USPG Privacy Notice
We want to let everyone connected with USPG – whether you are a supporter, volunteer, participant in one of our programmes or just interested in finding out more about what we do – know that we value you for your contribution to everything that makes USPG the unique organisation it is. However, we would like you to be happy with the ways we contact you and to make it easy for you to tell us how you would like to receive information. We also want you to be aware of and comfortable with how your personal information is gathered and used. This notice provides these details, and we also want to tell you we follow data protection legislation and guidelines and applicable fundraising and other standards, as it is important to us that we respect and protect your personal information.
1) Who we are
We are the United Society Partners in the Gospel, although we are usually known as USPG.
USPG is a charity registered in England and Wales and our charity number is 234518.
Our Information Commissioner’s Office reference is Z5845874.
The USPG office address and other contact details are: USPG, 5 Trinity Street, London, SE1 1DB, England. Phone: +44 (0)207 921 2200. E-mail: info@uspg.org.uk Website: www.uspg.org.uk
2) What this privacy notice covers
- A definition of what ‘personal information’ or ‘personal data’ is.
- Why USPG collects and processes information about you.
- The information USPG may collect about you.
- The conditions under which we will use your information.
- Whether we disclose your details to anyone else.
- How we manage your personal information – security, storage and retention.
- Your choices regarding our connection with you.
- The rights you have.
- The Data Protection regulator’s contact details.
3) Questions and changes to this privacy notice
If you have any questions about this notice or about how we use your personal information, please contact us at data.protection@uspg.org.uk, or on +44 (0)207 921 2200, or write to The Data Protection Coordinator, USPG, 5 Trinity Street, London, SE1 1DB, England.
Please note that from time to time we may need to amend or update this privacy notice; for example, if there is a change in the way we use personal information or because of updates to the law. Please check this privacy notice periodically to make sure that you have seen the most up to date version (it is easiest to check via USPG’s website at https://www.uspg.org.uk/privacy-notice).
4) Definition of personal information
Your ‘personal information’ or ‘personal data’ is any data that identifies you directly or is any data which can be identified as relating to you personally.
5) Why we collect and process information about you
We collect and use personal information for a variety of reasons, but they all contribute towards enabling USPG’s work supporting churches around the world in their mission to bring fullness of life to the communities they serve.
If you are enquiring about our work or requesting one of our resources, we will collect enough information to enable us to answer your questions or send you your order.
For supporters, we want to be able to tell you about USPG’s work in a way that recognises your connection with us, and to send information about fundraising and give you other opportunities to support or get involved in USPG’s activities and events.
If you are a volunteer, we use your personal information to help coordinate our volunteers’ activities and ensure you are volunteering in the way that suits you best (for the more formal part of your connection with USPG, see the Privacy Notice for Volunteers).
Engaging with USPG’s programmes, events or other activities in Britain and Ireland or around the world may mean we need to collect and use your personal information to enable you to participate fully. These include Journey with Us, which is made up of a number of short-term experience programmes allowing participants to spend time in a variety of settings within Anglican and United churches around the world.
6) The personal data we collect and use
USPG collects, stores and uses different types and amounts of personal information about you, depending on the type of connection you have with us and the ways you engage with us. This allows us to work with and communicate effectively with you.
a) When you give us information
Almost everyone will be asked for basic contact details, so we can keep in touch with you. Other information asked for will depend on the context. For example, if you are a supporter we will ask for particular types of information if you want to make a donation, but if you want to join one of our international programmes we will need different information. The types of information we ask for may include:
- Your name, postal address, e-mail address and telephone number;
- Financial data, such as bank account details and whether your donations qualify for Gift Aid (see section 9 for more information on payment security);
- Details of your interests, opinions, preferences and the ways you support or have supported us, for example whether you have worked overseas with USPG or how long you have supported us for;
- Details of your experience;
- The motivation behind offering to participate in one of our programmes;
- Contact details for referees if they are needed to enable you to join a programme (please first ask for their permission to give us their contact details).
The personal information you give us may then lead us to generate further information about you, such as:
- A record of donations you have made and data about your tax status for Gift Aid purposes;
- Details of potential placements for you as part of our international programmes;
- A note of the ways you interact with us and when.
