Privacy Policy 

We are The Brain Tumour Charity, the largest dedicated funder of research into brain tumours globally and the only charity in the UK taking on brain tumours on all three fronts: research, campaigning and support. Our vision is for people diagnosed with a brain tumour to live longer and better lives. So, we’re transforming the research landscape, improving quality of life and providing support and best care for everyone and raising voices to campaign for change.

In terms of privacy, The Brain Tumour Charity is known as the ‘data controller’ which means we’re responsible for deciding why and how personal data is processed within The Charity. This responsibility includes collecting, storing, using, and sharing personal data in accordance with UK data protection laws and regulations. Data controllers have various obligations under data protection laws and this notice aims to be transparent about our intentions. 

Throughout this notice, The Brain Tumour Charity will be referred to using “we”, “us” and “our”. These terms may also refer to TBTC Trading Ltd and The Lewis Moody Foundation, which are both administered by The Brain Tumour Charity. 

The Brain Tumour Charity is a company limited by guarantee no. 08266522. We’re also registered with the Information Commission (formally the Information Commissioners Office, ICO) as a Data Controller under reference Z7239747 for all of our activities. 

Our charity numbers are 1150054 (England and Wales) and SC045081 (Scotland). 

The Brain Tumour Charity is registered with the Fundraising Regulator and follow their best practice code – Code of Fundraising Practice. We’re also a member of the Association of Medical Research Charities and the Helplines Partnership. 

TBTC Trading Ltd is a company registered in England and Wales company no. 08855559, wholly owned by The Brain Tumour Charity and sells a range of products where all of its profits are donated to The Brain Tumour Charity cause.

All entities are registered at Fleet 27, Rye Close, Fleet, Hampshire GU51 2UH and are wholly owned and controlled by The Brain Tumour Charity. All staff, including volunteers and contractors, are considered The Brain Tumour Charity ‘employees’ for ease of referencing.

The Information Commission (formally the Information Commissioners Office, ICO) is the UK’s independent body set up to uphold information privacy. They help clarify complex areas of UK data protection laws, such as how Personal Data is defined. This is referred to as any information that relates directly or indirectly to an identified or identifiable living individual. This can include a wide range of information, such as a name, identification number, location data or an online identifier such as an IP address.  Personal Data can also include physical, physiological, genetic, mental, economic, cultural or social factors which are specific to an individual and can be used to distinguish them from other individuals.

Some categories of Personal Data are more sensitive than others. For example, health information is referred to as “special category data”, which means it requires more consideration and security. For further information, please refer to the ‘Special category data’ section of this notice.

Non-personal information

For example, IP addresses (the location of the computer on the internet) or statistics like web pages accessed and files downloaded. This helps us to understand how many people use our websites, how many people visit regularly and which pages people find most useful. This information cannot be used to identify you personally. For further information, please see our Cookies Policy.

Personal information

For example, we may ask for your email address to send you information or process a donation. We’ll ask you for this information so we can provide you with the services requested, provide donation confirmation and keep you informed about our activities and impact. This is not an exhaustive list.

Sensitive personal information or special category data

We may ask you for information about your health and tumour type if you are living with a brain tumour. This is so we can provide you with relevant information and support or in order to support your safe participation in an event. We may also collect this information if you make the information public or if you tell us about your experiences relating to a brain tumour (for example, if you agree to share your story with us). 

Under 18s

The Brain Tumour Charity recognises the importance of protecting the privacy of children online. According to the UN Convention on the Rights of the Child, which the UK has ratified, a child is defined as any individual under the age of 18, unless they have attained majority earlier under applicable law. Under UK data protection legislation, individuals aged 13 and above can exercise their privacy rights. However, within Health and Social Care services, individuals aged between 13 and 16 are categorised as ‘teens’ and they may transition to ‘young adults’ services at age 17.

Due to this transitional age period, we will continue to require parental consent until the age of 16 to ensure that individuals have a full understanding of their rights and responsibilities regarding privacy.

The Charity prioritises the well-being and privacy of the children we support and will only process children’s information with verifiable parental consent for anyone under the age of 16. The processing of children’s data is aimed at improving our services, advancing research, supporting fundraising efforts and ensuring compliance with applicable regulations. We do not send any marketing communications directly to children under 16.

If we become aware that we have inadvertently collected personal data from a child without appropriate parental permission, we’ll take prompt steps to delete such information from our systems. We encourage parents and guardians to be involved in their children’s online activities and to monitor their online interactions to ensure that their privacy is protected. If you believe that your child has provided personal data to us without the appropriate permissions in place, please contact us (using the details provided under ‘Contact Us’ below) so that we can review, update or delete the child’s information from our records. 

We only gather information that’s necessary for us to deliver the best possible services and accomplish our goals. Our foremost priority is maintaining the security of personal information using appropriate technical and organisational measures in line with best practice and taking into account state-of-the-art technological advances. Your data is never disclosed to any other company or charity for marketing purposes.

For the functionality of our services and to ensure we are compliant with legal requirements, The Brain Tumour Charity collects information about:

• the people we support and service users
• supporters
• donors
• fundraisers
• volunteers
• employees
• healthcare professionals we engage with
• researchers we fund or have expressed an interest in our funding.

