Edition Date: June 2023

Yorkshire Cancer Research (the Charity) is committed to keeping your information secure and managing it in accordance with our legal responsibilities under privacy and data protection laws where we operate.

This Privacy Policy provides information about how we process your personal information in all contexts, whether or not you provide the information over our website.

By visiting our website, you agree to your personal information being used and disclosed in the manner set out in this Policy.

For the purposes of data protection law, Yorkshire Cancer Research is the controller of personal data which you provide when you interact with us.

1. The personal information that we collect

When you use www.yorkshirecancerresearch.org.uk certain limited information (such as your browser type and IP address) will be collected by us automatically.

We will also collect and store certain personal information when you make a donation through yorkshirecancerresearch.org.uk, by telephone, by post or in person (for example, at a community event), signing up to a Direct Debit programme, through an online fundraising platform (for example JustGiving, Virgin Money, etc.) or when donating through an individual’s social media fundraising campaign (for example, via Facebook). To enable us to process donations we will collect basic payment information. If you are eligible for UK Gift Aid, we may also ask you to confirm your UK home address.

You may also provide us with personal information if you complete a form on the Charity’s website, for example if you sign-up to volunteer at a Yorkshire Cancer Research event.

If you make a donation through our text message service (which is administered on our behalf by a third-party service provider), your donation will also be managed in accordance with this Policy. If you wish to claim UK Gift Aid on the donation, or leave a message of support, we will collect information about you as explained in this Policy.

If you apply for a job or volunteer role with the Charity, you will provide us with personal information on your application form and/or in your covering letter and CV. We will generate further personal information in the course of creating interview notes and running recruitment assessments. We may request references about your employment or volunteer history from the referees you provide. For some roles we may also require a basic criminal records check, through the Disclosure and Barring Service (DBS).

For job applicants, we will also provide a link to, or send, a detailed Job Application Privacy Notice providing further detail.

Personal information may also be collected by, and shared by us with, our local voluntary committees (see section 4).

We may also collect personal data from you if you volunteer to help in one of our high street shops.

We may contact you from time to time to ask you if you would be interested in sharing personal experiences you may have had in relation to cancer, or to provide comments on the work that we do. We would explain in further communications with you how that information would be used, and we treat all such information that our supporters share with sensitivity and care.

We will also collect personal information in connection with our funding of charitable research and other activity, in particular from our peer reviewers, Research Advisory Panel members, the administration staff of the universities or other institutions which we fund and/or with whom we work on research and services projects, and those who make an application for charitable, or are given an Award.

Your image may be recorded on CCTV when you visit one of our shops or offices.


2. How we use personal information


We use the personal information collected for a number of purposes:

- administering donations made (and claiming Gift Aid, if applicable).
- personalising our communications to fit personal preferences which you have told us about.
- providing fundraising related news stories, event information, and updates on campaigns or fundraising via email or SMS messaging, where you have consented to receive these communications.
- to provide you with newsletters, event information and other fundraising related news stories by post. We will do this on the basis of our legitimate business interests, and you may opt out of postal communications at any time.
- in the delivery of our will-writing service.
- analysing our supporter base to improve the relevance and effectiveness of supporter interactions.
- contacting you in connection with charitable funding opportunities, to give information about our charitable funding opportunities, any applications for charitable funding submitted to us, any Awards you may hold with us, or where you are involved in a peer review of any such applications.
- considering applications for recruitment, conducting recruitment interviews and assessments, and contacting employment referees.
- to help us prevent fraud or criminal activity associated with online payments.
- improving the service we offer – for example you may be asked to complete one of our online user satisfaction surveys, and
- in the delivery of our charitable research and services activities – for example, we will keep a record of your details if you hold an Award from us to undertake research; or an Award to provide services to patients; or you are an expert in cancer research or cancer services and have peer reviewed an Award proposal for us; or if you are a member of our Research Advisory Panel.
- To protect our employees, volunteers, customers, premises, and assets from crime, we operate CCTV systems in our stores and outside our offices which may record images for security. Our CCTV systems do not use facial recognition, nor do they collect biometrics; they are also not connected to other systems containing personal data. We operate these systems on the basis of our legitimate interests.

In accordance with data protection laws, all processing (i.e. use) of your personal information is justified by a "condition" for processing. In the majority of cases, processing will be justified on the basis that:

You have consented to the processing (for example, where you consent to receive electronic marketing communications from us). In these circumstances, you may withdraw your consent at any time (for example, by using "unsubscribe" links included in emails).

The processing is necessary for the performance of a contract with you or in connection with steps preparatory to entering into a contract with you (for example, where you enter into a funding agreement with us in connection with research which the Charity is supporting).

The processing is necessary for us to comply with a relevant legal obligation (for example, the disclosure of certain information to HMRC, or the maintenance of proper records which charities are required to maintain); or

The processing is in our legitimate interests as a charity, provided these are not overridden by your interests and fundamental rights. Examples of our legitimate interests include: to analyse the composition and demographics of our supporter base better to understand and serve those supporters (for example, with events which we think will appeal to our supporters); to improve the effectiveness of our fundraising efforts; to send you marketing materials and other personalised communications in the post; to help to prevent fraud associated with online payments; to contact you via electronic means for non-marketing related purposes (e.g. in relation to peer review of Awards we might make); or to work with our peer reviewers and Research Advisory Panel members to evaluate applications for research or services Awards.


