The Boparan Charitable Trust is completely committed to protecting your privacy and we take our data protection responsibilities seriously. We will keep the personal data you share with us safe and secure and only use it for the purposes for which it was collected. That includes whether you want to work, volunteer or advocate for us, make a donation, fundraise for us, use our services, want information, training or just want to learn more about what we do.

This notice, together with our website terms and conditions and our cookies policy, tells you about how we collect, use, store and protect your personal data. Please note that we may update this privacy policy at any time. Any changes we may make to our policy in the future will be posted on this page. Please check back frequently to see any updates or changes made.

Who we are

The Boparan Charitable Trust is a registered charity (RCN 1129992) and a company limited by guarantee Private Limited Company by guarantee without share capital use of ‘Limited’ exemption (company number 06852304). The Boparan Charitable Trust’s registered/contact address is 2nd Floor, Colmore Court, 9 Colmore Row, Birmingham, B3 2BJ.

Processing of your personal information is carried out by or on behalf of The Boparan Charitable Trust.

We are the ‘data controller’ for the information that we collect when you visit our website. That means that we decide how to use information about you (referred to as ‘personal data’) and we are responsible for looking after your personal data in accordance with data protection legislation.

Should you have any complaints or queries about anything relating to the privacy of your personal data, or any other data protection issues, please get in touch with our Charity Director: Email: Gareth.aston@boparan.com Phone: 0121 661 9860 Post: Director of The Boparan Charitable Trust

How and when we collect information about you

1. When you directly give us information

We will collect most of your personal data directly from you when you interact with us, whether in person, by telephone, text or email and/or via our website. This might be when you: For example, this could be when you:

• complete an online form
• subscribe to a publication/newsletter
• request that information be sent to you
• support our work through a donation
• fundraise on our behalf
• register for an event
• tell us your story
• submit an enquiry
• register for or use our services
• participate in our training
• give us feedback
• make a complaint
• apply for a job
• register as a volunteer
• enter into a contract with us
• are captured by video or photo recordings at events.

2. When you indirectly give us information

We may also collect information:

• from publicly-accessible sources (for example the internet, LinkedIn or Companies House);
• directly from a third party where the issue involves someone else (for example referees for a job);
• from automated technologies or interactions with our website through the use of cookies and similar. Please visit our cookies policy for information on this;
• when you interact with us on social media platforms such as Facebook, WhatsApp, Twitter or LinkedIn we may also obtain some personal information about you. The information we receive will depend on the privacy preferences you have set on each platform and the privacy policies of each platform. To change your settings on these platforms, please refer to their individual privacy notices; and
• via our systems (for example door entry systems and reception logs, CCTV and access control systems, communications systems, email and instant messaging).

3. What personal we might collect

The term personal data means any information about an individual from which that individual may be identified. It does not, therefore, include data where the identity has been removed (anonymised data).

We may collect, store and use some or all of the following categories of data about you.

When you contact or engage with us:

• your name and contact information, including address, email address and telephone number;
• business/company details if you have contacted us on behalf of a business/company;
• your gender information, if you choose to give this to us;
• your personal or professional interests;
• your professional and/or personal online presence (e.g. LinkedIn or Facebook profile);
• information about how you use our website, IT, communication and other systems;
• your responses to surveys; and
• personal information such as date of birth, job title and details of your education.

This personal data is needed so that we can provide services to you. If you do not provide the personal data asked for, we may be delayed or prevented from providing those services.

Data protection law recognises that certain types of personal information are more sensitive. This is known as ‘sensitive’ or ‘special category’ personal information and covers information revealing racial or ethnic origin, religious or philosophical beliefs and political opinions, trade union membership, genetic or biometric data, information concerning health or data concerning a person’s sex life or sexual orientation.

Sensitive information will only be collected where necessary, for example, we may need to collect health information from you if you apply for a beneficiary grant, when you register for a challenge event or to deliver a community service as a volunteer or member of staff. Clear notices will be provided at the time we collect this information, stating what information is needed, and why. With your express consent, we may also collect sensitive personal information if you choose to tell us about your experiences relating to our services for use in a case study.

