Privacy Policy

Participating in Customer Surveys / Voting

We collect information volunteered by our customers using an online survey tool hosted by Survey Monkey. This company is a data processor for Charity Bank and only processes personal information in line with our instructions. We will only use the information provided for the purposes specified in the survey, usually to help us to monitor, review, report on and improve our customer service. Whenever we share the results of the survey with our investors or members of the public, we will use the information only in ways that will not identify any individual.

For more information, please see Survey Monkey’s privacy policy. Whilst the services are provided to Charity Bank by Survey Monkey Europe, the parent company is based in the US. This parent company is registered with the EU-US Privacy Shield Framework, which means that it has committed to manage personal data to an equivalent standard as is required of companies based in the EU. You can find out more about the framework and how it protects the fundamental rights of anyone in the EU whose personal data is transferred to the United States here.

Providing Case-Studies/taking part in interviews

From time to time we will engage freelance writers to produce content for our website, particularly within the News section. These individuals may carry out face-to-face or telephone interviews with specific Charity Bank contacts (including customers, employees and individuals employed by businesses working with Charity Bank) for the purposes of creating content for the website. We will always seek your consent before we arrange for an interview to take place and there is no obligation to accept our invitation. Once you have agreed to take part in an interview, we may share your contact details with the relevant freelance writer for the sole purpose of contacting you to arrange and carry out the interview.

Attending our Events

From time to time, Charity Bank (‘we’, ‘our’) will host networking or learning and development events for our customers, contacts and staff members. Sometimes these take the form of webinars and sometimes we host live (or ‘face-to-face’) events, where Bank staff and/or customers and/or other stakeholders can meet and celebrate achievements, share experiences or just catch-up with old friends!

What personal information does Charity Bank collect and process, when attending an Event?

There are three separate aspects to this – preparation for the event, attendance at the event, and any associated post-event tasks:

a. Preparing for the Event:

If you register (or are invited) to attend one of our events, we will share relevant information about you with our business partners to help ensure that the event runs smoothly. The information shared will usually be limited to your name, job title and your organisation’s name (where relevant), together with any specific information you have provided to us in relation to your attendance at the event (such as access or dietary requirements) and will be provided for the sole purpose of facilitating the event (unless you choose to opt-in to receiving future marketing from Charity Bank where appropriate information (name, e-mail, organisation/job title (if relevant)) for this purpose will be maintained). However, we will let you know beforehand if the information that we need is different to – or more than – this.

b. Attending the Event and any post-Event tasks

We may seek to gather, process and store data in the form of photographic images, video footage, audio recordings and perhaps verbal quotes – and we will refer to this, going forward, as ‘event content’ – as well as the categories of data, as above.

What lawful basis (or bases) would apply to this processing?

Data protection legislation allows six lawful bases for data processing – and the information gathered above will usually be shared on the grounds of legitimate interests. However, where we think that any information collected may contain sensitive data (such as access or dietary requirements) then we will consider that your consent has been provided, for the specific event only, to gather and share that information with appropriate entities (such as the venue/catering suppliers etc) by the nature of supplying us with this data.

We will also seek consent, in advance of an event, if we share your contact details with any of our business partners, or if we collate or use any ‘event content’ taken in our promotional materials (see below).

We do not sell or share your information with any other third parties.

What happens at an Event?

We may engage an appropriate professional to take ‘event content’ at an event, or this may be undertaken by a designated Charity Bank staff member (usually a member of the Marketing team), for us to use in subsequent promotional material. If we are going to do this, we will let you know within our invitation and/or as part of the event sign up process how you can opt out of event content either in advance or by speaking to one of the Charity Bank team when arriving at the event.

We will keep a note of your decision for our own records and will then proceed as follows:

• Event content related to a large group, e.g. a photograph of the room with all delegates seated – we will give delegates the option to avoid their photograph being used;
• If we want to feature individuals, e.g. speakers, we may seek approval via a consent form ahead of the event. Alternatively, or additionally, we may seek to gain consent via a consent form on the day.

If feasible and appropriate, delegates who do not wish to be captured in event content will be given a sticker and shown to an area of the venue which we have marked out as a non-filming zone.

If you decide that you are content to participate/be included (in ‘event content’), you agree that we may use your image, any associated audio recordings and any verbal quotes/comments in our promotional material (including within direct marketing campaigns, on our website, in promotional literature and on our social media channels) for a period of up to five years from the date of the event and that we may store and use ‘event content’ in line with data protection legislative requirements (applying as at the date of the event). We may also share event materials with appropriate media outlets/select third parties.

