Privacy notice

This Privacy Notice explains what information we gather about you, what we use that information for and who we give that information to.

It also sets out your rights in relation to your information and who you can contact for more information or queries. 

• Who this privacy notice applies to and what it covers
• What information we collect
• How we use your personal information
• Legal grounds we use for processing personal information
• How we keep your data safe
• What locations your information is disclosed to
• How we keep your personal information up to date
• Who we disclose your information to
• Your data rights
• Direct Marketing
• Children’s data
• How long we keep your personal information
• Amendments

1. Who this privacy notice applies to and what it covers

Here at Maggie’s (also known as The Maggie Keswick Jencks Cancer Caring Centres Trust) we are committed to protecting your privacy.

If you have any requests concerning information about you that we hold (including any requests to exercise your rights under applicable data protection law) or any queries with regard to how we handle, store or protect your personal information, please contact our Supporter Care Team or Data Protection contact at:

Maggie’s
The Gatehouse
10 Dumbarton Road
Glasgow
G11 6PA

Email enquiries@maggies.org or data.protection@maggies.org or call us on 0300 123 1801.

This Privacy Notice sets out how we collect, handle, store and protect information about you when you visit and use our Website or interact with us over the phone, in person, on paper or through another medium, for example by email. It should be read alongside our Cookies Notice.

It also contains information about when we share your personal information with other parties (for example our service providers).

When we refer to “our website” or “this website” we mean the webpages of www.maggies.org. In this Privacy Notice, we may also sometimes collectively refer to handling, collecting, protecting and storing your personal information as “processing” such information.

Our website may contain links to other websites that are not operated by us and outside our control. These websites are not covered by this Privacy Notice and if you access them using the links provided, the operators of these websites may collect information about you.

We encourage you to review the privacy notice on each of these websites (which may differ from ours) before disclosing any personal information.

2. What information we collect

We collect information about you when you give it to us.  For example, you enquire about our fundraising activities; make a donation; register for an event; make an enquiry; purchase one of our products; tell us your story; visit one of our centres; or if you otherwise provide us with personal information (such as, in person, over the phone, on paper, by SMS or email).

In some cases, we also collect information about you because other people legitimately provide that information to us. For example, sometimes when you support us, your information will be collected by an organisation working for us. In some cases, we also receive information about you from independent event organisers for example, GSI, Kiltwalk, JCP and other third parties (for example JustGiving, Eventbrite, Great North Run, MuchLoved, GivePanel, Cymba) where it is legally permissible for them to share your information with us (for example, you have consented to this).

In addition to the above, we typically collect personal information from you because we observe or infer that information about you from the way you interact with us. For example, we may use cookies and web beacons on our Website so as to automatically collect information about your visit. This information will help to improve your experience when you use this Website and ensure that it is functioning correctly. Please see our Cookies Notice for more details.

The information about you which we collect or obtain typically includes the following details about you: name, date of birth, age, gender, email address, postal address, telephone numbers; country of residence; employment details (for example, the organisation you work for and your job title); family circumstances (for example your marital status and dependants); financial-related information (for example information relating to your means); credit/debit card details; information on why you decided to donate to Maggie’s; and your postings on any blogs, personal story pages, forums and any other social media applications and services we provide. This information can be collected through face-to-face communications, offline registration forms, online forms or through third party providers working on our behalf such as Eventbrite, Enthuse (formerly known as Charity Checkout), GivePanel or Access Paysuite Ltd.

If you visit our Website, we also generally gather information about you based on the way in which you access and use our Website. In particular, we gather information about which pages on our Website users visit most often. We also usually track popular links on Maggie’s emails and collect information on individuals’ IP address; browser and device type; device settings; language; access times and durations; websites you visited before and after our Website; details of how you like to interact with us and similar information. We use this information to personalise the way our Website is used to improve the service we provide to you. Wherever possible we use aggregated or anonymous information which does not identify individuals.

Where you receive electronic communications from us such as emails, we also typically gather information about your use of that communication. This includes information on when you open the communication and what links you click on within it. If you unsubscribe to a communication from us, we will also adjust your preferences and retain a record of this so that we don't contact you inappropriately.