3. Communications from us

Where you have indicated that you would like to hear from us, we may send electronic marketing communications in various forms (for example, email or SMS), in accordance with the preferences you have expressed. If you are an existing donor or volunteer, we may from time to time send you marketing communications in the post or contact you by telephone. We will do this to tell you about news stories, our charitable activities, details of upcoming Charity events and developments in the services we make available.

You have complete control over if and how we communicate with you for marketing and promotional purposes. You can unsubscribe from receiving electronic or postal messages by following the “unsubscribe” instructions included in our communication. You can also contact us at any time on supportercare@ycr.org.uk or you can call us during business hours on 01423 501269 to opt-out of any or all forms of marketing communication.

Please note that even where you opt-out of marketing communications, we may still send you non-marketing communications (for example, event information relating to an event you have signed-up to, information about any ongoing donation you are making to the Charity or correspondence relating to a funding application you have made).

The accuracy of personal information is determined by the accuracy of the information you supply to us. If you have an ongoing relationship with the Charity (for example, you are a supporter, volunteer, Award holder or beneficiary of our charitable activity) we encourage you to notify us when there are changes in your personal details (for example of change of postal address or email address), so that we can keep our records up to date. In addition, we will proactively take steps to do this from time to time.


4. Providing information to others, including service providers

We work closely with a number of trusted business and charity partners with whom we need to share personal information to help us operate this website and manage our ongoing relationship with you. These include:

- banks and payment providers – to authorise and complete payment transactions;
- organisations within the payment card industry to help prevent online fraud;
- direct mail providers to print and post newsletters and other printed materials that we may send to you from time to time;
- law enforcement bodies in order to comply with any legal obligation or court order and, where we are otherwise requested to provide information, we provide it but only in accordance with applicable privacy and data protection laws;
- If we discover any criminal activity or alleged criminal activity through our use of CCTV, fraud monitoring and suspicious transaction monitoring, we may share this data with law enforcement bodies for the purposes of preventing or detecting unlawful acts;
- HM Revenue & Customs, but only if we need to authorise claims for Gift Aid or other forms of tax efficient ways of giving;
- organisations who provide the will-writing services accessed through our websites;
- in relation to our charitable funding activities, we may share personal data of applicants who make applications for charitable funding with external reviewers, who may be located outside the United Kingdom, - to assess the suitability of any applications or proposals we receive; and
- organisations linked to our charitable activities such as the Association of Medical Research Charities (AMRC) and the National Cancer Research Institute (NCRI).
- We may also provide information to third party service providers who process information on our behalf to help run some of our internal business operations including email and mail distribution, tax and financial management service providers, IT services and customer services, or in relation to this website, such as card payment providers. Where we use service providers, we will enter into appropriate contracts to ensure that we are able to exercise control over their access to, and use of, your personal information.

We will only share information with such organisations where (i) we have a legitimate reason to do so, which is related to one of the ways in which we use your information, as set out at section 2 above; or (ii) where a disclosure is required by law or covered by a relevant exemption from disclosure restrictions under data protection law.

We may also transfer personal information to our local voluntary committees, which help to organise fundraising events in local communities on behalf of the Charity.

We may share details of successful applications for charitable funding with other organisations usually after our funding decisions have been made, under these strict circumstances: 1) with another charity if we are considering co-funding the application with them; 2) with Cancer Alliances and Clinical Research Networks to discuss coordination of cancer research activities regionally and resourcing and support issues for conducting the work; 3) with relevant umbrella Research or Service organisations, such as the AMRC or the NCRI, where it is either (a) in line with our charitable aims to do so or (b) we are required to do so (as part of any membership criteria for example).

You understand that we may disclose or share your personal information with such business partners in order that we may manage our relationship with our supporters, operate our website and comply with our legal obligations.


5. International transfers

Some of our service providers and group companies may be located in the UK, other countries in the European Economic Area or elsewhere in the world (for example our card payment provider in the United States). Different privacy laws may apply in these countries and you understand and unambiguously consent to the transfer of personal information to these countries and service providers.

If personal information is transferred outside the UK we will take steps to ensure that the information receives the same level of protection as if it remained within the UK, including by entering into data transfer agreements, using EU Commission or ICO approved Standard Contractual Clauses, or by relying on adequacy regulations or certification schemes that have been approved by the ICO. You have a right to be provided with details of the mechanism under which your data is transferred outside of the UK.


6. Keeping information secure

We take appropriate steps to protect your personal information from loss, misuse, unauthorised access, modification or disclosure. However, we cannot be held responsible for unauthorised or unintended access that is beyond our control.


