This Privacy Notice includes:
- Who we are
- How and why we process personal data
- Our lawful basis for processing personal data
- Who we share your personal data with
- How long we keep your information for
- Your rights
- Withdrawing Consent
Who we are
WaterAid, a UK charity, aims to transform lives by improving access to clear water, decent toilets and good hygiene available in the world’s poorest communities.
WaterAid (registered company number 1787329 and registered charity numbers 288701 (England and Wales) and SC039479 (Scotland)) also operates a wholly owned trading subsidiary, WaterAid Trading Limited (registered company number 2362892).
WaterAid operates globally and is established in a number of countries across the world in a federation structure. This privacy notice only relates to the data controlled by WaterAid UK and our federation coordinating body, WaterAid International. It does not cover the practices of the other WaterAid federation members themselves (see list below).
WaterAid International is a coordinating body designed to promote working relationships between federation members and share good practice. It does not process the personal data of supporters. No WaterAid Federation Member shares the personal data of its supporters with other federation members for marketing purposes. The only circumstances where supporter data could be shared between federation members would be where a clear lawful basis is established, in compliance with data privacy law, and where appropriate safeguards have been put in place to ensure the security of the data in transit.
- WaterAid America
- WaterAid Australia
- WaterAid Canada
- WaterAid India
- WaterAid Japan
- WaterAid Sweden
- WaterAid UK
If you have any questions regarding this Privacy Notice, or wish to exercise your data protection rights, please write to our Data Protection Officer using the contact details below:
Or you can call our Supporter Care team: 0207 793 4594
How and why we process personal data
Below is a list of the different ways in which we may process personal data. You can click each heading for more information about how and why we process data in this way.
When making a donation or a payment to WaterAid
We will process your personal data when you make a donation or payment to WaterAid. We collect the necessary data to process and verify this transaction, and set up a direct debit with your bank if you have chosen to give in this way.
Any payment details (such as credit or debit cards) we receive through our website are passed securely to our payment processing providers who meet the required Payment Card Industry (PCI) Security Standards.
We will retain information regarding your transaction (such as your name, contact details, and donation amount) for six years for internal audit purposes and in accordance with the Limitation Act (1980).
When enquiring about our activities or services
We will process your personal data when you contact us about our activities or services. Typically this will involve processing your name and contact details in order to respond to you, or any other personal data you volunteer to us in your correspondence.
The amount of time we retain this information will vary depending on the nature of your query. It is likely we would retain this data for no more than two years in accordance with our email retention practice. It is possible we will retain this data for a longer period if you correspond with us on a regular basis or are contacting us in order to raise a complaint.
When we send administrative communications to you
We will process your personal data in order to communicate with you using the contact details you have provided for administrative purposes. This could be to administer a donation, provide you with information regarding a fundraising event you have asked to take part in, or in relation to GiftAid claims.
When we send marketing communications to you
We will process your personal data in order to send you marketing communications where we have a lawful basis to do this.
We will seek your consent for any direct marketing by electronic means (e.g. email, telephone or texts). We currently send the following marketing materials:
(a) Updates about our work – including newsletters, magazines and other publications.
(b) Campaigns – information about our campaigning activities and their progress.
(c) Appeals and fundraising activities – including requests for donations, information about how you can leave us a gift in your will, and how you can take part in fundraising events or fundraise on our behalf, as well as the impact all of this has on our work.
(d) Events – including details of our challenge events and other sponsored activities. If you sign up to take part in an event we will also send you administrative communications about how you can take part.
(e) Shop products – including information about products offered by our online shop.
(f) Volunteering – information about how you can get involved with volunteering for WaterAid.
We will also rely on our legitimate interest in order to send you postal marketing content when we collect your postal address from you unless you opt-out of receiving communications in this way.
You are in control of how we use your personal information for marketing and fundraising purposes, and can update your preferences at any time. If you would like to contact us about your marketing preferences, please email email@example.com or call us on 0207 793 4594 – our Supporter Care Team will be happy to answer any queries you may have. If you do ask us to stop sending marketing communications, please note that we will continue to send you administrative communications as needed.
If you ask us to stop sending you marketing materials, we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.
We will retain your personal data for marketing communications for as long as we have an active supporter relationship with you. If you have not donated, volunteered, or otherwise been an active supporter of WaterAid then we will cease processing your personal data for marketing purposes three years from the date of your last activity with WaterAid.
Please note that we may retain your marketing preferences for a lifetime if you have registered with the Fundraising Preference Service in order to prevent marketing from all UK charities. This is so that we can ensure we never send marketing material to you per your request.
When you visit our website
'Cookies' are small pieces of information stored on your computer or mobile device when you visit our website, to collect information and identify you
If you provide your consent for marketing and analytics cookies then we may use information about your use of the WaterAid website to help us analyse trends and, where it is lawful to do so, display WaterAid advertising to you on third-party websites.
For more information please read our cookies policy.
When you campaign, fundraise, take part in an event, or meet with us
The personal data we will process may vary in each specific circumstance and you will be advised of this as you sign up to your respective activity. In all circumstances we will seek to process the minimum amount of personal data that we need in order to ensure the smooth running of an activity, and to ensure your safety and the safety of others. Occasionally we may need to ask for data regarding your health (such as food allergies) to ensure we maintain a safe environment.
