Privacy Policy

The privacy and security of your personal information is extremely important to us. This privacy policy explains how and why we use your personal data, to make sure you are stay informed and can be confident about giving us your information.

We do use your personal data to help us provide an exceptional experience for you. This includes tailoring the information we share to ensure you find it relevant, useful and timely.

We do respect your privacy and work hard to ensure we meet strict regulatory requirements.

We do not sell your personal data to third parties.

We’ll amend this privacy policy from time to time to ensure it remains up to date, shows how and why we use your personal data, and reflects any new legal requirements. We will publicise significant changes clearly on our website.  The most up-to-date version will always be posted on our website.

In this policy, whenever you see the words ‘we’, ‘us’, ‘our’, ‘Penny Brohn UK’, it refers to Penny Brohn UK, the working name of Penny Brohn Cancer Care (Reg. Charity No. 284881).

Penny Brohn Cancer Care is a company limited by guarantee (registered number 01635916). PB UK Commercial Ltd undertakes trading activities. After each financial year the directors of the PB UK Commercial Ltd consider the profits made alongside the level of reserves held in determining whether a donation can be made to Penny Brohn Cancer Care (Penny Brohn UK). PB UK Commercial Ltd is a company limited by shares, registered in England & Wales (registered number 03983263) and operates under the same policies as the charity.

1. What personal data do we collect and how do we collect it?

Your personal data (i.e. any information which identifies you, or which can be identified as relating to you) will be collected and used by us. We’ll only collect the personal data that we need, and we’ll make it clear at the point of collection why we are collecting it.

1.1 What types of personal data we collect

In whatever way you interact with us, such interaction may create items of personal data. This could include details of how you’ve helped us by volunteering or by supporting our campaigns and other activities. If you decide to donate to us, we’ll also keep records of when and how much you give to support our cause.  Examples of personal data collected by us include:

Personal details (name, date of birth, email, address, telephone, and so on) when you book onto our courses, complete a referral form, make a donation or purchase from our shop
Financial information (payment information and whether donations are gift-aided)
Reference and employment details by completing a job or volunteer application form
Your opinions and attitudes about Penny Brohn UK, activities and interests, and your experiences of Penny Brohn UK.

1.2 Personal data created directly from your involvement with us

We collect personal data in connection with specific activities such as enquiring about our services and activities, registration requests or bookings on courses/to use our services, placing an order, donating, volunteering or taking part in research for us and applying for employment.

You can also give us your personal data by filling in forms on our website, registering on our website, participating in discussion boards, subscribing to take part in research on our website or other social media, entering a competition, promotion/survey or by corresponding with us. These can be done by phone, email or by joining as a client/supporter.

1.3 Personal data created indirectly from your involvement with us, or when you’ve given other organisations permission to share it

You may give us information indirectly, for example, when you use other fundraising sites. If you are fundraising for us via Just Giving for example, these organisations have their own privacy policy so please ensure you understand this when providing your data.

When you connect with us on social media sites, depending on your settings, or the privacy policies for social media and messaging services like Facebook, Instagram, X(Twitter), or Pinterest, you might give us permission to access information from those accounts or services.

We may automatically collect information as you use our digital service such as the website. This may include the pages you have visited, information about the device or browser you are using, any errors you encountered and data relating to any online transactions such as donations, event bookings and online shop purchases.

1.4 Administering legacies

If you’ve told us that you have left a gift in your will, or are thinking about doing so, we will keep details of this.

We will collect personal data from:

Executors, Trustees, solicitors and any other professional third party instructed in the legacy administration process.
Third parties, such as the Smee & Ford notification service
Copies of wills either provided by Executors, Trustees or other professionals acting in the administration, or publicly available online.
Other co-beneficiaries of the will
The public domain

1.5 Information from third parties

When undertaking supporter analysis we may analyse geographic, demographic and other information relating to you.  We may use additional information from third party sources when it is available.  Such information is compiled using publicly available data about you, for example addresses, listed Directorships or typical earnings in a given area. In addition, we may buy anonymous external data (e.g. census data, Experian MOSAIC, TGI) and combine it with your personal data at an aggregated level to build profiles which help us work out what you’re most likely to want to hear from us about and how.

