Privacy notice

Background

Juvenile Arthritis Research is a charity funded by donations. We are committed to maintaining your trust and confidence in us. We do all we can to protect your privacy and make sure the personal data you provide us with is kept safe. 

This privacy notice explains how we collect, use, store and share your personal data, and your rights in relation to that data. For any queries relating to this policy or how we use your data, please contact us via www.jarproject.org/contact-us or at our registered address below.

Why do we collect data?

We collect personal data for the following reasons:

• To provide services and goods, including delivery.

• To receive donations or funding and organise fundraising activities, and to support you with your fundraising.

• To provide you with service updates or marketing information.

• To undertake research (including through the JIA VIP Research Panel).

• To comply with our legal obligations.

• To undertake recruitment of staff, volunteers and trustees.

• To deal with queries and complaints.

• To create case studies and stories, including media and press releases (helping raise awareness of Juvenile Idiopathic Arthritis and Juvenile Arthritis Research).

What data do we collect?

We collect and process the following categories of personal data:

• Identity and contact information: name, address, email address, telephone number, date of birth, gender, and next of kin details;

• Financial information: donation history, payment details, Gift Aid declarations, taxpayer information, National Insurance numbers, and tax codes;

• Health information: medical conditions, allergies, medical history, dietary requirements, disability information, and care needs;

• Photographs and recordings: images and video recordings of events, activities, and case studies;

• Website usage data: IP addresses, browser information, cookie data, and website navigation patterns;

• Communication records: correspondence, feedback, complaints, and meeting notes;

• Recruitment information: employment history, education qualifications, DBS checks, and references;

• Research data: responses to surveys, participation in research studies, and clinical information where relevant.

• Special Category Data: We process health information and other special category data only where we have a lawful basis under Article 6 UK GDPR and an additional condition under Article 9 UK GDPR as set out below.

How do we collect your data?

You provide us with most of the data we collect. We collect data and process data when you interact with any of our online, digital or in-person services, including:

• Submitting forms through our website to access services or request information.

• Complete a survey or feedback form.

• Use or view our website via your browser’s cookies.

• Interact with us through third-party services such as social media.

• Make a donation or payment through our website and our contracted third-party providers.

• Attend our events or use our services.

• Contact us by telephone, email, post or social media.

• Apply for employment or volunteer positions.

Participate in our research activities or join our JIA VIP Research Panel.

Where you have provided consent for them to do so, trusted third-parties (such as those who manage payments and donations for us) may also provide us with information. This information will only be used to provide support and information to you, or to supplement data we already hold about you.

Why do we process your data and on which lawful basis?

We process your personal data for the following purposes and on the following lawful bases:

Providing services and support

Lawful Basis: Contract / Legitimate interests / Consent

Special Category Condition: Substantial public interest (health/social care) / Explicit consent

Processing donations and Gift Aid

Lawful Basis: Legitimate interests / Legal obligation / Consent

Special Category Condition: N/A

Research activities

Lawful Basis: Legitimate interests / Consent

Special Category Condition: Substantial public interest (research) / Explicit consent

Marketing communications

Lawful Basis: Consent / Legitimate interests

Special Category Condition: N/A

Legal compliance and safeguarding

Lawful Basis: Legal obligation

Special Category Condition: Substantial public interest (safeguarding)

Recruitment and employment

Lawful Basis: Contract / Legitimate interests / Consent

Special Category Condition: Substantial public interest (equality of opportunity) / Explicit consent

Handling complaints and feedback

Lawful Basis: Legitimate interests

Special Category Condition: N/A

Where we rely on legitimate interests, our legitimate interests are:

• advancing research into juvenile arthritis;

• providing support and information to affected families;

• maintaining donor relationships and ensuring effective fundraising;

• protecting our organisation and individuals from harm.

Children’s data

Where we collect personal data from children under 18, we take additional measures to protect their privacy:

• for children under 13, we obtain parental or guardian consent before processing their personal data;

• for children aged 13-17, we may accept their own consent but will inform parents/guardians where appropriate;

• we provide age-appropriate privacy information;

• children may exercise their data protection rights when they reach majority.

How do we store your data?

We securely store the data we hold about you. This will be on our servers and computers, on our cloud service, and on UK-based CRM, which are secured following guidelines from the National Cyber Security Centre. Data is held in the UK and EEA. These include:

• Cloud servers based in the EEA

• Website and associated resources hosted in the EEA

• CRM services hosted in the UK

• Email service provider (currently MailChimp based in the US, name and email address only)

• Survey software based in the EEA

How long do we retain your data?

