Privacy policy
- Who are we and what do we do?
- Where does Tommy’s collect your personal data from?
- What personal data does Tommy’s collect?
- How do we use your personal data?
- Who do we share your personal data with?
- Prospect research
- Automated decision-making
- Storing your personal data outside the EEA
- EU Representative
- Your rights
- Queries
At Tommy’s we are committed to protecting your personal data and helping you understand what we are doing with it. We will use your personal data in compliance with all data protection laws, keeping it safe and using it in ways that you would reasonably expect.
1. Who are we and what do we do?
Tommy's is the leading charity in the UK working to improve maternity care and save babies' lives. We fund research into the causes and prevention of pregnancy complications that lead to miscarriage, stillbirth and premature birth. We also provide health information to support parents throughout their pregnancy journey.
Tommy’s is registered as a charity in England and Wales (registered charity number 1060508), and in Scotland (registered charity number SC039280). We are also registered as a company limited by guarantee (company number 3266897).
There are 2 wholly owned subsidiary companies of Tommy’s:
- The Baby Fund Trading Limited (registered company in England and Wales number 2557706), to record our activity classed as trading, including the selling of sponsorship rights, and
- LLHM Limited (registered company in England and Wales number 10584979), to manage our event-driven activity, specifically the London Landmarks Half-Marathon.
Within the context of this policy, ‘we’ means the charity Tommy’s, and The Baby Fund Trading Limited. LLHM Limited has its own Privacy Policy.
We are located at:
Nicholas House,
3 Laurence Pountney Hill,
London EC4R 0BB
Telephone: 0207 398 3400
Email: [email protected]
Where does Tommy’s collect your personal data from?
Tommy’s collects your personal data from the following places:
- When you give it to us. This is the main way that we collect personal data about you. You give us information when:
- You fundraise for Tommy’s by organising or taking part in an event
- You donate money directly to Tommy’s
- You contact Tommy’s to provide you with support or information
- You contact Tommy’s to share your personal experiences
- You order goods or services from Tommy’s
- You complain to us about something that we have done
- You apply to work for us
- You sign up to charity and fundraising activities and appeals
- You sign up to receive information and service communications
- You register on the My Prem Baby app or other support tools we provide
When you give permission to other organisations to provide Tommy’s with your personal data
We receive personal data about you from an event organiser e.g. London Landmarks Half Marathon when you have asked them to share your personal data with Tommy’s, perhaps because you are running and raising money for Tommy’s.
We also receive personal data about you from an online fundraising site such as Just Giving. These organisations will only provide us with your personal data if you have given your consent to do so.
We also receive personal data about you if you make a donation via social media e.g. Facebook.
When your personal data is available publicly
In order to grow our income and meet the charitable objectives of Tommy’s we undertake prospect research to supplement the information we hold about potential donors. This is explained fully in 6. Prospect research and helps us build a better picture of our potential supporters.
We receive information about you from social media accounts, for instance if you tag Tommy’s in one of your posts.
3. What personal data does Tommy’s collect?
Personal data is information that can be used to identify you.
Tommy’s collects and stores the following personal data where it is relevant and needed in your contact with us:
- Personal information about you such as your name, gender, marital status, date of birth, contact details (including postal address, telephone number, email address, social media identity)
- Financial information such as your bank account or credit card details where you provide these to make a payment, or your tax status to enable us to claim gift aid
- Your marketing preferences such as whether you wish to receive our e-newsletters
- Donation information such as details of any gifts you have given to Tommy’s
- Event information such as details of any Tommy’s events you have registered for or participated in
- Information which helps us understand our relationship with you and your reasons for supporting Tommy’s
- Employment information such as your job title and your employer
- Publicly available information such as data gathered through prospect research
- Visual information about you such as photographs and, in the case of certain events, film
- Medical and pregnancy information (physical or mental health conditions) about employees, race participants and users of pregnancy tools
- Personal experiences of Tommy’s support, from people who share this information with us
- Information about your activities on our website and about the device you use to access these, such as your IP address and geographical location.
4. How do we use your personal data?
How we use your personal information will depend on how you interact with us.
The details below set out how you could interact with Tommy’s, what we are doing with your personal data, our lawful basis for processing your data, and our legitimate interest (if we are relying on this).
We will only keep your information for as long as we need it. The maximum period will be 7 years since our last interaction with you.
The lawful bases we use to process your personal data are: -
⦁ Consent
This is where we have asked you if we can use your personal data in a certain way and you have clearly agreed to this. If we are relying on consent as our lawful basis to process your personal data, you have the right to withdraw your consent at any time.