7. Keeping your records

If you are a supporter, donor or charitable funding Award holder we will keep certain personal information about you (such as your contact details and, where relevant, bank account details required to take donations) for as long as you remain a supporter, donor, Award holder or beneficiary of our charitable activity. We will also retain some personal information, such as your name, and a record of the fact that you were a supporter. This helps us to resolve any queries and complaints in the future.

The retention periods for some of the records we keep are set by legal requirements or regulatory recommended practice, for example, in the context of tax and accounting requirements that are relevant to your donations or gifts. We maintain a Data Retention Policy, which we apply to records in our care, which contains further detail on the principles explained in this Privacy Policy.

We retain records of successful research and services applications (Awards) for an extended period of time, governed by our Data Retention Policy in order to track and monitor impact of Awards as is expected by best practice in the research sector and, in order to deal with queries which may arise concerning the work we fund. We retain unsuccessful applications for a shorter period of time, as set out in our Data Retention Policy.

CCTV footage is deleted after 30 days unless there is an overriding reason to be retained.

Where your information is no longer required, we will ensure it is disposed of in a secure manner and, where required by applicable law, we will notify you when such information has been disposed of.


8. Analytics

We collect, assess, store and analyse information regarding how you use our website and electronic communications, the pages you visit and time spent on each page. This information is used for statistical analysis and helps us to improve the website and, whilst we note this issue here, it has no impact upon you.

These tools may be provided by third-party service providers and may include the collection and tracking of certain data and information regarding the characteristics and activities of visitors to our website. We may disclose data, including personal information, to certain such third-party services providers in order to obtain such services.

One of these providers is Google Analytics and more information about the ways in which they collect and process your personal data can be found here:

https://policies.google.com/technologies/partner-sites?hl=en-GB&gl=uk

If you use buttons on our website linked to social media or similar sites (for example “Like” and/or “Share” buttons), content from our website may be sent back to that other website and, depending on your privacy settings, may be privately or publicly visible (for example to friends, followers or generally to anyone who has access to your profile page).

You may request further details on these other tools and third parties from us.


9. Cookies

Our website uses cookies (which includes third party cookies to support social media, personalisation and analytics functionality).

Cookies are small computer files which are downloaded onto your device and collect information about the way in which you navigate and use our website and the internet. Cookies do not collect information which allows us to identify individuals. The information provided by cookies helps us to provide you with a more personal experience and allows us to make improvements to our services over time. You may delete and block all cookies or decide to just block certain types of cookie via your browser setting. However, if you choose to block or delete cookies, this may affect the functionality of the website when you use it.

For more information, please refer to our separate cookie policy: https://yorkshirecancerresearch.org.uk/cookie-policy/


10. Personal information rights

Subject to certain conditions and exemptions, you have the right to:

- obtain a copy of your personal information together with information about how and on what basis that personal information is processed.
- rectify inaccurate personal information (including the right to have incomplete personal information completed).
- erase your personal information (in limited circumstances, where it is no longer necessary in relation to the purposes for which it was collected or processed).
- restrict processing of your personal information where:
- the accuracy of the personal information is contested.
- the processing is unlawful but you object to the erasure of the personal information.
- we no longer require the personal information, but it is still required for the establishment, exercise or defence of a legal claim.
- challenge processing which we have justified on the basis of a legitimate interest (as opposed to your consent, or to perform a contract with you).
- prevent us from sending you marketing communications (please see section 3 above).
- withdraw your consent to our processing of your personal information (where that processing is based on your consent).
- object to decisions which are based solely on automated processing or profiling, and
- obtain, or see a copy of the appropriate safeguards under which your personal information is transferred to a third country or international organisation.
In addition to the above, you have the right to lodge a complaint with the supervisory authority. In the UK this is the Information Commissioner.

If you wish to exercise any of these rights or have any question in relation to these rights, please email or write to us at the address below. Please note that we may, where permitted under applicable law, charge a small administrative fee (for instance if your request is manifestly unfounded or excessive) and we will request proof of identity. We will endeavour to respond to your requests within all applicable timeframes.

In certain circumstances (for example where required or permitted by law) we might not be able to comply with a request (for example, where we consider that the conditions required to exercise the request have not been satisfied, or where a relevant exemption applies), but where appropriate we will notify you of the reasons for this.


11. Complaints Process

If you have a complaint about how we have handled your personal information, you may contact us using the details in section 14 below and we will investigate your complaint.


12. Third Party Websites

If you land on our website from other websites (or move to other sites from our website) you should read their separate privacy policies. We are not responsible for the privacy practices of external websites.


13. Updates

We keep this Policy under regular review and place updates on yorkshirecancerresearch.org.uk from time to time. Please review this Policy periodically for changes.

However, we will always notify you of material changes we make to this Policy and, where required under applicable privacy and data protection legislation, we will appropriately notify or give you the option to consent to changes to the Policy.

If you do not accept our Policy, please stop using our website and/or cease any further interaction with us.


14. Contact

If you have any questions about this Policy or would like to exercise your rights with respect to your personal information, please contact us via supportercare@ycr.org.uk, via telephone on 01423 501269 or write to the Company Secretary, Yorkshire Cancer Research, Hornbeam Square West, Harrogate, HG2 8PA.