Privacy Policy

This policy and our Cookies Policy sets out how Cerebra – For Brain Injured Children and Young People, uses and protects your personal information, including data from your use of our website.

Cerebra is the Data Controller for personal data about families we help, professionals, supporters, event attendees, grant applicants, volunteers and newsletter subscribers. For the purpose of this document we will use the group term ‘supporters’ to describe any one of these groups.  Our ICO registration number is Z6201581.

We do not trade personal data for commercial purposes and will only disclose it if required by law, if it is necessary to arrange your event attendance, or if it is with your consent. Cerebra uses providers based in the European Economic Area to process supporter data.

Cerebra is registered with the Information Commissioner’s Office under number Z6201581 is a registered charity under number 1089812 and a registered company limited by guarantee under number 4336208 (England and Wales).

You can change how we contact you at any time, simply by contacting using our contact form or calling us on 01267 244200.

As part of our commitment to you, we have appointed a Data Protection Officer, whose name is Ralph Nicholls. You can contact Ralph, either by writing to:

The Data Protection Officer,
Cerebra,
2nd Floor Lyric Building,
King Street
SA31 1BD

or using our contact form.

This policy was updated to show that we are adhering to the new General Data Protection Regulation (GDPR), which came into force in May 2018.

Our promise to you

Cerebra promises to respect and look after all personal data you share with us or that we get from other organisations.

We will always keep it safe.

We aim to be clear when we collect your data about what we all use it for, and not to do anything you wouldn’t reasonably expect.

We will never sell your personal data to other organisations, and we will only ever share it in appropriate, legal or exceptional circumstances.

What personal data we collect and why we collect it

The type and quantity of data we collect and use depends on why you have provided it.

We will only collect, use and otherwise handle your personal data:

• where you have consented to this for specified, explicit and legitimate purposes
• where this is necessary to fulfil legal obligations that apply to us
• where it is necessary for our legitimate interests relating to running our daily operations, as long as, in each case, these interests are in line with applicable law and your legal rights and freedoms.

Coronvirus and your data

In order to continue to deliver our charitable services to children living with a brain condition and their families, it’s vitally important that our fundraising activity is able to continue.

In line with Government guidance, we have been able to ensure that all staff are able to work from home. This includes our Call Centre agents, who are now all calling donors from home but doing so via our headquarters computer network.

Because our agents use this internal computer network it means the call is completely secure. This means any payment information received over the phone is safely processed and uploaded to our system via an encrypted connection. We wanted to assure you that your information remains safe at all times.

Our call centre managers are also monitoring all calls as normal to ensure the highest level of professionalism is being maintained.

We are incredibly grateful for your ongoing support. During this worrying and uncertain time, it is even more vital.

If you have any comments or concerns at this time, please do not hesitate to contact us.

Research

Much of the work we do involves carrying out research. If you agree to take part, we will record responses to questions that you give us, and your personal details.

This data will be used to fulfil our research objectives, and may be shared for relevant projects. Your data will remain anonymous unless you consent to it being disclosed.

The data we collect will be kept for five years.

Services

Cerebra offer a wide range of information and advice services to families, and professionals.

We will collect your contact details and preferences, and any other data that is relevant to delivering the service to you.

This information will only be used for the purposes of the service and not shared with the rest of Cerebra unless you give us permission to do so.

We will keep the data for up to six years, in line with contracts and government regulations.

Children’s data

Although children under 16 can fundraise with the consent and support of a guardian, we do not record their contact information. Instead, their parent or guardian’s details are recorded (with their contact preferences). Individuals over 16 can be recorded but still require a guardian as reference (for school contacts this can be a teacher).

For our services, the service is always provided to the family or parent. Data is supplied to us where we have a legal basis to collect and retain that data as per the contracts, or included in the case notes provided, for example by paediatricians or in independent support where there is a young person involved. This information is not shared with anyone not connected to providing the service.

We will keep the data for up to six years, in line with contracts and government regulations

Helpline

We run a support and information helpline.