⦁ Legal obligations
If we are relying on this as our legal basis to process your personal data we are complying with a common law or statutory obligation.
⦁ Fulfilling contracts
This is where we need to process your personal data in order to fulfil a contractual service to you.
⦁ Our legitimate interest
This is where we are processing your personal data in ways that you would reasonably expect. If we are using this basis, we have conducted a legitimate interest assessment to make sure that we have a legitimate interest, that the processing is necessary to achieve that interest and that we have balanced our interests against your interests, rights and freedoms.
Where we are relying on this basis, we have outlined a summary of our legitimate interest.
If you are in contact with us or use our services, we may ask you if you would like to hear from us about our charitable and fundraising activities. You can unsubscribe from hearing from us at any time. This will not impact the service you receive from us.
|
What are we doing? |
Our lawful basis for processing your personal data |
Our legitimate interest, if this is our lawful basis for processing your data |
The maximum time we will hold this data |
| Contacting and organising events that promote Tommy's and raise funds | Our legitimate interest Your consent Fulfilling contracts |
To fundraise in order to conduct research and provide information and support services | 7 years after last interaction |
| Providing organisers of fundraising events with details of participants | Our legitimate interest | To enable organisers of fundraising events to know who is taking part | 7 years after last interaction |
| Encouraging and managing service providers, volunteers and medical support who assist us at our events and in fundraising | Our legitimate interest | To ensure that our events are well organised and that participants are given the support they require | 7 years after last interaction |
| Using images of participants (including children) for PR and promotional purposes for current and future events | Your consent (parental/guardian consent in the case of children) | 4 years | |
| The personal data of organisers of events will be shared with a public relations company to help them publicise that event | Fulfilling contracts | 6 months after the event | |
| Processing applications for places at events to fundraise for Tommy's | Fulfilling contracts Our legitimate interest |
To fundraise in order to conduct research and provide information and support services | 7 years after last interaction |
| Contacting and managing participants at events who are fundraising for Tommy's to offer support, encouragement and congratulations | Fulfilling contracts Our legitimate interest Your consent |
To fundraise in order to conduct research and provide information and support services | 7 years after last interaction |
| Processing information about people who organise community events or who are fundraising in memory of a loved one | Fulfilling contracts Our legitimate interest |
To fundraise in order to conduct research and provide information and support services | 7 years after last interaction |
| Processing surveys on past events | Your consent | 7 years after last interaction |
| What are we doing? | Our lawful basis for processing your personal data | Our legitimate interest, if this is our lawful basis for processing your data | The maximum time we will hold this data |
| Contacting previous and current supporters and users of our services of Tommy’s by email, SMS, post, and telephone about our charitable and fundraising | Our legitimate interest
Your consent |
To fundraise in order to conduct research and provide information and support services | 7 years after last interaction |
| Maintaining supporter and donor service user data to target communications | Your consent | 7 years after last interaction | |
| Analysing the effectiveness of our email communications to improve them | Your consent | 7 years after last interaction |
|
What are we doing? |
Our lawful basis for processing your personal data |
Our legitimate interest, if this is our lawful basis for processing your data |
The maximum time we will hold this data |
|
Conducting research into possible future donors to Tommy’s |
Our legitimate interest |
To identify individuals who may be interested in and have the capacity to make a major donation to Tommy’s To identify how best to approach people To avoid unwanted and inappropriate approaches |
7 years after last interaction |
|
Marketing sporting events and information about Tommy’s to potential entrants supporters to fundraise on behalf of Tommy's |
Our legitimate interest Your consent |
To fundraise in order to conduct research and provide information and support services |
7 years after last interaction |
|
What are we doing? |
Our lawful basis for processing your personal data |
Our legitimate interest if this is our lawful basis for processing your data |
The maximum time we will hold this data |
|
Sending you automated emails to prompt completion of an order for goods or services from our website
|
Our legitimate interest
|
To help people who may have been interrupted while using our website
|
Not stored |
|
Processing orders for fundraising materials, goods and clothing on our website |
Contract |
|
7 years after last interaction |
|
What are we doing? |
Our lawful basis for processing your personal data |
Our legitimate interest if this is our lawful basis for processing your data |
The maximum time we will hold this data |
|
Processing direct debit donations
|
Our legitimate interest
|
By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us. |
7 years after financial year direct debit cancelled
|
|
Issuing advance notification letters to you if you have set up a direct debit which sets out your payment schedule
|
Legal obligations
|
|
7 years after last interaction
|
|
Processing cheque and cash receipts
|
Our legitimate interest
|
By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.
