Privacy policy

Whenever you see the words 'we', 'us', 'our', 'the charity' or 'Parkinson's UK', it refers to the Parkinson's Disease Society of the United Kingdom and its subsidiaries.

Parkinson's Disease Society of the United Kingdom is a registered charity in England and Wales (258197) and in Scotland (SC037554). A company limited by guarantee. Registered no. 948776 (England and Wales). Registered office:
Parkinson's UK, 50 Broadway, London, SW1H 0DB

The Parkinson's Research Ventures Limited, a private company limited by shares and registered at Companies House (registered in England and Wales as 11228595). The company’s activities includes the granting of licences of intellectual property rights licensed to it by Parkinson's UK and the commissioning of research and development services in the Parkinson's indication.

Parkinson’s UK Sales Limited, a private company limited by shares and registered at Companies House (registered in England and Wales as 1575175). The company’s activities include the trading element of fundraising events and sale of daily living aids, Christmas cards, stationery and general gift items.

There are more than 300 Parkinson's UK local groups running meetings, activities and social gatherings throughout the UK. When you see the term local group in this policy, it means Branches, Support Groups and Activity Groups.

Our local groups are included in the references to ‘we’, ‘us’ and ‘our’.

If you have any questions in relation to this privacy policy or how we use your personal data they should be sent to:

• Email: [email protected]
• Written inquiries: Data Protection Officer, Parkinson's UK, 50 Broadway
  London, SW1H 0DB
• While it may be helpful to contact us in the first instance, you can also lodge a complaint with the Information Commissioner's Office, which is the supervisory authority for data protection matters in the UK. Contact details are available on the Information Commissioner's Office website.

You can also view a full copy of our compliance framework.

Here is a list of the rights that all individuals have under the General Data Protection Regulation (GDPR). They don't apply in all circumstances. If you wish to use any of them, we'll help you as much as possible.

You have a right to: 

• Be informed about the processing (for example collection, use and storage) of your personal data.
• Access your information. This is called a Subject Access Request. Whether you are requesting information about yourself or on behalf of someone else, find out more about how to complete a Subject Access Request.
• Correct any information that we hold about you.
• Erase any of your information that we no longer have a right to hold about you.
• Restrict processing. For example, limiting the way in which we use your data.
• Access a machine readable version of your data, although there are some conditions.
• Ask us to stop us doing anything with your data unless we must by law or a contract.
• Stop any automated decision making. This is where a computer makes a decision about you. It should be noted that we do not do this.

To exercise any of these rights please contact our data protection officer:

• Email: [email protected]
• Written inquiries: Data Protection Officer, Parkinson's UK, 50 Broadway
  London, SW1H 0DB

Personal data you give us may include name, title, address, date of birth, age, gender, email address, telephone numbers, personal description, photographs and CCTV images. We'll only collect the personal data that we need.

We process personal information to enable us to:

• provide a voluntary service for the benefit of the national public as specified in our constitution
• administer membership records
• fund raise and promote the interests of the charity
• maintain our own accounts and records.

Our processing also includes the use of CCTV systems for the prevention of crime.

You can give us your personal data by filling in forms on our website, registering to use our website, participating in discussion boards or by corresponding with us (by phone, email or by joining as a member, supporter or volunteer).

Special categories of personal data includes health information, race, religious beliefs, genetic and biometric data and political opinions.

Sometimes we will ask to collect special categories of personal data – for example whether you are living with Parkinson’s yourself, or perhaps you have a relative with Parkinson’s. You do not have to provide this information if you do not wish to do so.

We hold this information on our database so that we can tailor our communications to you – including information and support services and fundraising materials. We only collect this information with your explicit consent.

Supporters

For supporters that make financial donations, we record information that enables us to process your donations, such as name, contact details and financial details. We collect this with your consent. Where you choose to use Gift Aid, we will share your details with HMRC in line with our legal obligations.

We use third parties to process payments, such as PayPal. In such cases, your data is managed by these companies in line with their privacy policies.

If you are donating or participating in an event through a third party website, such as JustGiving, that website’s privacy policy will apply. We receive your details only if you consent for these to be passed on to us and we use the data in line with your consent.

Where you attend an event or participate in an activity that we are running directly, we will collect - with your consent - a wide range of data, from name and contact details, to dietary preferences (where the event is catered), some of which may reveal health conditions or religious beliefs.