Deleting data that we have collated, processed and/or stored

It is important for you to know that we cannot – nor want to – keep personal data for any longer than is required. So, we have a ‘Data Retention Policy’, to which we adhere – though we should point out that the right of erasure is not absolute, but we will try to accommodate as much as we can (subject to, for example, regulatory, legal or contractual obligations).

For any data that is not used post-event (such as that relating to ‘Preparing for the Event’), we will delete any such data within 90 days of the event.

Where consent is – or is not – involved:

• For any situations whereby consent is not granted for future use of ‘event content’, again, we will delete any such data within 90 days of the event. The only personal data we will retain is your name, a reference number and the confirmation that you did not provide consent for use – and this will be stored in a centralised, encrypted (or password-protected) file, with limited access to it. This action aims to protect us both and is primarily retained for compliance and auditing purposes.

• For any situations whereby consent is granted for future use of ‘event content’, you agree that we may:
  • use your ‘event content’ (e.g. imagery and any associated audio recordings) in our promotional material (including within direct marketing campaigns, on our website, in promotional literature and on our social media channels) for a period of up to five years from the date of the event;
  • store and use ‘event content’ in line with data protection legislative requirements (applying as at the date of the event) – deleting it securely, in line with our ‘Data Retention Policy’.

• That said, if consent is granted for future use of ‘event content’:
  • You may revoke that consent at any time, without incurring any fees or charges, by letting us know in writing. We will then confirm how this can be actioned and when.
  • We will let you know if, and when, any personal data that has been collated, used and stored can be deleted.

Does Charity Bank engage any third-parties to process data?

To help facilitate events, we would usually use third-party service providers such as Eventbrite and SurveyMonkey and other Professional Services – appropriate due diligence and risk assessments will be undertaken on any such entities.

1. Eventbrite

• We use the services of Eventbrite to send electronic invitations and manage attendance lists for many of our events. Attendees’ contact details are input into the Eventbrite platform in order to send out invitations and to track responses.
• Eventbrite, Inc is a U.S. company and has an active registration under the EU-US Privacy Shield Framework. We are comfortable that, having implemented appropriate controls, any risks to processing an individual’s personal data have been minimised.
• You can find out more about the Privacy Shield framework by clicking on this link.

2. SurveyMonkey

• We may occasionally use the services of SurveyMonkey to gauge attendee satisfaction, post-event, and to help us enhance future events. Typically, we aim to keep personal data to a minimum using this service – so this is usually full name, possibly email address, event attended (and date) and IP address.
• SurveyMonkey (now part of Momentive), Inc is a U.S. company and has an active registration under the EU-US Privacy Shield Framework. We are comfortable that, having implemented appropriate controls, any risks to processing an individual’s personal data have been minimised.
• SurveyMonkey data deletion will take place within 180 days of the closure of the relevant survey.
• You can find out more about the Privacy Shield framework by clicking on this link.

3. Any Other Professional Services

• We undertake due diligence on all professionals providing services to us, to ensure that any risks are minimised (or acceptable) and have signed Contractual Agreements in place which address the requirements of confidentiality, privacy and safeguards applying to any data processed by them.
• Our Contractual Agreements typically ask for personal data to be returned to us – or securely deleted – promptly, by the professional service firm/individual, upon the conclusion of the contract.

Contacting us via social media

If you send us a private or direct message via social media, this will remain on the relevant platform in accordance with the terms and conditions of that platform.

Applying for an account:

Applying for a Savings Account with us

You are now able to apply for certain personal and business savings accounts through our online platform. This is provided under licence from Sandstone Technology (Europe) Limited (a company incorporated in England & Wales which is a wholly owned subsidiary of Sandstone Technology Pty Ltd, an Australian company). Even though the parent company is based in Australia, as it may be involved in the processing of data of our customers who are EU citizens, it is legally obliged to comply with the requirements of the GDPR. You can view the parent company’s privacy policy here: Privacy Policy of Sandstone Technology Pty Ltd. Our contract is with Sandstone Technology (Europe) Limited and we would not expect this company to routinely access your personal data. We have ensured, through our contractual terms with Sandstone Technology (Europe) Limited that on the rare occasion where we are required to share personal data in order for the company to provide us with effective support services, the processing is only carried out in the UK on Charity Bank premises using Charity Bank systems under the supervision of Charity Bank staff.