We also collect data to:

• provide services or goods
• provide information
• provide grants to researchers 
• fundraise for our work
• perform administrative work
• perform research
• prevent or detect crime
• offer a more personalised experience via profiling and analysis to better understand our supporters. 

We collect, store and use the following kinds of personal information:

• Your name and contact details, including postal address, telephone number and email address
• Your date of birth
• Financial information you provide when you make a payment, such as bank details or credit/debit card details
• Information about your computer or mobile device and your visits to and use of this website, including for example your IP address and geographical location
• Which of our services you use or that we consider of interest to you
• Whether you’re a tax payer so that we can claim Gift Aid
• Any other personal information you share with us as described above.

Special Category 

Certain categories of personal information are regarded by the law as more sensitive than others.

This is known as ‘special category’ or ‘sensitive personal data’ and covers things like information about your health, ethnic origin, religious beliefs, political opinions or any genetic or biometric data that is used to identify you.

We don’t usually collect ‘sensitive personal data’ about our supporters unless there’s a clear reason for doing so. This may include:

• Participation in a marathon or similar fundraising event, where we need this information to provide appropriate facilities or medical support.
• Completion of forms requesting health-related information to receive tailored information packs or details about relevant services.
• Situations where you make the information public or voluntarily share your experiences relating to brain tumours (for example, if you agree to act as a case study or volunteer to be a Young Ambassador).

There may be instances where we will need to collect special category data from someone other than the data subject. An example of this is via an individual’s carer in the process of planning and providing support services. This may only occur if it is essential and with the correct permissions. We’ll always make it clear when we collect this information what sensitive personal data we’re collecting and why it is relevant.

Your financial information

If you use your credit or debit card to donate to us, pay for a registration or make a purchase from our shop, we’ll ensure this is done securely and in accordance with the Payment Card Industry (PCI) Data Security Standard. For more information about these Standards see here – https://www.pcisecuritystandards.org/about_us/

We don’t store your credit or debit card details following the completion of your transaction. All card details are securely destroyed once the payment or donation has been processed. Should you become a regular giver, your account details are temporarily processed for the initial setup of the direct debit and held thereafter by our third-party payment processor for direct debits. 

We encourage all purchases and donations to be completed through our website

(https://www.thebraintumourcharity.org) or by calling 0808 800 0004 to speak to our Community Experience Operations and Supporter Care team. All purchases and donations completed online are handled securely by Stripe or PayPal. If you provide your card details to make a donation by phone, only The Brain Tumour Charity staff who are authorised and trained to process these payments are able to collect or see your card details for the duration of the transaction only. 

Please note, that we don’t accept credit or debit card details via email as these are automatically deleted for security reasons and payment will not be taken. If this happens, we’ll contact you to let you know.

Information provided by you

We receive information you directly provide to us through completion of our online forms for enquiries, information packs and support services. We collect information you provide to us via email and/or through our Live Chat services. We also receive information from you when you talk to us on our Support and Information line. This information includes personal data such as your name, contact details and health information relating to brain tumours to assess support needs and services we can provide.

Call Recording and AI Summarisation

We may record telephone calls for training, quality assurance, service improvement, complaint investigation, and to verify our understanding of information exchanged in the call.

Where applicable, these recordings may be processed using AI summarisation tools, such as Natterbox, to help us better understand and respond to your needs. Natterbox is a trusted partner that has been vetted and meets our data protection standards.

You will always be notified at the beginning of any call that is being recorded, and you may request for the recording to be stopped at any time. All processing is carried out securely and in accordance with data protection laws.

Information received from third parties

We may receive personal information about you from third-party organisations where you have provided consent for your data to be shared and have expressed an interest in supporting The Brain Tumour Charity. These third parties may include fundraising platforms, event registration services, or other partners facilitating charitable activities.

Depending on your settings or the privacy policies for social media and messaging services, we may access information from those accounts or services. This can include details like your name, mailing or email address, contact number, geographic location, credit/debit card information and your taxpayer status as this will potentially allow us to claim Gift Aid.

If you’ve been named as the Executor on a Will, we may receive your details in order to administer a Gift left to us in that Will. 

Publicly available sources

We source information about potential peer reviewers from publicly available online platforms that host academic publications and researcher profiles. These may include databases, search engines, and professional research networks. We also collect information about journalists who may be interested in our work. We use publicly available sources to ensure we understand our supporters effectively. Please refer to the ‘Profiling and Wealth Screening’ section of this notice to find out more.

Information received from your use of our website

For a website to work properly, it needs to collect certain basic information about its visitors. To do this, a site will create small text files known as cookies. Our websites use cookies so we can give you a personalised website experience. When you visit our websites, we collect technical information such as the IP address you use to visit the website, your browser type/version and your browsing history. 

We collect information about our online content that you use and how you use it, like when you watch a video on YouTube, visit our websites or view and interact with our ads and social media content. We use the information we gather to help improve the experience and personalisation of our website. For example, they help us to identify and resolve errors, or to determine the most relevant information and services to show our visitors in the future.

Wherever possible we’ll aggregate or anonymise the information we collect, which does not identify individuals by name, for analytical purposes. Please see our Cookie Policy for more detail.

