Please see below our Privacy Notice. For the time-crunched users, a summary of the points is :
- we collect information to provide services or goods, to provide information, to administer our research participant database, to provide grants to researchers, to fundraise for our work, for administration, to manage membership, profiling and analysis to better understand our supporters and for the prevention or detection of crime.
- we don't sell it.
- we do share it, only with your permission, with academic institutions doing research on smell loss.
- where possible, any shared data is anonymised so that you are not recognisable from the data.
- we don't allow advertising on the site.
- we do use Google Analytics which does collect your use data.
- if you are purchasing products from the site, your financial information will be passed to the third party financial transaction provider (such as Stripe) and we only receive minimal data from them so that we can find your order and confirm it has been paid.
- you have various rights in respect of your data and full information can be found below.
- if you have any enquiries about your personal data please contact us on the details found below.
Please read our entire Privacy Notice below for a more detailed and accurate description of the points above.
INTRODUCTION AND DEFINITIONS
AbScent ("we", "our" and "us") is committed to protecting and respecting your privacy.
References in this Notice to "data protection law" mean (as applicable) the General Data Protection Regulation (Regulation (EU) 2016/679) and all related data protection legislation having effect in the United Kingdom from time to time (including the Data Protection Act 2018).
References in this Notice to "data or "information" include "sensitive personal data" and "special categories of data" (as defined under data protection law) where applicable.
For the purpose of this Privacy Notice, the word 'processing' or 'process' means anything that we can do with your data. This includes, but is not necessarily limited to collecting, storing and sharing with third parties (see below). We give you detailed information on this below, just keep reading.
The data controller with conduct of your personal information is AbScent, a charity registered in England and Wales under charity number 1183468 at 14 London Street, Andover, Hampshire SP10 2PA. Our company number is 11523615.
We are not required to have a data protection officer, but if you have any queries about your personal data please contact firstname.lastname@example.org.
How we use your information
The following sections explain what information we hold about you, why we are processing that information, the legal bases for the processing, the duration for which we keep your information and (if applicable) who your information will be shared with and where those recipients are based.
Which information do we process and for what purpose?
We process the following information from you:
Information you give us.
This is information about you that you give us by filling in forms on our websites, emailing us, writing to us or speaking to us by phone or in person. The information you give us may include your name, address, email address, phone number, date of birth, gender, personal description and photograph.
Information you give us might also include "special categories" of more sensitive personal information. This could include information about your health, including information relating to your smell loss or that of a family member.
We process information you give to us for the following purposes:
to enable you to benefit from the support and information available from AbScent either directly or on our website;
to enable you to take part in the Sense of Smell Project and enable further research, by ourselves and our partners, into smell loss;
to supply you with the goods and/or services you have purchased/requested from us;
to publish your story on our site, social media and elsewhere. We will only do this with your consent and we will anonymise your personal data;
to manage your account with us;
where you have consented to receive information materials, to send you our newsletter and information sheets, to keep in touch with you and tell you about events, goods and services that we offer. Remember, you can unsubscribe at any time by contacting email@example.com;
where you have consented to receive information about fundraising from us, to keep in touch with you and tell you about events, fundraising campaigns and other ways that you can support us; and
to notify you about changes to our service.
Information we collect about you.
Like most other website operators, we use Google Analytics to collect information of the sort that web browsers and servers typically make available. This includes technical information, such as your IP address and your login information and information about your visit, such as records of how you navigate the pages on our site and how you interact with the pages.
We process information we collect about you for the following purposes:
to allow us to administer the account you hold with us and/or your membership if you become a member;
to improve our services;
to comply with our regulatory and legal obligations to process and keep a record of your data;
to ensure that content from our site is presented in the most effective manner for you and for your device; and
to measure or understand the effectiveness of advertising we serve to you and others, and possibly to deliver relevant advertising to you on our site.
Information obtained from or provided by third parties.
We process information we obtain from or are provided by third parties for the following purposes:
where you purchase goods/services from our website, the financial transaction will be dealt with a third party payment provider. We are provided with the last four digits of your card number which we will use for identification purposes should there be any issue with the transaction. Please check the terms and conditions and Privacy Notice of the third party payment provider if you have any questions.
What are the grounds for processing your information?
