Privacy Policy

About CLAPA

Cleft Lip and Palate Action (CLAPA) is the operating name of the Cleft Lip and Palate Association, a registered Charity in England and Wales (1108160) and Scotland (SC041034), which is a company limited by guarantee registered in England and Wales (5206298).

CLAPA is committed to protecting your privacy and always using your data responsibly.

We know you’re putting your trust in us by sharing your personal data, and we want you to feel confident that we respect your privacy and rights. When you share your personal information with us, we’ll treat it with care and respect, and if you think we’ve made a mistake we’ll do everything we can to make it right.

This privacy policy (and any other documents referenced in it) explains how we use personal data which we collect from you or which you provide to us. By using our website (www.clapa.com) or providing any personal data as explained below, you are accepting and consenting to the practices described in this policy.

If at any time you’d like to change your information or how we communicate with you (or if you’d like to stop receiving communications from us altogether), get in touch at [email protected] or call us on 020 7833 4883. We won’t try to change your mind or ask for any more information other than what we need to process your request.

Data CLAPA may collect from you

In Short

We collect and process personal information which we need in order to operate as a charity, from contact details to health information (such as your connection to cleft lip and palate) to details of donations made and services used. In all cases, we do our best to make sure we’re not asking for any more than what we need for a specific purpose, and to make it clear what will happen to your information in each case. You have control over what you share with us, how we use it, and how long we keep it for.

When you use our website, we’ll also collect information that your browser or email platform shares with us, like where you are in the world or what links you click on. We don’t use this to identify you personally and don’t pass this data on to anyone else. When you open our emails (such as our CLAPA Connect e-newsletter), we also collect data about who opens and clicks on each email. Unless there’s a good reason for us to do so, we don’t look at individual people’s data; instead, we use overall statistics to help us improve our emails.

In Detail

CLAPA may collect and process the following kinds of data about you:

• Information you provide when signing up to our mailing list or when submitting any of the forms on our website, such as our fundraising enquiry form. This information can include things like personal contact details, your child(ren)’s date of birth, your ethnic origin, which of our services you may be interested in, and other information you provide when submitting one of these forms. Completing these forms is optional; you have control over the information you send to us in this way.
• Depending on your privacy settings, our website may collect information available from your browser, such as the country you’re in and the language you’re using, as well as resources you access. This is statistical data about our visitors’ browsing habits and does not identify you personally, though we do use it to better understand how people use our website.
  • This website uses cookies to distinguish you from other users. This helps us to give you a better experience when browsing our website and helps us to improve it for other users. We don’t use this information to identify you personally. See our cookie policy for more information.
  • Pages and articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites (such as Instagram or YouTube) behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
• Our emailing software (for e-newsletters) Campaign Monitor may collect information available from your browser or email client, such as when and where you opened any of our emails and which links you clicked on. Like almost all organisations, we use this to analyse how successful our emails are. We won’t access the tracking data for your email address unless it’s to provide you with a service you’ve asked for or process a request you’ve made.
  • To avoid sending tracking data (for all emails, not just CLAPA’s), you can set up your email client to not download/display external images automatically, and access any links by right-clicking on them, selecting ‘copy link location’, and pasting the link in a different browser window or tab.
• Information about your use of our services, such as your attendance at events or the use of our Parent/Peer Support Service. Sensitive details will be kept confidential and only shared with necessary staff members.
• If you contact us, we may keep a record of that correspondence. If you send us personal information via email, we may keep your email address and the contents of your message for our records.
• We may ask you to complete optional surveys for research purposes and/or to help us improve our services. Unless clearly stated, we will not collect personally identifiable information in these surveys and will not connect you personally to your responses.
• Details of orders made through our online shop and the fulfilment of these orders. We use this information to process your orders and to help you with any issues with your orders. Please note credit and debit card information provided through our shop is sent directly to the payment processor (Shopify Payments) and is not held by CLAPA, nor is it accessible by staff. Certain staff members can access limited information about payments you make, but this is only so we can identify specific payments to resolve issues or respond to queries.
• CVs, application forms, references or other information about yourself which you provide to us for specific purposes.

We have a Records Management Policy which details how long we keep different kinds of records, why we keep them, and what happens when it’s time to delete these records. We regularly clean up our database and other systems to make sure we’re not holding onto any more information than we need. Our staff also receive regular data protection training to ensure they’re up to date on the latest legislation.

