Privacy Policy
Anorexia and Bulimia Care (EDA) is committed to protecting your data and your privacy. We aim to ensure that any information you give us is held securely and safely.
Please read this policy carefully, to understand how we collect, use and store your personal information.
EDA holds and processes personal details in accordance with the Data Protection Act 1998
If you have any questions about this policy or how your data is handled, please write to:
The Data Protection Officer
10- 11 Saville Court
Saville Place
Clifton
Bristol
BS8 4EJ
Email: mail@eatingdisordersadvice.co.uk
Telephone: 08500 1 22 555 option 3 (during office hours, Monday to Friday)
Data Protection
As you use our website, get in touch with us, or take part in our campaigns and activities, we collect information. This deepens our understanding of what you are interested in and helps us to improve the quality and relevance of all of our communications with supporters.
EDA and its subsidiary will never share your information with another organisation for their own marketing purposes and we will never sell your information for any reason whatsoever. We know that this is important and want to reassure you that you are always in control of how we use your personal information in regard to marketing and fundraising activities.
We do however need to collect and use your personal information for carefully considered and legitimate business purposes, which will help to ensure that we can run EDA efficiently, raise funds effectively and deliver our charitable programmes around the UK.
This policy will set out what data we collect, how we will use it, what the legal basis for this is, and outline what your rights are in respect of your personal data.
Lawful Processing
EDA, like all organisations in the UK, needs a lawful basis to collect and use your personal data. The law allows for six legitimate purposes which organisations can rely on to legally process people’s personal data. Of these, only three are relevant to charities for the type of activities listed above:
• Information is processed on the basis of an individual’s consent.
• Information is processed in line with a contractual relationship.
• Information is processed on it being a legitimate interest for EDA to do so.
We may also share your personal information when we are compelled to do so by a legal authority acting in compliance with the law.
Consent
EDA will always ask for your consent to send you marketing by email.
Should we ever ask you to provide any sensitive personal data about yourself, for example any health condition that may be relevant if you are taking part in an EDA event, we will always seek your explicit consent to process this data.
Where you give us consent to process your data we will always keep a clear record of how and when this consent was obtained, and you can withdraw this consent for all channels and activities at any time by contacting our supporter care team on 08500 1 22 555 Option 3 or by email mail@eatingdisordersadvice.co.uk
Legitimate interests
The law allows personal data to be legally collected and used by an organisation if it is necessary for a legitimate business interest of the organisation - as long as its use is fair and balanced and does not unduly impact the rights of the individual concerned.
There are times when it is just not practical to ask a person for consent. In many situations, the best approach for EDA and our supporters, beneficiaries, and volunteers is to process personal data because of our legitimate interests, rather than consent.
If you want to change our use of your personal data for marketing and fundraising activities, you can do so at any time by contacting our supporter care team.
What information we collect
We collect and use personal information such as names and address details, as well as other contact information such as email addresses and telephone numbers. We also collect information about the services you use on our website, any purchases or financial transactions you make and any marketing preferences you give.
We maintain a record of communications that we send to you and will also log any communications that you send to us. In some limited cases we may collect some publicly available information about you, including company directorships, and your interests. If you attend an EDA event it is possible that your photograph may be taken. If you call our supporter care team, your call may be recorded for quality and training purposes however we do not record calls to our Helplines.
If you have made a donation to EDA and kindly agreed to Gift Aid that donation we must record the fact that you are a UK tax payer and we have to maintain a record of the amount of Gift Aid we have collected.
Sensitive personal information
Under data protection law, certain categories of personal information are recognised as sensitive, including health information, race, religious beliefs, and political opinions (‘sensitive personal data’). In limited cases, we may collect sensitive personal data about you.
We would only collect sensitive personal data if there is a clear reason for doing so, as outlined earlier in this policy, such as where we need this information to ensure that we provide appropriate facilities or enable you to participate in an athletic event (such as a marathon, where we would need prior knowledge of any relevant medical conditions).
We will only use sensitive information provided to us for the purpose it is provided.
Credit and debit card information
If you use your credit or debit card to donate to us, or buy one of our resources online, your card details will be taken securely by our payment-processing partner as part of the payment process. We do this in accordance with the Payment Card Industry Security Standard and EDA does not take or store the details of your card in our office, on our website or databases.