We’ll mainly use the information we collect about you to:

• Provide you with the services, products or information you asked for, for example, Brainy Bags, Information Packs or fundraising materials.
• Administer your donation or support your fundraising, including submitting your details to HMRC to claim Gift Aid if applicable.
• Administer your participation in an event, which may include sharing your details with a third-party event organiser.
• Support your participation as a volunteer.
• Keep you up to date with the impact of your support and our work (including volunteering and events) and to ask for financial and non-financial support. This will only be where you’ve consented to being contacted for these purposes unless The Brain Tumour Charity is in a position to rely on the Legitimate Interest basis for contacting you via postal communications only (find out more about Legitimate Interest in the ‘Legal Basis’ section of this notice).
• Manage our research grants, including funding availability notifications and the peer review process.
• Support and further our mission, for example if you have shared your story or given us consent to use your photo, we may use this in marketing or promotional materials.
• Process orders from our online shop.
• Carry out any obligations arising from any contracts entered into by you and us.
• Process a job or volunteering application.

Your experiences and relationship with us

We record contact we have with you, so we have a clear understanding of our relationship, how you’ve supported us or have been supported by us in the past. We may also collect and retain your information if you send us feedback about our services, give us a compliment or make a complaint.

We believe it’s important to make sure that all of our services are the very best they can be, which is why we evaluate them. Once you’ve used one of our services, taken part in an event, received information, or bought a product, we may get in touch to ask you about your experience. You don’t have to take part but it’s really valuable to help us improve in the future.

Website users

By using our websites, social media pages, services (including phone, email and live chat) or providing your information to us, we’ll collect and use your information in the way(s) set out in this notice. If you don’t agree with this notice, please don’t use our websites, social media pages or services.

This notice applies to all the websites we operate, our use of emails and any other methods we use for collecting information. It covers what we collect and why, what we do with your information, what we won’t do with your information and what rights you have.

Social media 

We utilise a variety of social media channels, such as Facebook, X, LinkedIn, Instagram and TikTok, to promote our work. Through these platforms, we facilitate donations using tools like Facebook Fundraisers and Facebook Donate, as well as other avenues.

When individuals from the public interact with our content or share material related to our cause, we may actively engage with them by liking their posts, subscribing to their accounts, responding to their comments or initiating direct communication.

We participate in Facebook’s Custom Audience and Lookalike Audience programs so that you can receive relevant ads from us when you use Facebook, and so that we can raise awareness among users of Facebook who share similar interests to you. We provide personal information such as your email address to Facebook to enable them to determine if you’re a registered account holder with Facebook. Our adverts may then appear when you access Facebook and on your Facebook feed. Your data is sent in an encrypted format that is deleted by Facebook if it does not match with a Facebook account. For more information please read the Facebook Business page about Custom Audiences and Facebook’s Data Policy.

Safeguarding

To make sure we continue to understand the developing needs of our community, we securely store the content that is shared across our social media platforms, such as our private Facebook support groups, anonymously in a separate internal database to help us identify the needs of our community and make improvements to our services and information. To do this, we may on occasion make use of trusted external consultants/partnerships for monitoring and gaining insight, the data won’t be shared with any unknown third parties.

Safeguarding is everyone’s responsibility, and therefore we have a duty, wherever possible, to share any concerns that we have about conversations, live chats, emails, posts, messages or comments from our online forums that indicate you or someone else might be at risk, with the relevant services. This includes reference to abuse, neglect and self-harm.

Service adjustments

In certain circumstances, it may be helpful to make adjustments to our services to better meet the needs of our service users, improve our efficiency and respond with care. This is compliant with the Equality Act 2010, which places a legal obligation that ensures individuals who reach out to us with a disability don’t face any barriers in accessing our services.

To facilitate any changes, we’ll document your adjustment needs, including your name, contact information, the type of adjustment required and a brief description. This record demonstrates our legal compliance and enables relevant staff to communicate with you appropriately.

We may collect and analyse information related to the usage and effectiveness of our initiatives to enhance and tailor our services. The processing of personal information for service adjustments is based on our legitimate interests in continually improving and optimising our services. We strive to ensure that any adjustments made consider the well-being and preferences of the people we support. 

The data we collect and process may be aggregated or de-identified for statistical analysis and reporting purposes. The information collected during service adjustments is used to assess the impact of changes on the quality and inclusivity of our services. Aggregated, de-identified data may be used for internal reporting, research and to demonstrate the impact of our programs to stakeholders.

We don’t share personal information collected for service adjustments with third parties in a way that would directly identify individuals unless required by law or with explicit consent.

Job applicants

If you apply to work at The Brain Tumour Charity, we’ll only use the information you give us to process your application or monitor recruitment statistics on an unidentified basis.

If you commence employment with The Brain Tumour Charity, your personal information will be processed in accordance with your employment contract and other applicable human resources policies we have from time to time. Please see our Applicant Privacy Notice for more information on how this data is managed.

Attend an event or workshop

When you attend an event or workshop organized by The Brain Tumour Charity, we may collect and process personal data for the purposes of event management, participant communication and to enhance your overall experience: 

• For event registration, we may collect your name and contact details to communicate important updates and provide you with relevant event-related information. 
• During the event, we may capture photographs or video footage for promotional materials and to share on our website and social media platforms. If applicable, we will seek your explicit consent before capturing and using such media.
• We may share your information with third-party service providers involved in event logistics (for example, venue management or catering) to ensure a smooth and successful event. 
• Your personal data will be retained for the duration necessary to fulfil the purposes outlined in the individual privacy notice and in accordance with our data retention policy. 