4. If you’re 16 or under

If you’re aged 16 or under, you must get your parent/guardian’s permission before you provide any personal information to us. We will always seek explicit consent from the person who has parental responsibility for children under 16 years of age.

5. How and why we use your information

We will use your personal information for the following purposes:

• Donation processing: We will process personal information you provide in order to administer any one-off or on-going donations you make and claim Gift Aid.
• Responding to a request: If you contact us with a query, we may use your personal information to provide you with a response. Fundraising or direct marketing: We will only send you marketing information by email, SMS, or phone if you have given us specific consent. If you withdraw your consent and then subsequently opt in to receive marketing information again, then your most recent preference may supersede. If you have responded to a letter of appeal, you may also receive fundraising mail, which you can opt out of at any time by:

Phone 0121 661 9860 Email events@boparan.com Post The Boparan Charitable Trust, 2nd Floor, Colmore Court, 9 Colmore Row, Birmingham B3 2BJ.

• Monitoring and evaluating: We may use your information in order to improve current and future delivery of our services.
• Processing an application to work with us: We may process your information if you send or fill in an application form or send us your CV or details in respect of an opportunity to work with us in order to evaluate your suitability and respond to you. Processing an application for one of our services: We will need to process the information you give to us to enable you to access our services.
• Transactional purposes: We will need to use your personal information in order to carry out our obligations arising from any contracts entered into between you and us for services, for example, processing payment for a DBS check.
• Providing and developing our website: We may use your personal information to help provide you with access to our website, personalise your experience, and improve and develop it further.
• Administration: We may use your personal information to record and deal with a complaint, record a request not to receive further marketing information, record what our volunteers have done for us, and for other essential internal record keeping purposes. Protecting your vital interests: We may process your personal information where we reasonably think that there is a risk of serious harm or abuse to you or someone else.
• Market research and surveys: We may invite you to participate in surveys or market research to help us improve our website, fundraising, services and strategic development. Participation is always voluntary and no individuals will be identified as a result of this research, unless you consent to us publishing your feedback.
• Where it is necessary for our legitimate interests (or those of a third party); for example, we have a business or commercial reason for using your personal data and your interests and fundamental rights do not override those interests.
• Legal, regulatory and tax compliance: Where required we are subject to a legal obligation (for instance, in connection with recruitment), we may process your personal information to fulfil that obligation.
• Profiling and analysis: We may occasionally for the purposes of our legitimate interests use your personal information to conduct profiling of our supporters or potential supporters. This will help us target communications in a more focused, efficient and cost-effective way, helping us reduce the chances of supporters and potential supporters receiving inappropriate or irrelevant communications. You can object to such use of your personal information for profiling at any time by contacting us at the details set out at the end of this Privacy Notice

Our profiling and analysis activities can be broken into five categories:

1. Data matching

We may combine the personal information you have given us with data obtained from external sources, such as the Office for National Statistics, to infer the likely social, demographic and financial characteristics, so we can tailor our communications and services to better meet your needs or the needs of others like you based on the insight we gain from the profile we build. We will not use the results of this data matching activity in a way that intrudes on your privacy or your previously expressed privacy preferences.

2. Segmenting

We conduct analysis of supporters by group, post code or particular area where supporters may be based. This is to ensure that campaigns or mailings are sent to those who will be most interested or likely to respond. This type of activity is not aimed at identifying specific individuals to target, but rather many individuals who may fall within a certain segment of supporters.

3. Major donor analysis

We may carry out research to determine whether an individual could be a potential major donor. We may use publicly available information from third party sources such as Google; Companies House; published biographies and publicly available LinkedIn profiles.

The type of information we collect can include:

• career overview
• gift capacity
• areas of interest
• history of giving to us and others
• how the individual is connected with us and others
• public information on any philanthropic activities.

4. High value event planning

We may also use profiling to produce short biographies of people who are due to meet with our leadership team or attend an event that we may be hosting.

This helps our people to understand more about those we engage with and their interests or connection to us.

5. Ethical screening and minimising risk

As a registered charity, we are subject to a number of legal and regulatory obligations and standards. The public naturally expect charities to operate in an ethical manner and this is integral to developing high levels of trust and demonstrating our integrity. This means that we may carry out appropriate due diligence of donors, check donations and implement robust financial controls to help protect the charity from abuse, fraud and/or money laundering.