Data retention
EDA removes personal data from our systems in line with our data retention policy. The length of time each category of data will be retained will vary on how long we need to process it, the reason it is collected, and in line with any statutory requirements.
After this point the data will either be deleted or rendered anonymous. In certain specific situations, for example where a supporter has kindly pledged a legacy to EDA in their will, we will maintain their details up to the time when we need to carry out the legacy administration and communicate effectively with their family.
Data Sharing
As mentioned above, EDA will never sell your personal information and will never share it with another organisation for their own marketing purposes. However, there are a number of legitimate situations where we may share your information with third parties whom we have contracted to fulfil specific services for us.
This will include organisations such as mail fulfilment houses and email broadcasters who will send out our marketing materials on our behalf. In all of these situations we ensure that we always have a written contractual agreement in place that will ensure that those organisations can only use the data provided for the specific purposes we direct them to do, and that they have in place strict security requirements in order to protect your personal information.
Your data protection rights
Where EDA is using your personal information on the basis of your consent, you have the right to withdraw that consent at any time. You also have the right to ask EDA to stop using your personal information for direct marketing purposes. Simply contact our supporter care team on 08500 1 22 555 Option 3 or by email to mail@eatingdisordersadvice.co.uk and they will amend your contact preferences. The law also gives you a number of other rights in relation to your personal data:
Right to be Informed: You have the right to be told how your personal information will be used. This policy document, and shorter summary statements used on our communications, are intended to be a clear and transparent description of how your data may be used.
Right of Access: You can write to the Data Protection Officer asking what information we hold on you and to request a copy of that information. Currently the Data Protection Act 1998 gives us 40 days to respond. From May 2018 we will have 30 days to comply once we are satisfied you have rights to see the requested records and we have successfully confirmed your identity.
Right of erasure: From May 2018, you have the right to be forgotten (i.e. to have your personally identifiable data deleted). In many cases we would recommend that we suppress you from future communications, rather than data deletion.
Right of rectification: If you believe our records are inaccurate you have the right to ask for those records concerning you to be updated.
Right to restrict processing: In certain situations, you have the right to ask for processing of your personal data to be restricted because there is some disagreement about its accuracy or legitimate usage.
Right to data portability: Where we are processing your personal data under your consent the law allows you to request data portability from one service provider to another. This right is largely seen as a way for people to transfer their personal data from one service provider to a competitor and is unlikely to be relevant to your relationship with EDA.
Right to object: You have an absolute right to stop the processing of your personal data for direct marketing purposes.
Right to object to automated decisions: In a situation where a data controller is using your personal data in a computerised model or algorithm to make decisions 'that have a legal effect on you', you have the right to object. This right is more applicable to mortgage or finance situations. EDA does not undertake complex computerised decision making that produces legal effects.
Cookies
A cookie is an alphanumeric text file that is sent from a website and stored on your computer's hard drive by your web browser. Cookies are essential for some websites to operate effectively but also to make your visit to a website a better experience, for example, by remembering who you are, so that when you visit again, it recognises you as a previous visitor.
Managing cookies
EDA use anonymous analytic cookies to track visits to our site and routes around areas of our site. As with other statistics about visitors to our site, this tracking is anonymous and aggregate and does not relate to any information we might hold about individuals.
Links to Third Party websites
This Privacy Policy applies solely to the personal data collected by EDA and does not apply to Third Party websites. EDA is not responsible for the privacy policies of Third Party websites. EDA advises users to read the privacy policies of other websites before registering any personal data.
Third party cookies
EDA uses websites such as YouTube to show films. Pages from these providers may use cookies. As some of these services are based outside the UK and the European Union, they may fall outside the jurisdiction of EU and UK laws.
If you are concerned about this, you can visit the Information Commissioner's website for more information, or change the cookies settings on your browser. EDA also maintains a presence on social media channels including Facebook and Twitter.
If you share content from one of EDA websites, a cookie may be used by the service you have chosen to use to share that content. EDA does not control these cookies. You should check the relevant third party main website for more information.
Changes to EDA privacy statement
From time to time, we will make changes to this statement to keep it up to date and relevant. Please make sure you check regularly to see what's changed. This statement was last updated on 9th May 2018.