Privacy Statement

Medical Aid Films Limited
Privacy policy

Your privacy and security of your personal information are of the highest importance to us. This privacy policy explains what personal information Medical Aid Films
collects about you, how and why we use that information.

*********************************************************************************************************************************************************************
1 Who we are:

1.1 About us:
We are Medical Aid Films Limited (MAF), a charity registered in England and Wales (Company Reg. No. 06296236).
Our registered address is 124 Finchley Road, London, NW3 5JS
Our current office address is 16 Lincoln’s Inn Fields, London, WC2A 3ED

1.2 How to contact us:
If you have any questions about this privacy policy or to exercise your rights in relation to your personal data, please contact our Finance and HR Manager/DPR.
Finance and HR Manager/DPR
Medical Aid Films
16 Lincoln’s Inn Fields, London
WC2A 3ED
info@medicalaidfilms.org

*******************************************************************************************************************************************************************

2 Introducing our privacy policy:

2.1 Purpose and scope of this policy:
Using personal data allows us to develop a better understanding of, and engage with, our stakeholders and in turn provide you with relevant and timely information about the work that we do.
The purpose of this policy is to explain why we process your personal data and your rights in relation to your data. We are committed to respecting and protecting your personal data and being transparent about what we do with it, in accordance with your reasonable expectations and applicable laws and regulations.

This privacy policy was updated on 24th May 2018. We will update this privacy policy from time to time with regard to our activities and in accordance with applicable laws and regulations and will post any changes here on our website. When you use our services, the latest privacy policy posted will apply so please check back regularly to ensure that you have seen our most up to date notice. We appreciate your support and the trust you give us when you provide us with your personal data.

2.2 Our legal basis for collecting data:
We will only use your personal data if we have a legal basis to do so. This means that we will only use personal data where we have your explicit consent, where it is necessary in order to perform a contract with you, to comply with a legal duty or right, to protect your vital interests, or where the processing of your personal information is in our legitimate interest and not overridden by your legal rights.

There are generally three legal bases under which we may process your data:
 Consent: When consent is required we will always ask for your explicit consent to processing your personal data.
 Contract: When you make a donation to us or become a Friend, you are entering a contract with us. We need to process and store your data in order to perform this contract.
 Legitimate interests: In some situations we collect and process your personal data for purposes that are in our legitimate organisational interests. In doing so we consider that there is no overriding prejudice to you and that you would reasonably expect us to use your data in this way.

2.3 Key terms:
 Cookies: means small text files which our website places on your computers hard drive to store information such as activity on our website. When you visit the website again, the cookie allows that site to recognise your browser. Cookies may store your preferences and other information.
 Malware and viruses: means malicious software (such as viruses) which can gain access to your computer or device and be used for criminal activity.
 Donor: means a person who has supported any of our appeals.
 Personal data: means any information that identifies you or that could identify you either alone or when combined with other information.
 Processing: means anything that is done to, or with, personal data (including simply collecting, storing or deleting those data).
 We/us: means Medical Aid Films Limited a charity registered in England and Wales (Company Reg. No. 06296236).
 Website: means the website located at www.medicalaidfilms.org and any other websites operated by Medical Aid Films Limited.

************************************************************************************************************************************************************************

3 Information we collect:

3.1 Supporters:
When you make a donation, a pledge or become a Friend of MAF we use your personal data to record that you have given us financial support. Our legal basis for this processing is our legitimate interest to recognise your valuable contribution and send communications and invitations in appreciation. We aim to send communications that you would reasonably expect to receive as a donor with minimal impact on your privacy; this may be postal information on our latest fundraising appeal or an email with retail offers where you have previously brought goods or tickets from us.

Fundraising and marketing emails will only ever be sent when you have given us your explicit consent to receive them. We may also call you about our work but we will always get your prior consent to do so. As a donor we may collect the following information about you:
 Name
 Address and postcode
 Email address
 Telephone numbers
 Bank and/or credit card details

We may also create information about you that becomes your personal data such as:
 Payments and donations you have made to us, including amount and frequency
 Attendance at events

As a donor we may also combine the personal information we hold with publicly available information (such as directorships listed at Companies House or publicly available sources like news reports).