We record only the data needed to help your enquiry. This data is not shared in any way and will not be used to contact you about other services or offers from Cerebra unless you give us permission to do so.

We will keep this data for one whole financial year after you contact us.

Supporters

If you support us, for example by signing up to an event, donating, signing up to Gift Aid, or signing up to a campaign, we will usually collect your name, contact details, and whether you would like to be contacted, and how we would do so. If appropriate, we may also ask to collect your date of birth, financial details, Gift Aid eligibility, reasons for support, information relating to health and disability, and responses to our campaigns. We will also ask if we can share your story for publicity purposes.

We collect this data so we can keep you up to date with information and products you have requested, or may be interested in, and to ask for more support, in the way that you have chosen; to run our events; and to fulfil our legal responsibilities for financial and Gift Aid reporting.

We will keep your data only for as long as necessary. If you have kindly donated to us, we are required to keep this data for seven years. If you have not donated to us, we will only keep your data for three years.

Volunteers

If you volunteer with us, or enquire about our volunteering opportunities, we will usually collect your name, contact details, emergency contact details, bank details, contact preferences, ethnicity, gender, availability to volunteer, disability (including physical and mental conditions) and criminal convictions.

We collect this data so that we can contact you about volunteering opportunities that come up; so that we ensure the safety of our volunteers, staff and customers; can pay expenses; carry out our awards programme; and to help us anonymously measure our inclusion and accessibility across our volunteering programmes.

We will keep this data for two years after you stop volunteering for us.

Gift in Wills

If you plan to leave a gift in your Will to Cerebra we will collect your contact details and contact preferences. We will also do this if you tell us you are you are thinking about leaving a gift to the charity or would like more information on how to do so. We will use this data to keep in touch and send you other information and products that you are interested in. This data will be kept on file long-term, as hopefully it will be many years before your gift is realised. If you change your mind then we will only keep this data for three years

In order to administer bequests, solicitors, executors will provide us with details of the deceased, the corresponding executors, solicitors and where necessary other beneficiaries. This data will be kept by us and shared with our legacy administrators for the purposes of administering our legacy income. On occasion we may share this data with other parties such as co-beneficiaries, third party experts and any other person(s) involved with the estate for the purposes of administering legacies only. The data will be kept on file indefinitely.

Storytellers

Some of our families and supporters kindly tell us stories about their experiences to help us in our publicity and fundraising campaigns. If you are happy to do this we will ask you to complete a publicity consent form.

We will record the details of the story, including photographs, and contact details to enable us to get updated approval to use the story should this be deemed necessary.

We will keep this data for five years after you give it to us.

Photography

Our families, supporters and volunteers kindly let us use photography and images of them to help our campaigns and activity come to life.

We keep these images stored in a secure location and will only use them with the subject’s permission.

We keep these images for five years after we have been given them, unless you ask otherwise.

E-newsletter (News Flash)

We use third-party providers, Mailpoet and ElasticEmail, to deliver our monthly e-newsletters. We collect statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve our e-newsletter. For more information, please see  Mailpoet privacy notice and ElasticEmail privacy notice.

Complaints

Should you wish to register a complaint we will collect your name, contact details and details about the complaint to enable us to respond, monitor and improve our organisation.

This data will be shared with any parts of Cerebra or any third parties who are involved in resolving the complaint, for example, agencies that we have partnered with.

We will hold this data for six years.

Website

When someone visits cerebra.org.uk we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out information, such as the number of visitors to the various parts of the site.

If we want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it. We will collect any questions, queries and feedback you leave. This will include your email address if you send us an email, your IP address, and which web browser (and version) you use. Information on how people use the site, through cookies and page tagging, helps us improve our website and our services. Find out more about our link to Cookies Policy.

We may also pass on your personal information to online advertising tools, including Facebook Custom audiences, Google AdWords Match and Google Analytics to carry out ‘remarketing activities’. These third-party vendors may use cookies to serve these ads based on your previous visits to our website.