When you visit our Centre(s), we may ask you to share your personal data with us for the effective delivery of our service(s). We mostly use this data to help you get the most out of our cancer support services. While you use our Centre(s), we take note of the courses or activities you participate in, for our statistical analysis and to improve our services.

Please note that in some cases we also collect sensitive personal information, such as details relating to your health, dietary requirements, ethnicity and/or race. This is possible where you are a user of our centres / programmes or you share your story with us about your experiences of cancer. The types of sensitive personal information that we collect vary depending on how you interact with us. In some rare circumstances, we might also gather other sensitive personal information about you because you volunteer such information to us.

When you need Benefits advice or Psychological support, we may collect further personal data. You will be presented with further information and layered privacy disclaimers.

Where we have identified, in some cases via analysis of our supporter database, that you may be able and/or inclined to support us with a significant gift, we may collect additional information about you such as employment, interests, philanthropic activity etc. from public-domain sources like Companies House, LinkedIn, reputable media, published donor lists, charity websites, annual reviews and subscription-based funder databases. We may summarise this into a profile, which may include an estimate of gift capacity, to help us potentially engage with you in the most appropriate way.

None of the information that we request from you is mandatory; however, if you choose not to provide some or all of the information that we request from you, we may be hindered or unable to provide you with the services or support that you seek from Maggie’s.

3. How we use your personal information

We typically use your personal information:

• To provide you with products and services that you have requested (the services we provide include supporting people living with cancer, and their family and friends). When we give you advice that requires more information, we will always ask you for your consent; this may be with a Benefits Advisor, Cancer Support Specialist or Psychologist.
• To improve our products and services (for example, collecting information on who visits or uses our centres in order to monitor how well our services meet the needs of people in the local areas of our centres). 
• To demonstrate the impact of our services on the cancer community and the NHS to get grants and funding. For example, we would share anonymised reports with public authorities showing the percentage of certain stages of cancer that we have supported.
• To invite you to donate to us or raise funds for us, administer your donations or support your fundraising, including processing gift aid.
• To manage and improve our Website (including products and services provided via our Website).
• To help us learn more about you, the products and services that you receive from Maggie’s, and other products and services that may be of interest to you (including building profiles of individuals and supporter segments to help us ensure that our fundraising communications are directed to individuals that might be interested in them, and in some cases estimating your capacity and propensity to donate to us). We may also undertake statistical analysis of your data, including Mosaic profiling (see below), to better understand your likelihood or otherwise of donating and being interested in or responsive to a campaign, appeal or event.
• To share your experiences of cancer where you permit us to do so.
• To deal with your enquiries and requests.
• To offer opportunities to get involved with your nearest centre or attend one of our events.
• To invite you to attend events, arrange logistics and update you with relevant details around these fundraising activities. 

As part of the uses above, we use your personal information in the course of any correspondence relating to products or services you requested from us or information you provided to us. This correspondence may be with you, our service providers or competent authorities. If you enter your details onto one of our online forms, and you don’t ‘send’ or ‘submit’ the form, we will usually also contact you to see if we can help with any problems you may be experiencing with the form or our Website.

In some cases, we also use your personal information for the purposes of, or in connection with:

• Applicable legal or regulatory requirements.
• Requests and communications from competent authorities.  
• Financial accounting, invoicing and risk analysis purposes.
• Prudent operational management (including credit and risk management, insurance, audit, training and similar administrative purposes).
• Customer/donor relationship purposes, which typically involve: (i) contacting you (including by telephone, e-mail, SMS and by post) to receive feedback on our products and services; and (ii) contacting you for other marketing, market research or general research purposes.
• Services we receive from our professional advisors, such as lawyers, accountants and consultants; to further our charitable aims including to fundraise.