By attending our events or workshops, you agree to the terms outlined in this Privacy Notice regarding the processing of your personal data for the purposes stated herein. You have the right to withdraw your consent at any time.

Marketing 

The Brain Tumour Charity is committed to transparency in how we use our funds and aims to keep supporters informed about the impact of their contributions. Some examples of how we may achieve this:

• If you show interest in or sign up for an event or similar activity, we aim to provide relevant information, such as fundraising tips, event details and reminders to submit any funds you raise.
• If you participate in an event run by us or have indicated that you’re fundraising for us at a third-party event, we may reach out to thank you and to offer guidance for your fundraising efforts.
• To make our communications more relevant, we may use information like your donation history, location, demographics and past interactions with us.
• Reconnecting with past supporters is an effective fundraising strategy so we may occasionally update you on similar upcoming events or campaigns.
• Our communications cover a range of topics, from our latest achievements and advocacy efforts to donation appeals. Sometimes, these messages may include content from partner organisations that support our mission.

Our marketing communications are based on your consent and you have the right to unsubscribe from such communications at any time. If you’ve expressed your preference to not receive marketing communications from us, we’ll maintain your information within a ‘do not contact’ registry. This measure is in place to help prevent us reaching out to you by accident. Please note that even if you opt out of marketing communications, we may still need to contact you for administrative purposes, such as processing donations, thanking you for your support or providing you with information you need in order to participate in an activity or event for which you have registered.

An alternative method of opting out of further communications is by submitting your preferences to the Fundraising Preference Service (FPS), which is a service that is overseen by the Fundraising Regulator and offers the flexibility to manage the availability of your contact details. They can be contacted by telephone on 0300 303 3517 or you can use their online portal at https://fundraisingpreference.org.uk/home. This service allows you to opt out of email, telephone,post and text messages from any designated charity, including The Brain Tumour Charity.

Third-party Email Campaigns

We occasionally work with trusted third-party providers to distribute promotional content about our work, events, and fundraising opportunities. These providers, such as Buzz Education, use their own GDPR-compliant mailing lists to send emails on our behalf.

The Brain Tumour Charity does not share personal data with these providers, nor do we receive access to their mailing lists. Instead, we supply the campaign content, which may include links to our website or sign-up forms. If individuals choose to engage with these campaigns by clicking through or submitting their details, their information will be collected directly by The Brain Tumour Charity in accordance with this Privacy Notice.

Buzz Education acts as the data controller for their own mailing list and email distribution. The Brain Tumour Charity becomes the data controller only if and when an individual chooses to engage with our campaign and provide their personal data to us directly.

Please note that unsubscribing from emails sent by third-party providers does not affect your communication preferences with The Brain Tumour Charity. If we hold your personal data separately (for example, if you have previously signed up to receive updates from us), you will continue to receive communications from us unless you update your preferences directly with us.

All third-party campaigns are subject to rigorous compliance checks and are designed to respect the privacy rights of recipients. Individuals can opt out of future communications via the unsubscribe link included in the emails or by contacting the third-party provider directly.

We ensure there are appropriate technical and organisational controls (including physical, electronic and managerial measures) in place to protect your personal details.  For example, our online forms are always encrypted and our network is protected and routinely monitored. 

Some of our suppliers run their operations outside the United Kingdom, including within the European Economic Area (EEA). This includes countries which don’t have the same data protection laws as in the UK.  In these circumstances, we make sure they provide an adequate level of protection in accordance with UK data protection law and confirm that appropriate safeguards are in place. Safeguards to protect personal data may include but are not limited to the UK Addendum used in conjunction with the EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreement (IDTAs). Such safeguards will be subject to Transfer Risk Assessments (TRAs).  

International transfers of personal information  

Your information is normally kept within the UK or the European Economic Area (EEA). This is a priority for The Brain Tumour Charity when selecting where we host and use your information.

On some occasions, we may have to use services of other parties that host your information outside of these areas. When this occurs, we’ll only ever use highly reputable suppliers that have gone through our information security due diligence, have contractual clauses about the high standard of data processing and meet all requirements that your information is looked after to a standard as if it were in the UK or the EEA.

The Brain Tumour Charity holds its data on secure databases and there is restricted access to data based on a person’s role in the organisation.

Our digital files are currently stored within the UK. Access to this data centre is also restricted. 

Where we engage with organisations outside of the UK or EU, we endeavour to ensure that the processing of your data is subject to additional security measures.

We only share data where we are required by law or with carefully selected suppliers and trusted partners that we work alongside or have appointed to undertake work on our behalf. All data sharing with third parties is subject to an appropriate lawful basis being identified and in place before any data sharing commences.  All our partners are required by their contract with us to treat your data as carefully as we do, to only use it as instructed and to allow us to check they do this. For example, if you request to use our Benefits Clinic, we’ll share your contact details with Citizens Advice Rushmoor so our specialist advisor can get in touch. When sharing information with third parties, we have data sharing agreements, data processing agreements or contracts in place to ensure data is not compromised. These third parties implement appropriate technical and organisational measures to ensure the security of your data.

