Privacy Policy
At First Love Foundation, we are committed to protecting your personal information. We respect and keep safe any personal information you share with us or that we get from other agencies/organisations. This privacy notice sets out the basis on which we will process personal information, whether that information is collected through the First Love Foundation website or by any other means. The contact details for First Love Foundation in relation to processing of personal information and for any questions regarding this privacy notice are:
First Love Foundation
9th Floor, The Import Building
Republic
2 Clove Crescent
London
E14 2BE
First Love Foundation’s Data Protection Officer can be contacted on dataprotection@firstlovefoundation.org.uk. This privacy notice provides an overview in relation to all personal information that First Love Foundation’s processes. You can view our full Data Protection Policy here. Specific Data Processing Statements are also available:
-
Service delivery Data Processing Statement (please see below from the heading ‘Why we will hold your information and what we would do with it’ down).
-
Easy read full-service delivery Fair Processing Notice (please see the heading ‘Your rights in relation to your personal information’ below).
-
Data Processing Statement – Prospective employees and volunteers
Visiting our Website
When someone visits https://www.firstlovefoundation.org.uk/ we use the third-party services, Google Analytics and Hoot Suite, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to various parts of the site. This information is processed in a way which does not identify anyone. We do not make, and do not allow either services to make, any attempt to find out the identities of those visiting our websites. Our full Cookie Policy is here. If we do want to collect personally identifiable information through our websites, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it. We collect personal information when you sign up to our e-mail list and make this clear on the sign-up form. Our e-mail list is stored and managed within MailChimp.
Who is First Love Foundation?
First Love Foundation is an independent charity providing advice and support to people who are facing crisis in their lives. Our specialist teams provide individual, independent, emotional and practical help to enable people to cope and recover from the effects of poverty.
Why we will hold your information and what we would do with it
We process personal information to:
-
Enable us to provide emotional, practical, advice and advocacy support
-
Campaign for change on areas affecting those experiencing poverty or crisis
-
Conduct research into matters affecting those experiencing poverty or crisis
-
Keep in contact, communicate with and get the views and input of our supporters
-
Fundraise in relation to the above services, campaigning and research
-
Support and manage our employees and volunteers
The legal basis for First Love Foundation processing the personal information of those who use our services, our volunteers and employees is the consent of the individual the personal information is about. There may be times when we process personal information under a legal obligation and very occasionally the reason for processing information will be that it is in the vital interests of an individual.
In relation to other people, such as supporters, donors, and prospective volunteers and employees, we process sensitive personal data and financial information on the legal basis of consent. We process other data on the legal basis of legitimate interests. There may also be times when we process personal information under a legal obligation and, very occasionally, on the basis of the vital interests of an individual.
You have a right to object to the processing of information about you. See the section on ‘Your rights in relation to your personal information’ below.
The service we deliver is supported by a variety of support functions and the processing of personal information may apply in relation to these, such as befriending, employability and welfare rights advice services.
First Love Foundation will always ensure that there is a legal basis for any processing of personal information it undertakes.
What information we would hold
In relation to delivering our services
The types of personal information that First Love Foundation collects and processes in relation to services provided to people we support include:
-
Personal details, such as contact details, date of birth, and other personal information for identifying the individual.
-
Brief details of the crisis users of our service are experiencing.
-
Details of individuals’ needs and the support provided to them.
-
Where we are supporting an individual to make or appeal claims to central or local government, details such as medical information that support their claim (or appeal).
-
Other details that the individual chooses to provide, including where applicable equality, diversity and inclusion data (so that First Love Foundation can look to ensure its services are reaching all areas of the community).
In relation to other functions
The service we deliver is supported by a variety of other functions. Types of personal information relating to other functions include:
- Personal details, such as contact details, date of birth, and other personal information for identifying the individual.
-
Other personal information relating to:
-
Our supporters, such as what you want to hear from us about and how you want to hear from us.