In some cases, we may obtain potential indicators of interest or financial status based on postcodes. This information is not specific to the individual but will indicate probable characteristics based on postcode. We may use postcode analysis to send every postcode in an area special offers or invitations to events. This is known as profiling and our legal basis for the processing is our legitimate interest to build a more personalised relationship by building a more detailed profile of you.

You have the right to object to this profiling and may do so at any time. If you would like to object please email info@medicalaidfilms.org. We aim to communicate with you about the work that we do in ways that you find relevant, timely and respectful.

You can change your preferences and also object to the way we process your data, including the way we communicate with you at any time using the contact details at the end of this policy. In the case of marketing emails, we will always provide you with an option to unsubscribe in every email that we send you. More information on how your personal data is used for marketing purposes is below.

3.2 Children:
While children have the same rights as adults over their personal data, we take particular care when processing children’s personal data, following data protection principles and with a particular emphasis on fairness in processing. In running some of our activities or making films we may collect personal data from or about children and for this we rely on parental consent where at all practicable. We only retain children’s personal data for so long as reasonably necessary to fulfil the purposes required. Where we use children’s images it is our policy to collect a signed release form which records parental/guardian consent.

3.3 Photos, videos, stills, audio from which persons are identifiable:
We protect these as personal data. We collect these, and also permit some of our service providers to do so, in the following circumstances:

At events – From time to time we take photos and video at our events. Your image may be captured and recorded if you attend one of our events. You consent to this when you purchase a ticket to our events or when you enter our premises. When we are filming we will let those in the vicinity know so that the area can be avoided if you do not want your likeness to be captured or recorded. If you can be identified from an
image, audio or video that we wish to use to promote MAF through advertising or via third parties, then we will ask you to consent to such use through signing a release form.

Film production – We are making films through time-lapse photography and video. Individuals identifiable and involved in these films will be asked to sign a release form. We will keep these records secure.

3.4 Sensitive personal data:
We do not normally collect or store sensitive personal data (such as information relating to health). However, there are some situations where we will need to do so
(e.g. if you have an accident at one of our events or if you tell us about a disability). If we record your sensitive personal data, we will take extra care and follow additional procedures to ensure your privacy rights are protected. Our legal basis for collecting sensitive personal data will usually be so that we can fulfill legal or regulatory requirements and in other cases, it will be your explicit consent.

**************************************************************************************************************************************************************************

4 How we use your information:

4.1 Marketing communications:
Marketing doesn’t just mean offering things to buy, but also includes news and information about what we do. What information and communications you receive from us will depend on whether you are a donor or a prospective supporter.

Donor
If you are a current donor, you will receive our regular digital communications about our events and activities, our charitable work and offers. We will send this information by post or email, unless you ask us not to.

Prospective donors
If you are not already a donor, we would love to be able to tell you more about our work at MAF, our charitable work and appeals.

Do not miss out! Opt-in so that we can let you know about events and activities you might be interested in. You can do this by emailing to info@medicalaidfilms.org

Our marketing promise
 We will only ever use your details to help you make the most of what we have to offer and what you have asked if you have previously made a donation.
 We endeavour to ensure we do not send you too many communications.
 Your details are only used by us, or those who work with us (such as our suppliers and contractors) and will not be sold to anyone else.
 Where suppliers and contractors process personal data on our behalf, we control this in order to safeguard your personal data rights, through reviewing their data security arrangements and enforcement of specific personal data obligations in our contracts with them.
 We do not make personal data available to third parties to use for their own marketing purposes.

4.2 Other ways we may use personal data:

Analysis and grouping
We may analyse data about our donors to understand common characteristics and preferences. We may analyse various types of information including demographic information (e.g. age or location). By analysing data and grouping people together by common characteristics, we can provide more relevant communications, offers, and information, improve our activities and services, and operate more efficiently.

