JANUARY 2024
INTRODUCTION
1.1
Challenging MND (CMND) Trustees are committed to protecting the personal information and respecting the privacy of ambassadors, donors, grant applicants and the respective Trustees of the charity.
1.2
This Privacy Notice, together with any other documents referred to in it, sets out the basis on which any personal data will be processed.
1.3
Challenging MND was established as a CIO on 22 March 2019 and amended 22 March 2022. For the purpose of the General Data Protection Regulation (Regulation (EU) 2016/679), the Data Controller is Challenging MND (charity number 1182607), whose registered office is Unit L Radford Business Centre, Radford Way, Billericay, Essex CM12 0BZ.
1.4
This privacy notice may be update from time to time. Please check back regularly to see any updates or changes to this Policy.
DATA PROTECTION TEAM
2.1
The contact details for our Data Protection Team are as follows:
Email: info@challengingmnd.org
Phone: 07702 118749
Address: Unit L Radford Business Centre, Radford Way, Billericay, Essex CM12 0BZ.
2.2
It is the responsibility of the Data Protection Team to monitor compliance with data protection legislation, and to be the first point of contact for supervisory authorities and for individuals whose personal data is being processed.
PARTICULARS OF PROCESSING
3.1
The Particulars of Processing for the respective Challenging MND Trustees, ambassadors, donors and grant applications are set out in the Schedules to this Privacy Notice.
3.2
It may be the case that you have contact in more than one capacity, so please read this notice and then look at the relevant schedule that may apply to you if you wish to know more about how your personal data is processed including the purposes and legal basis. The specific Schedules are as follows:
- Schedule 1 – CMND Trustees
- Schedule 2 – CMND ambassadors
- Schedule 3 – Donors to CMND
- Schedule 4 – CMND Grant Applicants
3.3
Note – we will use personal data sometimes for statistical purposes but retain anonymity so you cannot be identified.
YOUR RIGHTS AS A DATA SUBJECT
4.1
The section sets out the rights of a data subject, as set out on the General Data Protection Regulation. Under certain circumstances by law, you have rights of access, correction, erasure and restriction.
Request access to personal information (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal information held about you and to check that it is being lawfully processed.
Request correction of the personal information. This enables you to have any incomplete or inaccurate information corrected.
Request erasure of your personal information. To request deletion or removal of personal information where there is not good reason to continue to process the data.
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object to the processing of your personal information for direct marketing purposes.
Request the restriction of processing of your personal information. This enables you to ask that the processing of personal information be suspended, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Data Protection Team in writing using the details in section 2.
4.2
Challenging MND will generally process personal data for contractual necessity, legal obligation or its legitimate interests. The charity will use personal information for additional relevant purposes you might reasonably expect, and where the benefits of doing so are not outweighed by your own interests or freedoms. The law calls this the ‘Legitimate Interests’ condition for processing. Where we rely on it the benefits being pursued are:
- Complying with/supporting compliance with legal and regulatory requirements
- Internal training purposes
- To maintain records and other administrative purposes, including updating details and preferences
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
4.3
Where processing of personal data is based on consent, there is a right as a data subject to withdraw that consent at any time. If you wish to invoke this right, please notify our Data Protection Team in writing using the details in section 2.
4.4
You have the right to lodge a complaint with a supervisory authority, In the United Kingdom, the supervisory authority is the Office of the Information Commissioner, full contact details of which can be found at https://ico.org.uk/global/contact-us/
CONTACT DETAILS
You can contact the Data Protection Team on the details in section 2 if you have any questions or concerns about personal data and privacy matters.
SCHEDULE 1 – CMND TRUSTEES
This schedule sets out the processing of personal data relating to CMND Trustees.
What personal data do we process?
- Name
- Address
- Email address
- Telephone number
- Date of birth
Where do we obtain your personal data from?
Personal data is received directly from the Trustee.
The provision of personal data is a necessary requirement for the Trustees to fulfil the role of a Trustee of the charity.
Trustees are under a statutory obligation to provide personal data in order for the charity to comply with statutory and regulatory requirements.
Why do we process your personal data and what is the lawful basis?
We process your data for the following purposes:
| PERSONAL DATA TYPE | PURPOSE |
| Administration of the charity and communications regarding trusteeship | Contractual necessity |
| The performance of requirements upon Trustees under the Trust Deed and statutory obligations as required by the Charity Commission | Legal obligation |
How long do we hold your personal data for?
