Tommy's privacy policy

This page outlines our privacy policy to explain what personal information we hold, how we may use it and what your rights are.

  1. Who are we and what do we do?
  2. Where does Tommy’s collect your personal data from?
  3. What personal data does Tommy’s collect?
  4. How do we use your personal data?
  5. Who do we share your personal data with?
  6. Prospect research
  7. Automated decision-making
  8. Storing your personal data outside the EEA
  9. Your rights
  10. Queries 

At Tommy’s we are committed to protecting your personal data and helping you understand what we are doing with it. We will use your personal data in compliance with all data protection laws, keeping it safe and using it in ways that you would reasonably expect.

1. Who are we and what do we do?

Tommy's is the leading charity in the UK working to improve maternity care and save babies' lives. We fund research into the causes and prevention of pregnancy complications that lead to miscarriage, stillbirth and premature birth. We also provide health information to support parents throughout their pregnancy journey.

Tommy’s is registered as a charity in England and Wales (registered charity number 1060508), and in Scotland (registered charity number SC039280). We are also registered as a company limited by guarantee (company number 3266897). 

There are 2 wholly owned subsidiary companies of Tommy’s:  

  • The Baby Fund Trading Limited (registered company in England and Wales number 2557706), to record our activity classed as trading, including the selling of sponsorship rights, and 
  • LLHM Limited (registered company in England and Wales number 10584979), to manage our event-driven activity, specifically the London Landmarks Half-Marathon.

Within the context of this policy, ‘we’ means the charity Tommy’s, and The Baby Fund Trading Limited. LLHM Limited has its own Privacy Policy.

We are located at:

Nicholas House,
3 Laurence Pountney Hill,
London EC4R 0BB

Telephone: 0207 398 3461

Email: [email protected]

Where does Tommy’s collect your personal data from?

Tommy’s collects your personal data from the following places:

  • When you give it to us. This is the main way that we collect personal data about you. You give us information when:
    • You fundraise for Tommy’s by organising or taking part in an event 
    • You donate money directly to Tommy’s 
    • You contact Tommy’s to provide you with support or information
    • You contact Tommy’s to share your personal experiences
    • You order goods or services from Tommy’s
    • You complain to us about something that we have done
    • You apply to work for us
    • You sign up to support us
    • You sign up to receive emails from us

When you give permission to other organisations to provide Tommy’s with your personal data

We receive personal data about you from an event organiser e.g. London Landmarks Half Marathon when you have asked them to share your personal data with Tommy’s, perhaps because you are running and raising money for Tommy’s.

We also receive personal data about you from an online fundraising site such as Virgin Money Giving or Just Giving. These organisations will only provide us with your personal data if you have given your consent to do so.

We also receive personal data about you if you make a donation to us using a Tommy’s social media account e.g. Facebook.

When your personal data is available publicly

In order to grow our income and meet the charitable objectives of Tommy’s we undertake prospect research to supplement the information we hold about potential donors. This is explained fully in 6. Prospect research and helps us build a better picture of our potential supporters.

We receive information about you from social media accounts, for instance if you tag Tommy’s in one of your posts.

3. What personal data does Tommy’s collect?

Personal data is information that can be used to identify you.

Tommy’s collects and stores the following personal data:

  • Your name
  • Your date of birth
  • Your contact details (including postal address, telephone number, email address and/or social media identity) 
  • Bank account or credit card details where you provide these to make a payment
  • Gender
  • Marital status
  • Your marketing preferences such as whether you wish to receive our e-newsletters
  • Details of any gifts you have given to Tommy’s
  • Whether or not you are a UK taxpayer 
  • Details of any Tommy’s events you have participated in
  • Notes relating to our relationship with you
  • Your job title and your employer
  • The reason you give us for supporting Tommy’s
  • Data gathered through prospect research
  • Photographs and, in the case of certain events, film
  • Medical information (physical or mental health conditions) about employees and race participants
  • Personal experiences of Tommy’s support, from people who share this information with us
  • Information about your activities on our website and about the device you use to access these, for instance your IP address and geographical location.

4. How do we use your personal data?

How we use your personal information will depend on how you interact with us.  

The details below set out how you could interact with Tommy’s, what we are doing with your personal data, our lawful basis for processing your data, and our legitimate interest (if we are relying on this).

