We are currently updating our website. Please contact us if you find any broken links and we will be happy to help.
Juvenile Arthritis Research is a charity funded by donations. We are committed to maintaining your trust and confidence in us. We do all we can to protect your privacy and make sure the personal data you provide us with is kept safe.
This privacy notice explains how we collect, use, store and share your personal data, and your rights in relation to that data. For any queries relating to this policy or how we use your data, please contact us via www.jarproject.org/contact-us or at our registered address below.
We collect personal data for the following reasons:
To provide services and goods, including delivery.
To receive donations or funding and organise fundraising activities, and to support you with your fundraising.
To provide you with service updates or marketing information.
To undertake research (including through the JIA VIP Research Panel).
To comply with our legal obligations.
To undertake recruitment of staff, volunteers and trustees.
To deal with queries and complaints.
To create case studies and stories, including media and press releases (helping raise awareness of Juvenile Idiopathic Arthritis and Juvenile Arthritis Research).
We collect and process the following categories of personal data:
Identity and contact information: name, address, email address, telephone number, date of birth, gender, and next of kin details;
Financial information: donation history, payment details, Gift Aid declarations, taxpayer information, National Insurance numbers, and tax codes;
Health information: medical conditions, allergies, medical history, dietary requirements, disability information, and care needs;
Photographs and recordings: images and video recordings of events, activities, and case studies;
Website usage data: IP addresses, browser information, cookie data, and website navigation patterns;
Communication records: correspondence, feedback, complaints, and meeting notes;
Recruitment information: employment history, education qualifications, DBS checks, and references;
Research data: responses to surveys, participation in research studies, and clinical information where relevant.
Special Category Data: We process health information and other special category data only where we have a lawful basis under Article 6 UK GDPR and an additional condition under Article 9 UK GDPR as set out below.
You provide us with most of the data we collect. We collect data and process data when you interact with any of our online, digital or in-person services, including:
Submitting forms through our website to access services or request information.
Complete a survey or feedback form.
Use or view our website via your browser’s cookies.
Interact with us through third-party services such as social media.
Make a donation or payment through our website and our contracted third-party providers.
Attend our events or use our services.
Contact us by telephone, email, post or social media.
Apply for employment or volunteer positions.
Participate in our research activities or join our JIA VIP Research Panel.
Where you have provided consent for them to do so, trusted third-parties (such as those who manage payments and donations for us) may also provide us with information. This information will only be used to provide support and information to you, or to supplement data we already hold about you.
We process your personal data for the following purposes and on the following lawful bases:
Providing services and support
Lawful Basis: Contract / Legitimate interests / Consent
Special Category Condition: Substantial public interest (health/social care) / Explicit consent
Processing donations and Gift Aid
Lawful Basis: Legitimate interests / Legal obligation / Consent
Special Category Condition: N/A
Research activities
Lawful Basis: Legitimate interests / Consent
Special Category Condition: Substantial public interest (research) / Explicit consent
Marketing communications
Lawful Basis: Consent / Legitimate interests
Special Category Condition: N/A
Legal compliance and safeguarding
Lawful Basis: Legal obligation
Special Category Condition: Substantial public interest (safeguarding)
Recruitment and employment
Lawful Basis: Contract / Legitimate interests / Consent
Special Category Condition: Substantial public interest (equality of opportunity) / Explicit consent
Handling complaints and feedback
Lawful Basis: Legitimate interests
Special Category Condition: N/A
Where we rely on legitimate interests, our legitimate interests are:
advancing research into juvenile arthritis;
providing support and information to affected families;
maintaining donor relationships and ensuring effective fundraising;
protecting our organisation and individuals from harm.
Where we collect personal data from children under 18, we take additional measures to protect their privacy:
for children under 13, we obtain parental or guardian consent before processing their personal data;
for children aged 13-17, we may accept their own consent but will inform parents/guardians where appropriate;
we provide age-appropriate privacy information;
children may exercise their data protection rights when they reach majority.