Cookies, web beacons and similar technologies

The Brain Tumour Charity uses cookies, web beacons and similar technologies to collect and use certain information about your device(s), your use of our websites, app(s) or services and other unique identifiers personal to you. For further information on how this information is used, please see our Cookies Policy.

To opt out of third-party advertising technologies (including cookies) you can visit www.youronlinechoices.com/uk/your-ad-choices If you choose to turn off these technologies, we may still serve you ads, but these ads are unlikely to be tailored to your interests.

UTM Tracking and Analytics

We use UTM (Urchin Tracking Module) parameters to understand how users interact with our digital content. These parameters help us assess the performance of our campaigns and improve the relevance of our communications. While UTM tracking is often associated with marketing emails (where we rely on your consent), we may also use UTM tracking under our legitimate interests in transactional emails and across our website and social media platforms. This helps us ensure our communications are effective and relevant.

Joint fundraising

In some cases, we may share your personal data with trusted partner organisations involved in joint fundraising initiatives. This helps us coordinate communications, evaluate campaign performance, and conduct appropriate due diligence for major gifts. We will always endeavour to inform you when your data may be shared in this way and will carry out a legitimate interest assessment where required.

We do not sell or rent your personal information to third parties for marketing purposes.

Other sharing

We may also disclose your information to third parties in connection with the other purposes set out in this notice.  These third parties may include:

• Advertisers, social media platforms and advertising networks.
• Analytics and search engine providers.
• IT service providers.
• Specific organisations that are engaged (as data processors) to undertake data processing activities on our behalf under contract. These businesses undergo vetting and thorough due diligence processes to ensure they’re reliable and secure.
• If you’re a researcher, we may share your information with volunteer advisory panels, any joint funders of research, host institutions and members of our committees.
• We may share information with co-beneficiaries if you’re a legacy giver.

Where we’re under a legal or regulatory duty to do so, we may disclose your details to the police, regulatory bodies or legal advisors, and/or, where we consider this necessary, to protect the rights, property or safety of The Brain Tumour Charity, its personnel, visitors, users or others.

We reserve the right to disclose your personal information to third parties:

• if we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets; and/or

if substantially all of our assets are acquired by a third party, personal information held by us may be one of the transferred assets.

Automated decision-making

Automated decision-making refers to the use of algorithms or computer systems to analyse data and make decisions without human intervention. Although automated decision-making can streamline processes and enhance user experiences, our priority is to uphold fairness, transparency and accountability in these procedures. 

We take measures to reduce the use of automated decision-making and closely monitor the likelihood of any negative impacts on individuals arising from any automatic decisions. Some of our processes, such as send-time optimisation or content personalisation, use AI or machine learning to improve your experience. These processes do not produce legal or similarly significant effects and are therefore not subject to Article 22 of the UK GDPR.

We rely on our legitimate interests to carry out such activities. However, we respect your right to object to this type of processing. We offer mechanisms for individuals to request human intervention, review decisions, or raise concerns about the use of automated processes. (please see the ‘Your Rights’ section of this notice for information on how to object to this type of processing).

Artificial Intelligence (AI) 

In a dynamic digital landscape, AI and machine learning algorithms can help us enhance your experience by offering personalised, efficient and secure services tailored to your needs and preferences. These techniques may involve the analysis of data, including personal information, to provide recommendations for relevant content.

It’s important to note that while machine learning algorithms analyse data to make predictions or decisions, we take steps to ensure the privacy and security of your personal information. Your data may be anonymised or aggregated to prevent identification and used solely for improving our services.

We may also use machine learning for fraud detection, spam prevention and to enhance the overall security of our platform. In some cases, we might enlist the assistance of third-party machine learning services for these tasks, ensuring that their practices align with their respective privacy policies and terms of service.

We hold your personal information for as long as required to fulfil the purposes for which the personal data was collected. Our data retention schedule sets out the different periods we retain personal information for in respect of these relevant purposes. The criteria we use for determining these retention periods is based on various legal requirements; the purpose for which we hold data and whether there is a legitimate reason for continuing to store it (such as in order to deal with any future legal disputes).

Specific timeframes for retaining personal information are determined by a combination of legal requirements and the purpose of holding on to the data. Our Retention Policy adheres to guidance provided by the Information Commission (formally the Information Commissioners Office, ICO) and provides support for establishing these criteria.

Personal information that we no longer need is securely disposed of and/or anonymised so you can no longer be identified from it. Some personal information may be retained by us in archives for statistical or historical research purposes although we’ll do this in a manner that complies with applicable data protection law. 

Paper records are kept to a minimum and will only be stored on the premises at our offices in the UK. These offices are securely locked when no members of staff are present, and access is restricted and monitored during the working day.

Please refer to our Retention Policy for further information.

In line with the principles defined in the Data Protection Act 2018 and the General Data Protection Regulation (GDPR), The Brain Tumour Charity ensures that personal data is processed in ways that are:

• Lawful, fair and transparent
• Collected only for specific explicit and legitimate purposes
• Adequate, relevant and limited
• Accurate and up to date
• Not kept for longer than necessary
• Secure.

