Fundraise for the Mace Foundation

Fair Processing Notice

At Mace Foundation we are committed to protecting and respecting your privacy. This fair processing notice sets out how we collect and use information about you. Please read this fair processing notice carefully to understand your rights and practices regarding your personal data.

For the purpose of data protection legislation, the data controller responsible for the processing of your personal data as set out in this fair processing notice is Mace Foundation of 155 Moorgate, London EX2M 6XB. Mace Foundation is a charity, registered with the Charity Commission, with charity number 1150134.

This notice is overseen by the Data Protection Compliance Manager (“DPCM”). If you have any queries, complaints or requests please contact the DPCM at gdpr@macegroup.com or 020 3522 3081.

It is important that you read this fair processing together with any other fair processing notice or privacy policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This fair processing notice supplements other notices and privacy policies and is not intended to override them.

This notice was last changed in February 2023.

What information do we collect from you?
Why do we collect this information?
How long do we keep hold of your information?
Automated decision making
Who might we share your information with?
How is your data stored and kept secure?

International data transfers

What are your rights?
How can you access information we hold about you?
What we ask of you
Definitions
Changes to this Policy
Contact Us

What information do we collect from you?

Personal data means any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier, such identifiers including name, identification number, location data or online identifier.

Special categories of personal data includes data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

We will collect and process the following data about you:

Information you give us. This is information about you that you give us directly. You may do this by filling in forms or by corresponding with us by phone, email or otherwise.
Information we collect throughout our relationship. Where you donate to Mace Foundation or otherwise take part in a Mace Foundation event, campaign or activity, we may collect personal data relating to you. We may collect your personal data from third party payment platforms in connection with donations that you make to us. Those may include Just Giving, Easyfundraising, Payroll Giving, Stripe, Funraisin or PayPal depending on how you donate to us.
The type of information we collect. This may include, but is not limited to the following:

Contact details – address, telephone number, mobile telephone number, email address, emergency contact details.
Trustee related information – data relating to the suitability to act as trustee including conflict information where appropriate.
Information required when you take part in a Mace Foundation event – your date of birth, information about your fundraising goals including the amount you wish to raise, what you will be doing to fundraise for the Mace Foundation, why you are participating in our events and where relevant, location data, and information about how you found out about the event.
Information about your health – including any medical condition, where you take part in an activity that may require us to collect that information.
Information about donations – you may make to use, including any identification information or associated financial information that may be required in respect of that.
Spouse and dependent information – next of kin and family contact details.
Other data which you may choose to give us or which we may notify you of from time to time.

Why do we collect this information?

We use this information in the following ways:

Information you give to us and that we collect. We process your personal data for the following reasons:

Pursuant to any contract you may have with us in order to:

Administer your trusteeship;
Provide you with any assistance or services that you may have requested from us, including in respect of any event that you may wish to take part in or run on our behalf;

To comply with legal requirements relating to:

the appointment and functions of trustees;
complying with mandatory reporting obligations and other legal requirements (e.g., under tax, health and safety and anti-discrimination laws) and disclosures required by law enforcement agencies;
comply with any requirement or request of our regulators, including the Charity Commission.

In our legitimate interest for the purpose of:

providing assistance to you and communicating with you in respect of any donation that you may make;
providing assistance to you and communicating with you in respect of any event you may wish to take part in or run on our behalf;
monitoring and enforcing compliance with Mace Foundation policies and procedures and applicable law;
carrying out and reviewing surveys and communicating with you generally in our legitimate interest for improving Mace Foundation and the workplace;
for our legitimate interest in respect of litigation, including bringing or defending legal claims; and
accounting and financial planning purposes.

We may also process data on the basis of your consent. Where we do so we will inform you and seek your consent at the time that we collect your data.

Photographs. You may be included in images (including digital media and video) taken by Mace Foundation. These images may be used in our legitimate interests, as part of internal communications, promotional materials, social media or newsletters, use on an online profile.

Marketing. We may also use your data for marketing purposes such as case studies, testimonials, or in fundraising materials. In most circumstances we would obtain your consent.

Information about your health is a type of special category personal data. Where we process any special categories of personal data, we are required under the data protection law to have an additional ‘condition’. We will process your health data in connection with fundraising events that you participate in. Where we do this, we will rely on one of the following conditions:

On the basis of your explicit consent; or
Where the processing is necessary in in connection with any legal claims.

We may inform you of additional purposes for processing your information when that information is collected from you.

How long do we keep hold of your information?

We only store your information for as long as is required for the purpose it was collected. For most information, this will be for a short time after a donation has been made or an event has taken place.

If you are a Mace Foundation trustee, we will keep your information for the length of your trusteeship and then for a period of 6 years thereafter.

We may also be required to keep some information, including about donations made, for longer in order to comply with our legal and regulatory obligations.

For more detailed information on our data retention periods, please contact DPCM at gdpr@macegroup.com or 020 3522 3081.

Who might we share your information with?

Where information is shared with third parties we will only share the information required for the purpose it is being shared.

For the purposes set out in the ‘Why do we collect this information?’ section above, we may share your personal information with data processors who process personal data on our behalf as set out below.