We also combine your information with information available from external data sources including Royal Mail’s post office address file (PAF) and change of address file, Mortascreen, GetAdress and Experian. This is known as data- or tele-appending and enables us to ensure that the information (including contact details) that we hold about you are accurate and up-to-date. The external sources we use for this purpose include: (a) third party service providers that are permitted to share information about you with us; (b) information available publicly in places such as Companies House, Charity Commission and other charity registers, Who’s Who and Debrett’s guides, Electoral Roll, and information published in articles/newspapers; and (c) depending on your settings and applicable legal terms, social media platforms like Facebook, Twitter, Instagram, LinkedIn and other professional networking sites.

We may append Experian Mosaic data to the personal information you have given us – this postcode-based data helps us better understand social, demographic and financial characteristics, as well as geographical indications of affluence, so we can tailor and target our fundraising communications to you, identify potential new donors and analyse how well our services meet the needs of people with cancer, based on the associated profiles and segments (i.e. groups of individuals of similar characteristics) that we may build and analyse. This allows us to be more efficient and cost-effective with our very limited resources. We will do this data appending for the above reasons unless you let us know that you don't want us to – you can do this at any time via the process indicated below.

We may use your personal data for online advertising to match to your account on Facebook or other social media sites to be able to show you Maggie’s content while you are using these sites. If you have opted out from our Marketing Communication, you may still be able to see Maggie’s content based on your social media account’s settings. We may also use personal data to link to Facebook or other social media sites to be able to identify other users of these sites whom the social media platform believe would be interested in Maggie’s (‘Look-alike’/ ‘Similar audiences’). When doing this we send a list of hashed email addresses to the online platform, which will match the audience accordingly. Hashing is a security measure whereby the information is transformed into a code. The hashed data is deleted after a short period of time and not used for any other purpose. For more information, please refer to the social media platform’s privacy policy. We may also use ‘Saved audiences’ to remember which supporters on Facebook are most likely to engage with our adverts.

When you consent to us, we may send you emails promoting our cancer support activities (which may be in the form of a Centre’s newsletter).

We will only send you marketing materials according to the preferences you submitted to us – either via our Website or another medium. Where you have indicated to us that you do not want to receive any marketing materials from us, or you do not wish us to build profiles of you, we will respect your preference. If you would like to update your preferences at any point, please email us at enquiries@maggies.org, call us on 0300 123 1801 or write to us at:

Maggie’s
The Gatehouse
10 Dumbarton Road
Glasgow
G11 6PA

4. Legal grounds we use for processing personal information

We are required by law to set out in this Privacy Notice the legal grounds on which we rely in order to process your personal information.

We generally use your personal information for the purposes outlined above because: (a) it is necessary for our legitimate interests and does not unduly affect your interests or fundamental rights and freedoms (see below); (b) it is necessary for legal and/or regulatory obligations that we are subject to, such as keeping records for tax purposes or providing information to a public body or law enforcement agency; (c) it is necessary for the performance of a task carried out in the public interest (such as providing support to people living with or affected by cancer); or (d) in some cases, we have obtained your prior consent

Examples of the ‘legitimate interests’ referenced above are:

(i)             the effective operation of our charity and its charitable causes, including analysing and gaining insights into the performance and effectiveness of our fundraising and programme activities;

(ii)     to benefit from cost-effective services (for example, it being cheaper to use an external printer to print our letters instead of print them ourselves);

(iii)    to assess and verify any application that you submit through the Website to volunteer or work with us;

(iv)    to prevent fraud or criminal activity, the receipt of inappropriate gifts (for which we may conduct due diligence research in line with our legal and regulatory obligations and our internal policies and procedures), misuses of our products and services, as well as the security of our IT systems, architecture and networks;

(v)            to exercise our rights under Article17 of the Charter of Fundamental Rights, including our right to property; and

(vi)           to conduct market research to better understand our centre visitors and supporters, along with their expectations and perceptions of Maggie’s.

To the extent that we process any sensitive personal information relating to you for any of the purposes outlined above, we will do so because either: (a) you have given us your explicit consent to process such information; (b) the processing is necessary for reasons of substantial public interest on the basis of applicable law (for example, where we are required to process personal information to ensure we meet our ‘know your client’ and ‘anti-money laundering’ obligations); (c) the processing is necessary for the purposes of health or social care or treatment on the basis of applicable law; (d) the processing is necessary to carry out our obligations under employment, social security or social protection law; or (e) the processing is necessary for the establishment, exercise or defence of legal claims. The legal grounds for processing sensitive personal information outlined above at (a) to (e) appear at Articles 9(2)(a), 9(2)(g), 9(2)(h) 9(2)(b) and 9(2)(f) of the EU’s General Data Protection Regulation respectively.