The law requires us to set out the lawful grounds on which we collect and process your personal information as described in this notice. Depending on the purposes for which we use your data, one or more of the grounds listed below may be relevant.

Legitimate interest

In certain instances, we collect and use your personal information by relying on the legitimate interest legal basis. In broad terms, our ‘legitimate interests’ means our interest in being able to run The Brain Tumour Charity as a charitable entity effectively in pursuit of our aims and ideals. This includes:

• Providing services and support to service users, carers and families affected by health conditions relating to brain tumours
• Sending our regular supporter magazine, The Grey Matters, by post or email to keep supporters informed of our work and progress towards our goals
• Sending direct marketing material to supporters by post for fundraising purposes
• Conducting research to better understand who our supporters are and better target our fundraising activity
• Conducting research to better understand who is using our Support and Information services and measuring their impact to improve the services we offer
• Measure and understand how our audiences respond to a variety of marketing and communications activity so we can ensure our activities and services are well targeted, relevant and effective
• Providing information about brain tumours
• Processing donations
• Administering events
• The use of machine learning for profiling and automated decisions 
• Staff recruitment and taking applications for volunteers and contacting volunteers about their role
• The use of CCTV recording equipment in and around our premises for monitoring and security purposes.

However, ‘legitimate interests’ can also include your interests, such as when you’ve requested information or certain goods/services from us. It can also include the legitimate interests of third parties. 

If we rely on the ‘legitimate interests’ basis to use your personal information, we’ll only use the information in accordance with the purposes described in this notice.

When we legitimately process your personal information in this way, we also consider and balance any potential impact on you (both positive and negative) and your rights under data protection laws. We won’t use your personal information for activities where our interests are overridden by the impact on you, for example, where collection and use of your information would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law).

Consent

When necessary, we’ll rely on obtaining your consent to our use of your personal information in a certain way (for example, asking for your consent to send you marketing information using cookies or to share your sensitive personal information with our Support team). We’ll endeavour to be specific, informative and unambiguous when obtaining your consent so that this is freely given. The Charity will also provide details on how individuals can withdraw consent, and we’ll ensure we maintain records of consent preferences that have been provided.

We acknowledge that consent isn’t perpetual and that situations evolve. When determining whether it’s appropriate to contact you, we’ll consider when you last gave us consent and the nature of the support you require. We may ask you to periodically update your consent to allow us to continue supporting you and keeping you up to date with our work.

If you want to withdraw your consent for us to use your personal information, please contact our Community Experience team at The Brain Tumour Charity, Fleet 27, Rye Close, Fleet, Hampshire GU51 2UH or by emailing [email protected]

Legal obligation

The charity has legal obligations that require us record and report on certain information to ensure we’re compliant with regulations. We may need to collect, process and disclose personal information to comply with a legal obligation. For example, where we’re ordered by a court or regulatory authority or we’re legally required to hold donor transaction details for Gift Aid or accounting/tax purposes. 

Performance of a contract

This refers to a contract that you’re directly a part of or for the implementation of pre-contractual measures taken at your request. For example, if you purchase something from our online shop, apply for a grant from us or agree to work for us, we need to be able to process your information for the purpose of meeting our contractual obligations.

Vital interests 

We reserve the right to process information during emergency situations to protect the well-being and livelihood of our services users, staff and the community. Such situations are rare and will always be in the best interest of individual/s. For example, we may need to share health information with emergency services or the police to provide urgent medical treatment in life-threatening situations where obtaining consent is not feasible.

Public task

We may be required to process personal datafor the performance of a task carried out for the welfare of the general public or in the exercise of official authority vested in The Charity. For example, we may work with the Government or the National Health Service (NHS) to conduct public health research or deliver healthcare services to hard-to-reach individuals.

Special category data processing 

In certain circumstances, we may need to collect and process special category personal data (please refer to the ‘Types of information we collect’ section of this notice). We recognise the sensitive nature of such data and are committed to ensuring its protection in accordance with UK data protection laws. Our processing of special category data will only occur under one or more of the following conditions:

• Explicit consent has been freely given.
• For the initiation, exercise or defence of legal claims.
• To safeguard the vital interests of any natural persons where obtaining consent is not appropriate.
• Processing pertains to personal data that’s already been made public by the data subject.
• Processing is identified as being within the substantial public interest conditions of the UK GDPR and Data Protection Act 2018.
• For archival, scientific, historical research or statistical purposes.

Philanthropy  

In the case of a generous donation, or to identify potential high-value supporters, we may use profiling and screening techniques. This may include in-house research using publicly available sources such as Companies House, the Electoral Register, company websites, ‘rich lists’, social networks like LinkedIn, political and property registers, and news archives. We may also use Data Enrichment tools^[i] and Supporter Intelligence Platforms^[ii] to support this research and analysis. From time to time, we may also engage specialist agencies to carry out similar research on our behalf.

We would gather publicly available information regarding previous charity support, connection to our cause, credibility^[iii], geographical, demographic, financial soundness, career information, peer networks and other publicly available information e.g. age, address, listed Directorships, hobbies and interests.

If you have already engaged with us, we may also profile information that you have provided to us during your engagement, including information such as occupation, title, details of any correspondence had with us, date of birth, fundraising appeals responses, event participations with us and details of your reasons to engage with us.  

