Privacy policy

Create a Dream Foundation is committed to protecting the privacy of the people whose personal information we collect. We aim to be clear when we collect your data, keep it safe, and not do anything you wouldn’t reasonably expect. This policy sets out how Create a Dream Foundation uses the information that you provide us with, in order to help us continue to brighten the lives of seriously ill children and their families.

This privacy statement explains when and why we collect personal information about people who we support, who support us, who provide us with services and who visit our website – as well as how we use that information, the conditions under which we may disclose it to others and how we keep it secure.

Any questions regarding this privacy statement, our privacy policy or our privacy practices should be sent by email to info@createadream.co.uk or by writing to Data Controller, Create a Dream Foundation, 52 Wadsworth Drive, Sheffield, S12 2DF.

What information do we collect and where from?

The type and quantity of information we collect and hold, and how we use it depends on why you are providing it. Whenever we collect personal information we will identify ourselves as Create a Dream Foundation, tell you why we are collecting it, and inform you of how we plan to use it.

In order to carry out our work, we collect personal information about our donors, volunteers, supporters, hospitals, medical professionals and service providers as well as the children (and their families) we support. This includes names, addresses, contact details such as telephone numbers and email addresses, and where necessary dates of birth, medical records, records of previous support and donations, records of event bookings, and other information to assist us in providing our services.

We collect information when you give it to us directly, including via forms on our website and from emails. We also collect information that you have given permission to other parties to share it with us in order for us to carry out our organisational responsibilities. We occasionally collect information when it is available publicly from external sources and may help us provide a better service or raise funds to continue our work.

For those who attend our events, including volunteers, supporters and beneficiaries, we may hold an image of you in a photo or video. We may wish to use this on our website or in other marketing materials in order to promote the charity, but we will always seek explicit consent for us to do so. You do not have to agree that we may use your image, it is entirely your choice. Staff and volunteer information will be used for DBS checks.

When you visit our website, or download information from it, we record the date and time of your visit, the pages you accessed, the previous website you have visited and the type of browser you are using. This is anonymous data collected via Google Analytics, and is only used for statistical purposes, and to make improvements to our website.

How do we use your personal information

We use your personal information to carry out the functions and activities of Create a Dream Foundation, including processing information, services and donations and to comply with any legal obligations.

We use your information to:

• Keep a record of your relationship with us, for internal administrative purposes, and to let you know about changes to our services or policies that may affect you
• Look into, and respond to, complaints, claims, or any other issues
• Claim Gift Aid on your donations

We will process information to ensure all requests for dreams are handled and fulfilled correctly and to the highest standard. This includes sharing your name and postcode with other organisations to ensure that dreams are created fairly.

We may also use it to ask for your support, contacting you about the work of our organisation, fundraising, campaigns, and how you can further make a difference to the lives of seriously ill children and their families. This may be by post, email, telephone or text message, depending on your preferences and, where required, consents given. We will also continue to ask regularly about your preferences, to ensure that you are still happy to be contacted by us and by which means.

We may analyse your personal information and keep a record of our communications with you, to carry out statistical analysis and research in order to help us provide an improved experience to our beneficiaries and supporters, understand how we are performing and ensure we are using our funds in the best possible way.

You can ask us at any time not to contact you again, or not to use your data for these purposes, by emailing info@createadream.co.uk, or by writing to Data Controller, Create a Dream Foundation, 52 Wadsworth Drive, Sheffield, S12 2DF.

We do not use personal data for any automated decision making.

Data retention and keeping information up-to-date

In line with the General Data Protection Regulations (GDPR) guidance, your details and supporting paperwork will be retained for no longer than is necessary, and then either deleted, anonymised or archived.

In order to accurately report on the activities of the charity and demonstrate our impact, we need to be able to report on certain transactions including donations and services provided, as well as demonstrate our level of interaction with supporters, suppliers and beneficiaries.  Therefore some data will be kept longer than others.