We aim to keep accurate records, so we appreciate it if you inform us of any changes to your personal information. This can be done by informing your usual contact at USPG or by telling our Supporter Care Team at info@uspg.org.uk, or on +44 (0)207 921 2200, or by writing to USPG, 5 Trinity Street, London, SE1 1DB, England.
b) When you use USPG’s websites
When you use our websites we collect data about the services and features you use and how you use them, including how you interact with its content.
When you provide your personal information when filling out a registration form, making a donation, communicating with us, or signing up for or receiving a service on our website, we will collect this data and store it on your record in our secure database, so we can fulfil your request, answer your enquiries and keep a record of our communication with you.
The USPG website uses cookies. Cookies are files which are sent to the computer or device through which you access the website and collect small amounts of data. They are used to store information about the computer or device and your preferences so that our website doesn't have to keep asking you for them. We use cookies on the website as follows:
- Forms on the website will collect data – such as your name, e-mail address and postcode – that will allow us to identify you each time that you log in in order to help us provide certain information about you when you complete them. This may help forms automatically fill in information about your name or your contact preferences.
- To allow us to collect statistical and performance data about how the website is used. We may collect geolocation data about your geographic location, the mobile device that is used and to confirm what browser you are using, and computer operating systems that are being used. This data doesn’t contain any identifiable information about people. We use this data to improve the functionality of our website and ensure you have a good experience when browsing it.
- Facebook and Twitter collect pixel cookies that are used to collect data about which sections of the website are accessed by people who are registered users of these social media services. This data is not collected by USPG, but we can use it to reach new audiences when it is made available to us by Facebook and Twitter. We only have access to aggregated data from these companies, not identifiable personal information.
Our website may include links to other websites whose privacy practices are outside our control. You should check the privacy notice of any third party website before disclosing your personal information.
c) When you use social media
When you view information published on social media hosted across various platforms, we will collect and receive information that provides aggregate data relating to items such as video views, demographics and location data. Sources of this data may include:
- YouTube, Vimeo and Instagram;
- Facebook and Twitter. Identifiable personal information about people who access these platforms is collected in order to allow us to better understand our audience.
Special category or sensitive personal information
‘Special category’ or ‘sensitive’ personal information is defined in the data protection legislation and includes information relating to health, ethnic origin, political affiliation or religious beliefs.
USPG only collects and uses special category information when it is necessary to do so and with your explicit consent. This will primarily be when you engage with our international programmes, but may also be in connection with other activities, such as USPG’s annual conference. We will explain why we are collecting it and how the information will be used.
Data from third parties
We may collect additional information about you from other organisations or companies that provide such a service. For example we use information from Crockford’s Clerical Directory to keep clergy contact details up to date. We ensure that information is only collected from legitimate sources on a lawful, fair and transparent basis in accordance with data protection legislation.
We may receive personal information about you from organisations like Just Giving, if you make an online donation via them, rather than directly to USPG.
Personal information created by USPG
We carry out internal research and analysis of personal information, which may result in new personal data being created about you and added to your USPG record. For example, our research includes analysing the response to our fundraising appeals or attendance at events. We also group people according to common characteristics. Having this information allows us to better understand everyone connected with USPG, helps us improve our relationships and ensures we communicate with you in the most relevant way. Processing internally generated personal information also contributes to enabling us to manage our communications as cost effectively as possible.
This personal information can also form the basis for further analysis, with personal identifiers removed, allowing reports and statistical information about USPG and its work to be compiled and disseminated.
7) The conditions under which we will use your personal information
USPG relies on the following conditions to use your personal information in the ways described in this privacy notice. These are the definitions for the ‘legal basis for processing’ in data protection legislation and are listed in alphabetical order:
- Consent: when you give your clear agreement to or opt-in to receive information and marketing by e-mail. We use this consent to send you our e-mail newsletter, offer you marketing using e-mail and engage with you via social media sites such as Facebook and Twitter
When you participate in any of our international programmes and these involve sharing your personal information with one or more of our partners around the world, we will obtain your consent for this in advance. In addition, we will only share the information about you that they need to enable your involvement in the programme in their context.
- Contract: where we agree to provide any products and/or services to you, we will use your personal information in order to arrange for the provision of those products and/or services, as well as performing obligations to you or enforcing our rights under any contract we have with you.
