Privacy Policy

The Cleft Lip and Palate Association (CLAPA) is committed to protecting your privacy and always using your data responsibly.

We know you’re putting your trust in us by providing your personal data, and we want everyone in our community to feel confident that we respect your privacy and rights. When you share your personal information with us, we’ll treat it as carefully as if it were our own, and if you think we’ve made a mistake we’ll do everything we can to make it right.

This privacy policy (and any other documents referenced in it) explains how we use personal data that we collect from you or that you provide to us. By using our website (www.clapa.com) or providing any personal data as explained below, you are accepting and consenting to the practices described in this policy.

If at any time you’d like to change your information or how we communicate with you (or if you’d like to stop receiving communications from us altogether), get in touch at [email protected] or call us on 020 7833 4883. We won’t try to change your mind or ask for any more information other than what we need to process your request.

Jump To:

We want this policy to be transparent and comprehensive. If you have any questions or concerns after reading this policy, please share them with us so we can make sure they’re addressed.

Data we may collect from you

In Short

We collect and process information that’s necessary for us to operate as a charity, from contact details to health information (such as your connection to cleft lip and palate) to details of donations made. In all cases, we do our best to make sure we’re not asking for any more than what we need for a specific purpose. We also strive to make it clear what will happen when you send this information to us in each case. You have control over what you share with us and how long we keep it for.

When you use our website or read our e-mails, we’ll also collect information that your browser shares with us, like where you are in the world or what links you click on, but we don’t use this to identify you personally unless it’s necessary to provide you with a service you’ve asked for.

We have a Records Management Policy which details how long we keep different kinds of records, why we keep them, and what happens when it’s time to delete these records. We regularly clean up our database and other systems to make sure we’re not holding onto any more information than we need.

In Detail

CLAPA may collect and process the following kinds of data about you:

  • Information you provide when registering to join the CLAPA community or when submitting any of the forms on our website, such as our fundraising inquiry form. This information may include personal contact details, your child(ren)’s date of birth, your ethnic origin, which of our services you may be interested in, and other information you provide when submitting one of these forms.
  • Our website may collect information available from your browser, such as the country you’re in and the language you’re using, as well as resources you access. This is statistical data about our visitors’ browsing habits and does not identify you personally, though we do use it to better understand how people use our website.
  • If you leave a comment, we collect the data shown in the comments form, as well as your IP address and browser user agent string to help spam detection. This is sent to the Akismet anti-spam service which allows or blocks comments based on how likely they are to be spam.
  • Our emailing software (for e-newsletters) Campaign Monitor may collect information available from your browser or email client, such as when and where you opened any of our emails and which links you clicked on. Like almost all organisations, we use this to analyse how successful our emails are. We won’t access the tracking data for your particular email address unless it’s to provide you with a service you’ve asked for or process a request you’ve made. To avoid sending tracking data, you can set up your email client to not download/display external images automatically, and access any links by right-clicking on them, selecting ‘copy link location’, and pasting the link in a different browser window or tab.
  • Information about your use of our services, such as your attendance at events or the use of our Parent/Peer Support Service. Sensitive details will be kept confidential.
  • If you contact us, we may keep a record of that correspondence. If you send us personal information via email, we may keep your email address and the contents of your message for our records.
  • We may ask you to complete optional surveys for research purposes and/or to help us improve our services. Unless clearly stated, we will not collect personally identifiable information in these surveys and will not connect you personally to your responses.
  • Details of orders made through our webshop and the fulfilment of these orders. We use this information to process your orders and to help you with any issues with your orders. Please note credit and debit card information provided through our webshop is sent directly to the payment processor (Stripe) and is not held by CLAPA, nor is it accessible by staff. Select staff have access to Stripe and can see the expiry date and last 4 digits of your card to help identify payments.
  • CVs, references or other information about yourself which you provide to us for specific purposes.

How we use your data

In Short

We’ll use your information in the way you’ve asked us to, e.g. to send you emails or other communications, to provide you with a service you’ve signed up for, or to help you with fundraising, etc. You can ask for us to change your details or preferences (or to remove you altogether) at any time (see ‘Your Rights’ below).

We’ll also use your information as part of our database to find out more about our community and make sure our services are working as well as they can be for everyone.

In Detail

Your data will only be used for the purposes indicated when you submit the data or as laid out in this privacy policy.

