Privacy Policy

Scope

This Privacy Policy is not designed to cover the way in which we deal with the collection and use of personal data in regard those who are receiving a service from us (i.e Residents of our supported accommodation, users of our employment services, etc). This is covered in our Service User Privacy Policy which is available upon request by any one currently or previously receiving a service

YMCA Exeter Community Projects and City of Exeter YMCA Housing (jointly referred to as YMCA Exeter) are committed to protecting your privacy and processing your personal data with sensitivity. We aim to be clear why we collect your information and promise not to use it in any way you wouldn’t reasonably expect.

We collect personal information to help us develop an understanding of our supporters. This helps us to give more people access to our services, fundraise more effectively and provide you with appropriate opportunities to support us.

This policy has been written in accordance with the Data Protection Act 1998 and to comply with the General Data Protection Regulation Act. If you have any questions about the following policy please contact our Data Controller at YMCA Exeter, 39/41 St David’s Hill, Exeter, EX4 4DA, telephone 01392 410530 or email preferences@ymcaexeter.org.uk.

Where we collect your personal information
We will collect your information when you:

• Register for an event
• Send us your story or endorsement
• Make a one off donation, either by cheque, cash, BACS, CAF, JustGiving or Stewardship
• Make a monthly donation (Friends of YMCA Exeter)
• Join our monthly email or quarterly postal mailing list
• Complete an “interested in…” form i.e. volunteering
• Fundraise on our behalf
• Request information about our services
• are referred to our services for assistance

What information do we collect?
The personal information we collect about you can include your name, email address, postal address, date of birth, credit/debit card details and your particular area of interest, as well as any information relating to your health or personal circumstances. We only collect the data that is relevant to your interaction with YMCA Exeter.

Where your personal information is held
Your personal information is held on secure servers operated by YMCA Exeter and within our offices at YMCA Exeter 39/41 St David’s Hill, Exeter, EX4 4DA and 51 Queen Street, Exeter, EX4 3SR. Any paper records with your personal information are kept in locked cupboards and only accessible by authorised YMCA Exeter staff and volunteers. We never sell your data to any third party organisations and where your data is held on Mailchimp servers (for the purpose of email marketing) it is in compliance with the EU-U.S Privacy Shield Framework. Your information is only accessible by trained staff and volunteers at YMCA Exeter on a need to know basis.

How long will your information be retained?
YMCA Exeter will not retain information for longer than is necessary and reasonable for the relevant activity, which may be to fulfil statutory obligations (for example, the collection of Gift Aid).

How we use your information
The information you provide us with is used in the following ways:

• To provide you with information about our services, including changes to delivery times and policies
• To provide you with volunteering opportunities
• To provide you with ways to donate and ways to fundraise
• To help us get a clearer understanding of your situation and areas in which you may like to support
• For internal administration including accounting and gift aid procession
• To respond effectively to complaint
• To refer you to our services
• For other purposes in which we would specifically notify you and obtain consent

You can opt out of these communications at any time by emailing preferences@ymcaexeter.org.uk, calling 01392 410530 or writing to our Data Controller at the postal address above

Legal basis for using your information

In some cases, we will only use your personal information where we have your consent or because we need to use it in order to fulfil a contract with you (for example, because you have purchased something from our website).

However, there are other lawful reasons that allow us to process your personal information and one of those is called ‘legitimate interests’. This means that the reason that we are processing information is because there is a legitimate interest for YMCA Exeter to process your information to help us to achieve the objectives of our organisation.

Whenever we process your Personal Information under the ‘legitimate interest’ lawful basis we make sure that we take into account your rights and interests and will not process your personal information if we feel that there is an imbalance.

Some examples of where we have a legitimate interest to process your Personal information are where we contact you about our work via post, use your personal information for data analytics, conducting research to better understand who our supporters are, improving our services, for our legal purposes (for example, dealing with complaints and claims), or for complying with guidance from the Charity Commission.

Your rights

You have various rights in respect of the personal information we hold about you – these are set out in more detail below.  If you wish to exercise any of these rights or make a complaint, you can do so by contacting the Data Controller via email preferences@ymcaexeter.org.uk by phone 01392 410530 or writing to YMCA Exeter, 39/41 St David’s Hill, Exeter, EX4 4DA.

You can also make a complaint to the data protection supervisory authority, the Information Commissioner’s Office, https://ico.org.uk/

Access to your personal information: 

• You have the right to request access to a copy of the personal information that we hold about you, along with information on what personal information we use, why we use it, who we share it with andhow long we keep it for. You can make a request for access free of charge.  Please make all requests for access in writing, and provide us with evidence of your identity.

Right to object: 

• You can object to our processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.  Please contact us as noted above, providing details of your objection.

Consent: 

• If you have given us your consent to use personal information (for example, for marketing), you can withdraw your consent at any time.

Rectification: 

• You can ask us to change or complete any inaccurate or incomplete personal information held about you.

Erasure: 

• You can ask us to delete your personal information where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis for keeping it.

Portability: 

• You can ask us to provide you or a third party with some of the personal information that we hold about you in a structured, commonly used, electronic form, so it can be easily transferred.

Restriction: 

• You can ask us to restrict the personal information we use about you where you have asked for it to be erased or where you have objected to our use of it.

Please note, some of these rights only apply in certain circumstances and we may not be able to fulfil every request.

Direct Marketing
At each of our data collection points (i.e. online form or paper flyer) we will provide you with the opportunity to “opt in” to communications which have a particular fundraising purpose (this is called Direct Marketing). If you provide us with your consent by “opting in” to receive such communications we will occasionally contact you to let you know about upcoming ways to fundraise (such as events) and the areas where we need specific financial support (such as campaigns).

We want to communicate in a way that suits you so we will only ask you to fill in the contact details of your preferred means of communication. We will make it easy for you to opt out of Direct Marketing communications at any time and you can contact us to change your preferences.

Changes to this Policy
We will review and update this Policy from time to time and any revisions will be published on our website. The policy was last published May 2018.