Privacy notice
I Can Be, a registered charity (Number 1188905) and the owner and operator of the website www.icanbe.org.uk/, is committed to protecting and respecting your privacy.
Privacy
This privacy policy explains:
why and how we may use the personal data that we have obtained from interactions you (or others) may have with us as a charity, including when you visit and use our website currently located at www.icanbe.org.uk/ or when you contact us;
with whom we share your personal data; and
the rights you have in connection with the information we use.
I Can Be is the controller of your personal data. This means that I Can Be decides why and how your personal data is processed. Please see the section at the end of this privacy policy for our contact and legal information.
This privacy policy may change from time to time, so please check this privacy policy occasionally to ensure that you are happy with any changes. For more information on changes to our privacy policy, please see ‘Changes to this privacy policy’ below.
What is personal data?
Personal data is any information that can be used to identify a person. It could include their name, date of birth, email address, postal address, telephone number and credit/debit card details, as well as information relating to their health or personal circumstances.
What information does I Can Be collect?
I Can Be may collect, use, store and transfer different kinds of personal data which we have grouped together below:
Identity data: including first name, last name, title, photograph, video and date of birth.
Contact data: including home address, email address and telephone number.
Job data: including job title, company/organisation/school name, workplace address, region and country of residence.
Financial data: including billing address and payment card details.
Donation data: including details about donations made by donors (amount and date), Gift Aid declaration.
Survey data: including feedback and survey responses.
Usage and technical data: including information about how people use our website, IP address, browser type and version, time zone setting and location, browser plug-in types and versions and other technology on the devices people use to access the website.
Communications data: including communication preferences.
Charitable giving data: including philanthropic work and interests.
There are ‘special categories’ of more sensitive personal data which are more private in nature and therefore require a higher level of protection, such as genetic data, biometric data, sexual orientation, race or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and health. For the purposes of this policy, references to special category/ies personal data will also include personal data relating to criminal convictions.
We may collect, store and process information about criminal convictions when carrying out a Disclosure and Barring Service (DBS) check on prospective employees, trustees and volunteers. We will only collect this information where the law allows us to. This will be where such processing is necessary to carry out our legal obligations. If you are a volunteer, we may collect this information as part of the volunteer registration process or we may be notified of such information directly by you in the course of you volunteering with us. Where we process criminal conviction information about you, we will retain it in accordance with the retention periods set out in this policy.
How do we collect personal data?
We collect your personal data through various methods, set out below:
Direct interactions
You may give us your identity, contact, job, financial and donation data by:
(i) making a general enquiry with us
(ii) registering to become a volunteer directly with us or via our online application form on our website
(iii) registering as a school partner/I Can Be School Ambassador
(iv) making a donation
(v) corresponding with us by post, telephone, email or otherwise
(vi) completing a survey
(vii) giving us feedback or contacting us.Automated technologies or interactions
We may automatically collect technical data which may identify your device or web browser, relating to details of your visits to our website, such as your location data or what pages you accessed on our website. We will collect this personal data by using cookies and other similar technologies.
Third parties or publicly available sources
We may receive personal data about you from various third parties such as Stripe (our online payment processing provider), Squarespace (our website hosting provider) and the Disclosure and Barring Service (DBS). We may also seek personal data from publicly available sources to identify potential supporters to contact. You can opt out of this by contacting I Can Be using the contact details in the ‘Contact us’ section at the end of this notice.
How we use your personal data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
Legitimate interest
This is where a processing activity is in the interest of enabling us to engage with the public to achieve our charitable aims. We ensure that we consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).Performance of a contract
This is where we process your personal data in order to perform our obligations in a contract to which you are a party, or in order to take steps at your request before entering into such a contract – for example, to register you as a volunteer or a school partner/I Can Be School Ambassador.Comply with a legal obligation
This is where we may collect or share your personal data where we are required to do so by law. For example, to fulfil a regulatory requirement or assisting a public authority with a criminal investigation.Consent
This is where we have asked for your permission to use your personal data in a specific way, and you have agreed. For example, to use your photograph for campaign or marketing purposes.