|
7 years after last interaction
|
|
Processing telephone credit card donations
|
Your consent
|
By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.
|
Card details destroyed immediately All other details 7 years after last interaction
|
|
Sending automated emails to you to prompt completion of a donation
|
Legitimate interest
|
To help people who may have been interrupted while using our website
|
Not stored
|
|
Processing website donations
|
Our legitimate interest
|
By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.
|
7 years after last interaction
|
|
Processing fundraising from online giving sites
|
Our legitimate interest
|
By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.
|
7 years after last interaction
|
|
Processing payroll giving donations
|
Our legitimate interest
|
By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.
|
7 years after last interaction
|
|
Processing gift aid
|
Our legitimate interest
|
If a donor is a UK taxpayer, Tommy's can increase its income by reclaiming the tax due on the gift
|
7 years after last interaction
|
|
Issuing thank you communications
|
Our legitimate interest
|
To thank people who have donated to Tommy's and to make them feel supported
|
7 years after last interaction
|
|
What are we doing? |
Our lawful basis for processing your personal data |
Our legitimate interest if this is our reason for processing your data |
The maximum time we will hold this data |
|
Processing payments to suppliers
|
Fulfilling contracts
|
|
7 years after last interaction
|
|
Processing payments to volunteers
|
Fulfilling contracts
|
|
7 years after last interaction
|
|
What are we doing? |
Our lawful basis for processing your personal data |
Our legitimate interest if this is our reason for processing your data |
The maximum time we will hold this data |
|
Managing complaints
|
Your consent
|
|
7 years after last interaction
|
|
What are we doing? |
Our lawful basis for processing your personal data |
Our legitimate interest if this is our reason for processing your data |
The maximum time we will hold this data |
|
Using essential cookies to run our website and keep it secure |
Legitimate interest |
To enable our website functions and services to work |
6 months after last interaction |
|
Using marketing and analytics cookies to help us decide which services and events you may be interested in. This data makes the content you see on social channels more relevant |
Your consent |
|
7 years after last interaction |
|
What are we doing? |
Our lawful basis for processing your personal data |
Our legitimate interest if this is our reason for processing your data |
The maximum time we will hold this data |
|
Providing personalised health, emotional and informational support to people who contact us |
Your consent
|
|
7 years after last interaction
|
|
Providing general support to people who have requested it via our website, emails and social media |
Your consent
|
|
18 months after initial contact - planning pregnancy emails 18 months after initial contact - gestational emails
|
|
Providing general support to people who have signed up to our support tools such as the Premature Baby App or Parenting and Pregnancy at work eLearning tool
|
Your consent
|
|
7 years after last interaction
|
|
Asking support service recipients to review pregnancy information content so that it stays relevant and useful
|
Your consent
|
|
1 year
|
|
Processing and storing consent forms to publish and share personal stories |
Your consent |
7 years after last interaction |
|
| Organising online petitions and activities to enable people to show their support for Tommy’s | Your consent | 7 years after last interaction |
|
|
Publishing and sharing personal stories |
Your consent |
7 years after last interaction |
|
What are we doing? |
Our reasons for using your personal data |
Our legitimate interest if this is our reason for using your data |
The maximum time we will hold this data |
|
Processing requests from you via our website for emails and fundraising materials eg about events, about Tommy’s and health and pregnancy information
|
Your consent
|
|
7 years after last interaction
|
|
Transferring website requests to automated emailing platforms
|
Your consent |
|
7 years after last interaction
|
|
What are we doing? |
Our reasons for using your personal data |
Our legitimate interest if this is our reason for using your data |
The maximum time we will hold this data |
|
Performing psychometric assessments and equality, diversity and inclusivity monitoring |
Legitimate interest |
To recruit the right people to the right roles and to ensure that we meet our responsibility as an inclusive employer |
6 months after interview/assessment |
|
Recruitment of staff (unsuccessful candidates) |
Legal obligations |
6 months after interview/assessment |
Here is Tommy’s Employee Data Protection and Privacy Policy which describes how we manage the data of our employees.
5. Who do we share your personal data with?
At Tommy’s we will only share your data when we have a need to do so. The main reasons will be to provide you with the service you require eg processing payments from you via BACS or because we are using the services of a specialist company where we do not have the necessary expertise.