We will typically process data only for as long as it is required for an event and for a short period thereafter (e.g. six months to a year). Depending on the activity, we may be legally required to retain information for up to six years.
When you volunteer with us
If you apply to be a volunteer with WaterAid we will ask for your personal data as part of the application process. This will include your name, contact details, references, emergency contact details, information about unspent criminal convictions, and any relevant health and disability information we require in order to make sure we have a safe and welcoming environment.
While volunteering, WaterAid staff will maintain incident logs throughout the day in order to keep track of any issues and ensure the safety of everyone on site. It is possible your personal data may be recorded in these incident logs in relation to your activity as a volunteer. These logs are reviewed at the end of a volunteering event and all trivial data is securely destroyed and any serious incidents are typed up more formally for volunteer managers to review. It is also possible that serious incidents will be reported to our Safeguarding Team (please see the safeguarding section in this privacy notice for more details of this).
We will securely destroy most of our volunteer personal data within a year of your last volunteering event, but we are required to retain certain data regarding references for six years. We will also retain a list of all volunteers and the events they volunteered at for six years from the date of the latest event in case any complaint or incident is brought to our attention during this period.
In the event that your behaviour as a WaterAid volunteer was unsatisfactory we will retain a record of your name and contact details in order to ensure you are not selected as a volunteer during future application rounds. We may also share this information with our volunteer partners to assist them in ensuring safer recruitment practices.
When responding to a safeguarding concern
WaterAid may process your personal data in connection to a concern reported to our Safeguarding Team. The amount of personal data processed will vary depending on the nature of the incident, but we will process the minimum amount of personal data that we need in order to ensure your safety and the safety of others.
The amount of time we will retain safeguarding reports will vary depending on the concern raised with us and will be assessed on a case by case basis. Typically, we will retain a safeguarding report for six years in line with the Limitation Act (1980) but the level risk posed to individuals will be our decisive consideration in determining a retention period.
If a safeguarding concern carries a high level of risk then we may need to share this information with law enforcement agencies, or with another organisation if we are asked for a job reference from them.
When responding to a complaint
We will process your personal data in order to understand, investigate, and respond to a complaint you raise with us. WaterAid will process the minimum amount of personal data that is necessary to respond fully to your complaint, and may ask you for further details where we require them.
WaterAid retains all complaint data for at least six years from the date your complaint has received a final response from us in accordance with the Limitation Act (1980).
Internal audits and investigating fraud
We may process your personal data in the course of internal audits or investigating potential fraud. We will only process the minimum amount of personal data in order to complete an audit or investigation.
When working with large donors and government agencies
WaterAid regularly works with large donors and/or government agencies who are providing financial support to a particular aid project. Sometimes WaterAid may be asked to share small amounts of supporter personal data with respect to certain appeals (most commonly post codes, but on rare occasions this may include names and addresses). We may also be asked to share the personal data of the individuals in the communities we are working to help with donors involved in a project.
This is carried out in order to check that WaterAid is being truthful about the donations it is receiving, and that the money being raised is being spent in accordance with donor and government agency expectations. For example, the UK Government will only agree to aid match certain appeals after checking the validity of our donations.
WaterAid will only share this data where we have both a valid lawful basis to do so, and where we have made arrangements for the data’s security and swift destruction. Your personal data will not be used for any other purpose by the organisations we may share it with.
Supporter and Wealth Analysis
We rely on our Legitimate Interest to conduct analysis of our supporter personal data. We may combine information that you have provided to us with other information about you we can obtain from publicly available sources. This may include information about your parliamentary constituency, census records, other public records, and social media.
We do this in order to gain insights into the people who support WaterAid, such as their approximate age, gender ratio of and an estimate of the size of their households. This analysis helps us to understand our audience more fully, tailor our communications appropriately, and improve the quality of our supporters’ experience with us.
We also carry out wealth screening where we have identified an individual who may possess a high net-worth. Wealth screening is the practice of using personal data to identify high profile and wealthy individuals who may be able to support our work in a greater capacity.
We identify high net-worth supporters in two ways. One way is through analysis of our supporter database to find supporters who have made large donations to WaterAid (usually supporters who have made single donations of approximately £1000 or more). We may then conduct background research on these individuals from publicly available sources in order to learn more about them and ensure we contact them in an appropriate manner. Please see the section on carrying out background research of publicly available information for further details of this.
The other way we carry out wealth screening is by performing prospect research. We analyse from publicly available sources as well as databases which source from publicly available information, such as Factary Phi and Wealth X, in order to identify high-profile and wealthy individuals who may be interested in supporting WaterAid. We process this data in order to assess a prospect’s potential giving capacity to support WaterAid, and whether we think they will have an affinity with WaterAid’s mission. We retain records of these individuals for only as long as it takes to assess their suitability to support WaterAid. Data regarding prospects who we decide not to contact is securely destroyed at the end of this assessment. Data regarding prospects we decide to contact is kept for the duration of that individual’s relationship with WaterAid in accordance with our usual retention schedule.
