Sets a technical cookie recording you deny consent, you won't be asked again.
Removes the consent cookie from your browser.
1 About this Policy
City YMCA, London helps hundreds of young people every year struggling with homelessness through our advice, support and accommodation services. We have a vision for every young person to be able to create a future of their own choosing.
When doing this, we process personal data about people who receive advice, guidance or housing support from us or provide us with support through donations or volunteering. We are committed to protecting your privacy and take this responsibility very seriously. We therefore take care to safeguard it.
This notice outlines what data we collect, how we may use it, how we protect your data and your rights, and how you can exercise those rights. If you have any questions about this policy please contact us.
2 Our promise to you
You are important to us and we value every contribution. In whichever way you choose to support us, we want you to have choice and control over the information we have about you.
We therefore commit:
• To ask, listen to and act on your wishes so that you value your relationship with and communications from us
• To not put undue pressure on you to support us
• To make it clear and easy for you to choose how to hear from us.
• To protect your information. Any details you share with us will be used by us only for our own purposes. We will never give, sell or rent your information to other organisations for their marketing purposes.
3 Why we collect your data
We collect personal data to provide you with services, communicate with you, send
you information that you have requested and to administer donations.
Depending on how you interact with us, we may process data for the following
• Visitors to our website
• Supporters and donors
• Individuals who make enquiries or raise complaints
• Visitors to our projects
• Individuals we work with and provide services to
• Individuals that help us deliver our vision and mission
4 Information we collect
We may collect the following personal information:
1. your full name
2. contact details – including your postal address, telephone number(s) and
3. date of birth
4. details of your case when providing you with housing advice or services
5. your bank details
6. records of your correspondence and engagement with us
7. donation history and Gift Aid details
8. photographs, video or audio recordings
10. Biographical information
11. Other information that you share with us though letters, conversations,
surveys or publicly available sources
For those who access our projects and services, we may also collect sensitive, personal data about individuals. This includes information about health, religion, sexuality, ethnicity, political and philosophical beliefs and criminal records. We only record this data where we have your explicit consent unless we are permitted to do so in other circumstances under GDPR laws.
5 The personal data of service users
If you are receiving advice, guidance or support from us, we will need to process your data because of your specific relationship with us. We will keep all your case information – including notes, letters and information given to us about you – in a confidential record that is specific to you. We use a customer relationship management system (CRM) to provide our advice, guidance and support. This ensures that we provide appropriate and accurate advice or support. We take information security very seriously. No one is allowed access to our system or files unless they need this to provide the service to you or one of the other purposes discussed in this notice.
To ensure that our services meet a high standard of quality, client files are sometimes checked by our quality assurance staff. Files may also be checked by external auditors if the work we do is funded by another organisation. All auditors are bound by confidentiality policies.
We may use your data for statistical reports. These statistics will not include any information that could be used to identify any individual.
6 Fundraising & Marketing
We would love to keep you up to date with our fundraising and development activity. We use a range of marketing channels to contact supporters including our website, post and email.
We use an online provider, Mailchimp, to process our supporter communications. Every email we send has an opt-out facility included. We will also send you marketing by ‘point of sale’, on the basis of it being within our legitimate interests to do so, unless you opt out.
We send the following marketing materials:
a. Updates about City YMCA, London’s work – including newsletters, magazines,
and other publications informing you about our work
b. Appeals and fundraising activities – including requests for donations, information about how you can leave us a gift in your will, how you can raise money on our behalf, attend or take part in a fundraising event and updates on the impact that your fundraising activities have had on our work
c. Events – including details of sponsored activities or events to update you on
progress achieved against our vision.
d. Volunteering – information about how you can help support City YMCA, London by giving up your time or using your influence to progress our aims, along with updates on the impact of your work
e. Professional services – including details of any training events and publications. We will never share or sell your personal data to a third-party organisation for its marketing, fundraising or campaigning purposes.
If you tell us you do not wish to receive marketing or fundraising communications, you may still receive transactional and service-based communications confirming and servicing other relationships you have with us. You can also opt out of receiving marketing communications from us by signing up to the Fundraising Preference Service.
Occasionally we check for out of date data by checking it against publicly available records such as deceased records to help us minimise wasted expenditure.
7 Administrative communications to supporters
In addition to the fundraising and marketing communications that you receive from City YMCA, London, we may also communicate with you by post, telephone, and email in relation to administrative and transactional matters. For example, we may call you after you have set up a Direct Debit to confirm your details, and upon cancellation. There may also be other occasions where we need to contact you about your donation, for example, if there is a problem with a payment, and occasionally after you have opted out of hearing from us.
On occasion, we may also contact you about an event that you have signed up to participate in, for example, to check that fundraising pages have been set up and to provide necessary information.
8 Supporter research and analysis
We may use profiling and database segmentation techniques to analyse your personal information, and create a profile of your interests, preferences and ability to donate. This allows us to ensure communications are relevant and timely, to provide an improved experience for our supporters. It also helps us understand the background of our supporters so that we can make appropriate requests to those who may be willing and able to donate more than they already do, or leave a gift in their will. This enables us to raise funds quicker and in the most cost-effective way. You have the right to ask us not to process your data in this way.
We are also legally required to carry out checks on individuals who give us large donations, to comply with our duties in respect of anti-money laundering legislation and the prevention of fraud.
9 Social media
Depending on your settings or the privacy policies for social media messaging services like Facebook, Twitter, and Instagram, you may receive targeted advertisements through our use of social media audience tools. We do not share your data with these social media sites that could stop you receiving these advertisements.