We will only keep your information for as long as we need it. The maximum period will be 7 years since our last interaction with you.

The lawful bases we use to process your personal data are: -

⦁ Consent

This is where we have asked you if we can use your personal data in a certain way and you have clearly agreed to this.  If we are relying on consent as our lawful basis to process your personal data, you have the right to withdraw your consent at any time.

⦁ Legal obligations

If we are relying on this as our legal basis to process your personal data we are complying with a common law or statutory obligation.

⦁ Fulfilling contracts

This is where we need to process your personal data in order to fulfil a contractual service to you.

⦁ Our legitimate interest

This is where we are processing your personal data in ways that you would reasonably expect.  If we are using this basis, we have conducted a legitimate interest assessment to make sure that we have a legitimate interest, that the processing is necessary to achieve that interest and that we have balanced our interests against your interests, rights and freedoms.

Where we are relying on this basis we have outlined a summary of our legitimate interest.

If you are a participant or organiser of an event supporting Tommy’s

What are we doing?

Our lawful basis for processing your personal data

Our legitimate interest, if this is our lawful basis for processing your data

The maximum time we will hold this data

Contacting and organising events that promote Tommy's and raise fundsOur legitimate interest
Your consent
Fulfilling contracts 
To fundraise in order to conduct research and provide information and support services 7 years after last interaction 
Providing organisers of fundraising events with details of participantsOur legitimate interest To enable organisers of fundraising events to know who is taking part 7 years after last interaction 
Encouraging and managing service providers, volunteers and medical support who assist us at our events and in fundraising Our legitimate interestTo ensure that our events are well organised and that participants are given the support they require7 years after last interaction 
Using images of participants (including children) for PR and promotional purposes for current and future events Your consent (parental/guardian consent in the case of children) 4 years 
The personal data of organisers of events will be shared with a public relations company to help them publicise that event Fulfilling contracts  6 months after the event
Processing applications for places at events to fundraise for Tommy'sFulfilling contracts
Our legitimate interest 
To fundraise in order to conduct research and provide information and support services 7 years after last interaction 
Contacting and managing participants at events who are fundraising for Tommy's to offer support, encouragement and congratulations Fulfilling contracts
Our legitimate interest
Your consent 
To fundraise in order to conduct research and provide information and support services 7 years after last interaction 
Processing information about people who organise community events or who are fundraising in memory of a loved one Fulfilling contracts
Our legitimate interest 
To fundraise in order to conduct research and provide information and support services 7 years after last interaction 
Processing surveys on past events Your consent  7 years after last interaction 
Hide details

If you are a current or past donor to Tommy’s

What are we doing?Our lawful basis for processing your personal dataOur legitimate interest, if this is our lawful basis for processing your dataThe maximum time we will hold this data
Contacting previous and current donors and supporters of Tommy’s by email, post and telephoneOur legitimate interestYour consentTo fundraise in order to conduct research and provide information and support services 7 years after last interaction 
Maintaining supporter and donor data to target communications Your consent  7 years after last interaction

 

Hide details

If we think you may support Tommy’s in the future

What are we doing?

Our lawful basis for processing your personal data

Our legitimate interest, if this is our lawful basis for processing your data

The maximum time we will hold this data

Conducting research into possible future donors to Tommy’s

Our legitimate interest

To identify individuals who may be interested in and have the capacity to make a major donation to Tommy’s

To identify how best to approach people

To avoid unwanted and inappropriate approaches

 

7 years after last interaction

 

Marketing sporting events to potential entrants to fundraise on behalf of Tommy's

Our legitimate interest

 

To fundraise in order to conduct research and provide information and support services

 

7 years after last interaction

 

Hide details

If you have ordered something from our website

What are we doing?

Our lawful basis for processing your personal data

Our legitimate interest if this is our lawful basis for processing your data

The maximum time we will hold this data

Sending you automated emails to prompt completion of an order for goods or services from our website

 

Our legitimate interest

 

To help people who may have been interrupted while using our website

 

 

Not stored

Processing orders for fundraising materials on our website

 

Our legitimate interest

 

To publicise Tommy's

To support fundraisers in their fundraising

 

7 years after last interaction

 

Fulfilling orders for free event clothing

 

Your consent

 

 

7 years after last interaction

 

Hide details

If you have donated to us

What are we doing?