We have set out below a description of all the ways we may use your personal data, and which legal basis we rely on to do so.
Purpose/activity:
To register you as a volunteer, school partner/I Can Be School Ambassador or beneficiary to take part in our programmes.
To process your application to become a member of I Can Be staff or a trustee.
Type of data:
(a) Identity data
(b) Contact data
(c) Job data
Lawful basis for processing including basis of legitimate interest:
(a) Performance of a contract with you
Purpose/activity:
To run a DBS check to assess your suitability to become an employee or a trustee, or to volunteer for an eligible I Can Be role.
Type of data:
(a) Identity data
(b) Special category data (criminal convictions)
Lawful basis for processing including basis of legitimate interest:
(a) Necessary to comply with our legal obligation
(b) Necessary for our legitimate interests (to ensure the safeguarding of our beneficiaries)
Purpose/activity:
To enable us to run and deliver our charitable programmes such as:
a) contacting you with information about taking part in the Charity;
b) arranging visits and workshops;
c) collecting remote learning content.
Type of data:
(a) Identity data
(b) Contact data
(c) Job data
Lawful basis for processing including basis of legitimate interest:
(a) Necessary for our legitimate interests (to engage you to further our charitable objectives)
Purpose/activity:
To promote I Can Be’s programmes through promotional communications, activities or online testimonials.
Type of data:
(a) Identity data (including photographs)
Lawful basis for processing including basis of legitimate interest:
(a) Consent
Purpose/activity:
To manage our relationship with you whenever you contact us, which will include:
a) notifying you about changes to our privacy policy; and
b) asking you to take part in a survey or provide us with feedback.
Type of data:
(a) Identity data
(b) Contact data
(c) Communications data
Lawful basis for processing including basis of legitimate interest:
(a) Performance of a contract with you
(b) Necessary to comply with our legal obligation
(c) Necessary for our legitimate interests (to keep our records updated and to assess whether we are achieving our charitable objectives)
Purpose/activity:
To enable you to partake or complete a survey.
Type of data:
(a) Identity data
(b) Contact data
Lawful basis for processing including basis of legitimate interest:
(a) Necessary for our legitimate interests (to understand how our charitable programmes impact on volunteers and/or beneficiaries, to develop our programmes and grow the Charity)
Purpose/activity:
To process your donation when you give us a donation directly.
Type of data:
(a) Identity data
(b) Contact data
(c) Financial data
(d) Donation data
Lawful basis for processing including basis of legitimate interest:
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to collect your donation and fund I Can Be)
Purpose/activity:
To process your donation when you donate directly via our website.
Type of data:
Collected by Squarespace:
(a) Identity data
(b) Contact data
(c) Donation data
Collected by Stripe:
(a) Identity data
(b) Contact data
(c) Donation data
(d) Financial data
Lawful basis for processing including basis of legitimate interest:
(a) Performance of a contract with you
(b) Necessary for our legitimate interests
Purpose/activity:
To research and contact potential supporters using publicly available information.
Type of data:
(a) Identity data
(b) Contact data
(c) Job data
(d) Charitable giving data
Lawful basis for processing including basis of legitimate interest:
(a) Necessary for our legitimate interests (to identify and contact potential supporters of I Can Be)
Purpose/activity:
To administer and protect I Can Be and our website (including troubleshooting, testing, system maintenance, support, reporting and hosting of data).
Type of data:
(a) Identity data
(b) Contact data
(c) Technical and usage data
Lawful basis for processing including basis of legitimate interest:
(a) Necessary for our legitimate interests (for running the Charity, provisions of administration and IT services, network security, to prevent fraud)
(b) Necessary to comply with a legal obligation
Purpose/activity:
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences.
Type of data:
(a) Technical and usage data
Lawful basis for processing including basis of legitimate interest:
(a) Necessary for our legitimate interests (to keep our website updated and relevant).