Personal data is held for the duration of trusteeship of the Challenging MND
Recipients of personal data
- The Charity Commission: Personal data is also disclosed to the Charity Commission in accordance with statutory requirements.
Do we use your personal data for decision-making?
No automated decision-making is taken using personal data.
Any financial data arising from a transactional process will be held securely in accordance and compliance with all statutory, HMRC and Financial Authority requirements by Challenging MND.
SCHEDULE 2 – CMND AMBASSADORS
This schedule sets out the processing of personal data relating to CMND Ambassadors.
What personal data do we process?
- Name
- Address
- Email address
- Telephone number
Where do we obtain your personal data from?
Personal data is received directly from the Ambassador.
The provision of personal data is a necessary requirement for the charity to facilitate the work of its Ambassadors. Ambassadors are not obliged to provide personal data. However, if personal data is not provided, the charity will be unable to facilitate Ambassadors’ roles, as we will be unable to meet statutory requirement to record this data.
Why do we process your personal data and what is the lawful basis?
We process your data for the following purposes:
| PERSONAL DATA TYPE | PURPOSE |
| Administration of the charity and communications regarding ambassadorship | Contractual necessity |
| The performance of requirements under the Trust Deed and statutory obligations as required by the Charity Commission | Legal & statutory necessity |
How long do we hold your personal data for?
Personal data is held for the duration of ambassadorship of the charity
Recipients of personal data
- The Charity Commission: Personal data is also disclosed to the Charity Commission in accordance with statutory requirements.
Do we use your personal data for decision-making?
No automated decision-making is taken using personal data.
Any financial data arising from a transactional process will be held securely in accordance and compliance with all statutory, HMRC and Financial Authority requirements by Challenging MND.
SCHEDULE 3 – DONORS TO CMND
This schedule sets out the processing of personal data relating to donors to CMND.
What personal data do we process?
- Name
- Address
- Email address
- Telephone number
- Financial information relating to donations
Where do we obtain your personal data from?
Personal data is received directly from donors.
The provision of personal data is a necessary requirement for the charity to administer its contacts with donors and facilitate donations. The charity is obliged to meet statutory requirements in recording donations.
Why do we process your personal data and what is the lawful basis?
We process your data for the following purposes:
| PERSONAL DATA TYPE | PURPOSE |
| To facilitate donations to the charity and transactional communications | Legitimate interests |
| To comply with statutory obligations and Charity Commission requirements to record donors to the charity. | Legal obligation |
| Publication of the names of recent donors, on the CMND website or in other CMND publications as agreed with the donor. | Legitimate interests |
How long do we hold your personal data for?
Personal data is held for the duration of seven years in accordance with statutory and regulatory requirements.
Do we use your personal data for decision-making?
No automated decision-making is taken using personal data.
Any financial data arising from a transactional process will be held securely in accordance and compliance with all statutory, HMRC and Financial Authority requirements by Challenging MND.
SCHEDULE 4 – KCCT GRANT APPLICANTS
This schedule sets out the processing of personal data relating to CMND grant applicants.
What personal data do we process?
- Name
- Address
- Email address
- Telephone number
Where do we obtain your personal data from?
Personal data is received directly from the grant applicant.
The provision of personal data is a necessary requirement for the charity to administer grant applications received. Grant Applicants are not obliged to provide personal data. However, if personal data is not provided, the charity will be unable to provide the funding services, as we will be unable to meet statutory requirement to record this data.
Why do we process your personal data and what is the lawful basis?
We process your data for the following purposes:
| PERSONAL DATA TYPE | PURPOSE |
| Administration and transactional communications relating to grants. | Contractual necessity |
| The provision of funding services and facilitating grants from the CMND. | Contractual necessity |
| To comply with statutory obligations and Charity Commission requirements. | Legal & statutory necessity |
How long do we hold your personal data for?
Personal data is held for the duration of seven years in accordance with statutory and regulatory requirements.
Do we use your personal data for decision-making?
No automated decision-making is taken using personal data.
Any financial data arising from a transactional process will be held securely in accordance and compliance with all statutory, HMRC and Financial Authority requirements by Challenging MND.