Our lawful basis for processing your personal data

Our legitimate interest if this is our lawful basis for processing your data

The maximum time we will hold this data

Processing direct debit donations

 

Our legitimate interest

 

By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.

 

7 years after financial year direct debit cancelled

 

Issuing advance notification letters to you if you have set up a direct debit which sets out your payment schedule

 

Legal obligations

 

 

7 years after last interaction

 

Processing cheque and cash receipts

 

Our legitimate interest

 

By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.

 

7 years after last interaction

 

Processing telephone credit card donations

 

Your consent

 

By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.

 

Card details destroyed immediately

All other details 7 years after last interaction

 

Sending automated emails to you to prompt completion of a donation

 

Legitimate interest

 

To help people who may have been interrupted while using our website

 

Not stored

 

Processing website donations

 

Our legitimate interest

 

By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.

 

7 years after last interaction

 

Processing fundraising from online giving sites

 

Our legitimate interest

 

By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.

 

7 years after last interaction

 

Processing payroll giving donations

 

Our legitimate interest

 

By offering different ways to donate to us our donors can choose the most appropriate method for them, which helps to maximise income for us.

 

7 years after last interaction

 

Processing gift aid

 

Our legitimate interest

 

If a donor is a UK taxpayer, Tommy's can increase its income by reclaiming the tax due on the gift

 

7 years after last interaction

 

Issuing thank you communications

 

Our legitimate interest

 

To thank people who have donated to Tommy's and to make them feel supported

 

7 years after last interaction

 

Hide details

If you are a third party who needs to be paid

What are we doing?

Our lawful basis for processing your personal data

Our legitimate interest if this is our reason for processing your data

The maximum time we will hold this data

Processing payments to suppliers

 

Fulfilling contracts

 

 

7 years after last interaction

 

Processing payments to volunteers

 

Fulfilling contracts

 

 

7 years after last interaction

 

Hide details

If you complain to us

What are we doing?

Our lawful basis for processing your personal data

Our legitimate interest if this is our reason for processing your data

The maximum time we will hold this data

Managing complaints

 

Your consent

 

 

7 years after last interaction

 

Hide details

If you are a Tommy’s website user

What are we doing?

Our lawful basis for processing your personal data

Our legitimate interest if this is our reason for processing your data

The maximum time we will hold this data

Using essential cookies to run our website and keep it secure

Legitimate interest

To enable our website functions and services to work

 

7 years after last interaction

Using cookies to recognise and remember that you are a previous user of our website and provide you with a more personalised experience

 

Legitimate interest

To make our website easier to access and straightforward to users

7 years after last interaction

Using analytics cookies to recognise how you are using our website to understand how well it is working which means we can improve your experience

 

Your consent

 

 

7 years after last interaction

Using marketing cookies to help us decide which services and events may be relevant to you. This data will make the content you see on social channels more relevant

 

Your consent

 

7 years after last interaction

Hide details

If you contact us to provide you with information and/or support

What are we doing?

Our lawful basis for processing your personal data

Our legitimate interest if this is our reason for processing your data

The maximum time we will hold this data

Providing personalised health, emotional and informational support to people who contact us

Your consent

 

 

7 years after last interaction

 

Providing general support to people who have requested it via our website, emails and social media

Your consent

 

 

6 months after initial contact - planning pregnancy emails

9 months after initial contact - gestational emails

 

Providing general support to people who have signed up to our support tools

 

Your consent

 

 

7 years after last interaction

 

Asking support service recipients to review pregnancy information content so that it stays relevant and useful

 

Your consent

 

 

1 year

 

Processing and storing consent forms to publish and share personal stories

 

Your consent

 

 

7 years after last interaction

 

Publishing and sharing personal stories

 

Your consent

 

 

7 years after last interaction

 

Hide details

If you have requested something using our website

What are we doing?

Our reasons for using your personal data

Our legitimate interest if this is our reason for using your data

The maximum time we will hold this data

Processing requests from you via our website for emails and fundraising materials eg about events, about Tommy’s and health and pregnancy information

 

Your consent

 

 

7 years after last interaction

 

Transferring website requests to automated emailing platforms

 

Your consent

 

7 years after last interaction

 

Hide details

If you apply to work for Tommy’s

What are we doing?