Service providers including event management companies, and IT service providers such as website hosting providers.

Companies in the Mace Group who process personal data on our behalf.

Some third parties receiving your personal data from us can be data controllers, which means that they are responsible for the personal data that they process for their own purposes. That processing of your personal data is subject to their privacy policy, that you can find by contacting them. We may also share your personal data with third party data controllers as set out below.

With our charity partners including our charity of the year and strategic partners.

As part of our regulatory requirements, to our regulators, including the Charity Commission.
With third parties who carry out audits within our organisation;

Any trustees of Mace Foundation;

Companies in the Mace Group who process your personal data for their own purposes.

In the course of business, to other organisations and individuals as required in relation to your role and duties.
In the event that we sell or buy any business or assets or receive investment, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets or with any investor.
To third parties when it is necessary for the establishment, exercise or defence of legal claims.
If we choose to exercise a legal power to do so.
If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply contractual terms or other agreements; or to protect the rights, property, or safety of ourselves, our customers, our regulator, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and prevention of money laundering and credit risk reduction.

How is your data stored and kept secure?

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from the DPCM.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

International transfers

Due to the way that Mace Foundation operates, Mace Foundation may be subject to (i) the United Kingdom General Data Protection Regulation (“UK GDPR”) or (ii) the European Union General Data Protection Regulation (“EU GDPR”).

Where the UK GDPR applies

We may share your personal data with the Mace Group. This may involve transferring your personal data outside the UK. We share personal data with the Mace Group on the basis of model contractual clauses which have been approved by the UK Government.

We may also transfer your personal data outside the UK to other third parties. We will only do so if adequate protection measures are in place in compliance with the applicable data protection laws. We use the following protection measures:

transferring to countries that have been deemed to provide an adequate level of protection;
using approved model contractual clauses; or
transferring when one or more of the conditions set out in Article 49 UK GDPR are met.

Where the EU GDPR applies

We may share your personal data with the Mace Group. This may involve transferring your personal data outside the European Economic Area (“EEA”). We share personal data with the Mace Group on the basis of model contractual clauses which have been approved by the European Commission.

We may also transfer your personal data outside the EEA to other third parties. We will only do so if adequate protection measures are in place in compliance with the applicable data protection laws. We use the following protection measures:

transferring to countries that have been deemed to provide an adequate level of protection;
using approved model contractual clauses; or
transferring when one or more of the conditions set out in Article 49 EU GDPR are met.

What are your rights?

You have the following rights. You can exercise these rights at any time by contacting the DPCM. You can make a subject access request verbally or in writing. In order to deal with your request effectively, it would be helpful if you could contact the DPCM in the first instance. The DPCM may be contacted in the following ways:

By post:

DPCM (Legal Department), Mace Ltd., 155 Moorgate, London EC2M 6XB

By email:

gdpr@macegroup.com

By telephone:

+44 (0)20 3522 3081

You have the right:

to ask us not to process your personal data for marketing purposes;
to ask us not to process your personal data where it is processed on the basis of legitimate interests provided that there are no compelling reasons for that processing;
where processing of your personal data is based on consent, to withdraw that consent at any time.
to request from us access to personal information held about you;
to ask for the information we hold about you to be rectified if it is inaccurate or incomplete;
to ask for data to be erased provided that the personal data is no longer necessary for the purposes for which it was collected, you withdraw consent (if the legal basis for processing is consent), you exercise your right to object, set out below, and there are no overriding legitimate ground for processing, the data is unlawfully processed, the data needs to be erased to comply with a legal obligation;
to ask for the processing of that information to be restricted if the accuracy of that data is contested, the processing is unlawful, the personal data is no longer necessary for the purposes for which it was collected, or you exercise your right to object (pending verification of whether there are legitimate grounds for processing); or
to ask for data portability if the processing is carried out by automated means and the legal basis for processing is consent or contract.

Should you have any issues, concerns or problems in relation to your data, or wish to notify us of data which is inaccurate, please let us know by contacting us using the contact details above. In the event that you are not satisfied with our processing of your personal data, you have the right to lodge a complaint with the relevant supervisory authority, which is the Information Commissioner’s Office (ICO) in the UK, at any time. The ICO’s contact details are available here: https:// ico.org.uk/concerns/.

What we ask of you

Keeping your information accurate and up to date. If your information changes for any reason, for example if you change your name, address or bank, then you should inform us of the change as soon as possible so that we can ensure your information is kept accurate and up to date.
Personal data that you provide about another person. If you provide us with information about another person, for example, about your dependents, next of kin or emergency contacts, you confirm that you have informed them of our identity, the purposes for which their personal data will be processed (e.g. for emergency contacts or benefits purposes) and that you have obtained their permission to such processing.

Changes to our privacy policy

This policy may be updated from time to time. Please check this page on our website for any changes.

Contact us

Questions, comments and requests regarding this privacy policy are welcomed and, if applicable, should be addressed to your line manager in the first instance. If you still have queries or concerns or if, where applicable, you are not comfortable discussing with your line manager then you can contact the DPCM at gdpr@macegroup.com or 020 3522 3081.

Classification: Public
Date: February 2023

Privacy Policy