Privacy Policy

Cambridge Rape Crisis Centre is committed to protecting your personal information and being transparent about what information we hold, whether you are a service user, donor, fundraiser, volunteer or support us in other ways.

This policy covers how we collect, store and process personal information about supporters and the public and is used in conjunction with our Confidentiality, Data Protection and Sharing Information Policy, which details how we collect, store and process personal information about service users, employees and volunteers.

The purpose of this policy is to give you a clear explanation about how Cambridge Rape Crisis Centre uses the personal information you provide to us and that we collect, whether online, via phone, email, in letters or in any other correspondence or from third parties.

We ensure that we use your information in accordance with all applicable laws concerning the protection of personal data and information. This notice explains:

• What information Cambridge Rape Crisis Centre may collect about you;
• How we will use that information;
• Whether we disclose your details to anyone else;
• Your choices regarding the information you provide to us; and
• How we use cookies to provide services to you or to improve your use of our websites.

This notice is written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). The charity is registered with the Information Commissioner’s Office (ICO) as a Data Controller under reference number Z2503442.

If you have any queries about this policy please contact the charity’s Director at: Cambridge Rape Crisis Centre, Box R, 12 Mill Road, Cambridge CB1 2AD. Alternatively, you can call 01223 313 551 or email fundraising@cambridgerapecrisis.org.uk.

By using our website or any of our services, or providing us with any personal data, you agree to your personal data being used and disclosed in the manner set out in the policy.

Cambridge Rape Crisis Centre is a specialist sexual violence charity providing emotional, therapeutic and advocacy support services to survivors of all forms of rape and sexual violence across Cambridgeshire. We are registered with the Charity Commission and our registered charity number is 1179871.

In carrying out our day to day activities we process and store personal information relating to our supporters and we are therefore required to adhere to the requirements of the UK General Data Protection Regulation and the Data Protection Act 2018.

We take our responsibilities under these regulations very seriously and we ensure the personal information we obtain is held, used, transferred and otherwise processed in accordance with the UK GDPR and all other applicable data protection laws and regulations.

Personal information/data is information that can be used to identify you. It can include your name, data of birth, email address, postal address, telephone number, mobile number, fax number, bank account details, debit/credit card details and whether you are a UK tax payer so that we can claim Gift Aid (please rest assured we do not collect information about your actual tax payments, just whether you are a tax payer).

We collect this information when you use our services, donate money, undertake fundraising activities in aid of our work, volunteer with us or otherwise give us personal information online, in paper or electronic form, by phone, text or face to face.

We will collect and use your personal information for administrative purposes and to manage your engagement with us. For example, processing your donation and telling you what we do with the support we receive; supporting your fundraising or providing you with a service and recording how you’d like to hear from us.

We collect information in the following ways:

• Information you give us directly. For example, when you make a donation to us, fundraise for us, register for an event, engage with us on social media or otherwise provide us with personal information. When you register for fundraising or make a donation, we’ll ask for personal information – like your name, address, email and telephone number to store with your account.
• When you give it to us indirectly. Your information may be shared with us by independent organisations such as online fundraising services (e.g. JustGiving), fundraisers taking part in events, funeral directors, solicitors and other similar intermediate organisations. Those people will only provide us with information when you have indicated that you want to support Cambridge Rape Crisis Centre, and with your consent. If you have any concerns about the use and transfer of such information you should check their privacy policies when you provide your information to understand how they will process the information you give them.
• When you give permission to other organisations to share it. Depending on the privacy and settings you may apply to social media and messaging apps such as Facebook and Twitter, you might provide permission for us to access information from your accounts with those services.
• From other publicly available information sources. In some cases, for example to verify your address or post code when we have a legitimate reason to contact you (for example, the information on a donation form is illegible), we reserve the right to use publicly available sources of information such as Google and other search engines to ensure the accuracy of the information we hold about you.
• Information we get from your use of our website and online services. We collect information about your website and social media usage and engagement using cookies, page-tagging techniques and data analytics available through each social media platform (where applicable).

Data Protection law recognises that certain categories of personal information are more sensitive. This is known as ‘sensitive personal data’ and covers health information, race, religious beliefs and political opinions.

We do not usually collect sensitive personal data about our supporters unless there is a clear reason for doing so, such as participation in a marathon or similar fundraising event or where we need this information to ensure that we provide appropriate facilities or support to enable you to participate in an event.

We may also collect sensitive personal data if you make the information public or if you tell us about your experiences relating to sexual violence and/or Cambridge Rape Crisis Centre, e.g. if you choose to act as a case study for us.

Service user and supporter data is collected, stored and processed separately. The fundraising team does not have access to service user data.