5. How we keep your data safe

We ensure that there are appropriate technical controls in place designed to protect your personal information. For example, our data and hardware is housed in the cloud and encrypted both in transit and at rest. We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors.

Sometimes we use the services of our corporate partners or other reputable companies to collect or process personal information on our behalf. Before we permit a company to collect or process personal information on our behalf we seek to put a written agreement in place with appropriate controls to secure your personal information.  

Although we use appropriate security measures once we have received your personal information, the transmission of data over the internet (including by email) is never completely secure. We endeavour to protect personal information but we cannot guarantee the security of data transmitted to us or by us.

6. What locations your information is disclosed to

Section 8 below describes the third parties that we generally provide with information about you.  Some of them may be based outside the European Union (EU), including United States, Philippines, India, China and Japan. Although they may not be subject to the same data protection laws as companies based in the UK, we take steps to make sure that they provide an adequate level of protection to your personal information in accordance with our obligations under UK data protection law.  

These steps might include Maggie’s entering into a data transfer agreement with the relevant third party based on standard contractual clauses approved by the ICO.

Further details of the transfers of your personal information outside of the UK and the adequate safeguards used by Maggie’s in respect of such transfers (including copies of relevant agreements) are also available from us by contacting enquiries@maggies.org

7. How we keep your personal information up to date

Where possible we use publicly available sources to keep your records up to date; for example, the Post Office’s National Change of Address database and information provided to us by other organisations as described in Section 3 above.

We really appreciate it if you let us know if your contact details change.

From time to time we may use external data sources, such as Experian, to create a profile of your interests and level of potential donations so that our communications to you are as appropriate and cost effective as possible.

We also occasionally use external data lists to check the accuracy of the telephone numbers we hold for our supporters.

8. Who we disclose your information to

In connection with one or more of the purposes outlined in the Section 3 above, we typically share your information with:

• Third parties that provide services to us or on our behalf. This includes third parties such as those delivering postal mail (for example OnePost), print agencies (such as Production Hub or Cello Signal), making calls to our supporters, sending emails, analysing or collecting data (for example GivePanel or Telebank), processing credit card payments (such as Global Payments, GiveTap, Stripe, Elavon, LibertyPay and Creditcall)and a lottery management company (such as Sterling Management  Centre Limited), which is registered as external lottery manager by The Gambling Commission. If you use a special discount code to register for a Maggie’s event, we may share that you have used this code with a third party. In some cases, we also provide information to third parties, who assist with programmes we run to provide support for people living with cancer and their friends and family.
• Our third party partners that run events in partnership with us (examples of this include London Marathon Events, Great Run, Royal Parks, Run for Charity and London Landmarks Half Marathon) whereby we share registrant’s email addresses with the event organiser so that they can get in contact with the registrant directly.
• Regulators, other competent authorities (including courts, tribunals and regulatory and law enforcement authorities) and other parties to whom we are required to disclose your personal information to by law.
• Solicitors working with Maggie’s (for example, as part of our free Will writing service).
• Our professional advisors, including lawyers, accountants and consultants (for example The Philanthropy Company, their privacy notice is accessible here).
• Credit reference agencies and other organisations that help us to make credit decisions and reduce the incidence of fraud.

9. Your data rights

You have various rights in relation to your personal information. In particular, you have a right to:

• ask us to delete, or stop processing, your personal information.
• ask for a copy of the information we hold about you.  
• ask that we correct or update any discrepancies or inaccuracies in the information we hold about you.
• withdraw consent to our processing of your personal information (to the extent such processing is based on consent)
• object to our processing of your personal information.

If you want to exercise any of your rights, or if you have any other questions about our use of your personal information, please contact us by post to:

Data Protection Officer
Maggie’s
20 St James Street
London W6 9RW

Or contact us by email: data.protection@maggies.org

In certain circumstances we may need to seek further information about your identity before complying with your request.