We are processing your data on the following grounds:
where you have specifically consented to the processing of your special category data for the purposes of being considered for participation in research or participating in the Sense of Smell Project;
where you are purchasing products from our online shop or we are otherwise providing services to you - the processing is necessary for the performance of the contract between you and us. This includes where you have instructed us to take some pre-contractual steps prior to us formalising the contract;
the processing is necessary for us to comply with our legal obligations and tax or other financial regulations;
the processing is necessary for achieving our legitimate interest of conducting research into the long term effects of smell loss. In accordance with data protection law, we have carefully weighed your interests and fundamental rights and freedoms against our interest to process your information and are satisfied that we are justified in processing your information for this purpose;
the processing is carried out in the course of our legitimate activities with appropriate safeguards as a charitable association with a philosophical aim on the condition that:
the processing relates solely to our members, to former members or to persons who have regular contact with us in connection with our purposes; and
the personal data is not disclosed to third parties without your consent;
processing is necessary for the establishment, exercise or defence of legal claims.
Where we collect and use your personal information by relying on the legitimate interest legal basis. In broad terms, our 'legitimate interests' means our interest in being able to run AbScent as a charitable entity effectively in pursuit of our aims and ideals. This includes:
Conducting analysis to better understand who our supporters are and better target our fundraising activity;
Conducting research to better understand who is using our online forums and information services and their impact to improve our service offering;
Measure and understand how our audiences respond to a variety of marketing and communications activities so we can ensure our messages and services are well targeted, relevant and effective;
Providing information about smell disorders;
Staff recruitment and taking applications for volunteers and contacting volunteers about their role
‘Legitimate interests' can also include your interests, such as when you have requested information or certain goods/services from us, and those of third parties. If we rely on the 'legitimate interests' basis to use your personal information, we will only use the information in accordance with the purposes described in this policy.
Duration and further processing
When you give us your details, you agree to us recording your details on our secure database, so we can provide you with the best possible service every time you contact us. We hold your personal information for as long as required to provide you with the information or services you have requested, to administer your relationship with us, to inform our research into macular conditions, to inform our supporters’ preferences, to comply with the law or to ensure we do not communicate with people who no longer wish to hear from us.
We have adopted a data retention policy that sets out the different periods we retain personal information for in respect of these relevant purposes. The criteria we use for determining these retention periods is based on various legal requirements; the purpose for which we hold data and whether there is a legitimate reason for continuing to store it (such as in order to deal with any future legal disputes); and guidance issued by relevant regulatory authorities including, but not limited to, the Information Commissioner's Office (ICO).
Personal information that we no longer need is securely disposed of and/or anonymised so you can no longer be identified from it. Some personal information may be retained by us in archives for statistical or historical research purposes although we will do this in a manner that complies with applicable data protection law.
We continually review what personal information and records that we hold, and delete what is no longer required. We never store payment card data after the transaction has been completed.
Who is your information shared with?
Except as set out in the next paragraph, your personal information is not shared with anyone except where we are required to do so to comply with the law, to protect our rights, to improve and expand our products and services or to effectively operate our charitable purposes and business.
We may share anonymised, pseudonymised and non-personal information with sub-contractors engaged by us to help us operate our site and to analytics and search engine providers that assist us in the improvement and optimisation of our site.
We may share your information with the following people or group of people:
Our Partners - third party academic and/or research institutions who are actively participating in the Sense of Smell Project. At the time of release of this Privacy Notice, they are The University of Tennessee and The University of Dresden. As and when new partners come on board, we will update this list. Please refer back to this Privacy Notice at regular intervals. Typically, we will anonymise your personal data prior to sending to these partners.
Our delivery partners, who require your information to deliver the goods you purchase from us. Our delivery partners have a contractual duty to keep your information confidential.
Our outsourced IT providers and data consultants, who may have access to your personal information on our IT systems as part of the service they provide to us. Typically, your personal information will be encrypted before it is transferred to our hosts but in certain circumstances our service providers may require access to unencrypted personal information, for example when we need to troubleshoot a technical issue. Our IT providers and data consultants are subject to strict contractual obligations to treat your personal information with the utmost sensitivity, to keep it confidential and to comply with data protection law at all times.
Professional advisers, we may share personal information with our legal, financial and other professional advisers for the purpose of obtaining advice, such as legal advice. These transfers are protected by our advisers' duties of confidentiality.
Potential purchasers, we may share personal information with potential purchasers of our business, subject to those persons entering into strict confidentiality obligations with us and being only to the extent permissible under data protection law.
