Privacy Policy

Why does Back Up need personal information?  

At Back Up, it’s our job to inspire people affected by spinal cord injury to get the most out of life. We use personal information to ensure we provide the best possible support to our service users and our donors. It helps us to contact you in the most appropriate way with information that is important to you. 

You are under no obligation to provide us with personal data but ultimately, your information will help us to give you the best possible service.  

Your data is important to us. All information collected is confidential and handled in accordance with this Privacy Policy. 

This policy was last reviewed on 01/04/2023. 

What information do we collect? 

Information we collect may include: 

• contact details including name, address, email address, telephone number and contact preferences 
• bank account details for setting up a regular direct debit 
• credit card details for processing credit card payments 

• employer details for processing a payroll gift 
• taxpayer status for claiming Gift Aid 
• date of birth, age, and/or gender, where appropriate (e.g., where registering for a challenge event, such as a race) 
• information about your interactions with us through email, SMS, post, on the phone or in person (i.e., the date, time, and method of contact) 
• details about donations you make to us, events or activities that you register for or attend and any other support you provide to us 

• If you are a minor, we may collect the name and contact details of a parent or guardian and, where appropriate, the name and location of your school 
• any other relevant information you share with us about yourself, including your interests and your employer 
• If you are enquiring about our services, we may ask you details of a sensitive nature about your injury, health and mental wellbeing to ascertain how we might best be able to support you 

How do we collect your information?  

We do not buy data from 3rd parties. 

We collect information about you directly whenever you interact with us. For example, when you contact us regarding our services, register as a supporter, send or receive information, engage with our social media or make a donation to us, you may provide us with your personal information. 

We may also receive information about you when you interact with third parties with whom we work. For example, where you’ve made a donation to us through a third-party website (e.g., Just Giving, Enthuse, Facebook) and given them permission to share your information with us.   

We may receive your information from other partner organisations, (such as Aspire or the NHS), if you have specifically given them consent to pass your details on to us. You can find more details about this on the Aspire website. 

We may receive information about you from NHS England where you have given them consent to share with us. This will be limited to your name and contact details which we will use to contact you about our services. 

In order to ensure that our communication with you is relevant and tailored to your background and interests, we may supplement what we know about you with information that is available to the public.  This allows us to better understand your interests, preferences, and level of potential engagement and/or donation, so that we can contact you in the most appropriate way and to ensure that we do not send you unwanted communications.   

We may collect information about what interests you when you visit our website or interact with our e-newsletters and other online content.   

For some digital content, such as our app or e-learning modules, we may offer you the opportunity to share your name and email address to enable you to save your place and return later. Where this option is given, the purpose will be made clear to you and/or an option given to continue without providing this information. Where we request any additional information, such as your telephone number, the purpose will be made clear and this information will only be used for this purpose unless you provide further consent for it to be used in other ways. 

How is this information kept? 

We securely store and process this information on a database. We make sure nobody has access to your information who shouldn’t have access to it.  

How long is the information stored for? 

Under new data legislation, everyone has “the right to be forgotten”. We will only keep your data as long as is reasonable and necessary. We also have a legal obligation to retain some types of data for set periods of time. If you would like to understand more about how long we retain data, you can request a copy of our data retention schedule by contacting us using the details below.  

We will retain your information for 7 years to comply with legislation surrounding gift aid but if we have had no interaction with you after this time has passed, we will delete all personal information we store on you. 

When you provide us with consent to contact you, we will regularly give you the opportunity to update or revoke that consent. 

Do you share my personal data with any 3rd parties? 

We will never sell your details to other organisations. 

We may need to share your information with data hosting providers or service providers who help us to deliver our services, projects, or fundraising activities and appeals. These providers will only act under our instruction and are subject to pre-contract scrutiny and contractual obligations containing strict data protection clauses. 

We may use your data for specific marketing through 3rd parties such as social media, this could include a specific social media marketing campaign using your email address.  

