Our Privacy Notice

Rays of Sunshine Children’s Charity is committed to protecting the privacy of the people for whom it may process personal data. We aim to be clear about this when we collect your data. This policy sets out how Rays of Sunshine uses the information that you provide us with, in order for us to help continue to brighten the lives of seriously ill children and their families.

This Privacy Statement explains when and why we collect personal information about people who we support, who support us, who provide us with services, who visit our website or work or apply to work with us – as well as how we use that information, the conditions under which we may disclose it to others and how we keep it secure.

Any questions regarding this Privacy Statement, our Privacy Notice should be sent by email to info@raysofsunshine.org.uk or by writing to Data Controller, Rays of Sunshine Children’s Charity, 4th Floor, Berkeley House, 304 Regents Park Road, London, N3 2JY.

If you are unhappy with the way we process your data, you can also make a complaint to the Information Commissioners Office (ICO) which regulates the use of information in the UK. They can be contacted by Telephone 03031231113, by going on their website to complete their complaint form www.ico.org.uk/make-a-complaint, or you can write to them

Information Commissioner’s Office, Wycliffe House Water Lane, Wilmslow, Cheshire, SK9 5AF.

WHAT INFORMATION DO WE COLLECT AND WHERE FROM?

The type and quantity of information we collect and hold, and how we use it depends on why you are providing it. Whenever we collect personal information, we will identify ourselves as Rays of Sunshine, tell you why we are collecting it, and inform you of how we plan to use it.

In order to carry out our work, we collect personal information about our donors, volunteers, supporters, hospitals, medical professionals and service providers as well as the children (and their families) we support.  This includes names, addresses, contact details such as telephone numbers and email addresses, and where necessary dates of birth, medical records, records of previous support and donations, records of event bookings, and other information to assist us in providing our services.

We collect information when you give it to us directly, including via our website from online forms and from emails. or when you give permission to other parties to share it with us in order for us to carry out our organisational responsibilities. We occasionally collect information when it is available publicly from external sources and may help us provide a better service or raise funds to continue our work.

We will store information on children and parents in order to support our process of granting wishes and providing our other services. After granting a wish, your data may also be used, where relevant, to advise you of our events, outings and treats which may be of interest to you and your family. This information includes contact details, medical records and details of the wish requested.

For those who attend our events, including volunteers, supporters and beneficiaries, we may hold an image of you in a photo or video. We may wish to use this on our website or in other marketing materials in order to promote the charity, but we will always seek explicit consent for us to do so. You do not have to agree that we may use your image, it is entirely your choice. Staff and volunteer information will be used for DBS checks.

When you visit our website, or download information from it, the following information is recorded: your internet address, your domain name if applicable, the date and time of your visit, the pages you accessed, documents you downloaded, the previous website you have visited and the type of browser you are using. This information is not personal information and is only used for statistical and website development purposes.

If you do not wish to receive cookies, you may be able to change the settings of your browser to refuse all cookies or to give you the choice whether to accept cookies or not. If you do disable cookies in your browser certain features of the website may become unavailable, including the ability or make online donations.

HOW DO WE USE YOUR PERSONAL INFORMATION?

We use your personal information to: carry out the functions and activities of Rays of Sunshine including processing information, services and donations; to comply with our legal obligations; and to help us manage and provide our charitable services.

We use your information to:

• keep a record of your relationship with us, for internal administrative purposes, and to let you know about changes to our services or policies that may affect you
• If you sign up to receive information about our services or events
• look into, and respond to, complaints, claims, or any other issues
• claim Gift Aid on your donations
• Process your data when you work for the charity
• Process your data when you apply to work for the charity
• Process your data when you volunteer your time to the charity

We will process information to ensure all submissions to our wish programme are handled and fulfilled correctly and to the highest standard. This includes sharing your name and postcode with other wish-granting organisations to ensure that wishes are granted fairly.

We may also use it to ask for your support, contacting you about the work of our organisation, fundraising, campaigns, and how you can further make a difference to the lives of seriously ill children and their families. This may be by post, email, telephone or text message, depending on your preferences and, where required, consents given. We will also continue to ask regularly about your preferences, to ensure that you are still happy to be contacted by us and by which means.

We may analyse your personal information and keep a record of our communications with you, to carry out statistical analysis and research in order to help us provide an improved experience to our beneficiaries and supporters, understand how we are performing and ensure we are using our funds in the best possible way. We may make a note of your interests and preferences so that we can contact you with information relevant to you. We may make use of additional information about you when it is publicly available from external sources to help us do this effectively. We may also use your personal information to detect and reduce fraud and credit risk. When we carry out any of these processes, we work hard to ensure that we respect your privacy and your rights under the relevant data protection legislation.

You can ask us at any time not to contact you again, or not to use your data for these purposes, by emailing info@raysofsunshine.org.uk, or by writing to Data Protection Officer, Rays of Sunshine Children’s Charity, 4th Floor, Berkeley House, 304 Regents Park Road, London, N3 2JY.