Our reasons for using your personal data

Our legitimate interest if this is our reason for using your data

The maximum time we will hold this data

Performing psychometric tests

Legitimate interest

To recruit the right people to the right roles

 

6 months after interview/assessment

Recruitment of staff (unsuccessful candidates)

 

Legal obligations

 

6 months after interview/assessment

Hide details

If you have worked for Tommy’s now or in the past

Here is Tommy’s Employee Data Protection and Privacy Policy which describes how we manage the data of our employees.

Hide details

5. Who do we share your personal data with?

At Tommy’s we will only share your data when we have a need to do so. The main reasons will be to provide you with the service you require eg processing payments to you via BACS or because we are using the services of a specialist company where we do not have the necessary expertise.

We will never sell your information to a third party for marketing purposes. We ensure that all organisations that are processing your personal data on our behalf have the highest standards of security and will not use your personal data for anything other than our agreed purposes that we have set out in this policy.

We will share your information with third parties in the following circumstances: -

When we share your personal data

The organisations we share your personal data with

Why we share your personal data

If you sign up to attend an event which promotes Tommy’s and helps us fundraise

 

Companies that develop and manage online booking tools

To facilitate your booking process

If you sign you or your child up to participate in or attend a fundraising event for Tommy’s

 

The organiser of the event

To ensure the organiser of the event knows who is taking part and can manage the event

If you participate in an event and consent to us using your images and/or those of your child

 

Social media organisers, PR companies and local media

To publicise Tommy’s work and to maximise fundraising

If you consent to receive emails from us

A company that has the necessary technological and administrative skills to send mass emails on our behalf

To update you on our work, your fundraising, to track your actions and to prompt you to complete an order/donation in the most cost effective and efficient manner

 

If you order fundraising materials or event clothing from us

 

A specialist warehouse and logistics company to fulfil your orders

To fulfil your orders in the most cost effective and efficient manner

If you receive a letter thanking you for your support or to advise you of your direct debit schedule

 

A specialist fulfillment company to prepare and dispatch your letters

To write to you in the most cost effective and efficient manner

If you make or receive payments to or from us

 

BACS clearing houses, our bank and card payment providers

To process your payments and receipts

If you access our website

A specialist company that develops and maintains the Tommy’s website

To ensure that our website functions correctly, is easy to navigate and is secure

 

If you have indicated that you wish to gift aid your donations

HMRC

To ensure that we can reclaim UK tax and maximise your donation

 

If you have contacted us to provide you with general or personal support and information

A specialist company that develops and maintains the Tommy’s website if that is the way you have contacted us;

A specialist company that has the necessary technological and administrative skills to send out mass emails on our behalf if this is what you have requested to receive

 

To provide you with the appropriate support that you have requested through the most appropriate communication channel

If you consent to share your personal story with us

Current and potential donors;

 

So that people can understand the work that Tommy’s does

 

If you complete a survey for us on an event or about a service, we have provided

Specialist organisations that develop and maintain online survey tools

A specialist company that develops and maintains the Tommy’s website

 

To continually assess and improve our services

 

If you have participated in an event supporting Tommy’s

A specialist agency that uses your anonymised data to identify and market Tommy’s events to potential entrants

 

To maximise fundraising

If you apply for a job at Tommy’s, you may be asked to complete a psychometric test

 

A firm of occupational psychologists

To help us match the right people for the right jobs

If we have a regulatory or legal obligation

The police, regulatory bodies, legal advisors or auditors

To ensure we meet our regulatory and legal obligations

 

6. Prospect research

Identifying prospective donors is necessary to securing donations from trusts and major gifts from individuals, so that we can grow our income and meet Tommy’s charitable objectives. 

Our approach to prospect research complies with current law; we will update our approach should the legal position change.

Prospect research helps us to:

  • Identify if a potential donor may have the capacity and propensity to give major gifts to Tommy’s; and
  • Identify how best to approach them.

Prospect research includes manually gathering public and freely given information from the Internet, from Tommy’s contacts and from Tommy’s own donor records, and creating profiles to help us identify individuals, trusts, foundations and corporations able to give at this level. This means that we:

  • Create short profiles of potential donors, using public and freely given sources of data to identify people who may be able and predisposed to give major gifts. The type of information we may collect in profiles includes:
    • Career history, areas of interest, connection to Tommy’s
    • Gift capacity based on visible assets and previous charitable giving.