For more information, please ask us about our Data Retention Policy by emailing info@createadream.co.uk, or by writing to Data Controller, Create a Dream Foundation, 52 Wadsworth Drive, Sheffield, S12 2DF.

Accuracy of your personal information

Create a Dream Foundation will endeavour to ensure that the personal information we hold is accurate, complete and up-to-date. If you become aware of any inaccuracy in the personal information we hold about you, we encourage you to contact us so we can update any personal information we hold about you.

Who has access to your information and how do we keep it safe?

We will not share information about children without the prior knowledge and consent of their parents or guardians, unless the law requires it.

We will never sell, trade or rent your information to third parties. Occasionally we need to disclose personal information to trusted third parties who assist us in providing services or who perform functions on our behalf (such as suppliers who are integral to creating our dreams). We ensure that any third parties with access to your data are held to strict standards for data use and security.

Third party service providers working on our behalf

We may pass your information to our third party service providers, agents, subcontractors and other associated organisations for the purposes of creating dreams and providing services to you on our behalf (for example to process donations, organise travel and/or insurance for your dream. However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the dream and we have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. Please be reassured that we will not release your information to third parties for them to use for their own direct marketing or other purposes, unless you have requested us to do so, or we are required to do so by law.

Third party product providers we work in association with

When you are using our secure online donation pages, your donation is processed by a third party payment processor, who specialises in the secure online capture and processing of credit/debit card transactions. If you have any questions regarding secure transactions, please contact us by emailing info@createadream.co.uk, or by writing to Data Controller, Create a Dream Foundation, 52 Wadsworth Drive, Sheffield, S12 2DF.

Transfer of data outside of the EU or EEA

Where dreams take place outside of the UK, and data is required to be sent overseas for the fulfilment of the dream, we share relevant information with hotels, theme parks, insurance companies, travel operators, and other relevant organisations. However, we ensure that adequate safeguards are in place and only work with organisations that are certified to the EU-US Privacy Shield Framework.

Where the dream destinations are outside of the EU and EU-US Privacy Shield Framework, your information will need to be sent in order for your dream to be created, and consent for this to occur will have been requested at the point of registration.

Data that is not required to create a dream will not be transferred outside of the EU.

Security of your personal information

Create a Dream Foundation regards the security of your personal information as a priority and takes a number of precautions to protect your personal information from loss, misuse, unauthorised access, modification or disclosure. Specific security precautions are in place for processing online payments which include the use of encrypted links and Transport Layer Security (TLS) encryption. We remind you, however, that the internet is not a secure environment and although all care is taken, we cannot guarantee the security of information you provide to us or third parties via electronic means.

Your rights and choices

The Law on Data Protection is derived from various pieces of legislation including the Data Protection Act, Privacy and Electronic Communications Regulation and the General Data Protection Regulation (GDPR). GDPR states that personal data (information relating to a person that can be individually identified) can only be processed if there is a legal ground to do so. Activities like collecting, storing and using personal information fall into the GDPR’s definition of processing. The GDPR provides six legal grounds under which personal information can be processed in a way that is lawful. For the processing to be permitted by law, at least one of the legal grounds must apply.

The 4 legal grounds that are most relevant to Create a Dream Foundation's use of your personal information are:

• Consent
• Legitimate Interest
• Contract
• Legal Obligation

What is our legal basis for processing your personal data?

Create a Dream will only process your personal information if we have:

• Asked you and have a record of your express consent for us to do so.
• A ‘Legitimate Interest’ to do so in order to support our charitable purposes. Our use will be fair and balanced and never unduly have an impact on your rights.
• A contract with you that we can only fulfil by using your personal information, e.g. to send you an item that you have requested.
• A legal obligation to use or disclose information about you, e.g. we are required by law to keep records of gifts that are given to us with Gift Aid for 6 years, or for insurance purposes as part of creating a dream.