Further information and guidance on subject access requests is also available from the Information Commissioner's Office here:

https://ico.org.uk/for-the-public/personal-information/

If we have been unable to deal satisfactorily with any concerns you may have over how we have processed your personal information, you have the right to make a complaint to the UK’s Information Commissioner’s Office or to any other data protection regulator in the place where you live or work, or in the place where you think an issue in relation to your data has arisen. A list of the national data protection regulators can be found on Our Members European Data Protection Board

10. Direct marketing

Where your marketing preferences allow us to do so, we will contact you to let you know about the progress we are making and to ask for donations or other support.  

Occasionally, where we are permitted to do so, we may include information from partner organisations or organisations who support us in these marketing communications.  

Please note if you decide to turn off or disable cookies this may affect the level of service we can provide you as described in the .

We aim to make it easy for you to tell us how you want us to communicate in a way that suits you. Our forms have clear marketing preference questions and we include information on how to opt out when we send you marketing communications.

If you don’t want to hear from us, please do let us know. You can do this when you provide your data or by calling us on 0300 123 1801 or writing to us at:

Maggie’s
The Gatehouse
10 Dumbarton Road
Glasgow
G11 6PA

Or email enquiries@maggies.org

11. Children’s data

In limited circumstances, we collect a small amount of information from or about children and we ensure this is appropriately protected and used by any third party we disclose it to.

The information can be anonymised visitor data about when children visit one of our centres, who they came to the centre with and what members of our staff they saw during their visit. It can also be sensitive personal information. For example, where a child attends one of our counselling sessions, speaks to Cancer Support Specialists or attends one of our Kids/Teen Days.

For individuals aged 16 or under, who would like to participate in an event, donate or get involved with us, would need to be accompanied by their parent/guardian’s in order to collect their permission before giving us the child’s personal information. For some individuals we may require parental consent prior to collecting or using any personal information.

Where we collect information about a child, we will make it clear as to the reasons for collecting this information and how it will be used.

12. How long we keep your personal information

We will hold your personal information on our systems for as long as is necessary to fulfil the purpose for which it was collected or to comply with legal, regulatory or internal policy requirements. In general, although there may be some limited exceptions, your personal data is kept for up to 10 years after you:

(i)             Stop receiving communications from Maggie’s

(ii)     Stop receiving services from us

(iii)           Stop supporting Maggie’s, either financially or via attending our events

(iv)           Last visited our website

We believe it is reasonable to keep information and contact individual supporters up to 10 years after the above for the purposes defined in section 3 (How we use your personal information).

• If you have used or visited our centres, you may want, need or simply decide to visit us again whether due to recurrence, continuing your relationship with Maggie’s, to gain access to support information for you or your loved ones or to donate to or volunteer at your centre to support others affected by cancer.
• The information we hold about you ensures we are able to speak to you as efficiently as possible and in the way you find easiest.
• This allows us to do things such as tailor our programmes, communications and the support we provide to you in ways you find most useful.

Limited exceptions where we may keep information for longer than the above, may include:

• Financial information for auditing or legal purposes.
• Keeping data to support legacy administration and work. In order for us to be able to receive the gifts our kind supporters leave to us in their Wills, we’ll keep just the following information for up to 65 years based on the ages of our youngest supporters: (i) most recent and previous names and addresses, (ii) donations made, (iii) communications sent and received, (iv) legacy conversations and Will-writing appointments held and (v) legacy status (enquirer, intender, pledger).

Keeping this information enables us to communicate effectively with people potentially planning on leaving legacies, or the families of those leaving legacies.

Furthermore it also helps us to better understand the donations we receive so that we support our centres in a way which is most efficient for our visitors and programmes.

13. Amendments

We may change this Privacy Notice from time to time.  

Any future changes or additions to the processing of your personal data as described in this Privacy Notice affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you.

Alternatively, please visit this page from time to time in order to keep up to date with the changes in our Policy.

Maggie's is a certified member of the Direct Marketing Association.