1.6 Sensitive personal data

We sometimes collect and use ‘sensitive personal data’ from our clients, employees and volunteers. This is defined as information about racial or ethnic origin, political opinions, religious or other similar beliefs, physical or mental health, sexual life, and criminal allegations, proceedings or convictions.

For those using our services, we collect sensitive personal data about your cancer diagnosis and the general state of your health to enable us to provide a safe and supportive environment for you.

At times we’ll collect sensitive personal data to help us monitor equal opportunities, and to research whether we deliver great experiences for everyone, regardless of their background or beliefs, but this is only ever analysed at an aggregate rather than individual level.

1.7 Employees, Volunteers and Service Providers

We may collect extra information about you (such as references, criminal records checks, details of emergency contacts or medical conditions). We will keep this information for legal or contractual reasons, to protect us (including in the event of an insurance or legal claim), and for safeguarding purposes.

1.8 CCTV

We have Closed Circuit Television (CCTV) at the National Centre and The Hub therefore you may be recorded when you visit.

CCTV is used to provide security and protect both clients and visitors and the National Centre or The Hub. CCTV will only be viewed when necessary (for example, to detect or prevent crime) and footage is stored for a set period of time, after which it is recorded over. Penny Brohn UK complies with the Information Commissioner’s Office CCTV Code of Practice and we put up notices so you know when CCTV is used.

2. How we use your personal data and why

We will use your personal data for the purpose or purposes outlined at the time you gave it to us. Your personal data may be collected and used to help us deliver our charitable activities, help us raise funds, or complete your order or request.

As a cancer support charity we use personal information to help us understand our supporters and potential supporters, tailor our communications and use our resources effectively.

2.1 The main ways we use your data

To provide you with the services or information you have requested.
To maintain organisational records and ensure we have up-to-date marketing and communication preferences for individuals.
To send you information about our work.
To update you about any changes to our services.
To help us improve our services.
To invite you to participate in surveys or research.
To administer donations, including Gift Aid processing.
To support individuals’ fundraising activities.
To invite you to make donations to support our work.
To invite you to participate in fundraising activities and attend events.
To support our volunteers.
To ensure the safety of all that attend our events and activities.
To analyse and improve the operation of our website.
To analyse your use of our website.
To share your story to help further our work.
To make a purchase from our shop.
Hold dietary requirements for courses and events.
To administer your volunteering or employment application.
To contact you where you have been identified as a contact person for an organisation, such as a Cancer Support Nurse.

2.2 Research

We conduct research and analysis on the information we hold which can in turn create further personal data. For example, by analysing your interests and involvement with our work we may be able to build a profile which helps us decide which of our communications are likely to interest you. The section Supporter Analysis (section 2.4) gives more detail about how we use information for profiling and targeted advertising, including giving you more relevant digital content. We use this information to identify ways in which you could support Penny Brohn UK and invite you to do so if appropriate.

This analysis may be carried out by us or by third party organisations working for us.

We carry out research with our supporters and donors to improve the experiences we offer and ensure we know what you find relevant and interesting. We carry out research with our clients, staff and volunteers to get feedback on their experience with us so that we can improve. This includes looking at quality assurance to develop our services for people with cancer, and to demonstrate the impact of our services to funders and supporters.

If you choose to take part in research, we’ll tell you when you start what data we will collect, why and how we’ll use it. All the research we conduct is optional and you can choose not to take part. For some of our research we may ask you to provide sensitive personal data (for example, ethnicity, and cancer diagnosis). You don’t have to provide this data and we also provide a ‘prefer not to say’ option. We only use it at an aggregate rather than individual level (for example, for reporting on equal opportunities).

2.3 Communicating with you

Administrative communications

We will communicate with you using the contact details you have provided for essential administrative purposes, such as to administer a donation, provide you with information regarding a fundraising event you have asked to take part in or in relation to an appointment booked or enquiries made about our services.

