We want to make sure that we are as clear as possible about our data practices and we’re currently checking to make sure that they’re compliant with the new data protection regulations which became law on 25th May 2018.
If we need to make changes to this policy that will affect how we process your information, we will let you know about the changes by the most appropriate method (eg by email, by post if we don’t have an email address for you, or as an update on our website) as soon as we can.
What does this policy cover?
Viva! was founded in 1994 by Juliet Gellatley, our Founder and Director. We’re a UK registered charity. We fight to stop animal cruelty, to protect our planet and our health through our undercover investigations, campaigns, education and outreach. Viva! also runs events and Festivals and creates masses of practical information to help people become vegan and move in the direction of a kinder lifestyle. Viva! relies on donations from the public to run our campaigns and outreach.
We take the security of your data very seriously and do our utmost to protect it. You have the right to know what information we hold about you, to correct it if it is wrong, to ask us to delete it and to object to what we do with your data (either to us or to our supervisory authority).
If you would like to exercise any of these rights, discuss what we do with your data or request a paper copy of this policy, you can contact us here:
- Email firstname.lastname@example.org
- Write to Viva!, 8 York Court, Wilder Street, Bristol BS2 8QH, UK
- Call us on 0117 944 1000 (Mon-Fri, 9-6).
Viva! has appointed a Data Protection Officer to oversee our data practices and usage. The person appointed is Jeremy Ludlow and he can be contacted using the methods listed above.
What does Viva! know about you?
We only hold data about you that you have voluntarily given to us, except in very specific circumstances. This means that we collect the information you enter when you sign up to our mailing lists or websites, donate to us, sign a petition or otherwise contact us. We also collect information when you set up a fundraising page with one of our fundraising suppliers.
In addition to the data we collect, we also generate some data about you. This means that we will know when you’ve opened an email from us or clicked on a link in an email. We will also store information about donations you make to us, purchases you make, consents that you have given to us and orders for resources such as leaflets.
How long do we store this data for and where do we get it?
When you have made a donation:
If you give us a one-off donation (without Gift Aid) and never contact us again, your data will be kept for a maximum of three years.
If you’ve told us that your donations are eligible for Gift Aid and given us consent to claim, we will legally need to keep your name and address, the amount that you’ve donated, and a record of your consent for six years following the end of the financial year in which you last donated.
If you continue to make donations to us, maintain a regular subscription, or otherwise stay in touch with Viva! we will keep your data until you tell us not to, or until three years from your last recorded interaction with us.
When you have signed a petition:
If your only contact with Viva! is where you have signed a petition and you did not consent to further contact from us, we will delete your details after we have submitted the petition to the relevant organisation. If you have consented to further contact from us, please see ‘When you have signed up to emails’.
When you have signed up to emails:
If you have signed up to receive email updates from us, we will continue to send you emails until you tell us not to. You can opt out of this service at any time by unsubscribing or changing your preferences, or by contacting us. If you don’t open any emails from us for more than a year, we may assume that you’re no longer interested and remove your contact details from the list.
When you have ordered leaflets or resources:
We will keep your data for three years following your last order (or other interaction with Viva!), unless you have also donated with Gift Aid.
When you have purchased from our shop:
We will keep your details for three years following your last interaction with us (which may not be a purchase).
When you have given consent, or otherwise contacted us, on behalf of a child:
We will keep details for both of you, and a record of your consent, until the child turns 18 years old (this is why we ask for a date of birth). If you are asked for consent, but do not provide it within a month, we will remove these details. Your details will not be used for any other purpose, unless you have other contact with Viva!.
When you have left a gift in your Will to Viva!:
Information given to us about you and your legacies will be kept indefinitely. Following your death and the discharge of your instructions, we will securely store a record of your bequest unless an executor or your family members ask us to remove it.
If someone else has purchased an adoption for you as a gift:
If someone else purchases an adoption for you, we will store your data solely in order to send you information about your adoption, and will use it for no other purpose. If you do not wish to receive updates regarding your adopted animal, or you’d like us to delete your information, please contact us.
If you are a public contact:
If you’ve given us contact details in order for us to make them publicly available, for example to publicise fundraising work, or as a professional to whom we can refer contacts, this information will only be released to the extent to which you’ve consented. We will also check with you periodically to make sure that you’re still happy for your details to be passed on in that way.
When you apply for a job with us:
We’ll keep your information for six months from the date you’re informed of the result of your application (if unsuccessful). If you come to work with us, we are legally obliged to keep your information for six years following the termination of your employment.