If you choose to share that you are a survivor of sexual violence and/or service user (current or past) we will keep a note on your record to ensure the best possible supporter stewardship. This information is never shared without your explicit consent e.g. if you have agreed to be a case study for us.

Our staff members are trained to handle your information correctly and to protect your confidentiality and privacy.

If you are a service user, staff member or volunteer, how we handle sensitive personal data is covered by our Confidentiality, Data Protection and Sharing Information Policy.

We may use your information for a number of purposes including the following:

• To provide you with a service and to manage your engagement with us;
• To process donations we may receive from you;
• To create an account for you on our database (Donorfy) if you register with or donate to us;
• For administration purposes (for example, we may contact you regarding a donation you have made or an event you have registered for);
• For internal record keeping, including the management of any feedback or complaints;
• To provide you with services, products or information you have requested or which we feel may interest you where you have consented to being contacted;
• To fundraise in accordance with our internal policies and procedures;
• To provide you with information about our work or our activities that you have agreed to receive;
• To invite you to participate in surveys or research (although this is entirely voluntary);
• To analyse and improve the services we offer;

To comply with our obligations as a charity, we must take reasonable and appropriate steps to know who our donors are, particularly where significant sums are being donated. This means we may conduct research, including accessing information which is already publicly available, on prospective donors, partners or volunteers to ensure it would be right for us to accept support, whether that is from an individual or an organisation.

This will help to give assurance that the donation is not from an inappropriate source and to safeguard our reputation. This does not mean that we will question every donation, nor that we will research lots of personal and other details about every donor. Any information we do collect for this purpose will only consist of what is necessary for us to meet these requirements and will be processed in line with your rights – see the section ‘Your rights’ below for more information about your rights.

If you give us your information whilst receiving a service, making a donation, registering for fundraising, taking part in an event or any other purpose we are required to store and process that data for administration and auditing purposes and we will keep your information for as long as is required to enable us to operate our services but will not keep your information for any longer than necessary.

The law requires us to set out the lawful grounds on which we collect and process your personal information as described in this policy. Depending on the purposes for which we use your data, one of more of the grounds listed below may be relevant:

Legitimate Interest

We rely on the ground of ‘legitimate interest’ for processing where we believe it is in the legitimate interests of you, as the data subject, or of Cambridge Rape Crisis Centre, to process your data. When processing your data in this way, we always think about the potential impacts on you and your rights under the data protection laws and will not use your personal information for activities where our interests are outweighed by the impact on you.

Examples of processing on the grounds of legitimate interest include:

• Providing information about sexual violence;
• Administering events;
• Staff and volunteer recruitment and speaking to staff and volunteers about their roles;
• Promoting Cambridge Rape Crisis Centre of social media and online platforms.

Consent

We will often rely on obtaining your consent to use your personal information in a certain way. For example, we do not use your personal information for marketing purposes unless you have given agreed we can do so. For more information on marketing communications, please see the ‘Marketing materials’ section of this policy.

Legal obligation

We may need to collect, process and disclose personal information to comply with a legal obligation. For example, we are legally required to hold donor transaction details for Gift Aid and/or accounting purposes.

Performance of a contract

For example, if you purchase something from our online shop or community stalls or you agree to work with us, we need to be able to process your information for the purpose of meeting our contractual obligations.

By using the Cambridge Rape Crisis Centre website, you consent to the data practices described in this notice.

Your consent applies to the following domain: https://cambridgerapecrisis.org.uk

For all areas of our website which collect personal information then the following will also apply:

• Cambridge Rape Crisis Centre’s website collects personal information when you register, supply feedback or complete any form with us;
• The website uses secure online forms to collect personal information that you supply for the purposes of allowing you to refer yourself or another into our services, to make a donation, to fundraising for us or to join our mailing list. You will no longer be anonymous to us once your submit any of these forms;
• We use secure online forms provided by our databases – Donorfy and Visia – on our website to collect the information you supply;
• Although we cannot 100 per cent guarantee the security of any information you transmit to us, we enforce strict procedures and security features to protect your information and prevent unauthorized access;
• As part of the registration process and continued use of Cambridge Rape Crisis Centre services, you agree that any information you submit to the charity will always be accurate, correct and up to date;
• We collect and retain information about your transactions with us so that we can process your transactions and deal with future queries efficiently and effectively;
• We collect and retain information about your interactions with us so that we can process any requests and deal with future queries more efficiently;
• The Cambridge Rape Crisis Centre website is managed by the charity and Fishvan Ltd.