-
Our donors/sponsors. Further detail is provided here
-
Individuals who make donations to First Love Foundation via third-party giving websites. Further detail is provided here
-
-
Other personal information relating to individuals who make enquiries about our volunteering or fundraising opportunities. Such data will only be used by First Love Foundation to keep an accurate record of how your enquiry was handled. We will otherwise only contact you where you have opted to receive further updates from First Love Foundation.
-
Other personal information of employees for employee administration and general management purposes.
-
Other personal information of volunteers for general management purposes
-
Other details individuals choose to provide, including where applicable equality, diversity and inclusion data (so that First Love Foundation can monitor how inclusive we are as a charity)
Why we would share your information
In relation to delivering our services
In delivering our services First Love Foundation will normally only share personal information with another agency/organisation with the consent of the individual concerned.
There are exceptional circumstances where we may have to disclose personal information without the individual’s consent. These are:
-
If we believe that either you or someone else is at risk of significant harm. First Love Foundation employees, volunteers and trustees have a duty to report any issues relating to child protection or adult safeguarding.
-
Where there is another legal reason or requirement to disclose your personal information
Agencies/organisations we may share your personal information with in relation to services to people we support include:
-
Other statutory agencies that can also help support you in relation to your crisis, such as Local Authority agencies and National Health Service agencies.
-
Voluntary sector partner agencies that can also help support you in relation to your crisis, such as the Citizens Advice Bureau, Women’s Aid and Refuge
-
Other community agencies/organisations that can also help support you in relation to your crisis
First Love Foundation may also share personal information with another organisation/agency that will process that information on behalf of First Love Foundation in relation to crisis and welfare rights services, but this will only be in relation to a service that the individual the personal information is about has asked for, for example First Love Foundation arranging legal advice in certain circumstances.
In relation to other functions
The service we deliver is supported by a variety of other functions. Organisations/agencies we may share your personal information with in relation to other functions include:
-
Third party providers that provide payment services to individuals who want to donate to or sponsor First Love Foundation.
-
Third-party giving websites that provide a service to individuals who want to support First Love Foundation through these giving websites.
-
Her Majesty’s Revenue and Customs where individuals who give to First Love Foundation have declared an amount eligible for Gift Aid
-
BrightHR, who provide our web-based HR platform to allow individuals to work for or volunteer with First Love Foundation.
First Love Foundation also shares personal information of individuals employed by or who volunteer with the charity. Further detail is provided here
Where we store your information
First Love Foundation has appropriate technical and organisational measures in place to protect the personal information of individuals. We use secure systems that permit the easy identification of the individual the personal information relates to. First Love Foundation’s own systems and cloud service providers’ servers, such as Microsoft 365 and Salesforce, are all based in the UK or, in the case of some data processed by Microsoft, within the European Union.
Where an individual has opted to receive further updates from First Love Foundation, from time to time we may use Typeform, MailChimp and similar tools for communicating with you and carrying out surveys that may collect personal data relating to you. Data entered on some of these tools may go outside the European Economic Area (EEA). Data provided through third-party giving websites may also be processed outside of the EEA. Further detail on transfers of personal data outside of the EEA is provided under the heading ‘Personal information may be transferred outside of the European Economic Area (EEA) in relation to the following’ below. No other personal data is transferred outside of the EEA.
How long do we retain your personal information for?
At First Love Foundation we ensure that personal information is not kept for longer than necessary. Full details of First Love Foundation’s normal retention periods for personal information can be requested using the contact details provided towards the top of this document. Normal retention period criteria for personal information is provided under the heading ‘Criteria used to determine the retention period of your personal information’ below.
Your rights in relation to your personal information
Data protection requirements mean that you have specific rights in relation to your personal information held by First Love Foundation. Under data protection requirements First Love Foundation is required to inform you how we will process any information that we hold in relation to you. Data protection requirements mean that you have specific rights in relation to information about you held by First Love Foundation. You have a right to:
-
Be informed of how information about you will be used (Right to be informed).
-
Access information held about you (Right of access).