How CLAPA stores your data

In Short

We store your data in a few different secure systems for different purposes. All these systems comply with all UK and EU data laws. We do not store or have access to payment information provided online.

In Detail

We store your data in six key places:

• Salesforce database (CRM): this holds most of the personal data and contact information we collect. This system is carefully set up so that staff only have access to the records and information they need to fulfil their roles.
• CLAPA’s IT system: this is where CLAPA’s files are stored, and this may include temporary copies of mailing lists, copies of letters we’ve sent you, etc. This is also where any information you send us via email is stored until deletion.
• Gravity Forms, Microsoft Forms: these systems process the information you send us through one our forms. In some cases, they send it directly to our Salesforce database and/or e-mailing lists. We include a link to this policy on forms collecting personal data and will highlight if we think there is anything else you should know before submitting your information.
• Campaign Monitor: this is what we use to create our e-mailings (such as CLAPA Connect), and where we store names and email addresses for mailing lists.
• CLAPA’s Shopify shop: we run our shop through Shopify, which stores names and addresses of customers, as well as information on what they’ve ordered. We do not store information such as card details; payment transactions are handled by Shopify and are encrypted. Select CLAPA staff have access to Shopify but for each payment we can only see limited information such as the last four digits of a payment card. This helps us track down payments in case of any issues. Shopify has its own privacy policy which is available in our shop.
• Xero accounting software: this is where we store information on our customers and anyone we have financial dealings with, e.g. volunteers claiming expenses. We do not store credit card information.

Everywhere we store your data complies with strict UK and EU regulations on data security and protocols. This includes data centres based in the USA which work to ensure they are fully compliant for organisations, like CLAPA, based in Europe.

By submitting your personal data to us, you agree to us transferring, storing or processing your data in this way. We take all reasonable steps to ensure your data is treated securely and in accordance with your right to privacy.

How CLAPA may use your data

In Short

We’ll use your information in the way you’ve asked us to. For example, to send you emails or other communications, to provide you with a service you’ve signed up for, or to help you with fundraising. You can ask for us to change your details or preferences (or to remove you from our database altogether) at any time (see ‘Your Rights’ below).

We’ll also analyse your information as part of our wider database to find out more about our community and make sure our services are working as well as they can be for everyone.

In Detail

Your data will only be used for the purposes indicated when you submit the data or as laid out in this privacy policy.

We use personal information held about you in the following ways:

• To update and enhance our records. Please note that while we work to ensure the data we hold on you is accurate and up to date, CLAPA cannot be held responsible for confirming the ongoing accuracy of your personal information. You can contact us at any time to change or update your information.
• To provide you with the information, products and/or services you’ve requested from us.
• To provide you with the most relevant information and announcements. This may include invitations to take part in research studies which we think may be particularly relevant to you.
  • Some sensitive data linked to your personal record which you’ve shared with us (such as your connection to cleft or your child’s date of birth) is used to make sure you only receive relevant communications.
• To send you the kinds of communications you’ve asked to be sent when signing up, e.g. CLAPA Connect e-newsletters. You can opt in or opt out of any kinds of content we send you by following the instructions on the relevant content, by contacting us directly, or by updating your preferences (see ‘Your Rights’ below).
• To make sure the content on our website and in our emails is presented in the best way for you and your browser or device.
• To review our services and the content we provide to make sure it’s right for our community.
• We may analyse your data as part of a large set to compile information on our community so we can make sure our services are appropriate and accessible to all. For example, looking at how many people in our community have children of a certain age, or how many people clicked on a particular link in one of our emails.
• • Some sensitive data linked to your personal record which you’ve shared with us (such as your gender or ethnic origin) is carefully restricted and is only used for reporting and analysis where individuals are not personally identifiable.
• We do not currently (and have no plans to) use paid telephone, street or door-to-door fundraising services. CLAPA staff may contact you by post, email or occasionally telephone for fundraising purposes; this will be in line with your contact preferences, and you can change these at any time.

How CLAPA may share your data

In Short

We won’t give, trade or sell your information to anyone else so they can contact you directly without your explicit consent.

We only pass on your information to others if they’re working for us (e.g. to send out fundraising materials you’ve asked for), and we make sure they take good care of this data while they have it.

In rare and extreme circumstances, we may have a legal obligation to share information with the police or other parties.

In Detail

All CLAPA Staff have some access to our secure database which holds most of the personal information we may collect. The level of access individual staff members have depends on the data they need to do their job day to day. Other personal information (such as information you send in emails to staff) may be stored on our database if staff believe it is necessary to ensure we have a complete record of your history with us.

