UK for UNHCR Privacy Notice

United Kingdom for UNHCR is dedicated to raising funds and awareness to help protect forcibly displaced people around the world. The funds we raise support the humanitarian work of the United Nations High Commissioner for Refugees (UNHCR).

United Kingdom for UNHCR is a charitable incorporated organisation with its principal office in England at WeWork, 1 Mark Square, London EC2A 4EG

We are regulated by the Charity Commission (England and Wales) and our charity registration number is 1183415. We are registered with the Information Commissioner’s Office (ICO) and our registration number is ZB230695. 

We are also an approved member of the Fundraising Regulator and signatory to its code of conduct, as well as a member of the Institute of Fundraising.

In technical terms, personal data is any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.

In simpler terms, personal data is any information about you that enables you to be identified.

Personal data covers obvious information, such as your name, contact details, donation history, event attendance, but it also covers information, such as identification numbers, electronic location data, and other online identifiers.

Without collecting data, our charitable activities would not be able to operate. At the same time, we ensure that any personal data we collect is protected and remains private.

To support our fundraising and UNHCR’s humanitarian work, there are several categories of personal data we may need to collect:

• Identity data: such as your title, name, surname, date of birth
• Contact data: such as your phone number, postal address, email address
• Financial data: such as credit card details, bank account numbers, UK tax payer status
• Technical data: such as cookies and how you use our website
• Marketing data: such as your personal preference on how you would like us to contact you
• Other necessary data: such as data legally required from our employees and volunteers, such as proof of right to work, or emergency contact details

To ensure accuracy, we may amend the data we collect. This is to correct apparent errors that would otherwise render your data incompatible with the purpose for which it was provided. For example, we may amend an incorrectly formatted postal address or a typo in an email domain.

We only use your personal data where we have a legal basis for doing so. How we use your data depends on the purpose for which you provide it to us: 

• To accept and process your requests to make one-off or regular donations
• To manage Gift Aid in line with your donation
• To keep you updated on how your donation has been used, to update you on UNHCR’s work around the world, our appeals and our advocacy for the refugee cause 
• To update you on UNHCR’s work around the world, our appeals and our advocacy for the refugee cause
• To respond to requests you make of us, such as updating your personal details, contact preferences or requests for information about our work
• To let you know about our events and send you details when you have registered to attend
• To maintain your details if you have registered an interest in leaving a legacy gift to support UNHCR’s work
• To maintain your personal contact details if you represent a trust, foundation, corporate or any other organisation in communication or partnership with us
• To respond promptly to any feedback or complaints
• To manage job applications and our staff and volunteers, including payroll, training and development
• To manage and improve our website by analysing how you use it, when you have consented to relevant cookies
• To let you know about opportunities to feed back on our work and your support, such as surveys and research you may wish to contribute to
• To maintain our records and ensure your details and contact preferences remain up to date
• To deliver online advertising that is in line with your interests, such as emergency appeals, and in line with your preferences
• For business practices such as financial accounting, record keeping, regulatory and other legal obligation

You will not be sent any unlawful marketing or spam. We will always work to fully protect your rights and comply with our obligations under UK data protection legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003, and you always have the opportunity to opt-out. 

We will only use your personal data for the purpose for which it was originally collected unless we reasonably believe that another purpose is compatible with that. If we do use your personal data in this way and you wish us to explain how the new purpose is compatible, please contact our Supporter Care team and we are happy to assist. 

If we need to use your personal data for any purpose that is unrelated to, or incompatible with, the original purpose, we will inform you and explain the legal basis for this. 

We ensure we always have a lawful basis under UK GDPR and legislation for processing personal data. The following lawful grounds are relevant to our use of your personal data: 

Consent: This is where we seek your consent to process your personal information, for example to send you communications by SMS or email about our work or your support. You are free to update or withdraw your consent at any time. You can manage your preferences by contacting our Supporter Care team. 

Contractual: If we have entered into a contract with you, we may need to store or process your personal data to comply with the agreement, such as buying a product or becoming an employee. 

Legal obligations: This is where we are required by law to process personal data, for example to process Gift Aid donations with HMRC.  

Vital interests: This would be rare, but an example would be if you required emergency medical assistance at an event or at our office and we needed to share your details with an attending medic. 

Legitimate Interests: In line with UK GDPR, we may process data in support of the charity’s legitimate interests. We only do this where we believe this will not significantly harm the legitimate privacy interests and rights of individuals.   

Our legitimate interests include fulfilling our public purpose to support women, men and children who have been forced to flee their homes due to conflict and persecution. This includes fundraising and awareness raising through activities such as direct marketing (eg phone or mail contact); events; analysis and profiling of our supporter or potential supporters; research and profiling using public records to connect with new audiences interested in supporting refugees; and communication campaigns. 

Our legitimate interests also include ensuring we can help our supporters and members of the public who request information or ask for their contact preferences to be changed, or to help process donations or other participation in our campaigns. Legitimate interests may also include any processing of data to fulfil essential administrative functions in the charity. 

If you would like to know our lawful basis for a specific activity, please contact our Supporter Care team. 

We collect personal data from you when you interact with us in a range of ways.

