Fair processing notice: Providing feedback or making a complaint
This fair processing notice applies to external parties, including donors, supporters, fundraisers, participants and stakeholders who want to raise a complaint or provide feedback, including compliments.
The data we collect about you
We need information from you to investigate your complaint properly, and to understand what’s happened, or to process any general feedback in our endeavour for continuous improvement.
When we receive a complaint or feedback from you, we’ll record details on our electronic document management system. This normally includes your contact details and any other information you’ve given us about the other parties involved in your complaint or feedback.
We need to know the details of your complaint, which will vary, so we can investigate it fully or action any general feedback.
We will use your personal information to investigate your complaint and check on levels of service. We compile and may publish statistics showing information like the number of complaints we receive, and feedback given, but not in a form that identifies anyone.
If you are acting on behalf of someone making a complaint, we’ll ask for information to satisfy us of your identity and, if relevant, ask for information to show you have authority to act on someone else’s behalf.
You should also refer to the “specific information about your data” section for details of how we process your data as part of an existing relationship you have with us, for example, as a Donor or Fundraiser.
What we do with your data and on what grounds
We can process your personal data only if we have a basis to do so that is permitted by law. With regards to complaints and feedback these include:
- consent: we will use the personal data you provide to investigate your complaint or action feedback at your request
- explicit consent: we may process personal data that you have provided voluntarily as part of your complaint, including special category data if provided. We process this data only with your explicit consent
- legal obligation: to meet our regulatory fundraising obligations.
See also our fair processing notices for donors, supporters, fundraisers, participants and stakeholders for details of how we process your data if you are the subject of a complaint.
For details of your rights see our main privacy policy.
Automated decision making
No decisions will be taken about you using solely automated means because of submitting a complaint.
Who we share your personal data with
Normally, no other third parties will have access to your personal information provided as part of your complaint of feedback unless you have provided consent. This may include where it is necessary to investigate your complaint or action feedback, for example, where your complaint relates to a third party.
If you have provided consent, we may publish compliments on our website.
If you have made a complaint about a third party, we usually have to disclose your identity to them. This is so we can clearly explain to them what you think has gone wrong and if necessary, advise them how to put it right. This also means we may receive information about you from them.
If you don’t want information that identifies you to be shared with the third party you want to complain about, we’ll try to respect that if you ask us to. However, it is not always possible to handle a complaint on an anonymous basis, so we’ll contact you to discuss this.
There are other circumstances where we may disclose your details, for instance where the law requires us to, or we have a legitimate reason, such as to seek legal advice. This may include:
- regulatory bodies
- law enforcement
- our legal representatives.
In addition, where regulatory reporting requirements apply it may also include:
- Fundraising Regulator
Our use of data processors
Our third-party service providers include providers of IT systems and storage.
We use a third-party supplier of a Customer Relationship Management (Sales Force) IT system, based within the UK.
We also use Microsoft Office 365 to process email and for file storage, hosted within the EEA.
We also use a third-party provider for our complaint/feedback forms which processes data in the EEA.
Where we get your data from
Data provided as part of your complaint usually comes directly from you. We may also receive information from the individual or a third party your complaint relates to.
How long we keep your data
We will retain information relating to complaints and disputes for up to seven years following the resolution of the complaint or dispute. This information may include data about the complainant and the subject of the complaint, and anyone else who is involved, for example a witness, as well as the details of the complaint and the outcome.
Transferring your data overseas
We transfer your data overseas to the European Economic Area (EEA), as detailed above, with regards to data processors.
Transfers to the EEA are based on the UK adequacy decision with regards to EEA countries.