-
Request that information about you that is inaccurate or incomplete be rectified (Right to rectification).
-
Request deletion or removal of information about you in specific circumstances (Right to erasure).
-
‘Block’ or suppress processing of information about you (Right to restrict processing)
-
Obtain and re-use information held about you for your own purposes across different services (Right to data portability).
-
Object to processing of information about you (Right to object).
-
Withdraw consent at any time where your information is being processed based on that consent, for example where First Love Foundation is sharing your information based on consent.
-
Lodge a complaint with the Information Commissioner’s Office in relation to processing of information about you.
The Information Commissioner’s Office can be contacted at:
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire SK9 5AF
You have a right to object to the processing of information about you. If you have any questions relating to this Policy, or to exercise your rights in relation to information we hold about you, please contact the First Love Foundation office the communication is from, that this Policy accompanies or e-mail dataprotection@firstlovefoundation.org.uk to be put in contact with the relevant First Love Foundation member of staff. To access the personal information that we hold about you, please e-mail dataprotection@firstlovefoundation.org.uk. To ask for your information to be corrected or deleted, to update your contact preferences, or to object to our processing of your personal information – or if you have any questions about this privacy notice, please e-mail dataprotection@firstlovefoundation.org.uk or call 020 3069 9877. You can also contact First Love Foundation concerning your rights in relation to First Love Foundation’s processing of your personal information using the contact details provided towards the top of this document.
Where does personal information we hold about you come from?
In relation to delivering our services
People who are in crisis are referred to First Love Foundation by one of a range of agencies and community organisations. Such agencies pass personal information to First Love Foundation on the basis of the consent of the individual the information is about.
Some personal information is considered sensitive information (known as special category data), in that it reveals an individual’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, information concerning their health or sex life, or sexual orientation. Voluntary sector agencies must obtain the consent of the individual the information is about for the sharing of personal information with another agency in relation to services. First Love Foundation ensures it receives written advice from the agency as to the legal basis for the transfer of personal information that the agency is relying on.
First Love Foundation also on occasion receives self-referrals from individuals who want to use our services.
First Love Foundation does not receive referrals of personal information that comes from publicly accessible sources.
In relation to other functions
The service we deliver is supported by a variety of other functions.
First Love Foundation receives personal information from third-party giving websites. If people have any concerns in respect of their personal information being passed on to First Love Foundation by third-party giving websites, First Love Foundation asks that individuals do not give by this method. Such personal information is passed on to First Love Foundation via a secure portal for the purpose of accurately logging their fundraising and/or donations. First Love Foundation will only contact such donors for administrative purposes relating to their fundraising, unless the donor has opted to receive further updates from First Love Foundation.
In order to comply with legal obligations and/or to ensure First Love Foundation’s reputation is safeguarded, First Love Foundation must take reasonable and appropriate steps to gather information about our stakeholders, for example where a significant sum is to be or has been donated. This means that we may gather personal information on individuals, accessing information sources that are already publicly available. This will help to give assurance for example that a donation is not from an inappropriate source and is in compliance with our Finance, Fundraising, Anti-Terrorism and Fraud & Financial Crime policies. Any personal information that we do collect will only consist of what is necessary for us to meet these requirements and will be processed in line with the rights of the individual the personal information is about.
Other personal information that First Love Foundation processes is received direct from the individual concerned.
Do we use your personal information for automated decision making?
None of the operations First Love Foundation performs on personal information constitutes “automated decisions”.
Cookies
The website uses cookies to distinguish visitors to the website. This helps us to provide a better user experience when website is browsed. Cookies also allows us to assess a visitor’s use and journey through the website, we use this information to improve our site and its functionality. For detailed information on the cookies we use and the purposes for which we use them see our Cookie Policy.
Changes to this policy
In line with internal procedures, changing providers, best practice, or changing legal requirements, First Love Foundation reserves the right to make changes to this privacy notice and other aspects of its websites at any time. Please check this page regularly for any changes.