We use 3rd party services such as printers and email service providers to assist with mailings and we provide them with encrypted files of names/addresses/email addresses. We enter into contracts with all these service providers that require them to comply with data protection laws and to ensure that they have appropriate controls in place to protect the security of your information. 

We will specifically ask you if you consent to us sharing your details with partners or other charities for the purposes of offering services or support that may be of interest to you. Such services will complement ours and our partnerships allow us to maximise our support for people with a spinal cord injury. 

If you attend one of our courses, we may provide your data to volunteer group leaders so they can manage your needs and aspirations on the course in order to maximise the impact of our services. This data will also be used to manage your care needs (if you have them) on the course. 

If you enter into a mentoring relationship, we may provide information to your mentor regarding your background, your needs and your expectations in order to maximise your outcomes from the partnership. We may also share your data with trained volunteers for the purposes of evaluating our services. 

If you engage with our education service, we may use your basic details to contact education establishments on your behalf. We will always ask your permission before sharing sensitive data with an education establishment.  

If you attend one of our overseas courses, we may share your care needs with our travel and accommodation partners in order to ensure that adequate care is in place for your travel and stay. 

Whenever we share data, we undertake data protection impact assessments to ensure that your data is safe and secure, and to make sure you are able to exercise your legal rights under the Data Protection Act 2018. 

If you take part in one of our fundraising challenges or events, we may share personal details with venue and third-party event organisers to ensure your safety and that your needs are met.  We enter into contracts with these organisations to ensure your data is secure.   

We share anonymised data, without names, addresses or personal details, to funders or potential funders to demonstrate the impact of our services. Where we have your explicit permission, we may also use names and photos to support our funding applications. 

How do we use your information? 

We may use your information in a number of ways to fulfil a contractual or legal obligation, or where we feel it is in your vital interests, including: 

• to gain a full understanding of your situation so we can develop and offer you the best-possible personalised services 

• to make sure we have the right information when you contact us again, so you don’t have to keep repeating yourself 
• to help us plan our services, use our resources wisely, measure our work, and ensure it’s of the highest standard 
• to provide ongoing support and advice where we feel it is in your best interests 
• to invite you to participate in voluntary surveys or research 
• to process donations, we may receive from you (e.g., to rectify an error on a direct debit form) 

• to promote fundraising activities including appeals, raffles, legacy fundraising, payroll giving 
• to respond to queries you have made about events or challenges or fundraising activities you are interested in 
• to communicate with you about an event you have enrolled for or purchased a ticket for 
• to send you fundraising packs, collection boxes and information you have requested to assist you in fundraising for us 
• to invite you to events we feel you may be interested in attending, based on your previous interests and activities, in order to support our work 

• to invite you to participate in challenge events we feel you may be interested in, based on your previous interests and activities 
• to promote Back Up promotions including Christmas cards and other products 
• to contact you where you have been identified as a contact person for an organisation, such as a school or a trust (if we obtain your contact details in this way, we will only use them to contact you in your capacity as a representative of that organisation) 
• to analyse and improve the content and operation of our website 
• to analyse and improve our internal business processes 

• to analyse the personal information we collect about you, and use publicly available information to better understand your interests, preferences and level of potential donations so that we can contact you in the most appropriate way and to ensure that we do not send you unwanted communications 
• where we are required by law to disclose or otherwise use your information 
• to contact you about volunteering 
• To undertake analysis or research exercises to better understand how we can improve our services or influence the policy and practice 

We may contact you for marketing purposes by email or text message if you have agreed to be contacted in this manner.  We may also send you service communications via email or text, for example where you place an order for goods or services on our website, or you have made a donation by text. 

If you have provided us with your postal address or telephone number, we may send you information about our work or other communications of the kinds described above by direct mail or contact you by telephone unless you have not consented to be contacted in this way.  We provide information about how you can change your marketing preferences below. 