When we receive your information from third parties:
We may receive information about you from one of our fundraising partners (such as JustGiving or Facebook) when you set up a fundraising page on their site, or when you agree to allow them to share that information with us. If you have set up a fundraising page, we may be able to access your name and address, contact details and the amount of money you have raised. If we collect your information in this way, we will contact you within a reasonable period and give you the opportunity to opt out of us storing and using your information. We may use these details to contact you about your fundraising (ie to offer promotion or to say thank you!) store them, or include them in our review of supporters’ activity. We won’t use them for any other purpose, unless you have made other contact with us directly.
If it’s clear that certain details we hold are incorrect, for instance an incomplete or invalid postcode, we may use publicly available tools (eg from Royal Mail) to correct them, in order to maintain the integrity of your data. We’ll never use such methods to collect additional information – if you’ve chosen not to supply your address, we won’t try to find it anywhere else.
When we connect with you on social media:
When you ask us to publish your health story:
Viva! offers members of the public the opportunity to share their health successes with veganism on our website. If you share your story with us for this purpose, we will only make it public in the locations that we tell you about and with your personal information in a format you are happy with. If we wish to re-publish your story, we will contact you to ask you if you are happy for us to re-publish it in a different location.
If you have a story published on our site, we will keep your contact information, for this purpose only, until you tell us not to or until you withdraw your consent for the story to be public. You also have the option to publish your story anonymously. If you choose to do this, we won’t request consent to use your story again, or elsewhere, and we will only keep your contact details if we have some other justification for doing so.
What happens when we stop storing your data?
When we remove your data from our systems, we will remove any details that identify you as an individual from the records that we keep. We may keep anonymous records of financial transactions and other interactions for accounting and analysis purposes, but you will no longer be identifiable.
How do we use the data we hold about you
We use the information we have about you to perform actions that you have requested of us (such as fulfilling an order or sending you emails), to keep track of how you interact with Viva! so that we can send you relevant communications, to record your consent to certain activities, and to review the effectiveness of our campaigning and our other charitable functions.
This means that we will review the information that you give us, and the information that we generate, in order to work out how best to allocate our resources and to send you messages which are most relevant to you. We may use your donation history and location to send you specific communications or send you information about events in your area. If you don’t wish us to use your data this way, you can opt out at any time by contacting us.
The data that we review or generate will only be used to promote the interests of Viva! directly. We will never share this information with other charitable organisations or pressure groups, or outside of our trusted service providers, without your explicit consent.
How do we use children’s information?
We sometimes collect children’s information as part of our activities. This may be where they have joined us as a ‘Viva! Activist’ or where they have signed up to receive emails from us. In other situations, children may have ordered leaflets for ‘door-dropping’, ordered from our Shop or been given an animal adoption as a gift.
Only children who are 11 or over can use our services. If you want to order materials or sign up to information for a child under 11, we advise that you sign up on their behalf and only pass on the information you believe is appropriate for them.
We care about children and we want to ensure that what we do with their data is proportional and easy to understand. This means that we won’t send appeals asking for money to people who we know are children. If your child receives content which you do not think is appropriate for their age, please get in touch with us to let us know. We may not be aware that they are under 18.
We do review children’s data alongside adults’ data. But this processing is only to help us work out how people are using our services and to ensure that we use our charity’s resources as efficiently as possible. No decisions will be made about the child as a result and the processing will not materially affect them.
When a child reaches 18, we will contact them to ask if they consent to us continuing to contact them. If they no longer wish to be contacted, they have the option to have all of the information that we hold on them deleted (see Right to be Forgotten).
How will we contact you?
When will we send you post?
If you join Viva!, make regular donations or subscription payments, we have decided that we have a legitimate interest to send you post.
This post could include appeals, letters, our gift shop catalogue, our Viva!life magazine or updates about Viva!’s activities.
We will also send you post where we have promised to do so (ie where you have joined Viva! to receive Viva!life and a supporter pack, or where you have purchased an animal adoption).
As a charity which relies on donations from the public, post is a valuable and cost-effective method of contacting our supporters. You can opt out at any time by contacting us, or through the UK Government’s Fundraising Preference Service.
When will we send you emails?
At Viva!, we make a distinction between ‘marketing emails’ and ‘transactional emails’.
Marketing emails are emails that we send to you and a large group of other people, or which are automated, from our mailing list. These emails may include our regular newsletters, fundraising emails and campaign updates (among other things). We will only send these if you have asked us to, and you can withdraw your consent at any time.