Where you are leaving us a legacy, we will capture - with your consent - information about your bequest. Sometimes we are legally obliged to share this information with other beneficiaries.

We obtain contact details and other personal information regarding media contacts and influencers from a variety of sources including Cision. If you wish to know more about how such information is collected and used read Cision’s privacy notice.

Members

Because members cannot be under 18, we collect name and contact details plus a date of birth to comply with our constitution. Your data is shared internally and with local groups to ensure that you can attend meetings and are supported.

We hold this information on our database so that we can tailor our communications to you – including information and support services and fundraising materials. We only collect this information with your explicit consent. 

When you submit your membership form, you are providing your explicit consent to process your special category data captured in the form, for example - health data.

Customers

We use the personal information you supply to handle orders, deliver products and services, process payments, communicate with you about orders, products, services and promotional offers, update your records and generally maintain your accounts with us. We also use this information to improve our store and platform, prevent or detect fraud or abuses of our website and enable third parties to carry out technical, logistical or other functions on our behalf.

Special categories of personal data includes health information, race, religious beliefs, genetic and biometric data and political opinions.

Sometimes we will ask to collect special categories of personal data. For example, whether you are living with the condition yourself, or perhaps you have a relative with the condition. You do not have to provide this information if you do not wish to do so.

We hold this information on our database so that we can tailor our communications to you, including information and support services and fundraising materials. We only collect this information with your explicit consent.

Our information and support service users

Our information and support service processes personal information to enable us to:

• provide an information and support service
• develop our information and support user experience and content.

When you call, or consent to receive a call from, one of our adviser team, including via our helpline or one of our specialist advisers, we collect - with your consent - only that data that you are happy to give us, in order to provide advice, guidance, or to receive feedback and comments. We do record all calls for training purposes. Some of this information will be health information, which is special category data.

You can also give us your personal data by completing a referral form with a healthcare professional. The healthcare professional who refers you must collect your consent to be referred and share your information with us. 
If you would like us to provide any services to you, we will ask for some information about your circumstances to help us to support you. We will only collect this with your consent. You should only provide the information that you would like to. You will be given more information at the point at which we collect the information.

Where you have said that you want to receive more information from us to give you ongoing support, we may merge information from the helpline, advisers, referral forms and other places where you have given us your information with your consent. This helps us to build a picture of your needs and to provide you with the best support. We do not use this information for anything else.

Our support service includes use of the Parkinson’s UK forum. By using our online forum, you agree to the terms and conditions of forum use, including privacy conditions. These are provided at https://forum.parkinsons.org.uk/tos

Case studies

Some people have provided us with information about themselves in order to be used as case studies or in our literature or advertisements. In such instances, we obtain your consent to use these. We try to ask for consent again before these are used. Once these have been used, especially digitally, it is nearly impossible for these to be recalled as they will be downloaded by anonymous users.

Excellence Network

We will collect data from you with your consent to enable us to engage you with the professional world of supporting people affected by Parkinson's. There are periodic surveys where you can provide feedback anonymously.

We rely on the following legal bases to use your personal data.

Where it is needed to fulfil our contractual obligations 

The data processed to meet contractual responsibilities includes, but is not limited to, data relating to employment records: payroll, bank account, postal address, sick pay; leave, maternity pay, pension and emergency contacts. 

We will use your personal details to fulfil your order from the online shop.

Where it is in our legitimate interests to do so

1. To continue processing personal data on an individual who has exercised their right to erasure/to be forgotten. We will need to keep basic data to identify that individual and retain it solely for suppression purposes to prevent further unwanted processing.
2. To follow guidance and recommended best practice of government and regulatory bodies.
3. For management and audit of our business operations including accounting.
4. To carry out monitoring and to keep records of our communications with you and our staff (see below).
5. To administer our good governance requirements, such as internal reporting and compliance obligations or administration required for AGM processes.
6. For direct marketing communications by post.
7. For some of our profiling to determine the effectiveness of promotional campaigns and advertising.
8. To undertake market research.

To comply with our legal obligations

The data processed to meet statutory responsibilities includes, but is not limited to, data relating to: tax and money laundering.

With your consent or explicit consent

1. For some direct marketing communications including those by email and SMS.
2. For some of our profiling.
3. For some of our processing of special categories of personal data such as about your health.
4. For automated decision making to support the Digital Health Assistant.