We retain personal information only for as long as is necessary for the purpose for which it was collected. The length of time we retain your information will depend on why it was collected and what it was used for:

• Financial records are held for 6 years following the end of the relevant financial year to which they apply

• Research data for the duration of the research project plus 10 years, or until you withdraw consent

• Health data for the duration of our relationship plus 12 months

• Marketing data until consent is withdrawn

• Employment and volunteer records for 6 years after employment or volunteering ends 

• All other personal data is held for the duration of your relationship with Juvenile Arthritis Research and for 12 months thereafter.

At the end of the retention period, data is securely deleted or anonymised. When we delete your information, electronic files are securely deleted and paper records shredded. It is then not possible to recover your data.

How do we protect your data?

We implement appropriate technical and organisational measures to protect your personal information, including:

• encryption of data in transit and at rest;

• access controls and regular access reviews;

• staff training on data protection;

• regular security assessments and updates;

• secure disposal of data and equipment.

How do we share your data?

We do not sell, rent, or trade personal data with other organisations for marketing purposes.

We may share your personal data with the following categories of recipients:

• Service providers: IT support, payment processors, postal services, and professional advisers;

• Research partners: academic institutions and healthcare providers for legitimate research purposes;

• Regulatory bodies: HMRC, Charity Commission, and other statutory authorities where required by law;

• Emergency services: where necessary to protect vital interests or for safeguarding purposes.

All data sharing is conducted under appropriate data processing agreements and in accordance with UK data protection law.

International transfers:

Some of our service providers are located outside the UK and EEA:

• Mailchimp (US): email marketing services - data transferred under adequacy decision

Other international transfers are made only where adequate safeguards are in place through Standard Contractual Clauses or adequacy decisions.

We conduct transfer impact assessments to ensure your data remains protected when transferred internationally.

Marketing, newsletters and information emails

We may send you information about the services we provide. You may opt out of receiving these emails at any time by clicking on the ‘unsubscribe’ link in the email you receive.

Do we share your information with others?

We do not sell, rent or trade email lists or contact details with other organisations for marketing purposes.

We will never share your details with anyone else without your consent, unless required to by law (such as for safeguarding purposes). Anonymised information you provide may be used by us publicly without attribution, but we will ensure you cannot be identified unless you have given consent. In some circumstances, we may need to share your personal data with a trusted third party to fulfil our obligations to you – such as the postal service to send physical items, or payment providers to monitor payments.

What are your data protection rights?

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR:

• consent

• contract

• legal obligation

• vital interests

• public task; and

• legitimate interests.

None of the lawful bases are ‘better’ or more important than any of the others, and the specific basis used will depend on the service being provided. You can find out more about lawful bases on the ICO’s website. Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website.

• Your right of access. You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. 

• Your right to rectification. You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. 

• Your right to erasure. You have the right to ask us to delete your personal information. 

• Your right to restriction of processing. You have the right to ask us to limit how we can use your personal information.

• Your right to object to processing. You have the right to object to the processing of your personal data.

• Your right to data portability. You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.

• Your right to withdraw consent. When we use consent as our lawful basis you have the right to withdraw your consent at any time.

• Your rights regarding automated decision making. We do not use automated decision-making or profiling.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the bottom of this privacy notice. Some rights may not apply in all circumstances, and we may need to verify your identity before processing requests.

Cookies

Cookies are text files placed on your computer to collect standard Internet log information and visitor behaviour information. When you visit our websites, we may collect information from you automatically through cookies or similar technology. For further information, visit allaboutcookies.org

How do we use cookies?

We use cookies in a range of ways to improve your experience on our website, including:

• Keeping you signed in

• Remembering your preferences

• Understanding how you use our website

• Supporting you completing forms

What types of cookies do we use?

There are a number of different types of cookies. Our websites use functionality cookies  for website operation) and analytics cookies (based on legitimate interests for website improvement). We use these cookies so that we recognise you on our website and remember your previously selected preferences. These could include what language you prefer and location you are in. A mix of first-party and third-party cookies are used.

How to manage cookies

You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function properly as a result.

Data breach notification

We will notify you of any personal data breach that is likely to result in high risk to your rights and freedoms within 72 hours of becoming aware of the breach.

Privacy notices of other websites

Our website and digital resources contain links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

Changes to this privacy notice

We may update this privacy notice from time to time. We will notify you of significant changes and publish the updated version on our website.

Contact details

If you have any questions about this privacy notice, or information we hold about you, please contact us. You can do this via our website at www.jarproject.org/contact-us or by writing to us at: Juvenile Arthritis Research, North Frith Farm, Ashes Lane, Hadlow, Tonbridge, Kent, TN11 9QU

If you wish to complain about any aspect of how we collect, store or use your personal information, please contact us www.jarproject.org/contact-us
If you are dissatisfied with our response you can contact the Information Commissioner's Office: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, www.ico.org.uk, 0303 123 1113

Version Control - Approval and Review

This policy will be reviewed annually and updated as necessary to ensure continued compliance with applicable law and best practice.