In extreme situations, such as an accident or medical emergency, we may share your personal details with the emergency services if it is essential for the preservation of life (yours or another person’s) for us to do so. This is the ‘vital interest’ ground for using your personal information. After the emergency, we will always try to inform you about how we had to use your information in that extreme situation.

We will never prioritise our interests as a charity over your rights as an individual. We will always balance our interests with your rights. We will only use personal information in a way and for a purpose that you would reasonably expect in accordance with this policy.

Consent

Where Create a Dream has asked for your consent for processing your data, this can be withdrawn at any time by emailing info@createadream.co.uk, or by writing to Data Controller, Create a Dream Foundation, 52 Wadsworth Drive, Sheffield, S12 2DF.

We will only ask you for your consent where you have a genuine choice in how we process your information. In most instances we will use other grounds for processing than consent.

What is Legitimate Interest?

This legal ground for processing means that organisations can process your personal information if they have a genuine and legitimate reason for doing so and that use does not harm any of your rights and interests as an individual.

We do not unduly prioritise our legitimate business interests as a charity over your interests as an individual. We always respect your rights. Which is why we carry out a balancing exercise of the rights of the charity with your rights.

We consider your interests based on previous communications, as well as what we consider your expectations to be, and assess whether we are using your personal information in a way that matches your relationship with us.

We aim to be clear about what information we collect, to enable you to make meaningful choices about how it is used. When it is necessary we will contact you for administrative purposes, e.g. to contact you regarding a payment. We may hold the minimum personal information required to support our ability to respect your preferences for communication with us.

Anonymity

Where it is lawful and practicable, we will allow individuals to deal with us on an anonymous basis. For example, if we receive a telephone enquiry we will not require that the enquirer gives us their name, although depending on the nature of the enquiry, we may not be able to answer it unless they do. We can also accept gifts and other forms of support anonymously. However, if you wish to Gift Aid your donation, the government requires Create a Dream to collect the title, initials, surname, first line of address and postcode of the donor.

Your choices

We will not contact you for promotional purposes by email or text message unless you have given your prior consent. We will not contact you for promotional purposes by post if you have indicated that you do not wish to be contacted.

You have a choice about whether or not you wish to receive information from us, and whether or not we use your data for the purposes outlined above. If you do not want to receive direct marketing communications from us about our life-changing work creating dreams for other brave and deserving children, then you can select your choices by ticking the relevant boxes situated on the form on which we collect your information.

You can change your preferences at any time by contacting us by emailing info@createadream.co.uk, or by writing to Data Controller, Create a Dream Foundation, 52 Wadsworth Drive, Sheffield, S12 2DF.

Your rights as a data subject

The GDPR gives you rights as a data subject. You have:

• The right to request from us access to your personal data.
• The right to request from us rectification of your personal data.
• The right to request from us erasure of your personal data.
• The right to request from us restriction of processing your personal data.
• The right to object to our processing of your personal data.
• The right of data portability.

If we are processing your personal data on the basis of your consent, you have the right to withdraw your consent at any time. This does not affect the lawfulness of processing based on your consent before you withdrew it; and You have the right to complain to the ICO by visiting https://www.ico.org.uk

How you can access your information

Under data protection legislation, you have the right to request access to information that we hold. To make a request for your personal information, or be given access to your or your child’s Create a Dream record, our Data Protection contact is our Communications Manager and can be contacted by emailing info@createadream.co.uk, or by writing to Data Controller, Create a Dream Foundation, 52 Wadsworth Drive, Sheffield, S12 2DF.

If you do not wish to be contacted by us

Please just let us know by emailing info@createadream.co.uk, or by writing to Data Controller, Create a Dream Foundation, 52 Wadsworth Drive, Sheffield, S12 2DF.

Changes to this policy

If Create a Dream updates or changes this privacy policy, the changes will be made on this page. Your continued use of Create a Dream’s website following the posting of changes will mean you accept those changes.

We keep this policy under regular review.

This policy was last updated on 5th July 2019.