Cookies are small text files that are used to store limited information on an individual’s computer or device when the website is loaded on your browser. These cookies help the website function properly, make the website more secure, provide a better user experience and understand how the website is performing and to analyse what works and what needs improving.

As most of the online services, our website uses first-party and third-party cookies for several purposes.

First-party cookies are mostly necessary for the website to function the right way, and they do not collect any of your personally identifiable data.

The third-party cookies used on our website are mainly for understanding how the website performs, how you interact with our website, keeping our services secure, providing advertisements that are relevant to you, and all in all providing you with a better and improved user experience and help speed up your future interactions with our website.

When you visit our website, a consent notice will appear at the top of the page, enabling you to give consent for cookies, change your preferences or decline to give your consent. If you don’t choose an option on the consent notice and continue to use our website, you will be agreeing to the use of all cookies.

Should you decide to change your preferences, different browsers provide different methods to block and delete cookies used by websites. You can change the settings of your browser to block/delete the cookies. To find out more about how to manage and delete cookies just type the query into any search engine.

Please be aware that if you refuse cookies, our website may not function for you as we would like it to.

We use Google Analytics to understand how visitors interact with our website. They help to provide information on metrics, the number of visitors, bounce rate, traffic source, your IP address, what browser you are using and the operating system you are using. We use this information to improve our website’s performance and functionality. This information is transmitted to and stored by Google. We can’t use this information to find out further personal information about you.

Cambridge Rape Crisis Centre uses social media to promote our vital work. We have accounts on Facebook, Instagram and LinkedIn. We collect donations through Facebook Fundraisers, Facebook Donate, Instagram Fundraisers and Instagram Donate.

We use Facebook and Instagram adverts to raise awareness about our work and sexual violence and to promote our fundraising, events, impact, volunteering opportunities, employment opportunities and other areas of our work.

Where members of the public engage with our posts or publish content relevant to our work, we may like posts, follow them, reply or write to them.

If you post or send any content that we believe to be inappropriate, offensive or in breach of any laws, such as defamatory content on our social media pages, we may use your personal information to inform relevant third parties such as your internet provider or law enforcement agencies.

All donations made to us by debit or credit card are made via trusted third party processors, primarily PayPal, Stripe and GoCardless. Your debit or credit card details are never received or stored by the charity.

Payments are secure and meet the Payment Card Industry Data Security Standards (PCI-DSS).

All companies we use ensure your data is processed safely and securely. For further information about how they process and store your data when making a donation please visit their websites.

If we receive an email containing any credit or debit card details, it will be immediately deleted, no payment will be taken and you will be notified about this.

If you apply to work at Cambridge Rape Crisis Centre then the information you provide at the time of application is subject to our Confidentiality, Data Protection and Sharing Information Policy.

The charity will only use the information it receives during recruitment to process your application and to monitor recruitment statistics. If we want to disclose that information to someone outside the charity – for example, if we need a reference – we will make sure we tell you beforehand, unless we are required to disclose this information by law.

If you commence employment at Cambridge Rape Crisis Centre, your data will be processed in accordance with your employment contract and other applicable policies.

When you contact us and provide us with your information – for example, when making a donation or registering for fundraising – we may contact you by post, email, telephone or text for administration purposes relating to the reason you have contacted us.

We also like to contact you to tell you how your support has been used, give you updates and details about our work, let you know about our fundraising and how you can get involved. We do this by email. These are known as marketing materials. We will only do this with your consent.

It is your choice as to whether you want to receive marketing materials from us; how you want to receive them and the types of material you want to receive. You will only ever get marketing materials from us if you have consented to receive them and only ever by the method(s) you tell us. We will not use your information for marketing purposes if you have indicated to us that you do not wish to be contacted for such purposes.

At the point at which we collect your data – for example, when making a donation, registration forms, Gift Aid declarations – we will ask you what for these contact preferences. This can be digitally, verbally and/or in paper format. If you do not want us to use your personal information for marketing purposes please indicate your preferences at this point.

Five years after your most recent contact or donation – unless you tell us otherwise when we contact you – we will archive/suppress your personal information and you will no longer receive marketing materials from us.

You can also change your contact preferences at any time by contacting us on 01223 313 551 or emailing fundraising@cambridgerapecrisis.org.uk. You can also opt-out of our marketing emails by clicking on the ‘unsubscribe’ link at the end of the email.

We store supporters’ personal information as an account on our charity’s databases and on a financial ledger and, in certain circumstances, in a paper format.

We keep personal information for as long as we need to use it for the purposes set out in this policy.

We will retain certain information in respect of donations and financial transactions securely for as long as the law requires to for tax and accounting purposes (generally seven (7) years).