Personal information may be transferred outside of the European Economic Area (EEA) in relation to the following:
-
Where an individual has opted to receive further updates from First Love Foundation and from time to time we may use Typeform, MailChimp and similar tools for communicating with that individual and carrying out surveys that may collect personal information relating to that individual. Information entered on some of these tools may go outside of the EEA. The main tools that First Love Foundation uses are Typeform and MailChimp. Typeform’s privacy policy notes that personal information is processed outside of the EEA; further details can be found in Typeform’s privacy policy and the steps they take to ensure any data transferred is processed in line with GDPR is in their data processing agreement, both of which are available here.
-
MailChimp is based in the USA, and stores and processes data on servers based in the USA. MailChimp’s privacy policy and related documentation detail the steps they take to ensure that data transferred to their US-based servers from the EEA are processed in a GDPR-compliant manner.
-
Information provided through third-party giving websites may be processed outside of the European Economic Area (EEA). The main third-party giving websites that First Love Foundation receives some donations through are:
– Enthuse, which is UK-hosted and whose privacy policy at the date of publication of this privacy policy, states they are unlikely to ever share data outside of the EEA. Their privacy policy can be found here.
– Just Giving, which operates both within and outside the EEA. At the date of publication of this policy, Just Giving’s privacy policy notes that some personal information may be processed outside of the EEA; further details can be found in Just Giving’s Privacy Policy.
– CAF Online, operated by a UK-based charity and bank. At the date of publication of this policy, CAF Online’s privacy statement indicates that there may be circumstances where personal information may be processed outside the EEA; further details can be found in CAF Online’s privacy statement.
No other personal information in relation to processing of personal information by First Love Foundation is transferred outside of the European Economic Area (EEA).
First Love Foundation recognises that it has a responsibility to ensure that the level of protection of personal information afforded within the European Economic Area (EEA) is not undermined when personal information is transferred outside of the EEA. Providers First Love Foundation uses have mechanisms in place to ensure that any data transferred out of the EEA is protected to GDPR-compliant standards.
If people have concerns in respect of giving via third-party giving websites, First Love Foundation asks that individuals do not give by this method. Similarly, if people have concerns about providing data through other third party tools First Love Foundation uses, such as Typeform or MailChimp, we ask that you do not provide data through that tool.
Criteria used to determine the retention period of your personal information
At First Love Foundation we ensure that personal information is not kept for longer than necessary. Normal retention period criteria for personal information are as follows:
-
Where a potential service user’s personal information is referred to First Love Foundation, contact is made but no service is taken up, any personal information is normally retained for 6 months
-
Where it has not been possible to contact the potential service at all after the referral, user any personal information is also normally retained for 6 months
Service user personal information is normally retained for 6 years after case closure (or last contact, if that is later). Exceptions include:
-
Where there is a reason that would be acceptable in law to retain the information for longer (this may particularly be the case for children’s records in some instances); and
-
Where statutory commissioners, local authorities or regulators of the services First Love Foundation provides require in their contract with First Love Foundation for such information to be retained for longer.
The retention periods for the principal types of information provided to us are:
-
Complaints records are retained for 6 years after the last entry in the complaint record;
-
Web form information relating to service delivery is retained for the relevant retention period for the type of information provided
-
Employee and volunteer records are, in most cases, held for 6 years after the individual has left First Love Foundation
-
Personal Information about people that enquire or apply for employment with First Love Foundation or to volunteer with First Love Foundation but are not successful/do not take forward their application is deleted 1 year after the appointment of the successful applicant
-
Most accounting and finance related documentation is retained for 7 years or, where applicable, 6 years after the end of the contract to which it relates. Some accounting and finance related documentation however is retained for longer in line with legal and widely accepted best practice
-
Any personal information provided with consent for specific types of processing for marketing purposes will not be retained for longer than 2 years without getting renewed consent from the individual the personal information is about, unless need to retain information (for example, to comply with a legal obligation).