We use personal information held about you in the following ways:

  • To update and enhance our records. Please note that while we work to ensure the data we hold on you is accurate and up to date, CLAPA cannot be held responsible for confirming the ongoing accuracy of your personal information. You can contact us at any time to change or update your information.
  • To provide you with the information, products and/or services you’ve requested from us.
  • To provide you with the most relevant information and announcements, on both a local and national level. This may include research studies which we think may be particularly relevant to you.
  • To send you the kinds of communications you’ve asked to be sent when signing up, e.g. CLAPA News, e-newsletters, etc. You can opt in/out of any kinds of content we send you by following the instructions on the relevant content, or by contacting us directly with your preferences (see ‘Your Rights’ below).
  • To make sure the content on our website and in our emails is presented in the best way for you and your browser or device.
  • To review our services and the content we provide to make sure it’s right for our users.
  • We may analyse your data as part of a large set to compile information on our community so we can make sure our services are appropriate and accessible to all. For example, looking at how many people in our community are of a certain ethnic origin, or how many people clicked on a link in one of our emails.
  • We do not currently (and have no future plans to) use paid telephone, street or door-to-door fundraising services. We will only ever contact you by post or email for fundraising purposes and you may unsubscribe or change your preferences at any time by contacting us.

Sharing your data

In Short

We won’t give, trade or sell your information to anyone else so they can contact you directly without your explicit consent. We only pass on your information to others if they’re working for us (e.g. to mail out CLAPA News), and we make sure they take good care of this data while they have it. In rare and extreme circumstances, we may have a legal obligation to share information with the police or other parties.

In Detail

All CLAPA Staff have levels of access to our secure database which holds the majority of personal information we may collect. Other personal information, e.g. sent in emails to staff, may be summarised and stored on our database if staff feel it is necessary to gather a complete record of your history with us.

Selected volunteers may access this database if their work with us necessitates this, e.g. if they are helping us ‘cleanse’ our database of old addresses, or if they are working with us long-term as an intern. These volunteers sign a data protection agreement and their work is carefully monitored.

Third Parties

  • We will never pass on your information to a third party so they can contact you directly without your explicit consent. Your information will also never be sold to or ‘swapped’ with a third party, including other charities or the NHS.
  • We may pass on your data to carefully screened third parties for processing to help us clean up our database (e.g. by removing records of the deceased), or for the purposes of mass-mailing (e.g. sending CLAPA News). These organisations do not keep your data longer than is absolutely necessary.
  • We have previously used carefully-screened third parties to update contact information in our database, e.g. to find a new address if someone has moved. This was specifically for the purposes of posting out information about our services. As of 2016, we no longer do this, and only use these services to remove out-of-date information from our database.
  • We will not pass on your data for ‘wealth screening’, nor will we use any information (except about your previous donations to CLAPA) to target you for future fundraising.
  • We may disclose your personal information to third parties without your explicit consent if we are have a legal obligation to do so, or in order to enforce or apply any other agreements you’ve entered into with us. These occasions are extremely rare.

Storing your data

In Short

We store your data in a few different places for different purposes, but all of these places are secured and comply with all UK and EU data laws. We do not store or have access to payment information provided online.

In Detail

We store your data in six key places:

  • Salesforce database: this holds most of the personal data and contact information we collect.
  • CLAPA’s company server: this is where CLAPA’s files are stored, and this may include temporary copies of mailing lists, copies of letters we’ve sent you, etc. This is also where any information you send us via email is stored until deletion.
  • Formstack: this processes any information you send us through one of our website forms and in some cases sends it to our Salesforce database and/or e-mailing lists. We will always indicate on a form what we’ll do with this data and where it will be stored.
  • Campaign Monitor: this is what we use to create our e-mailings, and where we store names and email addresses for mailing lists.
  • CLAPA’s Woo Commerce shop: this is the ‘back end’ of our web shop which stores names and addresses of customers, as well as information on what they’ve ordered. We do not store payment information.
  • Sage accounting software: this is where we store information on our customers and anyone we have financial dealings with, e.g. volunteers claiming expenses. We do not store credit card information.

Everywhere we store your data complies with strict UK and EU regulations on data security and protocols. This includes data centres based in the USA which work to ensure they are fully compliant for organisations, like CLAPA, based in Europe.

By submitting your personal data to us, you agree to us transferring, storing or processing your data in this way. We take all reasonable steps to ensure your data is treated securely and in accordance with your right to privacy.

Payment transactions are handled by Stripe and are encrypted using SSL technology. Select CLAPA staff have access to Stripe but for each payment we can only see the last 4 digits and expiry date of a credit or debit card. This helps us track down payments in case of any issues.

Fundraising Practices

CLAPA is committed to transparent, ethical fundraising practices, and we do everything we can to make our donors and fundraisers confident in how we use their data. Below is a summary of how we may use your information for fundraising.