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
Third parties
We may share your personal data with the following:
• Volunteers
We share an I Can Be School Ambassador’s name with the volunteers who will be taking part in their school’s I Can Be visits.
• I Can Be School Ambassadors
We share a volunteer’s name, job title and company/organisation for each visit with the relevant I Can Be School Ambassador. This is shared via a password-protected calendar.
• Third-party service providers
We may share your personal data with a number of third parties which can be categorised as follows:
website hosting service providers (IT hosting)
website and app developers (IT software development)
cloud software system providers, including database, email and document management providers (IT cloud services and storage providers)
social media platforms (social media)
professional service providers (e.g. accountants).
• Law enforcement, government and regulatory authorities
We are required to disclose information and personal data in order to comply with legal and regulatory obligations, including to uCheck and the DBS in order to conduct DBS checks.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
When we share your personal data with any third parties that are controllers of that information, they may disclose or transfer it to other organisations in accordance with their data protection policies. This does not affect any of your data subject rights as detailed below. In particular, where you ask us to rectify, erase or restrict the processing of your information, we take reasonable steps to pass this request on to any such third parties with whom we have shared your personal data.
We may disclose your personal data to other third parties as follows:
any third party who is restructuring, selling or acquiring some or all of the Charity or assets or otherwise in the event of a merger, re-organisation or similar event; and
if we are under a duty to disclose or share your information in order to comply with any legal or regulatory obligation or request, including by the police, tribunals, regulators, the government or related agencies.
International transfers
All personal data that is provided to us may be transferred to countries outside the UK. By way of example, this may happen where any of our servers or those of our third-party service providers are from time to time located in a country outside of the UK. These countries may not have similar data protection laws to the UK and so may not protect the use of your personal data to the same standard.
If we transfer your personal data outside of the UK in this way, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this privacy policy. These steps include:
ensuring the non-UK countries to which transfers are made have been deemed adequately protective of your personal data for the purposes of data protection law by the relevant bodies;
imposing contractual obligations on the recipient of your personal data using provisions formally issued by relevant bodies for this purpose. We use these provisions to ensure that your information is protected when your personal data is transferred to suppliers outside the UK; or
ensuring that the recipients are subscribed to ‘international frameworks’ that aim to ensure adequate protection, such as binding corporate rules.
Please contact us using the details at the end of this privacy policy for more information about the protections that we put in place and to obtain a copy of the relevant documents.
The period for which we keep your personal data
If we collect your personal data, the length of time for which we retain it is determined by a number of factors including the purpose for which we use that information and our obligations under other laws. We do not retain personal data in an identifiable format for longer than is necessary.
We may need your personal data to establish, bring or defend legal/insurance claims. For this purpose, we will retain your personal data for the following timescales:
if you are a volunteer – 15 years after you first became a volunteer (your data will then be deleted if by that time you have ceased to be a volunteer for more than 3 years)
if you are a trustee or staff member – 15 years after you became a Trustee or employee (your data will then be deleted if by that time your Trusteeship or employment has ceased for more than 6 years).
After the above period, your personal data is no longer needed by us for any of the purposes listed in this privacy policy (see ‘How we use your personal data’ above). The only exceptions to this are where:
the law requires us to hold your personal data for a longer period, or delete it sooner;
you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law (see ‘Your rights’ below); or
you exercise your right to require us to retain your personal data for a period longer than our stated retention period (see ‘Your rights’ below).
Links to other sites
I Can Be’s website and social media pages may contain links to other websites run by other organisations that we do not control. This privacy policy does not apply to those other websites‚ so we encourage you to read their privacy policies. We are not responsible for the privacy policies and practices of other websites (even if you access them using links that we provide). We provide links to those websites solely for your information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or promises about their accuracy, content or thoroughness. Your disclosure of personal data to third party websites is at your own risk.
In addition, if you linked to the website from a third-party website, we cannot be responsible for the privacy policies and practices of the owners and operators of that third-party website and recommend that you check the policy of that third-party website.