In some circumstances, we may feel we have legitimate interest to contact you when you have not specifically given us permission to do so. We take your preferences seriously so we have given a lot of thought to how you might feel receiving communications like these. In some cases, we feel it would be strange not to contact you e.g., to thank you for a donation. In other cases, we feel we have a legitimate interest which is not overridden by your personal preferences. We may still contact you in the following circumstances: 

• to thank you for a donation 
• to express sympathy when donations are made in memory of someone special 
• to provide/collect information about our services where we feel you might be interested or benefit from them, including but not limited to: 

• outreach  
• mentoring 
• courses 
• assistance with returning to work 
• assistance with returning to education 

• to send you updates about our services and the impact we have on the lives of people affected by spinal cord injury, including stories of people who have benefitted from our services 
• to ask for feedback on an event or fundraising activity you have participated in 
• to invite you to take part in upcoming fundraising activities you might be interested in 
• to invite you to involve your company in fundraising activities, based on information you have provided us about your work and on previous interests and activities, where you have provided us with your corporate details 
• to enquire about trust fund opportunities, based on information you have provided us about your involvement with a trust 

• to ask you about gift aid on a donation you have made 
• to communicate with you about your regular giving, including invitations to upgrade 
• to ask for feedback on a course you attended or other support you have received so that we might improve our services 
• to ask your permission to use your story in our marketing to demonstrate the value of what we do. We will always contact you personally to specifically ask your permission for this and discuss which details you would be happy to see included 

Building profiles of supporters 

Our vital work is only made possible through the incredible generosity of our supporters; therefore, we need to ensure our fundraising is as effective as possible. Developing a greater understanding of our supporters through researching them using publicly available sources we can tailor and target our fundraising events, communications and volunteering opportunities. This allows us to be more efficient and allows us to reduce the risk of someone receiving inappropriate information. 

What information do we collect? 

We use information we hold on supporters to research their potential to be a significant donor to Back Up, this includes collecting additional details relating to their employment and any philanthropic activity. We may also estimate their gift capacity, based on visible assets and history of charitable giving and how connected they are to Back Up. 

Which information do we use? 

We use existing data on our own database and combine this with publicly available information. We only use reputable sources where someone would expect their information may be read by the public. We do this in order to understand our supporters better, so we can send you information you are interested in, to predict how you might be able to help us in future, and to make sure we do not send marketing to vulnerable individuals, meaning we can raise money in an efficient and ethical manner. 

We identify potential high value donors by: 

• Carrying out research on donors who have given £1,000 or more to us. 
• Asking our existing high value donors to give again. 

• Inviting potential high value donors to attend our supporter events as a way of engaging them with us. We also identify potential new donors by researching event attendees who were previously unknown to us. 
• Researching people who have not given to us in the past but who we believe may have a connection to our cause and have the capacity to give at a high level. 
• Asking our donors and influencers to open up their networks to us. 
• Asking our donors and influencers to introduce us to potential donors we have identified through our research and that they have a link to. 

Our initial research is undocumented and involves some basic checks looking at publicly available information, e.g. using Google, a public LinkedIn profile and Zoopla. 

We do not process special category data at this stage, unless the individual in question has manifestly put it in the public domain (e.g. have themselves given interviews to media outlets or published articles/ public blog posts revealing this information).  

If our initial research is promising, or if someone has donated £5,000 or more to us, we will create a research profile of the individual using information sources such as BoardEx, Companies House, Who’s Who, The Charity Commission, JustGiving and Twitter. 

We also use these information sources to identify potential new donors who have previously given at a high level and may have an interest in our cause. If we discover that someone in our network knows a potential donor that we have identified, we might ask them to facilitate an introduction. 

We sometimes ask existing supporters whether they would be prepared to open their networks up to us. An existing supporter may tell us about an individual previously unknown to us and facilitate an introduction. In this scenario we would advise our existing supporter about our data responsibilities and ask them to ensure that the individual in question is happy for an introduction to take place. Following the introduction, we would direct the individual to this privacy policy and ask them to confirm how they would like to hear from us. 

In the two scenarios above, we may create a research profile on someone who we have never had any contact with before. In this case, we plan to make contact within 30 days to tell the person about this privacy policy. If we attempt to make contact but are unable to do so, we will try again within the next 30 days and delete the research profile if we are still unsuccessful. 

