Tommy's privacy policy

5. Who do we share your personal data with?

At Tommy’s we will only share your data when we have a need to do so. The main reasons will be to provide you with the service you require eg processing payments to you via BACS or because we are using the services of a specialist company where we do not have the necessary expertise.

We will never sell your information to a third party for marketing purposes. We ensure that all organisations that are processing your personal data on our behalf have the highest standards of security and will not use your personal data for anything other than our agreed purposes that we have set out in this policy.

We will share your information with third parties in the following circumstances: -

6. Prospect research

Identifying prospective donors is necessary to securing donations from trusts and major gifts from individuals, so that we can grow our income and meet Tommy’s charitable objectives. 

Our approach to prospect research complies with current law; we will update our approach should the legal position change.

Prospect research helps us to:

• Identify if a potential donor may have the capacity and propensity to give major gifts to Tommy’s; and
• Identify how best to approach them.

Prospect research includes manually gathering public and freely given information from the Internet, from Tommy’s contacts and from Tommy’s own donor records, and creating profiles to help us identify individuals, trusts, foundations and corporations able to give at this level. This means that we:

• Create short profiles of potential donors, using public and freely given sources of data to identify people who may be able and predisposed to give major gifts. The type of information we may collect in profiles includes:
   
  • Career history, areas of interest, connection to Tommy’s
  • Gift capacity based on visible assets and previous charitable giving.

The data sources we use include:

• • Charity Commission data (which identifies trustees of grant-giving trusts, and charitable aims)
  • Other sources of information about charitable trusts’ giving, for example trustfunding.org.uk, trust websites, charity trade press
  • Companies House data (which identifies company directors)
  • Mint UK (a comprehensive database of UK companies)
  • Company and charity websites which profile, for example owners, senior partners, or Trustees
  • News articles about business, financial or philanthropic decisions
  • Public media where individuals have volunteered information about their interest or experience with pregnancy complications, for example interviews where individuals have spoken publicly about miscarriage
  • Public social media accounts, e.g. a company’s Facebook or LinkedIn page, or an individual’s public Twitter account which has a primarily professional function.

• Create queries on our database to identify past donors who may have given at major-gift level in the past, and therefore could do so again
• Database postcode reviews of current donors
• Review lists of individuals signing up to Tommy’s fundraising events (and have opted into communications) to look at the reasons that people give, their job titles, their family name (if they are well-known/in the public eye) and postcodes. We use this information to target personalised invitations to engage further with Tommy’s at those who are most likely to be interested.
• Identify where our Trustees, Fundraising Board or staff may be able to help with an introduction, for example because they move in the same professional social circles as a potential donor.

We do not seek consent to our prospect-research activities as defined above, because we believe we have legitimate interest which is not over-ridden by the individual’s fundamental rights.

For prospect-research purposes we gather sensitive data only in the form of information about experience of pregnancy complications which the subject has willingly put in the public domain or shared with Tommy’s. We do not:

• Gather data from personal sources such as personal Facebook and Twitter accounts
• Conduct automated wealth-screening using external agencies.

We want all individuals who come into contact with Tommy’s to have a positive experience, whether or not they are donors. We believe that the way we carry out prospect research will help us to identify potential donors efficiently, and to avoid making inappropriate or excessive approaches.

7. Automated decision-making

Tommy’s does not carry out profiling or take significant decisions about individuals by wholly automated means. The only exception to this is where Tommy’s collates email addresses of previous years’ participants in sporting events who have fundraised for Tommy’s. This data is used to target potential participants to fundraise for Tommy’s at future sporting events.

8. Storing your information outside the EEA

In very limited circumstances, Tommy’s may transfer your personal data outside the European Economic Area (EEA). Tommy’s will ensure that the country to which your personal data is transferred ensures an adequate level of protection for your rights and freedoms.

9. EU representative 

Tommy’s does not have an office in the EU but if you reside in the EU and Tommy’s processes your personal data or you are an EU supervisory authority, you can contact our EU representative who is based in the Republic of Ireland with any queries or concerns you may have. Please email [email protected]

10. Your rights

You have the following rights:

• The right to be informed of how your personal data is used – we do this in the Privacy Policy and providing links to this Privacy Policy when we are collecting personal data from you.
   
• The right to access your personal data – you can submit a request to find out about the information we hold about you. Here is our Subject Access Request Policy.
   
• The right to object to the processing of your personal data – if we are processing your personal data under the legitimate interest lawful basis.
   
• The right to have your personal data rectified – you can request that we correct your personal data if it is incorrect or incomplete.
   
• The right of portability of your personal data – you can request that some of your personal data is transferred to you or to another organisation.
   
• The right to be forgotten – you can request that we delete your personal data.
   
• The right to have your personal data restricted – you can request that we stop processing your personal data and only store it.
   
• The right to object to direct marketing – you can object to direct marketing at any point and we will not send you any further marketing communications unless you change your mind.
   
• The right to request that any automated decisions are reviewed by a human
   
• The right to withdraw consent – if we are relying on your consent as our lawful basis for processing your personal data, you can withdraw your consent for processing at any time.
   
• The right to complain about our processing of your personal data – please contact [email protected] so that we can help you. If you wish you can contact the Information Commissioner’s Office on 0303 123 1113 or via their website.

11. Queries

If you have any questions or queries about this Privacy Policy, or if you would like to exercise any of your rights, please contact the Data Protection Officer at the address and contact details below:

• In writing: Data Protection Officer, Tommy’s, Nicholas House, 3 Laurence Pountney Hill, London, EC4R 0BB
• Tel: 0207 398 3461
• Email: [email protected]

Data Protection Officer:

Amy Thomas
Chief Operating Officer

[email protected]