If you use our online savings application process, you should be aware that we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor-behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information (other than through your IP address which we cannot link to you individually) our website, we will tell you this. We will make it clear when we collect personal information and will explain what we intend to do with it. In this case, the lawful basis for processing of this information is “legitimate interests”.

Other applications can be made by completing a paper form and posting it to us. We process the data received from the online platform and from the paper applications in the same way.

We have contracted with Flagstone Investment Management Limited (Flagstone) for the purposes of raising new deposits. If you opened a Charity Bank account through the Flagstone platform then your personal data will be processed by Flagstone for the purposes of “know your customer” requirements. We will open a savings account in the name of Flagstone and will take instructions from Flagstone in relation to your account. We will have access to the information Flagstone holds, including your personal data, for audit and compliance purposes only. We will process only the minimum amount of your personal data required to operate the account and meet regulatory requirements. Please contact Flagstone directly if you have any privacy concerns or queries about how your personal data is handled by them. The privacy policy is available here.

Initial credit checks for all new personal savers and for trustees/directors/senior managers at new business savers, are undertaken by TransUnion (the trading name of CallCredit) (a company incorporated in England & Wales which is a wholly owned subsidiary of the company CallCredit Information Group Ltd, also incorporated in England & Wales). The purpose of the contract with TransUnion is to help Charity Bank to identify and prevent the risk of fraud by (i) verifying an individual’s identity and (ii) checking the validity of sort-codes, account numbers and credit/debit card numbers. The contract requires both parties to adhere to the requirements of the DPA and has recently been amended to incorporate all the relevant GDPR requirements. The service to which we subscribe is described more fully in this web-page: TransUnion. The Privacy Policy published by the parent company, CallCredit Information Group Limited, can be found here: TransUnion General Privacy Notice. Whilst these initial checks are, for the most part, automated, we will never make a credit decision based solely on information provided by an automated service. We supplement these initial credit checks with further manual processes.

Small Steps – existing accounts only

As with many banks, we offer a savings account for those under the age of 16. We are not accepting new applications for this account.

Our contractual relationship is with the adult who opens and runs this account on behalf of the child. The account is in the name of the child and the money in the account belongs to the child. The adult will open, run and close the account on the child’s behalf and must manage the account in the child’s best interests. The adult must be aged 18 or over and otherwise meet our requirements for opening this type of account. A child may only have one account with Charity Bank. Once the child reaches the age of 16, in the absence of alternative instructions from the adult managing the account, we will transfer the balance on the account to a standard 33-day notice savings account.

We will only process the personal data of a child to the extent that it is strictly necessary for us to run their account. This will typically be limited to the child’s name and date of birth since all correspondence will be sent to the adult’s address.

As a matter of policy, we do not send direct marketing material to those under the age of 18.

Applying for a Charity Bank Loan

We provide loans to charities, charitable organisations, social enterprises and private companies limited by shares with worthwhile social impacts. We will process the personal data of trustees/directors/senior managers only to the extent necessary to make a decision on whether or not to lend to the organisation, to monitor its continuing credit quality or to decide on our actions if the borrower suffers financial stress, and to provide the primary contact with our e-newsletter.

We may, with the prior permission of the relevant individual within a borrower or potential borrower’s organisation, share that individual’s contact details and job titles with third parties such as solicitors, valuers and surveyors, but this will be for the sole purpose of contacting that individual so that they can provide services to the organisation directly. Once initial contact has been made with the relevant individual, those service providers will become responsible for their own processing of the personal data of those nominated contacts.

Receiving information about Charity Bank

Any information which we send to an individual by email or post or which we provide to them over the telephone, which promotes our organisation or its products and/or services to that individual with the specific intention of securing (further) business from them falls within the definition of “direct marketing” as set the ICO. We never make automated calls or send “direct marketing” material by fax.

We may send Direct Marketing material to an individual without them requesting this (unsolicited) or we may send “direct marketing” material to an individual in response to a request (solicited) or because it relates to a product or service which is similar to one which the individual already has (related). The rules for these three types of marketing are different.

Before we send out unsolicited “direct marketing” by post, we will check that you have not registered with a preference service or previously asked us not to send you this type of information by post. If we do send you unsolicited “direct marketing” by post, we will let you know how we obtained your contact details and we will let you know how to stop receiving similar information from us in the future.

In keeping with data protection laws and legitimate interest communications, we include an “unsubscribe” option in every email communication we send to you which does not directly relate to your account or business relationship with us.

If you have asked us to send you more information about our organisation, products and services we will do so and may send this to you by email, post or by telephone, whichever we deem to be the most appropriate method (unless you have clearly stated that you do not wish to be contacted in a particular way).