Marketing and fundraising communications

We want to keep our supporters up to date with our fundraising and marketing activities. If you have given your consent to do so, we will contact you for marketing purposes by email and SMS message.  We may also send you communications by post or contact you via telephone on the basis it is in our legitimate interests to do so, unless you ask us not to.

You can always change your mind regarding your preferences at a later date and at any time. For more on withdrawing your consent, please see the information in section 7.  We’ll never share your information with companies outside Penny Brohn UK who want to use it for their marketing.

Marketing to those under the age of 18

We do not communicate with those under the age of 18. If someone under the age of 18 has signed up to either use our service or partake in a specific fundraising event/campaign, we will need parental/guardian consent from them to do this. We will not market to under 18 outside of this purpose.

For those where parental/guardian consent has been granted, their identifiable on our database as being under the age of 18 to allow exclusions from any communications. Their parent/guardian is linked and identified on their record as well as consent being tracked.

2.4 Supporter analysis

We know it’s important to our supporters that we use our resources in a responsible and cost-effective way. This is why we use automated profiling and targeting to help us understand our supporters and make sure that:

our communications (for example, emails) and services (for example, our website) are relevant, personalised and interesting to you.
our services meet the needs of our clients and supporters
we only ask for further support and help from you if it’s appropriate
we use our resources responsibly and keep our costs down

To do this, we’ll analyse how you interact with us. For example, on our website we use both geographic and demographic information to let you know what’s happening in your local area and understand your interests. The personal information we collect includes transactional information for donations and event sign ups.

Much of the information we collect is aggregated, which means we look at it in summary form rather than at an individual level. However, we may also collect some personal data to personalise your experience, tailor our marketing campaigns to your interests, and ensure the website is functioning as we want it to.

If you’ve agreed we can contact you for marketing purposes, or where legitimate interest applies, we may also gather additional information about you from external sources, for example; updates to address and contact information, or publicly available information regarding your wealth, earnings and employment at an aggregate level.

We may also use personal data to create profiles which help us target our communications, to you and to other people. For example, we may use your personal data to find online users with a similar profile to you who may also be interested in our products or services. We won’t profile anyone under the age of 18.

We may sometimes use third parties to capture some of our data on our behalf, but only where we are confident that the third party will treat your data securely, in accordance with our terms and in line with the requirements set out in the GDPR.

2.5 Social media

We may participate in Meta’s ‘Custom Audiences’ programme which enables us to display adverts to our existing supporters when they visit Facebook.  We provide your email address, mobile number and address to Meta so they can determine whether you are a registered account holder with them.  Our adverts may then appear when you access Facebook.  Your data is sent in an encrypted format that is deleted by Meta if it does not match with a Meta account. Meta’s data policy can be found here.

For more information click here. Learn about your Meta ad preferences here.

We also use Hotjar to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which webpages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices. This includes a device’s IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.

For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.

2.6 Location services

We use the location data provided by the devices you use to access our main website. You can change your location settings at any time in your device or computer settings.

2.7 Cookies and links to third-party websites

We use cookies to ensure that we give you the best experience on our website. Cookies are small text files stored on your computer when you visit certain websites. They are widely used to make websites work more efficiently for visitors, and to provide information to the owners of the site. Some of the cookies we use are essential in order for parts of the website to operate.

How do I change my cookie settings?

In your web browser you can control which types of cookies you allow. You can turn cookies on or off using your browser’s settings. You can also delete cookies and clear your browser’s cache (history).

Whether our cookies are used will depend on your browser settings, so you are in control. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, please use the following links:

Further information on cookies and how to manage your cookies can be found in our cookie policy.

2.8 Recruitment and employment

If you work for us, or apply for a job with us, we will process your personal data, including sensitive personal data, to comply with our contractual, statutory and management obligations and responsibilities.

This data can include, but isn’t limited to, information relating to your health, racial or ethnic origin, and criminal convictions. In certain circumstances, we may process personal data or sensitive personal data without explicit consent. You can find further information on the data we collect and why below.