Research and profiling
We may also use personal data to build profiles of categories of members and add profiles to the individual’s member’s record. This enables us to understand our donors and supporters, improve our relationships, and provide a better donor and supporter experience. Medical Aid Films does not carry out profiling that has any significant legal effect on you. If we think that any profiling activities that we carry out may have a significant legal effect, then we will ask for your consent to ensure you are informed and have control. We will not use profiling on children or special categories of data like genetic or biometric information.You have the right to object to this profiling. If you would like to do so, please let us know by contacting us using the details at the bottom of this policy.

Anonymised data
We may aggregate and anonymise personal data. We use anonymised or de-identified information for a variety of purposes, such as identifying trends or patterns within our existing member or supporter base, to improve our activities and services, including our campaigns, events and newsletters.

Special circumstances
If you do not fall within one of the above categories, why and how we process your data will depend on how you interact with us, for example, if you ask us for information or sign up for a newsletter we will need to collect some personal data from you. We will only use this information to provide the necessary service or information that you have requested, unless you have given us your explicit consent to use your information in other ways.

You can change your preferences at any time and can object to how we process your data at any time by contacting:
Finance and HR Manager/DPR
Medical Aid Films
16 Lincoln’s Inn Fields, London
WC2A 3ED
info@medicalaidfilms.org

4.3 Where we store your personal data:
We maintain appropriate safeguards, procedures and technology in order to keep your personal data secure and also require that third parties we choose to process your personal data do the same. We actively manage our use of your personal data and store it securely in the UK and abroad with GDPR compliant third parties. We have up to date security and carry out security audits.

Banking details
We store your bank account and debit/credit card details in accordance with the Payment Card Industry Data Security Standard (PCI-DSS).

4.4 How long we keep your information:
We keep your personal data safely for as short a time as we need it or legally have to keep it. In doing so, we:
 review the length of time we keep your personal data;
 consider the purposes for which we holds the personal data in deciding whether (and for how long) to retain it;
 securely delete personal data that is no longer needed for those purposes; and
 update, archive or securely delete personal data if it goes out of date. The time periods for which we retain your personal data depend on the purposes for
which we use it.

We have set destruction limits taking into account legal rules, your rights and our needs and have a continuous programme that securely destroys your personal data
when we have reached the relevant time limit. When you make a payment to us by giving us your card or bank account details, we may temporarily store these details securely in order to process the payment as soon as possible. After the payment has been processed we safely destroy the card or bank account details. If you make annual payments to us, we will safely store your payment details for annual processing of payment.

4.5 Sharing your personal data:
We will never sell your personal data. We may share data, including personal data, with our third-party vendors who may need to have access to your personal data for the purpose of providing services to us. We do not permit our third party service providers to use any personal data that we share with them for their own marketing purposes or for any other purposes other than in connection with the services they provide to us, unless you have provided your consent for them to do so.

In some circumstances, our third party service providers may collect your personal data on our behalf. When our service providers collect your personal data on our behalf, we ensure that they enter into contracts which only permit them to process your personal data in accordance with our instructions and this Privacy Statement. You should be aware that our service providers may ask you for your consent to send you marketing and other information about other events and services (“Third-Party Marketing”). If you do provide your consent to third party marketing, you should
be aware that your personal data will be processed by that third party in accordance with their privacy statement (and not MAF privacy statement). You should read their privacy statement and ensure that you are comfortable with how they may use your personal data before providing your consent.

We may also share your personal data with third parties if we are required to do so by law or contract, to respond to legal process, to protect our customers or staff, to protect lives, with your consent, to complete a transaction, or to protect the rights or property of MAF.

We pass your card or bank details to our payment providers in order to process payments that are due to us. We may allow our external researchers to create anonymous aggregate data and
perform trend analysis about donations, visits to our events. We will only use anonymised, non-identifiable information for these purposes to help us provide better and more relevant services.