- Legal Obligations: when we are under a legal obligation to process your personal information for a particular purpose. For example, obligations we have to hold information about donations or manage Gift Aid information in compliance with applicable tax laws. We may also sometimes need to process personal information for the purpose of being able to establish or exercise our legal rights or to defend legal claims.
- Legitimate Interest: this is the legal basis we rely on to send information or marketing by post or telephone when you take part in supporting USPG’s work by making a donation, or requesting information about our work, programmes, advocacy campaigns, events or other services.
Telephone marketing will not include people who have registered with the Telephone Preference Service (TPS) or indicated to us that they don't want to receive marketing calls made this way. The only time we will contact you by telephone when you have registered with TPS is if you have given your consent directly to USPG to receive marketing calls.
When you engage with our programmes, whether based in Britain and Ireland or with the intention of travelling elsewhere around the world, we have a legitimate interest in processing your personal information as part of the procedures for ensuring the success of those programmes and/or your participation in the programme.
We also have a legitimate interest in being able to use and process personal information for internal administrative purposes, and when it is necessary to take measures to protect our IT systems and data security or to protect ourselves (and our beneficiaries and supporters) from risks to USPG, such as fraud, criminal conduct or reputational damage.
When processing your personal information based on a legitimate interest, we will make sure that it is exercised proportionately and is always balanced against the privacy rights and other legal rights you have as an individual.
‘Special category’ information
If we are processing any personal information that is regarded as 'special category' or 'sensitive' as referred to in section 6 above, we will only do this with your explicit consent; or where needed to protect your vital interests (or those of someone else) in an emergency; or where you have already publicised such information (such as your religious affiliations); or where we have a need to use such data in connection with a legal claim relevant to us.
Fundraising, campaigning and marketing
We send fundraising and direct marketing communications to our supporters, which includes news, information and data about:
- USPG and its work, and related events and campaigns;
- Opportunities to volunteer;
- Appeals and fundraising;
- Our events and activities, including locally arranged events;
- Resources offered by USPG;
- Leaving a legacy.
We rely on donations and other support to continue our work on behalf of the Anglican and United churches around the world. Being able to contact you for marketing and campaigning purposes is an important part of our fundraising activity and purpose.
USPG does not share personal information with any other organisation, individual or company to allow them to use your personal information for marketing or campaigning purposes.
Anonymised data
Where possible, we anonymise the personal information we use so it can no longer be linked to any particular person. For instance, anonymity may allow us to tell a story without putting the person who tells it at risk of harm.
We may also aggregate data and the combination of aggregated anonymised data can be used for a variety of purposes, such as recruiting new supporters, or to identify trends or patterns within our existing supporter base. This data also helps inform our actions and improve our work, communications and resources.
8) Who helps us manage your personal information and who we share it with
USPG uses a number of companies and organisations who provide services that help us manage personal information or who need to receive personal information to fulfil the service they provide to us. In addition, others have access to personal information as a by-product of the service they provide. They are known as ‘data processors’ and act on USPG’s instructions. The types of organisation include:
- the mailing houses that send out Koinonia, resources and our supporter communications;
- payment processing service providers, operating to Payment Card Industry standards;
- the company which supplies and hosts our supporters’ database;
- our IT services provider;
- the agency that carries out Disclosure and Barring Service (DBS) checks on our behalf;
- online events registration providers;
- the company that supplies and hosts our accounts software;
- USPG’s Auditor.
These organisations all operate under contract with USPG and are expected to comply with all data protection obligations.
There are instances where USPG is or may be required by law to share personal information:
- for taxation purposes – with HMRC in connection with tax claims under Gift Aid;
- in the interests of national security;
- to assist with criminal investigations.
We may also share your personal information when you have given your consent to this. In particular, we will only share your information with our church partners around the world when you have specifically agreed to this.
9) Managing your personal information – Security, Storage and Retention
USPG considers keeping your information safe to be vitally important. We employ a variety of physical, organisational and technical measures to ensure we do this, and prevent unauthorised access to – or use or disclosure of – your personal information.
Electronic data and databases that contain personal information are stored on secure computer systems and we manage who has access to that information using both physical and electronic means. Our staff receive data protection training and we have detailed procedures and policies that staff must follow when handling personal information.
All paper records and data are managed securely in lockable storage.
Payment security
All electronic forms that request financial data will use the Secure Sockets Layer (SSL) protocol to encrypt the data between your browser and our servers.