We may carry out background checks and due diligence on potential donors or anyone planning on making a significant donation or gift before we can accept it. We may also ethically screen supporters to minimise risk of creating an association with an individual or group that conflicts with the standards we have set out in our overarching Fundraising Policy.

Normally, we will only use your data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another related reason, and that related reason is compatible with the original purpose. If we need to use your data for an unrelated purpose, we will seek your consent to use it for that new purpose.

Who do we share your information with?

We will only use your information for the purposes for which it was obtained.

Normally, we will not share your personal data with any third parties.

We may need to share your data with third parties where they provide services on our behalf (for example those who help us to operate the website). We require that all our third-party service providers take necessary security measures to protect your personal data. We do not permit your personal data to be used by those third parties for their own purposes, and they may only process your data for specified purposes, and strictly in accordance with our instructions.

We may share your personal data with third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, to enforce or apply our site terms of use, or to protect the rights, property or safety of our site, our users and others. We will, however, ensure that sharing of your data is kept to a minimum.

How we protect your information

We use technical and corporate organisational safeguards to ensure that your personal information is secure. We limit access to information on a need-to-know basis and take appropriate measures to ensure that our people are aware that such information is only used in accordance with this privacy policy.

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, volunteers and contractors. Our online forms are always encrypted and our network is protected and routinely monitored. If you use your credit or debit card to donate to us, buy something or make a booking online, we pass your card details securely to our payment processing partners. We do this in accordance with industry standards and do not store the details on our website.

Please bear in mind that the transmission of information via the internet is not completely secure, and whilst we will do our best to protect your personal data, we cannot guarantee the security of data transmitted via our website, or by email, and any such transmission is at your own risk.

Vulnerable circumstances

We understand that additional care may be needed when we collect and process the personal information of vulnerable supporters and volunteers. In recognition of this, we observe good practice guidelines in our interactions with vulnerable people.

How long will we keep your information?

We will keep your personal data only for as long as is necessary. In working out how long we need to keep your personal data we take into account the amount, nature and sensitivity of the personal data, the potential for harm to arise from its unauthorised use or disclosure, the purposes for which we process it, and as to whether those purposes may be achieved by other means, and the applicable legal requirements. Since retention periods will differ for different types of personal data.

We will keep your personal information in respect of financial transactions for as long as the law requires us to for tax or accounting purposes (which may be up to six years after a particular transaction).

Your rights to your personal information

Under the UK GDPR you have certain legal rights which apply in certain circumstances. These include the right to:

• Request access to your data: sometimes called a ‘subject access request’; this allows you to receive, from us, confirmation as to whether or not your personal data is being processed, and if so to gain access to that personal data and various other information about it, including the purpose for the processing, with whom the data is shared, how long the data will be retained, and the existence of various other rights.
• Request correction of your data: sometimes called a ‘right to rectification’, this is a right to obtain from us, without undue delay, the putting right of inaccurate personal data concerning you.
• Request erasure of your data: sometimes referred to as the ‘right to be forgotten’; this is the right for you to request that, in certain circumstances, we delete data relating to you.
• Restrict processing of your data: the right to request that, in certain circumstances, we restrict the processing of your data.

The Boparan Charitable Trust Children’s Policy

The Boparan Charitable Trust recognises that children have the same rights as adults in relation to why their personal information is needed, how it is processed, kept safe and retained. We have a children’s policy to raise awareness and support children’s understanding of the issues.

How to make a complaint or raise a concern

If you would like more information, or have any questions about this policy, to make a formal complaint about our approach to data protection or raise privacy concerns please contact the Charity Director.

Email Gareth.aston@boparan.com Phone 0121 661 9860 Post The Boparan Charitable Trust 2nd Floor, Colmore Court, 9 Colmore Row, Birmingham, B3 2BJ

If you would like to make a complaint in relation to how we have handled your personal information, please follow our complaints procedure. However, you also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection issues. The ICO may be contacted on their helpline number which is 0303 123 1113 between 9am and 5pm Monday to Friday, or by other contact methods as set out on their website: www.ico.org.uk

We are registered with the Information Commissioner’s Office as a Data Controller under registration reference number zb126019