We value your privacy. We promise to keep the data you trust us with safe. And we will never share your data with other organisations for their marketing purposes.
Who are we?
Innovista International (hereafter referred to as Innovista) is a charity registered in England and Wales (1108679) and a company limited by guarantee (5371169). Our registered address is Suite A, First Floor, Meridian House, Sandy Lane West, Oxford, OX4 6LB, UK. We are committed to protecting your privacy and will only use the information that we collect about you lawfully. This policy aims to give you an understanding of how and why we use the information you provide to us both online and otherwise, and covers all of Innovista’s activities, including our Thrive initiative.
What information do we collect and why?
We collect information that is personal data. Personal data is information that can be used to help identify you, such as your name, email address, postal address, telephone number, mobile telephone number and bank account details, and whether or not we can claim Gift Aid on any donations you may make. It also includes Internet Protocol (IP) addresses (the location of the computer on the internet), details of pages visited on our websites and files downloaded.We collect information in the following ways:
- Information you give us directly. For example, when you make a donation, register for an event, download a resource, or subscribe to our mailing list.
- Information you give us indirectly. For example, when you make a donation or register for an event using a third-party platform (such as Justgiving or Eventbrite). Innovista will select only reputable companies to provide these types of services. If you wish, you can check their privacy policies when you provide your information to understand fully how they will process your data.
- Information from third parties. For example, we may receive updated delivery and address information from our agents so that we can correct our records and deliver your next communication more easily.
- Publicly Available Information. We may combine information you provide to us with information available from public sources or records in order to gain a better understanding of our supporters and those who engage with us. This helps us to improve our fundraising methods, resources and programmes. Such information may be found in places such as Companies House and information that has been published online and in print.
How do we store and protect the information about you?
It is very important to us that any information we hold about you is safe. That’s why we operate to a high level of security in relation to the collection, storage and disclosure of your information. Information is stored on our database (ThankQ), secure servers or in paper files (which when not in use are stored in locked drawers at our offices), accessible only by authorised personnel who adhere to this policy. We do not collect or store your credit or debit card details. These are collected and processed securely by trusted and authorised third party payment providers. The information we collect from you may be transferred to, processed and/or stored at a destination outside the European Economic Area (EEA). This may occur if, for example, one of our supplier’s servers on which personal information is stored is located in a country outside the EU or if we use a cloud IT platform where data is dispersed between a number of different servers. These countries may not have similar data protection laws to the UK. However, we will take steps to ensure that the recipient treats your data with the same level of care as we do. If you have engaged with us from outside the EEA, your information may also be processed by authorised personnel operating outside the EEA (e.g. if you engage with one of our programmes from a country outside the EEA and we pass your details to an Innovista trainer to provide you with training and support). By submitting your personal information to us you agree to this transfer, storing or processing at a location outside the EEA.
If you are aged 16 or under and would like to make a donation, receive communications from us, or get involved in any other way, please make sure that you have your parent or guardian’s consent before giving us your personal information. Where we know that you are aged 16 or under, we will take appropriate steps to ensure that you do not receive any fundraising appeal communications from us. See also our Vulnerable Supporter Policy and Safeguarding Policy.
How do we use the information about you?
We use the information that we hold concerning you as an individual supporter in accordance with the provisions of data protection legislation. We use this information to administer our relationship with you and to provide you with information about our activities. We may use (or ‘process’) your personal data to:
- Deliver literature, resources, and other materials that you have requested from us;
- Administer your donation including processing Gift Aid;
- Keep a record of your relationship and correspondence with us;
- Communicate with you (where we have a legal basis to do so) by post, phone, e-mail and SMS for marketing purposes, to provide you with information about us, our fundraising campaigns, our events (including challenge events such as marathons), conferences, products and services, and any other information we think may be of interest (e.g. supporter updates);
- Manage your communication preferences;
- Carry out research to find out more information about our supporters’ backgrounds and interests;
- Comply with applicable laws and regulations, and requests from statutory agencies;
- Analyse the use of and effectiveness of our websites;
- Further our legitimate charitable aims such as sending you information about how donations are being used or sending you an annual report;
Research and Wealth Screening: In order to offer an excellent experience for our supporters, we may from time to time access publicly available information about you (e.g. Companies House records, media sources) to help us understand more about you and your interests. We do this to identify Innovista supporters who may be able to make significant donations in line with their interests, and to ensure that any such requests made are appropriate. This may include the use of profiling techniques and wealth screening to compile information using publicly available data about you or information that you have already provided to us. We may use third party agencies as a cost-effective way to undertake these activities on our behalf and share your information with them to the extent required. You will always have the right to opt out of this processing. To ask for a further explanation of wealth screening please email us at firstname.lastname@example.org or call us on 01865 788350. Your Preferences: You can choose at any time which marketing materials you want to receive from Innovista and in which format. If there is something you would prefer not to receive, please email us at email@example.com or call us on 01865 788350. Dates of Birth: Innovista process dates of birth (actual or estimated) for our supporters, which is either received from you (e.g. through a survey) or through publicly available information. We use this information to tailor our messages to you appropriately, and to adhere to our internal policy to not send fundraising appeals to under-16s. Sensitive Categories: If you provide us with sensitive/special categories of personal data including, but not limited to, your racial or ethnic origin, political opinions, religious or philosophical beliefs or your physical or mental health, we will only use this for the specific purpose for which you gave permission and where it is within our legitimate interests to process or where we have other legal grounds to do so.