Our contractual responsibilities include those arising from a contract of employment. This includes, but is not limited to, data relating to payroll, bank account, postal address, sick pay, leave, maternity pay, pension and emergency contacts.
Our statutory responsibilities are those imposed by law on us as an employer. This includes, but is not limited to, data relating to tax, national insurance, statutory sick pay, statutory maternity pay, family leave, work permits and equal opportunities monitoring.
Our management responsibilities are those necessary for the way the organisation functions. This includes, but is not limited to, data relating to contact details, terms of recruitment and employment, training and development, absence and disciplinary matters.

2.9 Managing volunteers

We need to use your personal data to manage your volunteering, from the moment you enquire to the time you decide to stop volunteering with us.

This includes contacting you about a role you’ve applied for or which we think you might be interested in, processing expense claims you’ve made, recording shifts you’ve booked, recognising your contribution, asking for your opinions on your volunteering experience and next of kin details.

2.10 Use of sensitive personal data about employees and volunteers

In certain limited circumstances, we may legally collect and process sensitive personal data without requiring the explicit consent of an employee or volunteer.

We will process data about an employee’s health where it is necessary, for example, to record absence from work due to sickness, to pay statutory sick pay, to make appropriate referrals to the Occupational Health Service, and to make any necessary arrangements or adjustments to the workplace in the case of disability. This processing will not normally happen without the employee’s knowledge and, where necessary, consents.
We will process data about, but not limited to, an employee’s or volunteers racial and ethnic origin, their sexual orientation and their religious beliefs, but only where they have volunteered such data and only for the purpose of monitoring and upholding our equality and diversity policy.

3. How we secure your personal data

We want to keep our clients, donors, volunteers, employees and contractors safe, so the security of your data and of our information systems is incredibly important to us.

External threats to our data security are changing all the time, so we have a robust process for assessing, managing and protecting all 0our new and existing systems to ensure they are up to date and secure. Our staff complete mandatory information security and data protection training when they start with us and every year afterwards, to reinforce their responsibilities and requirements.

We ensure that there are technical controls in place to protect your personal details on our websites and Office 365 network.  We always ensure that only authorised personnel (for example Penny Brohn UK staff or volunteers) have access to your information and that they are appropriately trained to manage personal information.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to the website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

3.1 Storing information

Penny Brohn UK’s operations are based in the UK and we store most of your data within the European Union (EU). Some organisations which provide services to us may transfer your data outside the European Economic Area but we’ll only allow this if your data is adequately protected. Some of our systems are provided by US companies and while it is our policy that we prefer data hosting and processing to remain in the EU, it may be that using their products results in your data being transferred to the USA. However, we only allow this when we are certain your data will be adequately protected in accordance with Standard EU contractual clauses.

3.2 Payment card security

Penny Brohn UK has an active PCI-DSS (Payment Card Industry Data Security Standard) compliance programme. This is the stringent international standard for safe card payment processes. As part of our compliance, we ensure that our IT systems do not directly collect or store your payment card information, such as the full 16-digit number on the front of the card or the security code on the back.

Our online donations solutions are carried out using a ‘payment gateway’ (such as Blackbaud Netcomms, Stripe or PayPal) which is a direct connection to a payment service provided by a bank. This means that when you input card data into the payment page, you are communicating directly with the bank and the bank passes your payment to us. This means that your payment card information is handled by the bank and not processed or held by us.

4. Disclosing and sharing data

We do not sell or share your personal information for other organisations to use.

When we allow third parties acting on behalf of Penny Brohn UK to access your information, we will always have complete control of what they see, how long they see it for and what they are allowed to do with it.

Where necessary, we may share the personal data we collect and process with:

Third party research organisations
Third party IT providers, for example who host the website or provide IT support
Our trading subsidiary PB UK Commercial Ltd

Also, under strictly controlled conditions, we will share personal data with:

Contractors
Service providers
Advisors
Agents
Data processors associated with legacy administration services

We may provide your email address to digital advertising or social media companies who work on our behalf, such as Meta. This is so we can reach you and others like you with information about how you can support our cause. This data is always provided in an encrypted format and is deleted immediately after use. If you don’t want to see targeted advertising from us on social media, please refer to the instructions provided by the social media site, for example on Facebook, Instagram,  and Google.