We also use publicly available sources to carry out due diligence on donors in line with the charity’s Gift Acceptance Policy and to meet money laundering regulations.  

​​​This information also allows us to understand how likely it is that you would be interested in supporting us so that we can better tailor our communications such as telling you about the things you are likely to be interested in, letting you know of ways to fundraise with us which are relevant to you and making sure that we only talk to you about a financial level of giving that is appropriate to you.  

We rely on our legitimate interest in order to profile and screen your information. If you would rather, we did not do this, please just let us know and we will, of course, respect your wishes. Otherwise, following our initial profiling and screening, we may contact you via phone, letter or e-communication if consent has been provided. During our conversation or contact, we will inform you of our processing and of your rights as a data subject (which include right to object, to restrict our processing and to have your data deleted). If you are happy to engage with us, we’ll proceed with establishing our relationship with you, which may include further engagement and profiling.

Additionally, we sometimes ask existing supporters, trustees and volunteers whether they would be prepared to open their networks up to us.  An existing supporter may tell us about an individual previously unknown to us and facilitate an introduction. In this scenario we would check that the person in question is registered on the Telephone Preference Service (TPS) or Fundraising Preference Service (FPS) and exclude them if their details have been registered on either of these registries.  We would then advise our Trustee or existing supporter about our data responsibilities and ask them to ensure that the person they would like to introduce to us is happy for an introduction to take place.  Following the introduction, we would direct the individual to this privacy notice and confirm their marketing consent preferences before communicating with them further.  We will also share a link to our privacy notice in the footer of all of our email communications.   

How long do we keep your data for? 

We keep your data as long as necessary. If you’ve made a donation, showed interest in supporting us or participated in our events we may keep your data for up to seven years. If you are a regular donor, we may keep your data for seven years once you’ve stopped engaging with us. 

Data is destroyed or deleted in a secure manner as soon as the retention date has passed.  

If you wish to know more about our data retention, please contact us using the details above.   

Confidentiality – who do we share your data with?  

Your personal data is not sold to third parties for marketing purposes.

In addition, if we ever need to send data to a third party for processing for the purposes of legitimate interests (for example checking against the Telephone Preference Service, updating our records and prospect researching from publicly available sources such as the electoral roll) we will make sure the company we use has signed a data processing agreement with us or there are other contractual obligations in place, so that they are bound to take care of your data in the same way we do.  We may also share personal information with external auditors, e.g. the Charity Commission for England and Wales or for the audit of our accounts. 

We may disclose and exchange information with law enforcement agencies, regulatory bodies, or relevant authorities were required to comply with legal or regulatory obligations, or where we believe it is necessary to raise a safeguarding concern in order to protect an individual from harm.

If you have made a Gift Aid declaration, we may disclose the information you have provided as part of the declaration to HMRC for the purpose of reclaiming gift aid on your donation(s). We may share or disclose your personal information if we are required to do so by any law, regulation or court order. 

---

[i] Data Enrichment Tools – These are technologies that help improve the accuracy and usefulness of information held. They work by adding publicly available or third-party data, such as demographic, geographic, or behavioural details, to existing records. This helps us better understand our supporters and tailor our communications and services more effectively. 

[ii] Supporter Intelligence Platforms – These are systems that analyse data about our supporters, such as donation history, engagement levels, and interests, to help us understand patterns and preferences. This insight allows us to make more informed decisions, personalise our outreach, and improve supporter experience. 

[iii] Credibility – Use of publicly available information that may indicate a person’s reputation and alignment with our values. This may include factors such as professional standing, history of charitable involvement, public recognition, or any publicly reported controversies.

Under UK data protection law, you have rights over personal information that we hold about you. These are summarised below.

Right to be informed

You have the right to be told how your personal information will be used. This notice and other policies and statements used on this website and in our communications are intended to provide you with a clear and transparent description of how your personal information may be used.

Right to access your personal information

You’re entitled to have access to certain personal data held about you, either physically or digitally. Anyone who wishes to exercise this right should apply, in writing, to the Data Protection Officer at

The Brain Tumour Charity, Fleet 27, Rye Close, Fleet, Hampshire GU51 2UH or [email protected]. Please include details of the information you wish to access. The Charity will aim to respond within one month, providing that the request includes appropriate contact details, proof of identity from the individual and we can validate the request.

Right to have your inaccurate personal information corrected

You have the right to have inaccurate or incomplete information we hold about you corrected. If you believe the information, we hold about you is inaccurate or incomplete, please provide us with details and we’ll investigate and, where applicable, correct any inaccuracies. If the information has been provided to us by the NHS, you’ll need to contact them to have their records amended.

Right to restrict use of your personal information

You have a right to ask us to restrict the processing of some or all of your personal information in the following situations: 

• if some information we hold on you isn’t right
• we’re not lawfully allowed to use it.
• you need us to retain your information in order for you to establish, exercise or defend a legal claim.

Right to erasure of your personal information

You may ask us to delete some or all of your personal information and, in certain cases and subject to certain exceptions (i.e. if we have to hold on to it to meet a legal obligation), you have the right for this to be done.

Right for your personal information to be portable

If we’re processing your personal information (1) based on your consent, or in order to enter into or carry out a contract with you, and (2) the processing is being done by automated means, you may ask us to provide it to you or another service provider in a machine-readable format.