Automated decision making takes place when and electronic system uses personal information to make decisions without human intervention. You have the right to question the outcome of automated decisions that may create legal effects or create similar significant impact on you. We do not use personal data for any automated decision making.

DATA RETENTION AND KEEPING INFORMATION UP-TO-DATE

In line with UK GDPR guidance, your details and supporting paperwork will be retained for no longer than is necessary, and then either deleted, anonymised or archived.

In order to accurately report on the activities of the charity and demonstrate our impact, we need to be able to report on certain transactions including donations and services provided, as well as demonstrate our level of interaction with supporters, suppliers and beneficiaries.  Therefore some data will be kept longer than others.

For more information, please ask us about our Data Retention Policy by emailing info@raysofsunshine.org.uk, or by writing to Data Controller, Rays of Sunshine Children’s Charity, 4th Floor, Berkeley House, 304 Regents Park Road, London, N3 2JY

ACCURACY OF YOUR PERSONAL INFORMATION

Rays of Sunshine will endeavour to ensure that the personal information we hold is accurate, complete and up-to-date. If you become aware of any inaccuracy in the personal information we hold about you, we encourage you to contact us so we can update any personal information we hold about you.

WHO HAS ACCESS TO YOUR INFORMATION AND HOW DO WE KEEP IT SAFE?

We will not share information about children without the prior knowledge and consent of their parents or guardians, unless the law requires it.

We will never sell, trade or rent your information to third parties. Occasionally we need to disclose personal information to trusted third parties who assist us in providing services or who perform functions on our behalf (such as suppliers who are integral to delivering our wish programme).  We ensure that any third parties with access to your data are held to strict standards for data use and security.

Third Party Service Providers working on our behalf:

Your data is shared (through operational necessity) with our IT providers, including our database provider, web-hosting company and email provider. We ensure that these data processors are compliant with data protection legislation.

We may pass your information to our third party service providers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf (for example to process donations, organise travel and/or insurance for your wish and send you e-newsletters). However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. Please be reassured that we will not release your information to third parties for them to use for their own direct marketing or other purposes, unless you have requested us to do so, or we are required to do so by law, for example, by a court order or for the purposes of prevention of fraud or other crime.

Third Party Product Providers we work in association with:

When you are using our secure online donation pages, your donation is processed by a third party payment processor, who specialises in the secure online capture and processing of credit/debit card transactions. If you have any questions regarding secure transactions, please contact us by emailing info@raysofsunshine.org.uk, or by writing to Data Controller, Rays of Sunshine Children’s Charity, 4th Floor, Berkeley House, 304 Regents Park Road, London, N3 2JY.

Wish Granting Charities and Organisations we work in association with:

We may pass your information to other wish granting charities and/or organisations for the purposes of processing your wish application (as stated in the wish application). Please note that we disclose only the personal information that is necessary to process your application and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. To see a full list of wish granting charities and/or organisations we share information with click here.

TRANSFER OF DATA OUTSIDE OF THE EU OR EEA

Where wishes take place outside of the UK, and data is required to be sent overseas for the fulfilment of this wish, we share relevant information with hotels, theme parks, insurance companies, travel operators, and other relevant organisations. However, we ensure that adequate safeguards are in place and only work with organisations that provide such safeguards. This may include but is not limited to UK International Data Transfer Agreements (IDTA) where these may be relevant and necessary.

Data that is not required for the fulfilment of a wish will not be transferred outside of the EU.

SECURITY OF YOUR PERSONAL INFORMATION

Rays of Sunshine regards the security of your personal information as a priority and takes a number of precautions to protect your personal information from loss, misuse, unauthorised access, modification or disclosure. Specific security precautions are in place for processing online payments which include the use of encrypted links, dedicated private connections and Secure Sockets Layer (SSL) encryption. We remind you, however, that the internet is not a secure environment and although all care is taken, we cannot guarantee the security of information you provide to us via electronic means.

YOUR RIGHTS AND CHOICES

WHAT THE LAW SAYS ABOUT PROTECTION OF PERSONAL INFORMATION

The Law on Data Protection is derived from various pieces of legislation including the Data Protection Act, Privacy and Electronic Communications Regulation and the General Data Protection Regulation (the ‘GDPR’). The GDPR states that personal data (information relating to a person that can be individually identified) can only be processed if there is a legal ground to do so. Activities like collecting, storing and using personal information fall into the GDPR’s definition of processing. The GDPR provides six legal grounds under which personal information can be processed in a way that is lawful. For the processing to be permitted by law, at least one of the legal grounds must apply.

The four legal grounds that are most relevant to Rays of Sunshine’s use of your personal information are:

• Consent
• Legitimate Interest
• Contract
• Legal Obligation

WHAT IS OUR LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA?