Selected volunteers may access this database if their work with us necessitates this, e.g. if they are helping us ‘cleanse’ our database of old addresses, or if they are working with us long-term as an intern. These volunteers sign a data protection agreement, full training, their access is limited to what is strictly necessary, and their work is carefully monitored.

Third Parties

• We will never pass on your information to a third party so they can contact you directly without your explicit consent. Your information will also never be sold to or ‘swapped’ with a third party, including other charities or the NHS.
• We may pass on your data to carefully screened third parties for processing to help us clean up our database (e.g. by removing records of the deceased), or for the purposes of mass-mailing. These organisations follow strict data protection procedures and do not keep your data longer than is necessary.
• We may disclose your personal information to third parties without your explicit consent if we have a legal obligation to do so, or to enforce or apply any other agreements you’ve entered into with us. These occasions are extremely rare.

How we Protect Your Data

CLAPA takes data protection very seriously. Our staff receive data protection training as part of their induction processes, and we hold refresher training at least once per year. We have a transparent and solution-focused culture at CLAPA, so staff are empowered to speak up if they have any questions or concerns.

As a small organisation, we might still make mistakes, but we are committed to doing everything we can to make these right. We want to treat your data as carefully as if it were our own, and if there’s a mistake we think you’d want to know about, you can count on us to get in touch.

CLAPA’s Fundraising Practices

CLAPA is committed to transparent, ethical fundraising practices, and we do everything we can to make our donors and fundraisers feel confident in how we use their data. Below is a summary of how we may use your information for fundraising.

• If you are actively fundraising or have recently donated, we may call you to catch up on your fundraising progress or confirm the details of your donation. If you have consented to further contact, we may use our own information about your previous donations or fundraising for CLAPA to contact you about future fundraising opportunities.
• We  may contact you in the ways you’ve consented to (post, telephone, and/or email) to invite you to fundraise or donate, and you can opt out of these communications at any time.
• We do not use paid telephone, street or door-to-door fundraising services. Anyone claiming to do this on CLAPA’s behalf may be committing fraud.
  • Genuine CLAPA fundraisers will have a letter of authorisation and will comply with our Fundraising Terms and Conditions. Please contact us immediately at [email protected] if you have concerns about anyone fundraising or soliciting donations for CLAPA.
• We will not pass on your data for ‘wealth screening’, which is where third parties use information from different databases to tell charities who to target for fundraising or legacies.
• We may use public sources of information (such as Companies House, business-related resources, or property websites) to supplement our own data on
  • This is done to help CLAPA with:
    • Due diligence before seeking or accepting significant donations
    • Carrying out required identity, source of funds, and money laundering checks
    • Assessing whether individuals are subject to sanctions
  • Details of this publicly available information will be carefully restricted and not be added to individual records, but decisions made based on this information (e.g. if someone should be removed from a contact list to ensure they don’t receive inappropriate fundraising communications) will be recorded on our database.
• We may contact you by post, email or occasionally telephone for fundraising purposes, depending on the details we have on record and your communications preferences. You can opt out of these asks or update your communications preferences at any time.
• We will not share or swap your data with other charities without your explicit consent, including other cleft charities.

The Fundraising Preference Service is a way for the public to opt out of different kinds of communications from specific charities, including direct mail and fundraising appeals. You’re welcome to submit a request through this service to change how you receive communications from CLAPA. You can also or contact us directly to change your preferences (or unsubscribe altogether). We won’t try to change your mind, and we’ll process your request as soon as possible.

If you have any concerns about our fundraising practices, especially if it’s to do with how we handle your data, please get in touch with [email protected] or call us on 020 7833 4883. We take concerns like this very seriously and will do everything we can to make it right.

Your rights

At any time you can email [email protected] or call 020 7833 4883 to ask for:

• CLAPA to change or remove some or all of the information we store on you
• CLAPA to change the way we contact you, and/or the type of content you receive – you can also update this information using this form
• A full record of all the information we hold on you as per your rights to a Subject Access Request under GDPR.

We’ll comply with any requests like these to the best of our ability, and we’ll make it as easy as we can for you.

Please note that other websites we may link to should have their own privacy and data protection policies, and CLAPA does not accept any responsibility or liability for these policies. Please check these carefully before submitting any personal data to these websites.

Find out more about your rights as an individual.