We are Midland Mencap a leading charity for people with a learning disability in the Midlands.

Within the context of this privacy policy, ‘we’, ‘us’, ‘our’ or ‘Midland Mencap’ refers to Midland Mencap. So whenever you see these words, we are talking about this organisation.

We collect personally identifiable information in order to provide services to you or to manage our relationship with you.  So when you use our services or website you are agreeing for us to store and process your personal data.

You have the right to be informed about the collection and use of your personal information.

When we collect personal information from you, we will provide you with privacy information at the time we obtain your information.

When we obtain your personal information from a source other than you, we will provide you with privacy information:

• within a reasonable period of us obtaining the personal information and no later than one month
• if the information is used to communicate with you, at the latest, when the first communication takes place; or
• if disclosure to someone else is envisaged, at the latest, when the data is disclosed.

There are 2 main ways in which we collect personal information about you: directly or indirectly, including the use of third parties.

When you give your personal information to us directly:

You may give us your information in order to tell us your story, register on our website, request a service from us, fundraise on our behalf, sign up to a campaign or event, add Gift Aid to your donation, make a donation, or communicate with us.

When you give your personal information to us indirectly:

Your information may be shared with us by independent event organisers, for example the fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so when you have indicated that you wish to support Midland Mencap and with your consent. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.

When you give permission to other organisations to share or it is available publicly:

We may combine information you provide to us with information available from external sources in order to gain a better understanding of our supporters to improve our fundraising methods, products and services.

The information we get from other organisations may depend on your privacy settings or the responses you give, so you should regularly check them.

Personal information means any information that may be used to identify you, such as your name, title, telephone number, email address, or mailing address.

We may process your personal information for our legitimate business needs in line with the General Data Protection Regulations (GDPR). We collect your personal information because we need it to help us fulfil your requests, keep in touch with you, and offer you communications that are relevant to you.

This includes things like:

• where processing enables us to enhance, modify, personalise or otherwise improve our services/communications for the benefit of our supporters
• to better understand how people interact with our website
• to provide postal communications which we think will be of interest to you
• to determine the effectiveness of promotional campaigns and advertising
• providing any information or services you have requested
• activating your registration on Mindbody (if you choose to join) – our online booking system for Children and Young Person services
• processing financial transactions such as donations, or paying for a service. This includes processing gift aid with HMRC if relevant
• keeping a record of any communications between us and you, for example emails and phone calls
• keeping a record of other interactions too, such as requests for leaflets or attending an event
• managing and improving how we communicate with you – how you prefer to be contacted, and what information you want to receive. We might contact you about our campaigns, events, appeals, volunteering, news, information and advice, and games, as well as other ways you can support Midland Mencap
• researching the interests, behaviours, demographics (for example, age, sex, income), and trends of the people who are using our information, and range of services, both support and non-support related. We may ask if you wish to take part in more research, such as surveys or focus groups, but this will be voluntary (your choice)
• creating a profile of what we think might interest you, so that we can offer you relevant communications. We may use your previous activities or interactions with us to try and predict how you may respond to different activities
• responding to complaints or queries and look into any legal claims.

You can find out more about what we mean by legitimate interests, and when we process your data for our legitimate interests in the What we mean by “legitimate interests” section below.

Whenever we process data for these purposes we will ensure that we always keep your personal information rights in high regard and take account of these rights. You have the right to object to this processing if you wish, and if you wish to do so please see the section(s) below on updating your preferences or unsubscribing.

Please bear in mind that if you object this may affect our ability to carry out the tasks above for your benefit.

Sensitive personal information
Sometimes, we may ask you for more sensitive information, such as your personal connection to learning disability or your health condition if you are taking part in a sporting event. We will only collect this information with your permission and we will always take extra care of it.

We are committed to protecting the privacy of children and young people that engage with us, whether through our website, at events, through a project facilitated by Midland Mencap, where we provide a care, support or youth service or where we provide information and advice.