We will never sell your information to a third party for marketing purposes. We ensure that all organisations that are processing your personal data on our behalf have the highest standards of security and will not use your personal data for anything other than our agreed purposes that we have set out in this policy.
We may share anonymised data relating to specific health conditions or lifestyle issues with non-profit health research organisations with the aim of improving public health, and it may be used in research publications. This will only be done in an anonymised manner.
We may share anonymised data relating to specific health conditions or lifestyle issues with non-profit health research organisations with the aim of improving public health, and it may be used in research publications. This will only be done in an anonymised manner.
We will share your information with third parties in the following circumstances: -
|
When we share your personal data |
The organisations we share your personal data with |
Why we share your personal data |
|
If you sign up to attend an event which promotes Tommy’s and helps us fundraise |
Companies that develop and manage online booking tools |
To facilitate your booking process |
|
If you sign you or your child up to participate in or attend a fundraising event for Tommy’s |
The organiser of the event |
To ensure the organiser of the event knows who is taking part and can manage the event |
|
If you participate in an event and consent to us using your images and/or those of your child |
Social media organisers, PR companies and local media |
To publicise Tommy’s work and to maximise fundraising |
|
If you consent to receive emails or SMS from us |
Companies that have the necessary technological and administrative skills to send mass communications on our behalf |
To update you on our work, your fundraising and donations, to track your actions and to prompt you to complete an order/donation in the most cost effective and efficient manner |
|
If you order fundraising materials or event clothing from us |
A specialist warehouse and logistics company to fulfil your orders |
To fulfil your orders in the most cost effective and efficient manner |
|
If you receive a letter thanking you for your support or to advise you of your direct debit schedule |
A specialist fulfillment company to prepare and dispatch your letters |
To write to you in the most cost effective and efficient manner |
|
If you make or receive payments to or from us |
BACS clearing houses, our bank and card payment providers |
To process your payments and receipts |
|
If you access our website |
A specialist company that develops and maintains the Tommy’s website |
To ensure that our website functions correctly, is easy to navigate and is secure |
|
If you have indicated that you wish to gift aid your donations |
HMRC |
To ensure that we can reclaim UK tax and maximise your donation |
|
If you have contacted us to provide you with general or personal support and information |
A specialist company that develops and maintains the Tommy’s website if that is the way you have contacted us; A specialist company that has the necessary technological and administrative skills to send out mass emails on our behalf if this is what you have requested to receive |
To provide you with the appropriate support that you have requested through the most appropriate communication channel |
| If you use our support services or tools such as the My Premature Baby App | Specialist companies that have the necessary technological skills to provide these services | To provide you with the appropriate support you have requested |
| If you subscribe to e-learning modules and/or make use of Tommy’s online services for pregnancy and parenting at work support | Companies that develop and manage online systems providing pregnancy and parenting at work support | To enable us to provide you with the pregnancy and parenting at work support you have requested |
|
If you consent to share your personal story with us |
Current and potential donors; |
So that people can understand the work that Tommy’s does |
|
If you complete a survey for us on an event or about a service, we have provided |
Specialist organisations that develop and maintain online survey tools A specialist company that develops and maintains the Tommy’s website |
To continually assess and improve our services |
|
If you have participated in an event supporting Tommy’s |
A specialist agency that uses your anonymised data to identify and market Tommy’s events to potential entrants |
To maximise fundraising |
|
If you apply for a job at Tommy’s, you may be asked to complete a psychometric assessment |
A firm of occupational psychologists |
To help us match the right people for the right jobs |
|
If we have a regulatory or legal obligation |
The police, regulatory bodies, legal advisors or auditors |
To ensure we meet our regulatory and legal obligations |
6. Prospect research
Identifying prospective donors is necessary to securing donations from trusts and major gifts from individuals, so that we can grow our income and meet Tommy’s charitable objectives.
Our approach to prospect research complies with current law; we will update our approach should the legal position change.
Prospect research helps us to:
- Identify if a potential donor may have the capacity and propensity to give major gifts to Tommy’s; and
- Identify how best to approach them.
Prospect research includes manually gathering public and freely given information from the Internet, from Tommy’s contacts and from Tommy’s own donor records, and creating profiles to help us identify individuals, trusts, foundations and corporations able to give at this level. This means that we:
- Create short profiles of potential donors, using public and freely given sources of data to identify people who may be able and predisposed to give major gifts. The type of information we may collect in profiles includes:
- Career history, areas of interest, connection to Tommy’s
- Gift capacity based on visible assets and previous charitable giving.