We securely store the data we hold about you. This will be on our servers and computers, on our cloud service, and on UK-based CRM, which are secured following guidelines from the National Cyber Security Centre. Data is held in the UK and EEA. These include:
Cloud servers based in the EEA
Website and associated resources hosted in the EEA
CRM services hosted in the UK
Email service provider (currently MailChimp based in the US, name and email address only)
Survey software based in the EEA
We retain personal information only for as long as is necessary for the purpose for which it was collected. The length of time we retain your information will depend on why it was collected and what it was used for:
Financial records are held for 6 years following the end of the relevant financial year to which they apply
Research data for the duration of the research project plus 10 years, or until you withdraw consent
Health data for the duration of our relationship plus 12 months
Marketing data until consent is withdrawn
Employment and volunteer records for 6 years after employment or volunteering ends
All other personal data is held for the duration of your relationship with Juvenile Arthritis Research and for 12 months thereafter.
At the end of the retention period, data is securely deleted or anonymised. When we delete your information, electronic files are securely deleted and paper records shredded. It is then not possible to recover your data.
We implement appropriate technical and organisational measures to protect your personal information, including:
encryption of data in transit and at rest;
access controls and regular access reviews;
staff training on data protection;
regular security assessments and updates;
secure disposal of data and equipment.
We do not sell, rent, or trade personal data with other organisations for marketing purposes.
We may share your personal data with the following categories of recipients:
Service providers: IT support, payment processors, postal services, and professional advisers;
Research partners: academic institutions and healthcare providers for legitimate research purposes;
Regulatory bodies: HMRC, Charity Commission, and other statutory authorities where required by law;
Emergency services: where necessary to protect vital interests or for safeguarding purposes.
All data sharing is conducted under appropriate data processing agreements and in accordance with UK data protection law.
International transfers:
Some of our service providers are located outside the UK and EEA:
Mailchimp (US): email marketing services - data transferred under adequacy decision
Other international transfers are made only where adequate safeguards are in place through Standard Contractual Clauses or adequacy decisions.
We conduct transfer impact assessments to ensure your data remains protected when transferred internationally.
We may send you information about the services we provide. You may opt out of receiving these emails at any time by clicking on the ‘unsubscribe’ link in the email you receive.
We do not sell, rent or trade email lists or contact details with other organisations for marketing purposes.
We will never share your details with anyone else without your consent, unless required to by law (such as for safeguarding purposes). Anonymised information you provide may be used by us publicly without attribution, but we will ensure you cannot be identified unless you have given consent. In some circumstances, we may need to share your personal data with a trusted third party to fulfil our obligations to you – such as the postal service to send physical items, or payment providers to monitor payments.
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR:
consent
contract
legal obligation
vital interests
public task; and
legitimate interests.
None of the lawful bases are ‘better’ or more important than any of the others, and the specific basis used will depend on the service being provided. You can find out more about lawful bases on the ICO’s website. Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website.
Your right of access. You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
Your right to rectification. You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure. You have the right to ask us to delete your personal information.
Your right to restriction of processing. You have the right to ask us to limit how we can use your personal information.
Your right to object to processing. You have the right to object to the processing of your personal data.
Your right to data portability. You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent. When we use consent as our lawful basis you have the right to withdraw your consent at any time.
Your rights regarding automated decision making. We do not use automated decision-making or profiling.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the bottom of this privacy notice. Some rights may not apply in all circumstances, and we may need to verify your identity before processing requests.
Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. For further information, visit allaboutcookies.org
We use cookies in a range of ways to improve your experience on our website, including:
Keeping you signed in
Remembering your preferences
Understanding how you use our website
Supporting you completing forms
There are a number of different types of cookies. Our websites use functionality cookies for website operation) and analytics cookies (based on legitimate interests for website improvement). We use these cookies so that we recognise you on our website and remember your previously selected preferences. These could include what language you prefer and location you are in. A mix of first-party and third-party cookies are used.
You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function properly as a result.
We will notify you of any personal data breach that is likely to result in high risk to your rights and freedoms within 72 hours of becoming aware of the breach.
Our website and digital resources contain links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.
We may update this privacy notice from time to time. We will notify you of significant changes and publish the updated version on our website.
If you have any questions about this privacy notice, or information we hold about you, please contact us. You can do this via our website at www.jarproject.org/contact-us or by writing to us at: Juvenile Arthritis Research, North Frith Farm, Ashes Lane, Hadlow, Tonbridge, Kent, TN11 9QU
If you wish to complain about any aspect of how we collect, store or use your personal information, please contact us www.jarproject.org/contact-us. Our Data Protection Complaint Handling policy is available here.
If you are dissatisfied with our response you can contact the Information Commissioner's Office: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, www.ico.org.uk, 0303 123 1113
This policy will be reviewed annually and updated as necessary to ensure continued compliance with applicable law and best practice.