Rays of Sunshine Children’s Charity will only process your personal information if we have:

1. asked you and have a record of your express consent for us to do so;
2. a ‘Legitimate Interest’ to do so in order to support our charitable purposes. Our use will be fair and balanced and never unduly have an impact on your rights;
3. a contract with you that we can only fulfil by using your personal information, e.g. to send you an item that you have requested;
4. a legal obligation to use or disclose information about you, e.g. we are required by law to keep records of gifts that are given to us with Gift Aid for 6 years, or for insurance purposes as part of fulfilling a wish.

In extreme situations, such as an accident or medical emergency, we may share your personal details with the emergency services if it is essential for the preservation of life (yours or another person’s) for us to do so. This is the ‘vital interest’ ground for using your personal information. After the emergency, we will always try to inform you about how we had to use your information in that extreme situation.

We will never prioritise our interests as a charity over your rights as an individual. We will always balance our interests with your rights. We will only use personal information in a way and for a purpose that you would reasonably expect in accordance with this Notice.

Consent

Where Rays of Sunshine has asked for your consent for processing your data, this can be withdrawn at any time by emailing info@raysofsunshine.org.uk, or by writing to Data Controller, Rays of Sunshine Children’s Charity, 4th Floor, Berkeley House, 304 Regents Park Road, London, N3 2JY.

We will only ask you for your consent where you have a genuine choice in how we process your information. In most instances we will use other grounds for processing than consent.

What is Legitimate Interest?

This legal ground for processing means that organisations can process your personal information if they

1. have a genuine and legitimate reason for doing so and
2. that use does not harm any of your rights and interests as an individual.

We do not unduly prioritise our legitimate business interests as a charity over your interests as an individual. We always respect your rights. Which is why we carry out a balancing exercise of the rights of the charity with your rights.

We consider your interests based on previous communications, as well as what we consider your expectations to be, and assess whether we are using your personal information in a way that matches your relationship with us.

We aim to be clear about what information we collect, to enable you to make meaningful choices about how it is used.

When it is necessary, we will contact you for administrative purposes, e.g. to contact you regarding a payment. We may hold the minimum personal information required to support our ability to respect your preferences for communication with us.

ANONYMITY

Where it is lawful and practicable, we will allow individuals to deal with us on an anonymous basis. For example, if we receive a telephone enquiry, we will not require that the enquirer gives us their name, although depending on the nature of the enquiry, we may not be able to answer it unless they do. We can also accept gifts and other forms of support anonymously. However, if you wish to Gift Aid your donation, the government requires Rays of Sunshine to collect the title, initials, surname, first line of address and postcode of the donor.

YOUR CHOICES

We will not contact you for promotional purposes by email or text message unless you have given your prior consent. We will not contact you for promotional purposes by post if you have indicated that you do not wish to be contacted.

You have a choice about whether or not you wish to receive information from us, and whether or not we use your data for the purposes outlined above. If you do not want to receive direct marketing communications from us about our life-changing work granting magical wishes for other brave and deserving children, then you can select your choices by ticking the relevant boxes situated on the form on which we collect your information.

You can change your preferences at any time by contacting us by emailing info@raysofsunshine.org.uk, or by writing to Data Controller, Rays of Sunshine Children’s Charity, 4th Floor, Berkeley House, 304 Regents Park Road, London, N3 2JY.

YOUR RIGHTS AS A DATA SUBJECT

The GDPR gives you rights as a data subject. You have:

• the right to request from us access to your personal data;
• the right to request from us rectification of your personal data;
• the right to request from us erasure of your personal data;
• the right to request from us restriction of processing your personal data;
• the right to object to our processing of your personal data;
• the right of data portability;
• if we are processing your personal data on the basis of your consent, you have the right to withdraw your consent at any time. This does not affect the lawfulness of processing based on your consent before you withdrew it; and
• You have the right to complain to the ICO by visiting https://www.ico.org.uk.

HOW YOU CAN ACCESS YOUR INFORMATION

Under data protection legislation, you have the right to request access to information that we hold. To make a request for your personal information, or be given access to your or your child’s Rays of Sunshine record, our Data Protection contact is our Communications Manager and can be contacted by emailing info@raysofsunshine.org.uk or at Rays of Sunshine Children’s Charity, 4th Floor, Berkeley House, 304 Regents Park Road, London, N3 2JY.

RoS Subject Access Request Form v1.1 April 2022

IF YOU DO NOT WISH TO BE CONTACT BY US

Please just let us know by emailing info@raysofsunshine.org.uk, or by writing to Data Controller, Rays of Sunshine Children’s Charity, 4th Floor, Berkeley House, 304 Regents Park Road, London, N3 2JY

CHANGES TO THIS NOTICE

If Rays of Sunshine updates or changes this Privacy Notice, the changes will be made on this page. Your continued use of Rays of Sunshine’s website following the posting of changes will mean you accept those changes.

We keep this Notice under regular review. This Notice was last updated on 21st March 2022.