Lawful grounds for processing 

We rely on legitimate interests as our lawful basis for identifying, researching, and otherwise processing the personal data of our potential high value donors as set out above. 

It is important for us to know about our donors’ connection to our cause, as we know this has a significant impact on their interest in supporting our work. This may be classed as sensitive or ‘special category’ data: so, if we come across details of a potential donor’s experience we will only record this if the individual has manifestly made it public. If an individual tells us directly about their experience of spinal cord injury, or shares any other special category data with us, we would only capture this data if we have their consent to do so. 

Our fundraising team foster long term relationships with our existing and potential donors. However, we are committed to only keeping data on individuals with whom we have an active relationship. We therefore remove the data captured in the ways described above if the existing or potential donor has not interacted with us. 

We want to always ensure you are in control of your data and you’re free to opt out of this activity at any time. Please contact the Data Protection Officer. 

Do we process ‘sensitive’ personal information? 

If you enquire about and/or access our services, we collect information about your health, physical and mental welfare in order to tailor the service we provide to best suit you. 

We collect information about ethnic background, religion, age, marital status, and sexual orientation in order to track which sections of the population we are reaching. 

We collect sensitive personal information where we need this information to ensure that we provide appropriate facilities or support to enable you to participate in an athletic event like a marathon.   

Can I have access to the information you hold about me?  

Yes. You can make a written request to access all the personal information we hold about you.  

Who do I contact about the information you hold on me? 

The Data Protection Officer 

Address: Back Up 

4 Knightley Walk 

London 

SW18 1GZ 

Email: dataprotectionofficer@backuptrust.org.uk  

Phone: 020 8875 1805 

If you let us know about any information that is inaccurate or incorrect, we’ll correct it. 

How can I withdraw my consent to processing my personal data? 

If you do not wish us to use your personal data for marketing purposes, you can use the relevant box on our forms to indicate your preferences when you initially provide us with your details. 

At any subsequent time: 

• you can indicate that you do not wish to receive our marketing emails by clicking the “unsubscribe” link which we will always provide 
• you can ask us to stop sending you marketing texts by sending us an “opt-out” text message, following the instructions we provide you in the text  
• you can ask us to stop sending marketing by post by following the instructions provided in the letter 

• if you wish to change the way we contact you (by email, post, text and phone), you can update your contact preferences here 
• You can enter your details on the Fundraising Preference Service (FPS) website. Once you have made a request through the FPS, we will ensure that your new preferences take effect within one calendar month of your request 

If you have indicated that you do not wish to be contacted for marketing purposes, we will maintain your details on a suppression list.  However, we may still need to contact you for administrative purposes, including (but not limited to): 

• Processing a donation, you have made and any related Gift Aid 
• Providing you with the information you need in order to participate in an activity or event for which you have registered  

• Explaining and apologising where we have made a mistake 

If your contact details have changed, you can always update or correct the information we hold about you by contacting the Data Protection Officer at the address listed above. 

Similarly, if you have more specific requests about how we use your data, you can contact the Data Protection Officer. 

What other data protection rights do I have? 

You can make a complaint or raise a concern about how we process your personal data by contacting our Data Protection Officer.  In some circumstances, you have the right to object to our processing of your personal data or to stop us from continuing to make active use of personal data that we retain in our records. Please see our complaints policy here. 

If you are not happy with how we have handled your complaint, you can contact the Office of the Information Commissioner, which oversees the protection of personal data in the UK, or the Fundraising Regulator, which is responsible for overseeing fundraising activities carried out by charities in the UK. 

If you would like to contact the Information Commissioner, please use our reference number Z6130006. To contact the Information Commissioner’s Office please either call 0303 123 113 or visit https://ico.org.uk/make-a-complaint/. 

Alternatively, you may choose to contact either the Information Commissioner or the Fundraising Regulator directly about your complaint, regardless of whether you have raised it with us first. 

Job and volunteer applicants and current and former employees 

If you apply to work at Back Up, we will only use the information you give us to process your application and to monitor recruitment statistics. If we want to disclose information to someone outside Back Up – for example, if we need a reference or need to get a ‘disclosure’ from the Disclosure and Barring Service (DBS) – we will make sure we tell you beforehand.