  • We will not pass on your data for ‘wealth screening’, which is where third parties use your information to tell charities who to target for fundraising or legacies.
  • We may use our own information about your previous donations or fundraising for CLAPA to contact you about future fundraising. If you are actively fundraising, we may call you to catch up or confirm the details of your donations, etc.
  • We will only ever contact you by post or email to invite you to fundraise or donate, and you can opt out of these asks at any time.
  • We do not currently (and have no current plans to) use paid telephone, street or door-to-door fundraising services.
  • We will not phone or visit you personally to solicit donations – anyone claiming to do this on behalf of CLAPA may be committing fraud.
  • We will not share or swap your data with other charities without your explicit consent, including other cleft charities.

The Fundraising Preference Service is a way for the public to opt out of different kinds of communications from specific charities, including direct mail and fundraising appeals. You’re welcome to submit a request through this service to change how you receive communications from CLAPA. However, if you contact us directly to change your preferences (or unsubscribe altogether), rest assured we won’t try to change your mind, and we’ll process your request as soon as possible.

If you have any concerns about our fundraising practices, especially if it’s to do with how we handle your data, please get in touch with [email protected] or call us on 020 7833 4883. We take concerns like this very seriously and will do everything we can to make it right.

How we Protect Your Data

CLAPA takes data protection very seriously. Our staff receive data protection training as part of their induction processes, and we hold refresher training at least once per year. We have a transparent and solution-focused culture at CLAPA, so staff are empowered to speak up if they have any questions or concerns. Our Data Protection Policy has more information on how we do this.

As a small organisation, we might still make mistakes, but we are committed to doing everything we can to make these right. We want to treat your data as carefully as if it were our own, and if there’s a mistake we think you’d want to know about, you can count on us to get in touch.

Your Rights

At any time you can email [email protected] or call 020 7833 4883 to ask for:

  • CLAPA to change or remove some or all of the information we store on you
  • CLAPA to change the way we contact you, and/or the type of content you receive
  • A full record of all the information we hold on you as per your rights to a Subject Access Request under GDPR.

We’ll happily comply with any requests like these to the best of our ability, and we’ll make it as easy as we can for you.

Please note that other websites we may link to should have their own privacy and data protection policies, and CLAPA does not accept any responsibility or liability for these policies. Please check these carefully before submitting any personal data to these websites.

Find out more about your rights as an individual.

Cookies

This website uses cookies to distinguish you from other users. This helps us to give you a better experience when browsing our website and helps us to improve it for other users. We don’t use this information to identify you personally.

See our cookie policy for more information.

This Policy

Any changes we make to this privacy policy will be posted on this page. We may make minor updates without providing notice, e.g. editing for clarity. If a major change is planned which we think any of our users may be concerned about, we will announce these 30 days before they come into effect via e-newsletter, and they will be highlighted at the top of this page.

By continuing to use our website you will be deemed to have accepted these changes.

Contact

Questions and comments regarding this policy or any of CLAPA’s data handling practices should be addressed to [email protected] where they will be passed on to the Data Protection Officer. At the time of writing, this is Anna Martindale.

CLAPA PRIVACY POLICY
LAST MODIFIED: JANUARY 2022

LAST UPDATES:

  • In the ‘Data We May Collect From You’ section, we added more detail to ‘In Short’ about the kinds of information we collect and why. Also in ‘In short’, we added a reference to the Records Management Policy now linked below.
  • In the ‘Data We May Collect From You’ section, we added a bullet point under ‘in Detail’ about comments, as we did not think this was explained clearly enough in the above bullet point about the website.
  • Added the ‘How We Protect Your Data’ section as we did not think this was explained clearly enough elsewhere in the policy.

As these updates are relatively minor and do not reflect a change in our practices, we will not send an update notification to all relevant people on whom we hold records. Instead, we will communicate this in our January 2022 e-newsletter.

Related Policies

Data Protection Policy (PDF)

NOTE: This linked policy is currently out-of-date. A new policy is under review and will be re-uploaded as soon as this review is complete.

This formal policy outlines the principles upon which the Privacy Policy on this page is based and the standards to which we hold ourselves when it comes to keeping your data safe.

Last Updated: December 2018

Records Management Policy

NOTE: This policy is currently under review and will be re-uploaded as soon as this review is complete.

Last Updated: December 2018

Subject Access Policy (webpage)

One of your key rights under data protection law is your entitlement to a copy of all the information organisations like CLAPA hold on you. This page explains what this means, and how you can make a formal request.

Last Updated: January 2022

Cookies Policy (webpage)

Cookies are used by almost all websites to distinguish you from other users and give you a better experience when browsing our site. This policy explains what they are, why they’re collected, and how we use them.

Last Updated: January 2022

Complaints Policy (PDF)

If you’re not happy with how we’ve used your data, or you have any other issues with CLAPA, we’d like to do everything we can to make it right. This policy explains how to make a complaint and what we’ll do about it.

Last Updated: January 2022

Comments are closed.