We collect and store personal information about children and young people where we are contracted to provide a care and support service to them. We are required to process this personal information in order to fulfil the requirements of the care and support contract and to meet our regulatory obligations.

Where we are providing an information and advice service to children and young people, we will only process their personal information if we have written parental consent and if we need the data in order to provide a service to them.

If you want to participate in an event organised by Midland Mencap, or a project facilitated by us, consent must be provided by the parent, guardian or carer if you are under the age of 16.

We ensure that there are appropriate technical controls in place to keep your personal information safe and prevent unauthorised access to it. For example, our online forms are always encrypted (this prevents other people from accessing them) and our network is protected and checked often.

Any payments we take by card are processed according to the Payment Card Industry Data Security Standards (PCI DSS).

Electronic data and databases are stored on secure computer systems and we control with who has access to them. Our staff receive data protection training and we have data protection policies and procedures in place which teams are required to adhere to.

We regularly review who has access to information that we hold to ensure it is only accessible by trained staff, volunteers and contractors.

Where we use external companies to collect or process personal data on our behalf, we undertake comprehensive checks on these companies before we work with them, and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they have collected or have access to.

We will not sell or rent your personal information to third parties for the purposes of marketing, and we will not share your personal information for others to use in their marketing or fundraising activities.

We may share your personal information with other companies (e.g. subcontractors, suppliers) who provide services on our behalf, including, sending emails and analysing data. We will only provide those companies with the information they need to deliver the relevant service, and we will make sure that your data is treated with the same level of care as if we were handling it directly. These activities will be carried out under a contract which imposes strict requirements on our suppliers to keep your information confidential and secure.

We undertake comprehensive checks on these companies before we work with them and then work closely with them for the duration of our working relationship.

We may need to disclose your personal information if required to the police, regulatory bodies or legal advisors.

We will only retain your personal information for as long as it is required in relation to the purposes for which it was originally obtained.

How long personal information will be retained for depends on the type of information it is and what it is being used for. For example, if you ask us not to send you marketing emails, we will stop storing your emails for marketing purposes (although we will keep a record of your preference not to be emailed).

We will retain personal information in accordance with the time periods stipulated in our data retention policy. We will review our data retention periods for personal information on a regular basis.

We continually review the information that we hold, and delete anything that is no longer required. We never store payment card information.

You have a right to obtain confirmation that your personal information is being processed. You also have the right to request a copy of the personal information that we hold about you.

When you are requesting a copy of the personal information that we hold about you, we will endeavour to provide you with the information you have requested without delay and in any event within one month of receiving your request.

We will not charge a fee for complying with a request unless the request is deemed to be manifestly unfounded or excessive.

Legitimate interests means the interest of Midland Mencap in the way we carry out our work to enable us to give you the best service/products and the best and most secure experience.

For example, we have an interest in making sure that any marketing we send to you is relevant, so we may process your information to send you marketing that is of interest to you.

When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you and your rights under data protection laws. We will always ensure that your personal data will not be used where our interests are overridden by the impact on you, unless we have your consent or are required by law.

If your personal details change, please help us to keep this information up to date by getting in touch and telling us:

Data Protection Officer
Pinewood
Bell Heath Way
Woodgate Business Park
Birmingham
B32 3BZ

If you want to stop receiving emails, click the ‘unsubscribe’ link at the bottom of any of our emails. We would rather you didn’t miss out, but we respect that this is your decision!

If you post or send any content that we believe to be inappropriate or content in breach of any laws, such as defamatory content, we may use your personal information to inform relevant third parties such as your internet provider or law enforcement agencies.

This privacy policy was last updated in May 2018.

We reserve the right to make changes to this Privacy Policy. Each time you visit this site, you should check this Privacy Policy to check that no changes have been made to any sections that are important to you. The latest version of our Privacy Policy will always be available on our website.

It there are any major changes to our Privacy Policy, we will add a notice on our website or contact you by email (where appropriate).