The data sources we use include:

    • Charity Commission data (which identifies trustees of grant-giving trusts, and charitable aims)
    • Other sources of information about charitable trusts’ giving, for example trustfunding.org.uk, trust websites, charity trade press
    • Companies House data (which identifies company directors)
    • Mint UK (a comprehensive database of UK companies)
    • Company and charity websites which profile, for example owners, senior partners, or Trustees
    • News articles about business, financial or philanthropic decisions
    • Public media where individuals have volunteered information about their interest or experience with pregnancy complications, for example interviews where individuals have spoken publicly about miscarriage
    • Public social media accounts, e.g. a company’s Facebook or LinkedIn page, or an individual’s public Twitter account which has a primarily professional function.

 

  • Create queries on our database to identify past donors who may have given at major-gift level in the past, and therefore could do so again
  • Database postcode reviews of current donors
  • Review lists of individuals signing up to Tommy’s fundraising events (and have opted into communications) to look at the reasons that people give, their job titles, their family name (if they are well-known/in the public eye) and postcodes. We use this information to target personalised invitations to engage further with Tommy’s at those who are most likely to be interested.
  • Identify where our Trustees, Fundraising Board or staff may be able to help with an introduction, for example because they move in the same professional social circles as a potential donor.

We do not seek consent to our prospect-research activities as defined above, because we believe we have legitimate interest which is not over-ridden by the individual’s fundamental rights.

For prospect-research purposes we gather sensitive data only in the form of information about experience of pregnancy complications which the subject has willingly put in the public domain or shared with Tommy’s. We do not:

  • Gather data from personal sources such as personal Facebook and Twitter accounts
  • Conduct automated wealth-screening using external agencies.

We want all individuals who come into contact with Tommy’s to have a positive experience, whether or not they are donors. We believe that the way we carry out prospect research will help us to identify potential donors efficiently, and to avoid making inappropriate or excessive approaches.

7. Automated decision-making

Tommy’s does not carry out profiling or take significant decisions about individuals by wholly automated means. The only exception to this is where Tommy’s collates email addresses of previous years’ participants in sporting events who have fundraised for Tommy’s. This data is used to target potential participants to fundraise for Tommy’s at future sporting events.

8. Storing your information outside the EEA

In very limited circumstances, Tommy’s may transfer your personal data outside the European Economic Area (EEA). Tommy’s will ensure that the country to which your personal data is transferred ensures an adequate level of protection for your rights and freedoms.

9. Your rights

You have the following rights:

  • The right to be informed of how your personal data is used – we do this in the Privacy Policy and providing links to this Privacy Policy when we are collecting personal data from you.
  • The right to access your personal data  you can submit a request to find out about the information we hold about you. Here is our Subject Access Request Policy.
  • The right to object to the processing of your personal data – if we are processing your personal data under the legitimate interest lawful basis.
  • The right to have your personal data rectified – you can request that we correct your personal data if it is incorrect or incomplete.
  • The right of portability of your personal data – you can request that some of your personal data is transferred to you or to another organisation.
  • The right to be forgotten – you can request that we delete your personal data.
  • The right to have your personal data restricted – you can request that we stop processing your personal data and only store it.
  • The right to object to direct marketing – you can object to direct marketing at any point and we will not send you any further marketing communications unless you change your mind.
  • The right to request that any automated decisions are reviewed by a human

  • The right to withdraw consent  if we are relying on your consent as our lawful basis for processing your personal data, you can withdraw your consent for processing at any time.
  • The right to complain about our processing of your personal data – please contact [email protected] so that we can help you. If you wish you can contact the Information Commissioner’s Office on 0303 123 1113 or via their website.

10. Queries

If you have any questions or queries about this Privacy Policy, or if you would like to exercise any of your rights, please contact the Data Protection Officer at the address and contact details below:

  • In writing: Data Protection Officer, Tommy’s, Nicholas House, 3 Laurence Pountney Hill, London, EC4R 0BB
  • Tel: 0207 398 3461
  • Email: [email protected]

Data Protection Officer:

Amy Thomas
Chief Operating Officer

[email protected]

    Last reviewed on February 27th, 2020.

    Was this information useful?

    Yes No