Transactional emails are communications about specific actions you have taken or where we need to communicate something that is specific to you. These could include (but are not limited to): receipts for purchases or donations, order updates, queries about an order, renewal reminders, questions about your Gift Aid consent or any other enquiry that specifically relates to you. Transactional emails are often required (like receipts), automatic (like delivery updates or order confirmations) or from individuals (such as a Viva! staff member) and are often sent to you by our service providers (such as payment processors) rather than directly from Viva!. In most cases, we have an obligation to send these communications – or a legitimate reason to believe you are happy to receive them.
Occasionally, we may need to send an update about this policy to a large section of our contacts who have not specifically consented to be added to our emailing list. In these cases, we will ensure that their contact details are used for this purpose only.
When will we phone you?
Viva! never do telephone fundraising and we do not employ external fundraisers to do so on our behalf. If you give us your phone number, we will only use it to contact you about specific issues with donations or purchases, or to respond to queries where you have asked us to phone you.
Do we share your information with anyone?
We share the data that you give us with our trusted suppliers only where we need to in order to perform our work as a charity. This could include:
- Sharing your name and address with our mailing house and delivery services in order to send you post. This is never retained longer than necessary to carry out each particular task.
- Sharing your email address, name and postcode with our email provider, in addition to your mailing preferences, in order to send you emails
- Using secure payment processors and banks to process donations (eg PayPal)
- Using hosted accountancy software to keep financial records.
- Using a hosted provider for our shop.
- Sharing your order details, name, address and contact details with the supplier who sends wine orders to our customers.
- Sending petition signatures/records of online petitions to the receiving organisation.
Some of our suppliers, such as our email provider, help us to generate information about you. Like all payment processors, ours will perform checks on payments made to detect potential fraud and analysis on the usage of their services.
We don’t share information with other organisations for their marketing or fundraising purposes and we will never do this without asking for your explicit consent first.
What safeguards do we use for sharing your information?
We only use suppliers who have a strong focus on data security and robust security practices. Some of our suppliers may transfer information about you to countries which are not within the European Union and are not designated ‘safe’ countries for EU data (ie ‘third countries’), but always with appropriate safeguards in place (such as the EU-U.S. Privacy Shield arrangement or Model Contract Clauses) which protect individuals’ data and rights to the legal standards required by the EU.
All of our payment processors are compliant with the PCI DSS official standard for handling payment details.
We are currently reviewing our third party processors to ensure that they comply fully with the new data protection regulations, and will update these details once we have completed the review.
When you use our websites, certain information about how you use our site, your device and general location information will be stored and tracked by our third party supplier, Google Analytics. Like most organisations, we use Google Analytics to find out how our website is used so that we can make improvements and track the success of campaigns. Although we can view the activity of individual users on our websites, we have no way of identifying them personally.
Viva! is serious about ensuring that your privacy is respected. Enquiries to email@example.com, which include information about your health, will be treated as private and will be accessible only to the members of Viva! staff who are directly involved in answering health queries.
We may store a record of your enquiry for up to three years from your last contact with Viva!Health, unless you have given permission for us to store it longer. We will only use this information to help us answer any future enquiries you make, unless you give us specific permission to use your information in another way (eg such as voluntarily providing your story for a health campaign – which can be done anonymously). If we want to store your enquiry, we will let you know and give you the opportunity to opt-out. If you choose to opt out, we won’t store your enquiry after we’ve answered your question. Opting out will not affect whether we offer you help and support but it may mean that we need to ask you for details of a previous enquiry, if relevant, when you make another.
If you apply for employment with Viva!, and provide details of your diet and philosophical beliefs, we will ensure that this information is only used for the purpose for which you provide it and that it is kept confidential. The information will be stored with your employment record for only as long as we are legally required to keep records of your employment or application.
Lawful bases for processing
Under general data protection regulations (GDPR), we must let you know what our ‘lawful basis’ is for each way that we process your data. ‘Processing’ includes storing, sharing or analysing your data, as well as using it to contact you.