If you receive an email, open it, do not open it, select a link and/or browse our website, MailChimp collects this information to ensure that the information we send to people is received and relevant.
10 Applying for a City YMCA, London job
When you apply for a job with us, your personal data will be collated to monitor the progression of your application, and the effectiveness of the recruitment process through the statistics collected. Where we need to share your data you will be informed beforehand. Personal data about unsuccessful applicants are held for 12 months after the recruitment exercise is complete for that vacancy. You, as an applicant, can ask us to remove your data before this time if you do not want us to hold it. If we feel there is another suitable vacancy available, we will contact the applicant prior to sharing your application details with the relevant manager.
Once you have taken up employment with City YMCA, London we will compile a file relating to your employment. The information contained in this will be kept secure and will only be used for purposes directly relevant to your employment. Once your employment with us has ended, we will retain the file in accordance with the requirements of our retention schedule and then delete it from our files.
11 Professional contacts
We may collect data about professional contacts and partners with whom we work, or to whom we provide professional services. Personal data collected in this way will be processed in accordance with this policy.
We may send our professional partners information and updates about our work (primarily by email). Such contacts can opt out of receiving this information at any time.
We maintain a record of information related to MPs and other holders of public office to enable us to further our charitable aims.
12 Our legal basis for processing personal data
The law allows for six ways to process personal data. When we use your personal information, we will always consider if it is fair and within your reasonable expectations to do so and that it is not unduly intrusive.
13 Disclosure of your personal data
We will not share any of your personal data to any third party – except where:
1. the transfer is to a secure data processor, which carries out operations on our behalf
2. we are required to do so by law
3. it is necessary to protect the interests of an individual
4. we have obtained your consent
14 Security of your personal data
We use appropriate precautions to protect your personal data.
15 Use of data processors
We occasionally may use a third-party supplier to manage mailings for fundraising appeals, campaigns, conduct research surveys or storage of your personal information on our behalf in accordance with GDPR.
16 Transfers of data outside of the European Economic Area
We use DropBox and Mailchimp which are multi-tenant cloud services, for our internal office use. This means that internal documents and information generated by us are stored in cloud services hosted within the European Economic Area (EEA).
However, in limited cases, we may use data processors that process and/or store data outside of the EEA, for example, payment processors such as Mailchimp. In these cases, we will take reasonable steps to ensure that your data is protected.
17 Retention of your data
The length of time that data will be kept may depend on the reasons for which we are processing the data and on the law or regulations that the information falls under. Typically donor and service user’s data would be retained for seven years and recruitment data for 12 months.
If you request to receive no further contact from us, we will keep some basic information about you on our suppression list to avoid sending you unwanted materials in the future.
18 Your rights
You have many rights under GDPR. These include:
a. Right of Access: you have the right to know what information we hold about you and to ask, in writing, to see your records.
b. Right to be informed: you have the right to be informed how your personal data will be used.
c. Right to withdraw consent: where we process your data based on your consent you can withdraw that consent at any time.
d. Right to object: You also have a right to object to us processing data where we are relying on it being within our legitimate interests to do so.
e. Right to restrict processing: you have the right to ask for processing of your personal data to be restricted because there is some disagreement about its accuracy or legitimate usage.
f. Right of erasure: you have the right to be forgotten
g. Right of rectification: you have the right to ask for our records to be updated.
h. Right to data portability: you have the right to request that the data is transferred from one service provider to another.
If you have any complaints about the way in which we have used your data, please get in touch with us and we would be happy to help and discuss your concerns.
If you have any questions about this policy, would like more information, or want to exercise any of the rights set out above, you can get in touch with us by email on email@example.com or by calling us on 020 7549 0475.
Our fundraising team uses information that is already in the public domain (information that has been published in print or online) to identify high net worth individuals who may be interested in supporting our work with a major gift. These publicly available sources of information include Companies House, the electoral register, the phone book, the Charity Commission’s Register of Charities, Who’s Who, LinkedIn, company annual reports, and articles in newspapers and magazines. We do not use publicly available sources which we consider would be intrusive for this purpose, such as Facebook, Twitter, JustGiving, the Land Registry, online planning applications, or websites that are like these. We also carry out research to identify existing supporters who may be able to join our major donor programme. This is based both on publicly available information and information our supporters have given us voluntarily
For example, Facebook’s ‘Custom’ and ‘Lookalike’ Audiences’ programmes enable us to display advertisements to our existing supporters when they visit Facebook, or other people who have similar interests or characteristics to our supporters.
The law allows for six ways to process personal data.
1. Consent – The person has consented to you keeping or using their data.
2. Contractual – Keeping or using someone’s personal data is required to fulfil a contract between them and your organisation.
3. Legal Obligation – Your organisation needs to keep or use personal data in order to comply with the law.
4. Vital Interests – Keeping or using someone’s personal data is necessary to protect the vital interest of them or somebody else.
5. Public Task – Your organisation needs to keep or use someone’s personal data to perform a task that is in the public interest.
6. Legitimate Interests – It is in your organisation’s and the person’s legitimate interests for your organisation to keep or use their personal data.
We will supply any information you ask for that we hold about you as soon as possible, but this may take up to 30 days. We will not charge you for this other than in exceptional circumstances. You will be asked for proof of identity as the person dealing with your request may not be the staff member you have met before. We need to be sure we are only releasing your personal data to you.