You can withdraw your consent by contacting our Supporter Care team by calling 0800 138 6593 or filling in our enquiries form.

We rely on the following legal conditions for processing special category data under the UK GDPR Articles:

Article 9(2)(a) - explicit consent

In circumstances where we seek consent, we make sure that the consent is unambiguous and for one or more specified purposes, is given by a positive action and is recorded as the condition for processing, such as when requesting health data from customers to assess the health impact of our policies.

Article 9(2)(b) - employment or social protection

Where processing is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law or the data subject in connection with employment, social security or social protection. For example our processing of staff sickness absences.

Article 9(2)(c) - vital interests

Where processing is necessary to protect the vital interests of the data subject or of another natural person, such as our processing would be using health data about a member of staff in a medical emergency.

Article 9(2)(f) - legal claims

For the establishment, exercise or defence of legal claims, such as processing relating to any employment tribunal or other litigation.

Article 9(2)(g) - substantial public interest

Where processing is necessary for employment, social security and social protection, equality of opportunity or treatment, support for individuals with a particular disability or medical condition and safeguarding of children and individuals at risk

Substantial public interest conditions for processing (Schedule 1, DPA 2018)

We process special category data for the following purposes in Part 1 Schedule 1:

• Paragraph 1 - employment, social security and social protection

We process special category data for the following purposes in Part 2 Schedule 1:

• Paragraph 8 - equality of opportunity or treatment
• Paragraph 10- preventing or detecting unlawful acts
• Paragraph 14 - support for individuals with a particular disability or medical condition
• Paragraph 18 - safeguarding of children and individuals at risk

We process criminal offence data for the following purposes in Part 1 of Schedule 1:

• Paragraph 1 - employment, social security and social protection

We follow the Code of Fundraising Practice guidelines as well as the Privacy and Electronic Communications Regulations. Parkinson's UK never sells personal information about supporters to any other organisation.

We never call people who have had no prior contact with the charity to ask for money or who have asked us not to call them. We only contact people who would reasonably expect to be contacted because they have recently supported the charity in some way.

We will not call people who are registered with the Telephone Preference Service (TPS) or companies registered with Corporate TPS, unless those people or companies have consented to be called by us.

At Parkinson's UK, we aim to make sure that the information we send to you is relevant and timely. We also wish to use our resources effectively, something supporters tell us is important too. We use profiling techniques because they help us to make appropriate fundraising requests to supporters and importantly, enable us to raise more funds sooner, and more cost-effectively, than we otherwise would.

A profile is primarily based on information that you have given through previous interactions with us. This may include broad information relating to you, such as geographic and socio-economic data (age, postcode etc), in order to have a better understanding of your potential interests and preferences.

This helps us to only contact you with the most relevant communications. If you have made a gift to us, we would bear in mind its value and your gift patterns to help us be as relevant to you as we can. For example if you have made a donation towards our research work we will prioritise sending you further information relating to our scientific research.

We do not include wealth screening as part of our legitimate interest in administering donations. This is a separate and distinct activity that requires its own basis for processing from within the GDPR.

Charity Commission rules require us to be assured of the source of funds and any conditions attached to them. As part of this process we'll carry out research using publicly available information and professional resources. If this applies to you, we'll remind you about the due diligence process when you make your donation and with relevant information from our privacy policy at an appropriate time. This is most likely to be at the point when we first make contact with you.

Such information is compiled using publicly available data about you, for example addresses, listed directorships or typical earnings in a specific commercial sector or profession. Where we have obtained personal data from publicly available sources, we provide a privacy notice to individuals explaining who we are and what we are doing with their data.

We compare the original purpose for which it was collected and used against the purpose for which we intend to use it to determine whether the purposes are compatible. In deciding whether the two are compatible, we consider factors such as: 

• the individual's reasonable expectations  
• the potential effect on them of the processing
• what they've been told.

For activities such as segmenting databases by reference to postcodes or other information we already have this represents a relatively low level of intrusion into privacy and in these cases, the legitimate interest condition may be a valid basis for processing.  

We only send data to other organisations for them to make decisions about how to use it if we have a legal duty to do so. 

For example, where you make a donation and use Gift Aid, by law we must send the information to Her Majesty's Revenue and Customs. 

Cookies 

Cookies are small text files stored on your computer when you visit certain websites.

We use first party cookies (cookies that we have set, that can only be read by our website) to personalise your online experience.