Do we share this information with others?
We will not sell or share your personal data with other organisations for their marketing purposes. We may allow our staff, Innovista trainers, professional advisors, consultants and/or external providers acting on our behalf to access and use your information for purposes within our legitimate interest (e.g. to deliver mailings, to analyse data, to process payments, to process Gift Aid). These data processors have access to personal information needed to perform their functions, but may not use it for other purposes. Innovista will select only reputable third parties who will comply strictly with our instructions, with data protection laws, and will make sure that appropriate controls are in place. Third-party data processors being used by Innovista at the time of this policy include: Charities Aid Foundation (to process monthly donations), Mailchimp (to send communications by email), SagePay (to process donations), HMRC (to process Gift Aid claims), Xero (for bookkeeping and expenses). Innovista may disclose your personal information where we are under a duty in order to comply with any legal obligation (for example to government bodies and law enforcement agencies).
What is our legal basis for processing data?
Under the General Data Protection Regulation, there are six lawful bases to process personal data. We rely on a variety of these for using (or ‘processing’) data depending on the purpose for which the data is being processed. Legitimate interest is about balancing Innovista’s interests against your interests, rights and freedoms. Basically, it means that when you provide your personal details to us we may use your information for our legitimate interests to carry out our charitable aims and objectives. But before doing this, we will also carefully consider and balance any potential impact on you and your rights. We will not process data in ways that a reasonable person would not expect us to in the circumstances. We rely on legitimate interests for a variety of purposes, which include:
- Contacting you via mail or telephone about events or resources which you may be interested in, based on your previous engagement;
- Sending you updates in the post, such as magazines, newsletters, or our Annual Review;
- Saying thank you (by mail or telephone) to you if you make a donation, both at the time of your donation and at other times to communicate our gratitude and to let you know how your gift has made a difference;
- Research and wealth screening activity to better tailor any financial requests we make of you so that they reflect your specific interests in Innovista’s mission and are at an appropriate financial level;
- Contacting you via the mail or telephone with fundraising appeals and asking for your support based on your engagement with Innovista’s events, programmes and communications. When contacting you by phone, this will be done by an Innovista staff member or volunteer, and not outsourced or automated.
You can let us know at any time if you would prefer not to receive these communications. We use your consent for all email newsletters and e-appeals delivered by Innovista and our programmes. For some electronic communications which involves commercial marketing of products or services (e.g. marketing of leadership courses and resources) we will rely on ‘soft opt-in’ e.g. for people who have recently downloaded a resource, where we believe you will probably be happy to receive marketing about similar products or services. An opt-out will always be provided at the point of collecting your data, and every electronic communication you receive will give you the option to unsubscribe. We use compliance with a legal obligation as the basis for processing any legally required activities such as Gift Aid returns to HMRC.
How long do we keep your data for?
We will hold your personal data for as long as is needed to fulfil the function for as long as is required by law for the relevant activity (e.g. HMRC requires us to keep a record of donations, Gift Aid and financial transactions for seven years) and for no longer than is necessary for the purposes for which it is processed, in accordance with our internal policies.
What are your rights?
You will always have the right to:
- Request a copy of the information that we hold about you (known as a Subject Access Request). If you would like a copy of some or all of your personal information, please contact us;
- Ask us to correct or remove information you think is inaccurate: we want to make sure that your personal information is accurate and up to date;
- Opt-out of receiving all or some of our marketing communications (as defined by the Information Commissioner’s Office and which includes our newsletters, magazine, campaign updates, appeals and event invitations);
- Request that we stop processing data about you for certain purposes (e.g. profiling) at any time by contacting us;
- Complain. Our complaints policy is set out in full here.
You can contact our Data Protection Lead at firstname.lastname@example.org, in writing to our registered address, or by calling 01865 788350.