Privacy Policy

Introduction

The Thunderbird Project (also referred to as ‘the charity’, ‘we’, ‘our’ or ‘us’) is the Data Controller over any personal data we process about you for the purposes set out in this Privacy Notice (see below). This notice outlines what personal data the charity collects and processes about you in various situations, which we have explained below. This notice does not cover personal data we process about our staff. The categories of data subjects whose personal data is covered by this privacy notice include; patients and victims of accidents, patients’ next of kin, volunteers, supporters, donors, third party healthcare employees, employees of public authorities, employees of corporate partners, individuals who make enquiries via our website or over the phone or email, supporters and donors.

Please read through the privacy notice to understand how the charity uses and processes your personal data obtained. If you have any concerns about our processing of your personal data or you have a general enquiry in relation to data protection, please contact our Data Protection Officer at mbeale@thunderbirdproject.co.uk

What is personal data?

Personal Data: means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Special Category of Data: means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

When we use the term ‘personal data’ we mean both personal data and special category of data.

Our Processing

Personal Data is collected in several different ways dependent on your interaction with the charity. The table below sets out what personal data we process about you, where we get it from, why we use it, our legal basis and who we share it with. Otherwise, we will only share your personal data:

where we use third parties to undertake certain services on our behalf and in doing so, they require to process personal data in order to do this. If so, we will ensure that adequate arrangements are in place to protect your personal data. These third parties include: our professional advisors, our DPO, cloud storage suppliers, CRM suppliers, marketing platforms (including parties used for sending email marketing communications), IT infrastructure suppliers, payroll provider, donation site, payment bureau provider, postal mailing housing, fundraising management sites;
where we are required to share your personal data in accordance with law e.g. such as to assist with investigations carried out by the police, other authorities, or any regulatory requirement to which the charity is subject;
where we are undergoing a corporate restructure;
where we have your consent.

How The Thunderbird Project uses the Personal Data

To respond to enquiries or indications of wishes to support the charity.

PERSONAL DATA: Name, e mail address, any information you provide to us.
WHERE DO WE GET THE DATA: When you submit an enquiry, use our online forms, e mail, text, telephone or when we meet in person. We may also receive data from independent sources.
LEGAL BASIS: Legitimate interest – it is in our legitimate interest to respond to enquiries so that we can respond to the benefit of the charity.
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: No

To enable The Thunderbird Project to provide you with direct marketing by e mail or text.

PERSONAL DATA: Name, email, and telephone number.
WHERE DO WE GET THE DATA: The data subject.
LEGAL BASIS: Consent
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: No

To enable The Thunderbird Project to provide you with our direct marketing communications by telephone or by post.

PERSONAL DATA: Name, telephone, and address.
WHERE DO WE GET THE DATA: The data subject.
LEGAL BASIS: Legitimate interest which is to promote our charitable objectives and to increase fundraising.
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: No

To enable 3rd party partners to provide direct marketing electronically.

PERSONAL DATA: Name, address and e mail address.
WHERE DO WE GET THE DATA: The data subject.
LEGAL BASIS: Consent
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: 3rd party media and marketing platforms.

To inform our marketing strategy by analysing and profiling our marketing database and to identify others who may be interested in hearing from us.

PERSONAL DATA: Name, address, and email address.
WHERE DO WE GET THE DATA: The data subject.
LEGAL BASIS: Our legitimate interest to inform and maximise our marketing strategy with a view to further supporting the charity.
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: 3rd parties providing data analytical services.

Managing our donor database and keeping it up to date.

PERSONAL DATA: Name, email, and telephone number.
WHERE DO WE GET THE DATA: You and third-party data bases.
LEGAL BASIS: Our legitimate interest in keeping our date base, up to date, accurate and relevant.
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: 3rd party data cleaning service providers.

Administer a donation, including processing gift aid.

PERSONAL DATA: Name, post, and email addresses, tel no, bank details, UK tax status, the reason for the donation and whether it is in memory of a person.
WHERE DO WE GET THE DATA: The data subject.
LEGAL BASIS: Legitimate interest to process donations for the benefit of the charity.
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: HMRC for the purposes of gift aid.Payment bureau provider administering the payment.

Case studies

PERSONAL DATA: Name and details of the mission.
WHERE DO WE GET THE DATA: The data subjects or 3rd parties involved in the call out.
LEGAL BASIS: Consent
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: With the public.

Managing volunteers

PERSONAL DATA: Name, post, and email addresses, tel no, emergency contact details of next of kin, hours of attendance at events.
WHERE DO WE GET THE DATA: The data subject.
LEGAL BASIS: Performance of contract.
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: Event organisers, 3rd party service providers.

Managing relationships with our corporate partners.

PERSONAL DATA: Name and details of our point of contact at the corporate partner.
WHERE DO WE GET THE DATA: The data subject.
LEGAL BASIS: Our legitimate interest of managing our relationship with our corporate partners.
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: No

PERSONAL DATA: Data about your use of our website.
WHERE DO WE GET THE DATA: The data subject.
LEGAL BASIS: Legitimate interest to understand the use of our website in order to maximise its usability. Consent for non-essential cookies.
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: Google analytics and Facebook pixel.

To record who visits our premises.

PERSONAL DATA: Name, contact details, date and time of visit and vehicle registration number.
WHERE DO WE GET THE DATA: The data subject.
LEGAL BASIS: Our legitimate interest of documenting visitors to our site for security and fire safety purposes.
WILL WE SHARE THE DATA OTHER THAN SET OUT ABOVE: No.

Will we share your Personal Data outside of the UK?

Some of our service providers process personal data we give them outside of the UK. Where this happens and the recipient country is not deemed adequate by the UK Government, then we will put in place additional measures to protect your personal data called the Standard Contractual Clauses.

Retention

The Thunderbird Project will keep your personal data for as long as is necessary and in accordance with our Retention Policy. In short, we retain general correspondence and emails for 1 year from receipt; inactive donor records for 2 years, after which we will archive your record; active donor records for as long as required until 2 years inactive, after which we will archive your record; financial records for up to 7 years.

Your rights

You have certain rights under data protection law, which are summarised below. You can exercise these by contacting our DPO on mbeale@thunderbirdproject.co.uk.

In certain circumstances you have the right to ask us to erase the personal data we hold about you. We will consider any such request in line with UK GDPR. Please note this is not an absolute right and there may be circumstances where we choose not to delete all of the personal data we hold about you.

You have the right to access personal data held by us about you.

You can withdraw your consent (including for marketing) at any time, at which point we shall stop processing your personal data in that way. Please note this does not affect the legality of our processing up to the date of your withdrawal of consent.
You can seek to restrict our processing of your personal data, ask us to rectify any personal data we hold about you or object to us processing your personal data for the purposes stated above.
In certain circumstances you have the right to ask us to provide you with your personal data in a structured, commonly used, and machine-readable format to allow you (or us on your behalf) to transmit this information to another party.
You have the right to lodge a complaint with the Information Commissioners Office (ICO) if you think that we have infringed your rights. You can find more information about reporting a matter to the ICO at the following link: https://ico.org.uk/

Website

The Thunderbird website www.thunderbird.org.uk may contain links to other websites. Please note that The Thunderbird Project has no control of websites outside our domain. The charity is not responsible for the protection and privacy of any sensitive information provided to a website linked to Thunderbird.

Changes

We reserve the right to amend this privacy notice from time to time.

Last Updated: June 2022