We may also share your personal data if it is necessary to:
 comply with applicable law or respond to valid legal processes, including from law enforcement or other government agencies. For example, on occasion we may disclose CCTV footage to the police.
 reclaim gift aid on your donations from HMRC gift aid declarations. In these circumstances, we will need to share your name and address and details of your tax status.

****************************************************************************************************************************************************************************************

5 You are in control:

5.1 Change your preferences and opt out:
You are in control of what we do with your personal data. If you would like to change your choices, or how we communicate with, just let us know. To change your preferences or opt out, please contact:

Finance and HR Manager/DPR
Medical Aid Films
16 Lincoln’s Inn Fields, London
WC2A 3ED
info@medicalaidfilms.org

There are “unsubscribe” buttons on all electronic communications which allow you to opt out of future communications. We also include a reminder of our “unsubscribe” email address and phone number on communications we send to you by post.

5.2 Updating your information:
Please let us know if your personal data is inaccurate because your details have changed (for example you have moved house). Please let us know using our contact details. When updating your personal data by phone or email, we may ask you to verify your identity before we can act on your request.

5.3 Your rights:
You have several legal rights in relation to your personal data. These data subjectrights are the right to request:

 Right to be informed about the collection and use of your personal data;
 Access to your personal data (see below);
 Rectification of your personal data;
 Erasure of your personal data (this right is also referred to as the right to be forgotten
 Restriction of our processing of your personal data;
 Portability of your personal data (where we process your data by automated means and under the legal basis of consent you have the right to receive this data in a structured, commonly used and machine-readable way and to transmit this to another controller);
 Processing of your personal data ceases (the right to object); and
 Not to be subject to automated decision making

To exercise your rights or ask any questions please contact:
Finance and HR Manager/DPR
Medical Aid Films
16 Lincoln’s Inn Fields, London
WC2A 3ED
info@medicalaidfilms.org

We will always try to respond to your satisfaction, but there may be situations where we are unable to do so. More information can be found at the website of the Information Commissioners
Office.

5.4 Access to information:
You can find out if we hold your personal data and ask for a copy of it by making a ‘subject access request’. If we do hold personal data about you, we will:

 let you know what personal data is being held or used and why
 let you know who can see your personal data
 give you a copy of the personal data you request in electronic form
 provide any other relevant information including how long we will hold your personal data for and how to correct inaccurate information that is held by us.

Please get in touch with us if you have any questions about any aspect of this privacy policy, or wish to exercise your legal rights. To make a request or to exercise
your legal rights, please email or send a letter (headed ‘Subject Access Request’) to:

Finance and HR Manager/DPR
Medical Aid Films
16 Lincoln’s Inn Fields, London
WC2A 3ED
info@medicalaidfilms.org

We will respond as soon as possible (and within one month of the date of receipt of your request and the information we need to respond).

**************************************************************************************************************************************************************************

6 Staying safe online:

6.1 Security and privacy:
We use up to date physical and technical measures to keep your information safe, prevent unauthorised access to it and to prevent misuse or unauthorised disclosure of it. We control who has access to our secure electronic databases and provide staff and volunteers training on our data protection policies and procedures. We also check these are being followed.

6.2 Linking to third party websites:

Our website includes some links to other sites that may be operated by third parties. If the third party website is operated on our behalf by one of our official partners, any personal data that you submit via that website will still be governed by this privacy policy, unless you provide your consent for your information to be used in other ways (such as if you opt-in to receive Third Party Marketing), in which case the third party’s privacy policy may apply. On some occasions, we may provide links to third party websites that are not operated on our behalf. When this is the case, we will notify you that you are leaving our Website and entering a website operated by a third party. In these circumstances, any personal data that you may submit to the third party’s website will be processed in accordance with the third party’s privacy statement. Our site may also have “plugins” (such as Facebook “like button”) through a third
party website. These and similar features are also governed by the third party’s privacy statement.