Right to object to the use of your personal information

If we’re processing your personal information based on our legitimate interests or for scientific/ historical research or statistics, you have a right to object to our use of your information. If we’re processing your personal information for direct marketing purposes and you wish to object, we’ll stop processing your information for these purposes as soon as reasonably possible. 

Right not to be subject to a decision based solely on automated processing

The Brain Tumour Charity understands the importance of transparency and accountability in the use of such technologies. We’re committed to safeguarding the privacy and rights of our service users and supporters. At times, we may use profiling and screening technologies designed to enhance efficiency and provide personalised experiences for our users. For example, our chatbot function will triage communications so that a request is picked up by the correct team. 

Algorithms may be used to analyse user data, such as browsing history, preferences and interactions with our platforms, to generate a profile for personalised recommendations for products, services or content that may be of interest to you.  

These insights are then integrated with the information you’ve provided, enabling us to allocate our resources more efficiently. By understanding our supporters’ backgrounds, we can tailor our requests accordingly, focusing on areas of potential interest.

In order to protect our users and maintain the integrity of our platforms, we may employ automated systems to detect and prevent fraudulent activities, such as account takeovers or unauthorised transactions.

We don’t undertake any purely automated decision making as part of our operations as human oversight is always involved. 

If you want to exercise any of the above rights, please contact our Community Experience team at The Brain Tumour Charity, Fleet 27, Rye Close, Fleet, Hampshire GU51 2UH or by emailing [email protected]. 

We may be required to ask for further information and/or evidence of identity. We’ll endeavour to respond fully to all requests within 30 days of receipt of your request, however if we’re unable to do so we’ll contact you with reasons for the delay.

Please note that exceptions apply to a number of these rights and not all rights will be applicable in all circumstances. For example, in some instances, we may anonymise and/or aggregate information collected which means it is no longer defined personal data. For more details we recommend you consult the guidance published by the Information Commission (formally the Information Commissioners Office, ICO) in their ‘Your Data Matters’ guidance for individuals.

If you’ve provided us with your postal address we may send you direct mail, including The Grey Matters magazine, which will include updates on our work. We may also contact you about fundraising, campaigning, events and trading. We don’t ask for consent to write or call you about these things, because, as a charity, each of these activities is fundamental to how we work, so we have a legitimate interest to contact you. However, you have the option to opt out of receiving marketing communications by email, post or phone at any time by contacting our Community Experience team by writing to us at our Head Office address, emailing [email protected] or calling us on 01252 237792.

We’ll only send you marketing communications by email if you’ve consented to receive these. You can unsubscribe at any time by clicking on the unsubscribe link in our marketing emails. Our mass email service allows us to track who has opened our e-newsletter and what links have been clicked on. This allows us to monitor what information is most useful to improve our content in the future.

If you’ve indicated you don’t wish to be contacted by us for marketing purposes, we’ll retain your details on a ‘do not contact’ list to help ensure that we do not contact you accidentally. However, we may still need to contact you if you carry on dealing with us, including (but not limited to):

• Processing a donation you make or any continuing Direct Debit
• Providing you with information you need in order to participate in an activity, event or campaign for which you have registered
• Sending you information you’ve requested or shop orders placed
• Explaining and apologising where we’ve made a mistake
• Dealing with future legal claims in connection with a contract we have with you.

We understand that consent is not indefinite and acknowledge that circumstances may evolve over time. When deciding whether to contact you, we consider when the last interaction with our services was and the type of support provided. You may be asked to renew your permissions to confirm you are happy to continue receiving our communications.

How to change the way we contact you

Your personal preferences and keeping your data accurate is of utmost importance to us. If at any stage you don’t want to hear from us, want to change your contact preferences or want to update your details, you can email [email protected], call us on 01252 237792 or write to our Community Experience team at The Brain Tumour Charity, Fleet 27, Rye Close, Fleet, Hampshire GU51 2UH.

You can also now register your details with the Fundraising Preference Service if you want to tell us through the Fundraising Regulator that you’d prefer us not to contact you.

Any marketing email we send you will contain information about how to unsubscribe from email marketing communications. During any phone, email or live chat conversation you have with us, please feel free to let us know how you prefer to be contacted.

Keeping your information up to date

Where possible we use publicly available sources to keep your records up to date, for example, the Post Office’s National Change of Address database and the National Bereavement Register. However, we really appreciate it if you let us know if your contact details or circumstances change. Just contact our Community Experience team at [email protected] or call us on 01252 237792 and we’ll update our records.

If you have any queries or are unhappy at any time about the way we process your personal information, please contact Liam Heffernan, The Charity’s Data Protection Officer, who will investigate the circumstances.

Please write to them at The Brain Tumour Charity, Fleet 27, Rye Close, Fleet, Hampshire GU51 2UH, email [email protected] or call 01252 749990.

We appreciate the opportunity your feedback gives us to learn and improve. Find out more in our Complaints Policy.

If you’re unhappy with the way your (or your child’s) data are being processed and we’ve been unable to satisfactorily resolve your concern, you have the right to complain to the Information Commission (formally the Information Commissioners Office, ICO): www.ico.org.uk