On occasions, we may write to you (by post or email) or phone you about a product or service which we think may be of interest to you and which is similar to one you currently have or have had in the past. For example, if you have a 1-year savings account with us which is due to reach maturity, we will contact you to find out what you would like to do and this may include providing you with information about another savings account into which you may wish to transfer your funds upon maturity. We do not need your specific consent to send you that information, as it is not unreasonable for us to expect that you would want to receive that information at that point in time and we already have your contact details.

At times, we will follow-up postal marketing campaigns with a phone-call. Again, we will have carried out checks to ensure that you have not registered with a preference service or requested that we do not contact you in this way for marketing purposes. We will also check whether or not you are content to receive similar calls in the future. We will monitor the number of calls we make to ensure that we do not contact you too frequently.

Where we send information to an individual in their capacity as an employee in a particular role at a particular organisation, we are sending that information to the organisation, not the individual. We know that in charities and social enterprises (as opposed to sole traders), decisions are not usually made by one person. For this reason, the rules relating to “business to business direct marketing” are slightly different. If we think that your employing organisation may be interested in receiving information about our organisation and its products and services, we will write to you with relevant details, but we will let you know how we found your contact details and we will give you the opportunity to decline to receive information about us in the future. We will not, however, contact you with direct marketing about our personal savings accounts, as that would be marketing to you outside your role as a contact for your organisation.

We do not classify invitations to our Annual Impact Awards as “direct marketing” as this event is primarily an opportunity for company personnel, savers, borrowers and other business contacts to meet together to celebrate the way in which Charity Bank uses savers’ money to support charities and social enterprises and to acknowledge the great work that some of our borrowers are achieving. For this reason, we will send invitations to our personnel, current and past customers and current business contacts as a matter of course. We may send invitations by email or by post, as we deem most appropriate, although we will take into account any clearly stated preferences and will usually send invitations by post to individuals who have unsubscribed from our e-newsletter.

Invitations to other events may, on occasions, be considered direct marketing but, again, only if there is a clear intention to secure (further) business from a named individual. We will usually promote these via our website or social media, rather than inviting an individual specifically. If you do receive an invitation from us, this will usually be in response to a request from you for more information about our organisation, products or services, although we may have identified you from our own research as someone who would be interested in receiving an invitation.

Submitting a Data Protection query

To make a request to Charity Bank for any personal information we may hold, you need to put the request in writing addressing it to our Data Protection Lead at Fosse House, 182 High Street, Tonbridge, Kent, TN9 1BE. Other queries can be sent by email to [email protected].

When you submit a data protection query we will deal with this as quickly as we can and, where applicable, within any relevant statutory timeframes. Please provide as much detail in your request as possible. Please also read this Privacy Notice in full before submitting your query as you may find that the response you are seeking is contained in this document.

Charity Bank tries to be as open as it can be in terms of giving people access to their personal information. Individuals can find out if we hold any personal information by making an “access request”. Please provide evidence of your identity with your request, so that we can make sure that we are responding to the individual about whom the personal data relates.

If we do hold information about you, and we are able to verify your identity, we will:

• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.

If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

If we do hold information about you, you can also ask us to correct any mistakes by contacting our Data Protection Lead.

Making a complaint

Charity Bank tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

If you want to make a complaint about the way we have processed your personal information, you can contact the Data Protection Lead at the address given above. Please provide as much detail as possible to help us to review your concerns.

When you submit a data protection complaint we will deal with this as quickly as we can and, in any event, within relevant statutory timeframes. Please remember that we will be able to respond more quickly if you provide evidence of identity with your query as we cannot provide our response until we are sure we are releasing it to the right person.

When we receive a complaint from a person, we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We do compile and share statistics showing information like the number of complaints we receive with our regulators, but not in a form which identifies anyone.

We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. But it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for a maximum of six years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

Similarly, where enquiries are submitted to us, we will only use the information supplied to us to deal with the enquiry and any subsequent issues and to check on the level of service we provide.

Right to complain to the Information Commissioner’s Office

If have a concern about the way in which we are Processing your Personal Data and we have not been able to resolve that concern directly with you, you may complain to the Information Commissioner’s Office (ICO). You may call the helpline on 0303 123 1113. Further details about how to submit a report to the ICO can be found here.

Formats

If you would like to receive a copy of this Privacy Notice in a more accessible format, for example, in Braille or large-print or audio format, please contact [email protected].