We may also disclose your personal information to third parties to comply with a legal obligation, or to enforce other agreement. It may also be used to protect the rights, property or safety of Penny Brohn UK and our clients, supporters and visitors. This includes exchanging information with other companies and organisations to protect against fraud.

4.1 Sharing employee and volunteers’ personal data

In order to carry out our contractual and management responsibilities, we may, from time to time, need to share an employee’s personal data with third-party suppliers.

To meet an employment contract or fulfil our statutory responsibilities, we are required to transfer an employee’s personal data to third parties, for example, to pension providers and HM Revenue & Customs.

4.2 Anti-money laundering

Charity Commission rules require us to know where funds have come from, as well as any conditions attached to them. We follow a due diligence process, which involves researching the financial soundness, credibility, reputation and ethical principles of donors who’ve made, or are likely to make, a significant donation to Penny Brohn UK, using publicly available information and professional resources.

5. Keeping your data

We will only use and store your information for as long as it is required for the purposes it was collected for. How long it will be stored for depends on the information in question, what it is being used for and, sometimes, statutory legal requirements.

6. Your data protection rights

You retain control of how we use your data, and you have the right to ask us to stop processing personal information, which we will do.

You have the following rights under the General Data Protection Regulation in relation to the information that we hold:

The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object
Rights in relation to automated decision making and profiling

7. Access to personal data

You have a right of access to personal data held by us. This right may be exercised by emailing us at privacy@pennybrohn.org.uk, or write to us at Penny Brohn UK, Chapel Pill Lane, Bristol, BS20 0HH or call us on 0303 3000 118 (local call rates apply), 9.00am-4:00pm weekdays.

You may be asked to provide the following details:

The personal information you want to access
Where it is likely to be held
The date range of the information you wish to access.

We will need you to confirm your identity. If we hold personal information about you, we will give you a copy of the information in an understandable format together with an explanation of why we hold and use it. We will aim to respond to any requests for information promptly, and in any event within the legally required time limits (30 days). This timeframe may be extended by up to two months if your request is particularly complex.

7.1 Withdrawal of consent

Where you have given consent for Penny Brohn UK to use your personal data, you have the right to withdraw that consent at any time. You also have the right to ask Penny Brohn UK to stop using your personal data for direct marketing purposes. To stop receiving an email from a Penny Brohn UK marketing list, please click on the unsubscribe link in the relevant email received from us or you can manage your marketing contact preferences online here.

7.2 Amendment of personal data

Where possible we try to keep records up to date but we would appreciate it if you would let us know if your contact details change.  We want you to remain in control of your personal data.

You may email us at privacy@pennybrohn.org.uk, write to us at Penny Brohn UK, Chapel Pill Lane, Bristol, BS20 0HH or call us on 0303 3000 118 (local call rates apply), 9.00am-4.00pm weekdays.

The verification, update or amendment of your personal data will take place within 30 days of receipt of your request.

7.3 Other data subject rights

This privacy policy is intended to provide information about what personal data we collect about you and how it is used. As well as rights of access and amendment referred to above, individuals may have other rights in relation to the personal data we hold, such as a right to erasure/deletion (‘right to be forgotten’), to restrict or object to our processing of personal data and the right to data portability. There may be other legal reasons why we need to process your personal data, but please tell us if you don’t think we should be using it.

If you wish to exercise any of these rights, please send an email to privacy@pennybrohn.org.uk,  write to us at Penny Brohn UK, Chapel Pill Lane, Bristol, BS20 0HH or call us on 0303 3000 118 (local call rates apply), 9.00am-4.00pm weekdays.

8. Our legal basis for processing data

We will only use your personal information if we have a legal basis to do so.  This will usually be either from when you have given your consent, where we have undertaken a legitimate interest assessment or where the use of your data is necessary to comply with a legal or contractual obligation or to protect an individual’s vital interests.