If you are unsuccessful in your job application, we will hold your personal information for 1 year after we’ve finished recruiting the post you applied for. After this date we will destroy or delete your information.

If you begin employment with us, we will put together a file about your employment. We keep the information in this file secure, and will only use it for matters that apply directly to your employment.

Once you stop working for us, we will keep this file for 6 years from your leaving date. 

Your credit/debit card information 

If you use your credit or debit card to donate to us, buy something or make a booking online, we pass your card details securely to our payment processing partner as part of the payment process. We do this in accordance with the Payment Card Industry Security Standard, and don’t store the details on our website or databases. 

Emails terms of use 

Emails aren’t always secure, and they may be intercepted or changed after they’ve been sent. Back Up doesn’t accept liability if this happens. The contents of emails reflect their author’s views and not necessarily those of Back Up. 

Please do not send Back Up any financial data through email. 

The information in emails is confidential, so if you’ve received one by mistake, please delete it without copying, using, or telling anyone about its contents. 

Photo Consent 

Do you take photos of service users? 

Yes, we take photographic images (moving and still) on our courses and activities to enhance and illustrate our communications. 

Do I have to have my photo taken? 

No, this is not a pre-condition of accessing any service or partaking in any Back Up activity. We will always ask for your consent before taking photos and there is no expectation for you to provide it if you do not wish to do so. 

What do you use these photos for? 

We produce a wide range of materials to tell people affected by spinal cord injury about our services and to raise money for our work.   

Examples of materials may include, but are not limited to, our printed publications; adverts; audio-visual and electronic materials; external media and publicity such as television, print, radio or online news; display materials; emails, e-newsletters, blogs, web pages, social media posts, presentations, speeches, research or policy reports and any other materials. 

Back Up cannot guarantee or be held liable for use of this information or image by a third party. 

If a photographer or videographer is present on the behalf of Back Up, the copyright of any material which is generated as a result of this photographic session shall be assigned and shall be the property of Back Up.   

Can I withdraw my consent to use these images at a later date? 

Yes, consent can be withdrawn at any time by contacting the Data Protection Officer. If you withdraw your consent, Back Up will no longer use any photographs or information you have provided previously. However, any published materials that already include your information or image cannot be recalled. 

How long will you keep these images for? 

We will retain and may use the images for up to five years unless you have revoked your consent in the meantime..  

In special cases (i.e., where a photo is of particular use to the charity) we would like to continue using the image beyond 5 years. In these cases, we will seek your renewed consent to continue using the image. 

How will you use photos of me at fundraising events? 

We use photos of our supporters to enhance and illustrate our fundraising materials, inspiring others to get involved in fundraising activities and events. People attending Back Up fundraising activities and events can expect that photos might be taken to be used in fundraising and marketing materials. As supporters will not be identified in photos, without their express permission, we are not using their data in ways that could be considered intrusive or harmful. We will offer an opt out, and ensure that people can access and request erasure of their photographs at any point. Our communications to supporters will include a photography notice, and this information will also be displayed on our website. 

Cookie Consent 

A cookie consists of information sent by a web server to a web browser, and stored by the browser. The information is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser. 

We may use both “session” cookies and “persistent” cookies on the website. We will use the session cookies to: keep track of you whilst you navigate the website. We will use the persistent cookies to: enable our website to recognise you when you visit. 

We use Google Analytics to analyse the use of this website. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users’ computers. The information generated relating to our website is used to create reports about the use of the website. Google will store this information. 

Google’s privacy policy is available at: http://www.google.com/privacypolicy.html  

Most browsers allow you to reject all cookies, whilst some browsers allow you to reject just third-party cookies. For example, in Internet Explorer you can refuse all cookies by clicking “Tools”, “Internet Options”, “Privacy”, and selecting “Block all cookies” using the sliding selector. Blocking all cookies will, however, have a negative impact upon the usability of many websites.