The data sources we use include:
-
- Charity Commission data (which identifies trustees of grant-giving trusts, and charitable aims)
- Other sources of information about charitable trusts’ giving, for example trustfunding.org.uk, trust websites, charity trade press
- Companies House data (which identifies company directors)
- Mint UK (a comprehensive database of UK companies)
- Company and charity websites which profile, for example owners, senior partners, or Trustees
- News articles about business, financial or philanthropic decisions
- Public media where individuals have volunteered information about their interest or experience with pregnancy complications, for example interviews where individuals have spoken publicly about miscarriage
- Public social media accounts, e.g. a company’s Facebook or LinkedIn page, or an individual’s public Twitter account which has a primarily professional function.
- Create queries on our database to identify past donors who may have given at major-gift level in the past, and therefore could do so again
- Database postcode reviews of current donors
- Review lists of individuals signing up to Tommy’s fundraising events (and have opted into communications) to look at the reasons that people give, their job titles, their family name (if they are well-known/in the public eye) and postcodes. We use this information to target personalised invitations to engage further with Tommy’s at those who are most likely to be interested.
- Identify where our Trustees, Fundraising Board or staff may be able to help with an introduction, for example because they move in the same professional social circles as a potential donor.
We do not seek consent to our prospect-research activities as defined above, because we believe we have legitimate interest which is not over-ridden by the individual’s fundamental rights.
For prospect-research purposes we gather sensitive data only in the form of information about experience of pregnancy complications which the subject has willingly put in the public domain or shared with Tommy’s. We do not:
- Gather data from personal sources such as personal Facebook and Twitter accounts
- Conduct automated wealth-screening using external agencies.
We want all individuals who come into contact with Tommy’s to have a positive experience, whether or not they are donors. We believe that the way we carry out prospect research will help us to identify potential donors efficiently, and to avoid making inappropriate or excessive approaches.
7. Automated decision-making
Tommy’s does not carry out profiling or take significant decisions about individuals by wholly automated means. The only exception to this is where Tommy’s collates email addresses of previous years’ participants in sporting events who have fundraised for Tommy’s. This data is used to target potential participants to fundraise for Tommy’s at future sporting events.
8. Storing your information outside the EEA
In very limited circumstances, Tommy’s may transfer your personal data outside the European Economic Area (EEA). Tommy’s will ensure that the country to which your personal data is transferred ensures an adequate level of protection for your rights and freedoms.
9. EU representative
Tommy’s does not have an office in the EU but if you reside in the EU and Tommy’s processes your personal data or you are an EU supervisory authority, you can contact our EU representative who is based in the Republic of Ireland with any queries or concerns you may have. Please email [email protected].
10. Your rights
You have the following rights:
- The right to be informed of how your personal data is used – we do this in the Privacy Policy and providing links to this Privacy Policy when we are collecting personal data from you.
- The right to access your personal data – you can submit a request to find out about the information we hold about you. Here is our Subject Access Request Policy.
- The right to object to the processing of your personal data – if we are processing your personal data under the legitimate interest lawful basis.
- The right to have your personal data rectified – you can request that we correct your personal data if it is incorrect or incomplete.
- The right of portability of your personal data – you can request that some of your personal data is transferred to you or to another organisation.
- The right to be forgotten – you can request that we delete your personal data.
- The right to have your personal data restricted – you can request that we stop processing your personal data and only store it.
- The right to object to direct marketing – you can object to direct marketing at any point and we will not send you any further marketing communications unless you change your mind.
- The right to request that any automated decisions are reviewed by a human
- The right to withdraw consent – if we are relying on your consent as our lawful basis for processing your personal data, you can withdraw your consent for processing at any time.
- The right to complain about our processing of your personal data – please contact [email protected] so that we can help you. If you wish you can contact the Information Commissioner’s Office on 0303 123 1113 or via their website.
11. Queries
If you have any questions or queries about this Privacy Policy, or if you would like to exercise any of your rights, please contact the Data Protection Officer at the address and contact details below:
- In writing: Data Protection Officer, Tommy’s, Nicholas House, 3 Laurence Pountney Hill, London, EC4R 0BB
- Tel: 0207 398 3400
Email: [email protected]
Data Protection Officer:
Amy Thomas
Chief Operating Officer
We may at our discretion amend this Privacy Policy from time to time. Please check here to ensure you understand the version of our Privacy Policy which will apply at that time.
This Privacy Policy was last updated in October 2021