We also use third party cookies (cookies that are set by an organisation other than the owner of the website) for the purposes of website measurement and targeted advertising. Please find more information regarding our cookies in our terms and conditions. 

If you browse our website without filling in any forms

We use Google Analytics to understand how you use the website. Google Analytics collects information including IP address, geographic location of the device, browser type, browser language, date and time of your request, time(s) of your visit(s), page views and page elements (ie links) that you click.

Find out more about our use of Google Analytics.

Links to other websites

Our website may, from time to time, contain links to and from the websites of other relevant stakeholders. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we don’t accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites. This privacy policy applies solely to the personal data collected by Parkinson's UK.  

Where you have agreed to receive email or SMS marketing communications from us, we may provide your email address or mobile phone number in an encrypted format to social media companies, such as Facebook, Instagram, Twitter or YouTube, or to digital advertising networks that are providing services to us by displaying our advertising to you on those social media platforms and other websites, as well as identifying audiences with interests similar to yours.

You can opt out of your data being used to display advertising to you by contacting our Supporter Care team or our data protection officer. However, this will not prevent our advertisements being shown to you on a randomised basis or based on cookie data and may mean that you stop receiving marketing communications from us more generally.

We operate a process for assessing, managing and protecting new and existing systems which ensures that they are up to date and secure against the cyber security threats.

Our Data Protection Impact Assessments consider security in detail.

Our staff complete mandatory data protection training upon employment and annually thereafter to reinforce responsibilities and requirements set out in our data protection policies, such as those on handling data securely and setting secure passwords.

When we allow third parties acting on behalf of Parkinson's UK access to your information, we will always have complete control of what they see, how long they see it for and what they are allowed to do with it. We do not sell or share your personal information for other organisations to use.

Personal data collected and processed by us may be shared with the following groups where necessary:

• third party cloud hosting and IT infrastructure providers who host the website and provide IT support in respect of the website
• language analysis companies
• the NHS 
• mailing houses to send our newsletters, appeals and products
• email service providers to send our emails and manage your marketing permissions
• agencies who handle your donations on our behalf 
• organisations or individuals who work with us to provide services for you – like providing you with tailored advice or local services like exercise classes or complementary therapies
• companies who help us campaign on your behalf, for example to lobby your local MP
• online hosting companies to facilitate events, meetings and webinars
• a database company who help us keep our records in order.

Also, under strictly controlled conditions:

• contractors
• advisors.

We may also disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use or cookie policy and other agreements, or to protect the rights, property, or safety of Parkinson's UK, our members and supporters. This includes exchanging information with other companies and organisations for the purposes of fraud protection.

Some organisations which provide services to us may transfer data outside the European Economic Area but we'll only allow this if your data is adequately protected.

Some of our systems are provided by US companies. However, we only allow this when we're certain it will be adequately protected (for example standard contractual clauses).

Our online donation facility is provided by Braintree.  Event registration fees, payments for events merchandise, sponsorship or donations relating to events are processed through Stripe. All online transactions take place via a secure server.

Some of our offices have Closed Circuit Television (CCTV) and you may be recorded when you visit them. CCTV is used to provide security and protect both our staff and visitors.

CCTV will only be viewed when necessary (to detect or prevent crime) and footage is stored for a set period of time after which it is recorded over. Parkinson's UK complies with the Information Commissioner’s Office CCTV Code of Practice and we put up notices so you know when CCTV is used.

Unless we explain otherwise to you, we'll hold your personal information based on the following criteria:

• for as long as we have reasonable business needs, such as managing our relationship with you and managing our operations
• for as long as we provide services to you
• retention periods in line with legal and regulatory requirements or guidance.

Local groups collect personal data from their members (for example, name or contact details) in order to run and inform them of the group’s activities.
 
Local groups may have their own abridged privacy policies tailored more to their local activities and needs. This covers the personal data they collect and hold on members, what they use it for (for example, management of membership and activities, communications and marketing); who they may share your personal data with; how long they will hold your personal data; and, your rights regarding your personal data.
 
Local groups will only collect the personal data they need for members to participate in their activities and receive information and services from the group. 

Parkinson’s UK is the ‘data controller’ in respect of local group members’ personal data. As data controller, Parkinson’s UK is responsible for storing and otherwise processing that data in a fair, lawful, secure and transparent way.