If you use a credit or debit card to make a donation or purchase something online your card details are transferred securely to our payment card providers, Stripe, who comply with the payment card industry data security standard (PCI-DSS) published by the PCI Security Standards Council. We do not store any payment card information.
We cannot guarantee the security of your home computer or any information sent over the internet or any publicly accessible communications network and using any online communications services are at the user’s own risk.
Where we store personal information
Wherever possible we store data in the United Kingdom or within the European Union (EU). Some organisations and companies that provide services to us may transfer personal information to territories outside of the EU, such as Canada (a country whose legal system the EU Commission considers to have adequate data protection standards), or to the United States (which does not have such EU approval in relation to its data protection standards). However in the latter case, we will only allow such a transfer when there is recognised assurance, such as the service provider being a member of the EU-US Privacy Shield Framework (e.g. Facebook, Twitter), or we have put other legally appropriate safeguards and/or contracts in place to ensure that your personal information is adequately protected in accordance with EU privacy standards.
All our paper records are stored in the United Kingdom.
How long we store personal information for
We use and store personal information for as long as it is required for the purposes it was collected for.
We have a data retention policy that sets out the different periods of time we retain personal information for in respect of these purposes and in accordance with our duties under applicable data protection legislation. The criteria for determining retention periods are based on various legislative requirements; the purpose for which we hold the personal information; and guidance issued by relevant regulatory authorities, including the Information Commissioner's Office (ICO) and Her Majesty’s Revenue and Customs (HMRC). Personal information that we no longer need is securely disposed of. Some personal information may be retained in USPG’s archives for historical research purposes, although we will do this in a manner that complies with data protection legislation.
We regularly review the personal information and records that we hold, and delete or dispose of what is no longer required. We never store payment card data.
For further information about data retention or our archives, please contact the Archivist at archive@uspg.org.uk or via the other contact details listed in section 1 above.
10) Your choices and updating your information
You can update your personal information and change your preferences about how we contact you whenever you choose. You can also stop us contacting you by one or all of the following methods –post, telephone or e-mail.
To make changes, please contact our Supporter Care team at info@uspg.org.uk, or on +44 (0)207 921 2200, or write to USPG, 5 Trinity Street, London, SE1 1DB, England.
Please note: if you ask us to stop sending postal mailings, we will update our records as quickly as we can, but mailings are prepared in advance of being sent so you may still receive post for a short period after you ask us to stop.
USPG’s email newsletters
If you have previously opted-in to receive USPG’s e-mail newsletter, but no longer wish to receive them, please click the unsubscribe link at the bottom of any of our emails to be removed from our list.
11) Your rights
Offering you choices about how we use your personal information is important to USPG, but we also want to be sure you understand your data protection rights, which are briefly set out below:
- You have certain rights of access in relation to your personal information. We will confirm whether or not we have any of your data and, if we do, provide a copy of the personal information we hold and other information about how we process your information within relevant timescales (usually a month for simple requests, although timescales can be extended for complex requests). This is the Right of Access, which is activated by making a Data Subject Access Request.
- The right to have your personal information that we no longer need erased from our records. This is the Right to be Forgotten.
- The right to have inaccurate personal information amended. This is the Right to Rectification.
- The right to ask us to stop using your information in certain situations. This is the Right to Restrict Processing.
- The right to prevent your personal information being used for marketing or profiling. This is the Right to Object.
- A right (in certain circumstances) to have a copy of your personal information provided for reuse by another organisation. This is the Right to Data Portability.
If you would like further details about your rights or would like to exercise them, please contact our Data Protection Coordinator at: data.protection@uspg.org.uk, or on +44 (0)207 921 2200, or by post to The Data Protection Coordinator, USPG, 5 Trinity Street, London, SE1 1DB, England.
If necessary when receiving a request, we reserve the right to ask for further information to verify your identity or to clarify the information that you are seeking.
12) If things go wrong
While we hope you will be happy with how USPG manages your personal information, sometimes things can go wrong. If they do, we will aim to put them right as soon as we can. However, if you are dissatisfied with USPG’s response you can contact the UK Information Commissioner's Office (ICO) at:
Information Commissioner's Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
- 0303 123 1113 (local rate) or 01625 545 745
Fax: 01625 524 510