8.1 Consent

In some cases, we will only use your personal information where we have your consent or because we need to use it in order to fulfil a contract with you (for example, because you have placed an order on our website).

We ask for a positive opt-in for consent to allow us to stay in touch with you by email and SMS about our services and products and to tell you about fundraising appeals, events and other opportunities to help.  Our requests for consent give you real choice and control and enable you to choose how we contact you, or to not contact you at all. Our requests for consent are kept separate from our terms and conditions.

We may require clear and explicit opt in of consent to allow us to collect sensitive personal data.  This is used for improving and informing our service delivery through our research and evaluation work.  This information helps us to apply for funding for our services and to make sure we are reaching as many people as possible.

We will ask you to review and confirm your consent on a regularly basis. You can update your consent at any time by clicking here.

Where we are processing your personal data on the basis of consent, you are entitled to withdraw that consent at any time by sending an email to privacy@pennybrohn.org.uk,  write to us at Penny Brohn UK, Chapel Pill Lane, Bristol, BS20 0HH or call us on 0303 3000 118 (local call rates apply), 9.00am-4.00pm weekdays or visit pennybrohn.org.uk/contact-updates.

8.2 Legitimate Interest

There are other lawful reasons that allow us to process your personal information and one of those is called ‘legitimate interests’. This means that the reason that we are processing information is because there is a legitimate interest for Penny Brohn UK to process your information to help us to achieve our vision.

Whenever we process your Personal Information under the ‘legitimate interest’ lawful basis we make sure that we consider your rights and interests and will not process your personal information if we feel that there is an imbalance. This is assessed by the Head of Fundraising, to ensure that the rights of our supporters are maintained.

Some examples of where we have a legitimate interest to process your Personal information are where we contact you about our work via post or phone, use your personal information for data analytics, conducting research to better understand who our supporters are, improving our services, for our legal purposes (for example, dealing with complaints and claims), or for complying with guidance from the Charity Commission.

If you prefer not to be contacted by post or phone, you are entitled to withdraw that consent at any time by sending an email to privacy@pennybrohn.org.uk,  write to us at Penny Brohn UK, Chapel Pill Lane, Bristol, BS20 0HH, call us on 0303 3000 118 (local call rates apply), 9.00am-4.00pm weekdays or visit pennybrohn.org.uk/contact-updates.

9. Breaches

Should a breach of your data occur that is likely to result in harm to the rights and freedoms of you as an individual or group of individuals, we will notify you within 72 hours along with the ICO, where applicable.

10. Additional information

Penny Brohn UK has not appointed a statutory Data Protection Officer as we are not required to by law. However, we have committed resources to manage our compliance with all applicable Data Protection laws.

A Record of Processing Activities (ROPA), in which the lawful basis for processing all of our data is maintained. Wherever Legitimate Interests is relied upon, an impact assessment has been created, available upon demand to those whose data is included.

As of January 1st, 2021, the UK left the European Economic Area (EEA). As Penny Brohn UK does not process the data of individuals outside of the UK, we are not required to appoint an EU representative.

11. What to do if you’re not happy

In the first instance, please talk directly to us, so we can learn from and resolve any problem or query. You can send an email with the details of any data protection complaint to privacy@pennybrohn.org.uk. We will respond to any complaints we receive.

You have the right to contact the Information Commissioner’s Office (“ICO”) (the UK data protection regulator).  For further information on your rights and how to complain to the ICO, please refer to ico.org.uk.

You may also register with the following services to stop receiving unsolicited marketing communications from a selected charity or charities:

The Mail Preference Services (MPS) in relation to postal communication
The Telephone Preference Services (TPS) in relation to phone calls
The Fundraising Preference Services (FPS) in relation to email, telephone, addressed post and/or text messages. We will ensure any new FPS preferences take effect within 28 days.

12. How to contact us

If you have any questions in relation to this privacy policy or how we use your personal information they should be sent by email to privacy@pennybrohn.org.uk,  write to us at Penny Brohn UK, Chapel Pill Lane, Bristol, BS20 0HH or call us on 0303 3000 118 (local call rates apply), 9.00am-4.00pm weekdays.