Cookies
'Cookies' are small pieces of information that are sent to your computer or device and stored on its hard drive to allow the website to recognise you when you visit it. For more information on how we use cookies, please read the I Can Be Cookies policy.
Automated decision making
We do not envisage that any decisions that have a legal or significant effect on you will be taken about you using purely automated means, however we will update this privacy policy if this position changes.
Your rights
You have a number of rights in relation to your personal data under data protection law. In relation to certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal data. Except in rare cases, we will respond to you within 1 calendar month from either:
the date that we have confirmed your identity; or
where we do not need to confirm your identity because we already have this information, from the date we received your request.
You have the following rights, some of which may only apply in certain circumstances:
Your right:
To have your information corrected if it is inaccurate and to have incomplete personal data completed.
Further information:
If you change your name or address/email address, or you discover that any of the other information we hold is inaccurate or out of date, please let us know by contacting us using any of the details described at the end of this privacy policy.
Your right:
To object to processing of your personal data.
Further information:
Where we rely on our legitimate interests as the lawful basis for processing your personal data for particular purposes, you may object to us using your personal data for these purposes by emailing or writing to us at the address at the end of this privacy policy. Except for the purposes for which we are sure we can continue to process your personal data, we will temporarily stop processing your personal data in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights under data protection laws, we will permanently stop using your data for those purposes. Otherwise we will provide you with our justification as to why we need to continue using your data.
Your right:
To withdraw your consent to processing your personal data
Further information:
Where we rely on your consent as the lawful basis for processing your personal data, you may withdraw your consent at any time by contacting us using the details at the end of this privacy policy. If you withdraw your consent, our use of your personal data before you withdraw is still lawful.
Your right:
To restrict processing of your personal data
Further information:
You may ask us to restrict the processing of your personal data in the following situations:
where you believe it is unlawful for us to do so; or
you have objected to its use and our investigation is pending or you require us to keep it in connection with legal proceedings.
In these situations, we may only process your personal data whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.
Your right:
To have your personal data erased
Further information:
In certain circumstances, you may ask for your personal data to be removed from our systems by emailing or writing to us at the address at the end of this privacy policy. Unless there is a reason that the law allows us to use your personal data for longer, we will make reasonable efforts to comply with your request.
Your right:
To request access to your personal data and how we process it
Further information:
You have the right to ask for a copy of the information that we hold about you by emailing or writing to us at the address at the end of this privacy policy. We may not provide you with a copy of your personal data if this concerns other individuals or we have another lawful reason to withhold that information.
Your right:
To electronically move, copy or destroy your personal data in a standard, machine-readable form
Further information:
Where we rely on your consent as the lawful basis for processing your personal data or need to process it in connection with a contract that is in place directly with you, you may ask us to give you a copy of that information in a structured data file. We will provide this to you electronically in a structured, commonly used and machine-readable form, such as a CSV file. You can ask us to send your personal data directly to another service provider, and we will do so if this is technically possible. We may not provide you with a copy of your personal data if this concerns other individuals or we have another lawful reason to withhold that information.
Your right:
Rights relating to automated decision making, including profiling
Further information:
You may also contest a decision made about you based purely on automated processing by contacting us using the information at the bottom of this privacy policy.
Your right:
To complain to a data protection regulator
Further information:
You have the right to complain to a data protection regulator (which in the UK is the Information Commissioner’s Office (ICO)) if you are concerned about the way we have processed your personal data. Please visit the ICO’s website for further details.
Changes to this privacy policy
We may review this privacy policy from time to time and you will be notified about any changes by I Can Be posting an updated version on our website. Any changes will take effect immediately. We recommend that you regularly check for changes and review this privacy policy whenever you visit or use the website. If you do not agree with any aspect of the updated privacy policy, you must immediately notify I Can Be and cease using our services.
Contact us
Please direct any queries about this privacy policy or about the way we process your personal data to I Can Be in the following ways:
call us on: 07942 674 630
write to us: I Can Be, International House, 12 Constance Street, London E16 2DQ
email us at: contact.icanbe@gmail.com