they’re raising;
- To provide email updates about Work for Good and your account;
- To improve our service by contacting you for feedback.
For the avoidance of doubt, we do not use personal data for automated decision-making which produces legal effects or similarly significantly affects individuals. This means that we will not use automated technology without any human intervention to make decisions about you which will then have a legal consequence for you.
Registering on Work for Good
In order to set up an account, we need to collect information about you, including your name, business or charity name, email address and telephone number. As part of this process, you’ll need to register a username and password in order to access your account.
In order to create a fundraising page, you’ll also need to tell us which charities or not-for-profit organisations you want to support, and how much you are seeking to raise. You can opt-out of setting a target amount and/or showing the supported charities on your page.
If you are registering on behalf of a business, you must ensure that the manager of the business agrees to you registering on Work for Good.
What lawful bases do we rely on to use your personal data?
Work for Good requires a legal basis to collect and use your personal data under data protection law. What this means is that we cannot legally process your data unless we can rely on one of the four reasons set out below. We rely upon four different legal bases, depending on how and why you provided us with your data. The four legal bases we rely on are:
1: It is within our legitimate interests:
We can legally collect and use your personal data if it is reasonably necessary for our “legitimate interests” or a third party’s legitimate interests (as long as the processing is fair, balanced and does not unduly impact your rights). “Legitimate interest” essentially means that we can show that we have an interest in processing your data, and that our interest is legitimate. We will rely on this ground to process your personal data when it is not practical or appropriate to ask for your consent, and where we are confident that this will not impact your rights.
Our legitimate interest is our interest in carrying out our mission of helping charities raise funds from purposeful and philanthropic businesses and generating publicity for Work for Good.
We will also rely on legitimate interests for the proper administration of Work for Good, and to manage our operations (for example, maintaining the Website/ Work for Good Platform, registrations, and appropriate records and databases).
When we process your personal data to achieve such legitimate interests, we consider and balance any potential impact on you (both positive and negative), and your rights under data protection law. We will not use your personal data for activities where our interests are overridden by the impact on you, for example where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law).
If you would like to change our use of your personal data in this way, please contact us using the details in the “How to contact us” section below.
2: It is necessary in connection with the performance of a contract with you:
Sometimes it is necessary to process your personal data so that we can enter into contractual relationships with you. For example, if you register with us to use our service as a business to donate to a charity, or as a charity to receive donations, we will need to process your personal data to allow this to happen and to enable us to meet our obligations under that contract.
3: It is necessary for compliance with a legal obligation to which we are subject:
This would include where we have to retain certain records, including financial records of donations and those relating to gift aid declarations.
4: You have provided your consent to us using your personal data for a specific purpose:
We will ask for your consent to use your personal data to send you electronic marketing communications by e-mail, such as updates and newsletters.
You always have the right to withdraw your consent at any time.
We will also take the bank details of participating charities to enable us to arrange onward payment of the donations.
Will you pass my information on to other organisations or individuals?
We will not sell your personal information, and we will not pass your personal information to any third parties except in the circumstances set out in this policy.
We will share the name of your company and the contact details of your business with the charities that you will be donating money to, as those charities need to know this to comply with their own fundraising rules and procedures, including monitoring any fundraising activity and complaints. Please note that charities may contact you directly about this.
Where you have provided consent, we will also share your name and contact details with the charity/charities that you have donated to so that they can contact you about your donation and their work in the future (including direct marketing and fundraising communications). Once we have passed your data to the charity, it will be the charity’s responsibility to manage or update your communication preferences and so you will need to get in contact with the charity directly if you wish to opt-out of communications from them.
Where you have provided consent, the charity will also be able to claim Gift Aid on your donation. As the Participating Business, you are solely responsible for ensuring that you are eligible to make a Gift Aid declaration.
On occasion, we may need to use other companies to process your data on our behalf for the purposes for which you have provided it to us. If we do this, we will not give those individuals or organisations any rights to use your personal information (or to contact you) except in accordance with our instructions.
The only times we will pass your details to anyone else would be:
- To enable payment providers to complete transactions;
- To organisations within the payment card industry in order to prevent online fraud;
- Where we are required to do so by any law or court order.
We may also merge or partner with other organisations and in so doing, acquire or transfer personal data but your personal data would continue to be used for the purposes set out above.
We will not pass your details to any third parties for marketing purposes, other than where you have consented to receive marketing from relevant charities.
How long will we keep this information about you?
We will only keep information about you for as long as we need to. We make sure that any companies which process your data on our behalf do the same.
The length of time may depend on the reason for which we are processing the data and the type of data being processed. Generally, we will retain data on our users for a period of 7 years after the last interaction with the user, or when a donation was made. This is to ensure that we have proper records and a clear audit trail. We will carefully and securely dispose of any data after the retention period has expired.
In the event that you ask us to stop sending you marketing communications, we will retain certain details, such as your name, to help us ensure that you are not contacted again. If you ask us to destroy your data, we will usually do so within 30 days, where we are able to do so and we do not need to hold the information for our records.
How do we keep your information secure?
Work for Good takes the security of our users’ data very seriously. We are committed to protecting your information from misuse, loss, disclosure or unauthorised access and have security measures in place to prevent this. We use a firewall, intrusion detection software and encryption to ensure user data is kept as secure as possible. Our hosting provider also employs physical security policies to prevent physical access to our data centres and we perform regular system patching.
We make no representations about any other websites, and when you access any other website through a link on our website (including social media sites); you understand that it is independent from us and that we have no control over that website or the way your personal information is collected through those websites. Those websites may have their own privacy policies and we encourage you to look at those policies or contact the website operators directly to understand how your personal information is used.
Your rights in relation to your information
Right to restrict processing
In certain circumstances you have a right to require us to stop processing your personal data in a particular way.
Right to erasure
You have the right to request that your personal data is erased from our database in certain circumstances.
Right of access
You have a right to ask for a copy of the personal data we hold about you. If you want to access your personal data, please send a description of the personal data you want to see and proof of your identity by e-mail to firstname.lastname@example.org
Right to rectification
We also want to make sure that your personal data is accurate and up to date. Please let us know if your details change. You may also ask us to correct or remove personal data which is inaccurate.
Right to object
You can also opt-out of receiving all or some of our marketing communications or request that we stop processing personal data about you for certain purposes at any time by contacting us using the details below.
Right to data portability
In certain circumstances you have a right to data portability which means we will provide you (or a third party you nominate) with your personal data in a structured, commonly used and machine-readable format.
Please note that you may only use/ benefit from some of these rights in limited circumstances. For more information, we suggest that you consult guidance from the Information Commissioner’s Office (ICO) – https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.
For more information or to exercise any of these rights, please contact us on email@example.com.
Where is my information stored?
The data that we collect from you will primarily be stored in the UK.
When providing payment details through the Stripe payment service, those details may be transferred outside of the European Economic Area ("EEA") to its US headquarters. Stripe uses the EU Commission’s Standard Contractual Clauses which means that data from the UK/ Europe can be lawfully transferred to it. More information about this transfer can be found here: https://stripe.com/privacy-center/legal#data-transfers
If you are unhappy with the way in which we have handled your personal data please contact us using the details below. You are also entitled to make a complaint to the Information Commissioner’s Office. For further information see the Information Commissioner’s guidance here https://ico.org.uk/for-the-public/personal-information.
How to contact us
If you would like further information on how your information is used, how we keep your information secure, how you can exercise your data rights as listed above, or have provided your details but have now decided that you no longer want to receive information from us, please email us at firstname.lastname@example.org.