We might also obtain your personal data through your use of social media such as Facebook, Instagram, Twitter or LinkedIn, depending on your settings or the privacy policies of these social media and messaging services. To change your settings on these services, please refer to their privacy notices, which will tell you how to do this.

Suppression List

Should you not wish Cerebra to contact you in the future, we will hold your contact details on file. This will enable us to ensure that we comply with your wishes.

We will hold this data indefinitely. Should you wish to engage with Cerebra again then please get in touch with us.

Phone Recordings

Cerebra records some calls to help train our staff and for legal purposes.

The records will be deleted after two years.

Who we share your data with

Unless we are required to share your data for legal or regulatory reasons, to help with a complaint, to administer a Gift in Will, provide requested services or to keep your record up to date, we will never share your data with other organisations without your permission.

We do use third-party organisations to help us collect donations such as JustGiving, and to help us fulfil our marketing. Where we use external companies to collect or process data on our behalf, we carry out comprehensive checks on these companies, and put in place contracts to control how they manage the data they may collect or have access to.

Cerebra uses providers based in the European Economic Area to process supporter data.

There are a few exceptional situations where we may have to breach confidentiality and pass on your details without your consent.

Situations where we might need to break confidentiality:

• A child is at risk of harm.
• A vulnerable adult is at risk of harm.
• You are at serious risk of immediate harm.
• A terrorist threat has been made.
• We have been ordered to share information with the courts.
• A person poses a serious risk to others.

If a decision is made to break confidentiality, we will make a reasonable effort to keep you informed of what we intend to do. We will only ever share your data in circumstances outside of this if we have explicit and informed consent.

How we protect your data

At Cerebra we ensure that the most appropriate technical controls are in place to keep your data safely. Access to your data is regularly reviewed and only accessible to the relevant trained staff, volunteers and contractors.

Where we use external companies to collect or process data on our behalf, we carry out comprehensive checks, and put in place contracts to control how they manage the data they may collect or have access to.

Your data will be hosted on servers located in the UK, which will not be transferred out of the European Union, or in the case of our ElasticEmail, the data will be stored in Canada and or the US.

What third party data, automated decision making and/or profiling we do

To help us ensure that we only hold accurate and up to date data, we regularly use third-party data sources to clean our data. These data sources include UKDataHouse and the Post Office.

We carefully manage the communications we send you to ensure that we are contacting you in the most appropriate way and that we are not sending you unwanted communications. To do this, we may combine the information that we collect about you and analyse what we know about your interests, preferences and level of potential engagement or donation. We may use data that we have not directly collected from you, such as information from Companies House, Media, and Dun and Bradstreet. We may also use statistical analysis on this data to understand the likelihood that you will be interested in or responsive to a campaign or message.

You can opt out of your data being combined and analysed for marketing purposes by contacting us. However, this may mean that you stop receiving marketing communications from us more generally

What rights you have over your data

We will only collect the data that we need to carry out the purposes you have contacted us for, or given us permission to use it for.

To enable us to carry out the purposes you have contacted us for, there will be occasions when we will make some data collection mandatory i.e. your name and address to claim gift aid, or your email address to access our services. If you don’t provide this data, we cannot carry out the purposes you have contacted us for.

We will always tell you why these fields are mandatory.

As an individual whose personal data is processed by Cerebra you have the following rights:

• the right to be informed – which is what this privacy notice is for
• the right to access the data we hold about you the right to object to direct marketing – either use the ‘unsubscribe’ button on our emails or contact us directly
• the right to object to processing carried out on the basis of legitimate interests
• the right to erasure (in some circumstances)
• the right of data portability
• the right to have your data rectified if its inaccurate
• the right to have your data restricted or blocked from processing

To exercise any of these rights, please use the contact form to get in touch.

If you are not happy with the way we have handled your data, and are unable to resolve the issue with us personally, you can complain to the ICO.