Marketing agencies - We use MailChimp as our marketing automation platform. You can access MailChimp's Privacy Notice here. We also use the ticketing and registrations platform, Eventbrite to organise our workshops and online training events. You will be transferred to their website to enter your details when making a booking. You can access their Privacy Notice here. Where the transfer involves your data being moved outside of the EEA, we do so under the protection of standard contractual clauses which are approved by the EU Commission.
The University of Tennessee is based outside of the EEA but we are authorised to transfer your information to them because a) we anonymise your personal data so that no living individual is identifiable and b) we do so under standard contractual clauses which are approved by the EU Commission. If you are participating in the Sense of Smell Project, you may have given consent to the transfer in the online consent form. If you require further information, please contact firstname.lastname@example.org.
Understanding our supporters and working more effectively
We are committed to providing everyone who gets in touch with us with the very best experience, providing you with timely and relevant communications and using our resources effectively.
To do this, we may use profiling techniques to provide us with general information about you, which may include geographic, demographic or other information relating to you, to better understand your interests and preferences. This information is compiled, either by our employees or occasionally a third party insights company, using publicly available data or information that you have already provided to us or third party organisations helping us run the profiles.
Publicly available information may include information found in places such as Companies House, the Charity Commission, LinkedIn, listed Directorships, typical earnings in a given area or published in the media.
By doing this it allows us to understand the background of the people who support us and helps us to make the right requests. Importantly, it helps us to raise more funds, sooner, and more cost-effectively, than we otherwise would.
We do not make automated decisions about you based on your information.
Under data protection law you have the following rights:
With regard to the Sense of Smell Project, if we are processing your personal information on the basis of your consent then you have the right to withdraw that consent at any time. Consent can be withdrawn by notifying us in writing. The lawfulness of our historic processing based on your consent will not be retrospectively affected by your withdrawal of consent;
the right to access a copy of your information which we hold. This is called a 'subject access request'. Additional details on how to exercise this right are set out in section 5, below;
the right to prevent us processing your information for direct marketing purposes. You can exercise your right to prevent such processing by leaving unchecked certain boxes on the consent forms we use to collect your data. You can also exercise the right at any time by writing to email@example.com;
the right to object to decisions being made about you by automated means. We will inform you if your information is subject to automated processing;
the right to object to us processing your personal information in certain other situations;
the right, in certain circumstances, to have your information rectified, blocked, erased or destroyed if it is inaccurate;
the right, in certain circumstances, to claim compensation for damages caused by us breaching data protection law; and
the right, in certain circumstances, to request that we erase, rectify, cease processing and/or delete your information.
You also have the general right to complain to us (in the first instance) and to the Information Commissioner's Office (if you are not satisfied by our response) if you have any concerns about how we hold and process your information. Our contact details are set out in section 9, below. The Information Commissioner's Office website is www.ico.org.uk.
For further information on your rights under data protection law and how to exercise them, you can contact Citizens Advice Bureau (www.citizensadvice.org.uk) or the Information Commissioner's Office (www.ico.org.uk).
ACCESS TO INFORMATION
Under data protection law you can exercise your right of access by making a written request to receive copies of some of the information we hold on you. You must send us proof of your identity, or proof of authority if making the request on behalf of someone else, before we can supply the information to you. Requests should be sent to us using the contact details in section 9 below.
You do not need to pay a fee to exercise this right unless you are requesting copies of documents you already possess, in which case we may charge our reasonable administrative costs. We are also allowed to charge you for our reasonable administrative costs in collating and providing you with details of the requested information which we hold about you if your request is clearly unfounded or excessive. In very limited circumstances, we are entitled to refuse to comply with your request if it is particularly onerous.
In certain circumstances, you are entitled to receive the information in a structured, commonly used and machine-readable form.
We will always store your digital information on secure servers. Unfortunately, however, the transmission of information via the internet is not completely secure. Although we will do our best to protect your information, we cannot guarantee the security of your information transmitted to our site or otherwise to our servers (such as by email). Any such transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
Third party Sites
Our site may, from time to time, contain links to and from partners', advertisers', affiliates' and social network sites. If you follow a link to any of these websites, please note that these sites have their own privacy notices and that we do not accept any responsibility or liability for those notices. Please check their privacy notices before you submit any personal information to those websites as they may not be on the same terms as ours.
Changes to our Privacy Notice
This Notice was last updated in September 2020. Future changes we may make to our Privacy Notice will be uploaded to our website and if the change is significant we will send you the updated Notice by email. Please check back frequently to see any updates or changes to our Privacy Notice.
Questions, comments and requests regarding this Privacy Notice are welcomed and should be addressed to firstname.lastname@example.org.