When your information is no longer required, we will ensure it is disposed of/deleted and/or anonymised in a secure manner at the appropriate time. We continually review what supporter records we hold and delete and/or anonymise what is no longer needed.

Any supporter information we collect is stored securely and processed primarily in the UK or European Economic Area.

For financial and/or technical reasons we may, on occasion, need to use the services of a supplier (data processor or sub-processor) outside the UK or European Economic Area (EEA), however we will ensure that your information is held in compliance with UK data protection regulations.

By submitting your personal information, you agree to this transfer, storing or processing at a location outside the UK or EEA. We will take all steps reasonably necessary to ensure that your data is kept secure and in accordance with this privacy notice.

We do not, and will never, sell, swap or rent supporters’ personal information with any third parties.

We may share your information with parties who provide a service to us and are our data processors. These are trusted partner organisations that work with us in connection with our charitable purposes, and other entities that act as fundraisers for the charity, sell Cambridge Rape Crisis Centre products or provide charity information and marketing (subject to your communication preferences and our internal policies and procedures).

Our trusted partners are required to comply strictly with our instructions and data protection laws and we will make sure that appropriate controls are in place. We enter into contracts with all of our data processors and regularly monitor their activities to ensure they are complying with Cambridge Rape Crisis Centre policies and procedures.

We may disclose your information to third parties without your permission where we are under a duty to do so in order to comply with any legal obligation or in order to enforce or apply our rights (including in relation to our website or other applicable terms and conditions) or to protect the charity, for example in cases of suspected fraud or defamation.

Reasons where we may be forced to share your information without your permission could include:

• We are compelled to disclose due to a police warrant, court order or DP1 Form;
• Prevention of terrorism;
• These is reasonable cause to suspect that there is significant risk of harm to children or young people;
• There is reasonable cause to suspect that an adult’s life may be in immediate danger.

If you are a service user, your information is subject to our Confidentiality, Data Protection and Sharing Information Policy.

If you are under 18 and would like to fundraise with us, please ensure that you have consent from a parent or guardian before giving us your personal information. When you register to fundraise for us we will specifically ask for information about your age, usually your date of birth, and will ask for confirmation of consent from a parent or guardian if you are under 18 years of age.

When we collect information about a child or young person aged under 18 we will make it very clear as to the reasons for collecting this information and how it will be used.

We will not send marketing materials to any supporters under 18 (if we are aware of their age) even if consent is given.

Please see our Vulnerable Supporters Policy for further information.

We aim to ensure that all information we hold about you is accurate and, where necessary, kept up-to-date. If any of the information we hold about you is inaccurate or incomplete and either you advise us or we become otherwise aware, we will ensure it is amended and updated as soon as possible.

You can edit your Cambridge Rape Crisis Centre account information and/or communication preferences, including your address and contact details, at any time by contacting us on 01223 313 551 or emailing fundraising@cambridgerapecrisis.org.uk.

You have the following rights with regard to your personal information:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling.

These include the right to request a copy of the personal information we hold about you, the right to have your personal information deleted from our records, the right to object to how we are processing your personal information and the right to obtain and reuse your personal information for your own purposes.

Should you wish to exercise these rights we require you to prove your identity with two pieces of approved identification. Please address requests to: Director, Cambridge Rape Crisis Centre, Box R, 12 Mill Road, Cambridge CB1 2AD and we will respond within 30 days. Please provide as much information as possible about the nature of your contact with us to help us locate your records.

Where you have provided your consent for our use of your personal information, you always have a right to withdraw your consent at any time.

This policy is correct as of 22 April 2024.

This policy will be reviewed on 22 April 2027.

We may update the terms of this policy at any time, so please do check it from time to time. We will notify you about significant changes in the way we treat personal information by sending a notice to the primary email address you have provided to us or by placing a prominent notice on our website.

By continuing to use our website and any of our services and/or the continued provision of personal information after we have posted the changes to this notice will be taken to mean you are in agreement with those changes.

We are always trying to improve our services and all your feedback – good or bad – is essential to that process.

Service user feedback and complaints

Please get in touch with us on 01223 313 551 or email contact@cambridgerapecrisis.org.uk.

Our Service User Complaints Policy is available here.

If you have used our emotional support services, you can you can fill out our online feedback form if you want to give us more detailed feedback on your experiences of our service(s).

Fundraising feedback and complaints

Please get in touch with us on 01223 313 551 or email fundraising@cambridgerapecrisis.org.uk.

Our Fundraising Complaints Policy is available here.

If you have any queries about this policy, you can contact us at fundraising@cambridgerapecrisis.org.uk or call 01223 313 551.