For example, we receive your personal data when you:

• Make a donation and provide your personal details, eg by phone, post, online or in person
• Subscribe to receive our communications, such as our newsletters
• Take part in our community fundraising work, including third party fundraising platforms such as JustGiving
• Give permission for a third-party fundraising site, such as JustGiving, to share your details with us
• RSVP to invitations to attend events we organise
• Visit our website
• Interact with our social media channels, such as engaging with posts or leaving comments
• Contact our Supporter Care team or submit forms on our website with requests for information or assistance
• Apply for job vacancies with our charity, whether paid or voluntary

We may also collect personal information about you that is legally and publicly available, such as from company websites, social media accounts, or public registers (eg Charity Commission) or the Post Office’s National Change of Address database, or from third party paid-for sources, such as list brokers, where you have signed up to receive communications from third parties via other organisations.

In addition to analysing data shared with us, we may use publicly available information and recommendations from staff and supporters to enhance our datasets and identify individuals who we believe may have the interest and financial capacity to make a major gift.  

We may research and collate additional information from sources in the public domain, typically concerning a potential donor’s interests, their philanthropic activity, financial capacity to give higher value donations and contacts within their networks. We may undertake this research ourselves or use the services of a third-party partner. 

We may also use existing supporters’ information to identify new audiences for direct marketing. By analysing the profiles of our existing supporter base, we can identify other individuals with similar interests or lifestyles whom we believe would be interested in our work.

This new information may be added to the record of a donor or potential donor. We use this data both to verify we have correct information and to assess whether it would be appropriate to approach you directly about philanthropic opportunities. Where we use this information to approach a new contact with whom we have no previous relationship, we will provide the individual with a link to this privacy notice as part of our initial engagement. We may also carry out due diligence on potential donors using publicly available information to comply with our policy on the acceptance of gifts, and to fulfil our legal responsibilities.  

You have the right not to be profiled or screened for financial capacity and you can opt out of this activity at any time by contacting our Supporter Care team. 

As a charity, we also rely on external suppliers to help deliver our work. These organisations process personal data on our behalf, such as delivering communications, publicising our appeals and helping to process donations. Examples include payment platforms, mailing houses and our Supporter Care helpline.

We have strict measures in place to ensure our suppliers operate the required safeguards to ensure your personal data is protected and treated in accordance with the law. This includes contractual obligations and stringent data protection requirements.

In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.

The exact length depends on the purpose for which you provided your personal data, but our general guiding principle is to hold your data for the period required for that purpose and as detailed within our Retention Schedule. For example, to keep you informed of our work, keep a record of legacy wishes or to process donations.

If you apply for a job with us, we will always seek your permission before keeping your details on record.

There are also legal requirements that our charity is required to comply with, such as retaining Gift Aid details for no less than six years after the most recent donation.

If you have a specific query about how long your data will be kept, please don’t hesitate to contact our Supporter Care team who will be happy to assist.

The security of your personal data is our priority. To protect your data, we take a number of important measures, including the following:

• limiting access to your personal data to those employees, volunteers and third parties with a legitimate need to know, and ensuring that they are subject to  confidentiality and the obligations set out in data protection laws. 
• holding data only in secure environments and using secure methods for any data transfers required to deliver our services
• procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data) including notifying you and/or the Information Commissioner’s Office where we are legally required to do so;

We do not directly store any credit or debit card details taken for online donations. Any such payment data is handled securely by our payment processing providers who meet the required Payment Card Industry (PCI) Security Standards. 

In most instances, we will store or transfer personal data within the United Kingdom (the ‘UK’). This means that personal data is protected in line with UK GDPR standards. 

In some exceptions, we may need to transfer data outside of the UK if the supplier is based outside the UK. In these cases, we seek to ensure this data receives a similar protection standard as it would in the UK. The European Economic Area (EEA), for example, has equivalent GDPR standards as the UK.   

Please note when you click on website links to, or complete forms on, UNHCR’s international website your data will be stored outside of the UK. UNHCR’s international website has its own privacy and cookie policies, which you can view here.  

For further information about the particular data protection mechanisms, we use when transferring your personal data please contact our Supporter Care team.  

Under the data protection legislation, you have the following rights, which we will always work to uphold. These include your right to:

• be informed about how we process your personal data
• access and be given a copy of the personal data we hold about you
• require us to correct any personal data that we hold about you if any of it is inaccurate or incomplete
• be forgotten: in certain circumstances you have a right to have your personal data erased from our records
• restrict (i.e. prevent) the processing of your personal data
• object to the way we process your personal data (e.g. for direct marketing)
• withdraw consent: if we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time
• data portability: the right in certain circumstances to have us transfer your personal data to another organisation
• not be subject to a decision based solely on automated decision making which produces legal effects on you. 

It is important that your personal data is kept accurate and up-to-date. If any of the personal data we hold about you changes, please keep us informed if you would like it updated.

If you wish to make a complaint about our use of your personal data, please contact our Supporter Care team and we will assist you. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office.

If you want to know what personal data we hold about you, you can ask us for a copy of it. This is known as a subject access request (“SAR”).

Please contact our Supporter Care team to request an SAR form and they can support you through the process.

We will aim to respond to your SAR within 28 days. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.

Our Supporter Care team is on hand to help answer any questions or provide further information. You can get in touch via the follow methods:

Email: [email protected]

Phone: +44 203 950 4011

Post: UK for UNHCR, WeWork, 1 Mark Square, London EC2A 4EG

We may change this Privacy Notice from time to time. Please visit this page to keep up to date. Our last update was 7th February 2024.