Viva! will justify processing your data using one of the following bases:
- Legitimate Interest
- Fulfilment of Contract
- Legal Obligation
In addition, some parts of our processes may involve dealing with ‘Special Category Data’, which is sensitive information about you. The justifications we will use for processing this information are:
- For the Purpose of Employment
- As a Charitable Organisation
- Where information has been made public
|Collecting information you give to us||Consent|
|Storing information you give us||Legitimate Interest|
|Allowing payment processors to process payments||Fulfilment of Contract or Legal Obligation|
|Sharing information with other trusted service providers||Legitimate Interest|
|Sharing your contact details with our email provider (when you have asked us to email you)||Fulfilment of Contract|
|Sharing your contact details with our email provider (to send you updates about this policy)||Legal Obligation|
|Sending you items when you ‘join’||Fulfilment of Contract|
|Sending you updates about adoptions||Fulfilment of Contract|
|Sending you all post when you give regular donations||Legitimate Interest|
|Storing donation records for required period||Legal Obligation|
|Storing Gift Aid records for the required period||Legal Obligation|
|Generating data about how you interact with us||Legitimate Interest|
|Analysing / reviewing how you interact with us||Legitimate Interest|
|Sharing your contact details with our mailing house||Legitimate Interest|
|Storing and using information about you supporting Viva!||Legitimate Interest|
|Storing and using information about your health||Legitimate Interest, As a Charitable Organisation|
|Administering job applications and employment records||Legal Obligation, For the Purpose of Employment|
|Contacting you about your data and how we use it||Legal Obligation|
How do we protect your data?
Viva! takes the care of your personal information seriously and ensures there are appropriate technical controls in place to protect them. These include providing training for staff and volunteers who are responsible for handling your data, using secure storage and servers, Transport Layer Security (TLS) and firewalls, and carefully selected external organisations.
Viva! processes all card payments securely in accordance with Payment Card Industry (PCI) Security Standard legislation.
You have the right to withdraw your consent at any time, to correct or view any information that we hold about you, to ask us to delete the information that we hold on you or to object to how we use that information.
You have the right to withdraw consent that you have previously given to us for communication, data processing or storing your data. You can do this by contacting us or, if you wish to update your preferences or unsubscribe from emails, clicking the relevant link in any email you receive from our mailing service.
You can also enter your details on the Fundraising Preference Service (FPS) website. This service is run by the Fundraising Regulator and allows you to stop email, telephone, addressed post, and/or text messages from a selected charity or charities by using the online service at www.fundraisingpreference.org.uk or by calling 0300 303 3517. Once your request is raised with the FPS, we will ensure that your new preferences take effect within 28 days of your request.
Please be aware that withdrawing consent to communication does not mean that we will also delete your contact details or other information that we hold about you. If you would like us to delete your information, see ‘right to erasure’.
Right to be Informed
You have the right to be informed about how we use your data in a concise, transparent and easily-intelligible way. We will usually provide this information to you by providing privacy notices alongside this policy, where appropriate, when you give us your data. If you would like a copy of this policy, you can either download this page or contact us to request a paper copy.
Right to Access and Correction
You have the right to access the data that we hold on you and to confirm that your data is being processed by us. You also have the right to have your information corrected if it is wrong. If you would like to request information from us or correct any data that we hold about you, please contact us.
Right to Restrict Processing
If you are unhappy about how we are processing your data, you have the right to restrict how we process the information that we hold on you in certain circumstances. If you would like to restrict processing, please contact us.
Right to Data Portability
If you would like to transfer the information that we hold on you to another organisation, or to receive it in a standardised form (‘comma-separated’ or plain text) that can be read and imported by most data systems, contact us to request a copy of your data.
Right to Erasure (or to ‘be forgotten’)
You have the right to request that we delete all of the information that we hold on you, but there are some cases in which we will not be able to delete your information. This could include when you have previously given a consent for Gift Aid claims, for which our legal obligation to keep records has not expired. In these cases, we will comply with your request as far as possible, and make sure to let you know what we cannot delete.
If you would like to exercise your right to erasure, please contact us.
Right to Object
You have the right to object to any processing of your information which is based on legitimate interests, direct marketing or profiling (automated decision-making). You also have the right to object to your data being processed by us for the purposes of scientific, historical or statistical research.
If you object to us using your information for the purposes of direct marketing (ie postal or email campaigns and appeals), we will ensure that we do not contact you further for those purposes.
You can also object to processing for which we have legitimate interest. If you do object to our processing of your data for this purpose, we will do our best to comply with your wishes. However, in some circumstances, we may not be able to stop the processing entirely.
If you wish to object to processing of any kind, you can contact us to let us know.
If you have objected to how we use your data and are not satisfied with our response, you also have the right to lodge a complaint with our supervisory authority: the Information Commissioner’s Office. They can be contacted by phone on 0303 123 1113 or via their online service.