We may use third party suppliers to undertake these activities on our behalf and share your data with them to the extent required to perform this analysis (usually full name, post code, donation values, and WaterAid event participation). Please rest assured that our suppliers will not share this information with any other organisation and it will only be used for the purposes set out above. Additionally, we may use and disclose information in aggregate (so that no individuals are identified) for marketing and strategic development purposes.
You can opt out of your data being used in any of the ways described in this section at any time. Please call our Supporter Care Team on 0207 793 4594 or email at firstname.lastname@example.org and they will be happy to assist you.
When carrying out background research of publicly available information
We rely on our legitimate interest to conduct background research of publicly available sources into individuals connected to trusts, foundations, companies, or holding significant personal wealth that may be able to support WaterAid’s work. We may collect personal information from open social networks (e.g. LinkedIn and Twitter), company websites, political and property registers, news archives, the Charity Commission, Companies House, Bloomberg, and databases sourced from publicly available information such as Factary Phi and Wealth X, in order to evaluate a person’s wealth and giving capacity, and whether it is appropriate for WaterAid to contact these individuals.
We may also conduct research into public figures and individuals where we may be about to enter into a business relationship or partnership with.
WaterAid will also often conduct network mapping of our donors and prospective supporters. Network mapping is a visual representation of connections among individual and organisations. Most often relationship maps are used to show how people and organizations are connected, and relationship mapping is invaluable for generating new business leads as it allows WaterAid to not only find new connections, but to utilise existing connections as well.
When you provide personal data indirectly
We may obtain your data when it is shared with us by third parties such as professional fundraisers, partners, or subcontractors acting on our behalf, or through fundraising sites such as JustGiving or Virgin Money. These organisations will have their own privacy policies, and/or statements so please do ensure you check when providing your personal information to them.
We always carry out due diligence on organisations who provide personal data to us to ensure it is lawful and secure. Please note that WaterAid never buys or sells personal data.
When you have given other organisations permission to share it
You may have provided your details to another organisation that works with WaterAid. For example, in order to sign up to a third-party event, or if you purchased a product via Shopify on Shop for Life. When working with other organisations, we work to ensure it’s completely clear to you that your information will be shared with WaterAid. The information we get from these third parties depends on your settings and the permissions and choices you have provided, so you should regularly check what you have agreed that these third-party organisations may share with us or with others. Please note that WaterAid never buys or sells personal data.
When you use social media
When you interact with us on our social media channels we will use your name or contact handle in order to communicate with you.
You may also sign up to a WaterAid event using a social media website like Facebook. Any data you enter onto a WaterAid social media page will be sent to us through Facebook or similar social media site.
Depending on your settings and the relevant policies and terms of service, when using social media and messaging services like Facebook and Twitter, you might give us permission to access information about you from those accounts or services.
When we guess business e-mail addresses
Where we have a legitimate interest and feel that an organisation would want to hear from us about supporting WaterAid, we may source information from third-parties that will help us to contact individuals in relevant roles acting on behalf of those organisations. We will use this information in order to guess business email addresses so that we can contact the most relevant member of staff.
When we administer legacies
In the course of administering legacies gifted to WaterAid we may obtain the personal information of, for example, other beneficiaries to the will. We also work with third party probate specialists who provide us with this information, and sometimes obtain it from other charities who are named in the will.
When we create promotional material
With your consent and in line with our Ethical Image Policy, we may use your image in material promoting WaterAid in print or electronic media. Please note, where it is impractical or impossible to seek consent (e.g. large group photographs from a public WaterAid event, or photographs from an event in progress such as a bike ride), we may rely on Legitimate Interests as our legal basis for using these images. We would always seek consent where you, or a handful of individuals are the main focus of an image.
You can withdraw your consent for use in promotional material, and have the right to object to these processing. In these instances, WaterAid will take all reasonable steps to cease using your image with immediate effect, however it may not be possible to withdraw promotional material already released or in late stages of production.
When we process Special Category Data
Certain categories of personal information are regarded by the law as more sensitive than others.
This is known as 'special category' or 'sensitive personal data' and covers things like information about your health, ethnic origin, religious beliefs, political opinions or any genetic or biometric data that is used to identify you.
We do not usually collect Special Category Data about our supporters unless there is a clear reason for doing so, such as participation in a marathon or similar fundraising event or where we need this information to ensure that we provide appropriate facilities or medical support to enable you to safely participate. We may also process Special Category Data if you make the information public or if you tell us about these details in the course of our relationship with you.
We will always make it clear what Special Category Data we are processing and why when we ask for this data.
When you apply for a job with WaterAid
If you apply to work at WaterAid, we will use the information you provide in your application in order to assess your suitability for the role you have applied for.
If you are unsuccessful in your job application, we may hold your personal information after we’ve finished recruiting for up to 12 months to deal with any follow up queries or issues.
We keep statistical information about all applicants to develop our recruitment processes however no individual applicant would be identifiable from this information.
Successful applicants may also require a criminal background check and we work with a trusted organisation in order to facilitate these. All applicants will be advised of the need for a background check within the job advert and job pack information.
If you commence employment with WaterAid, your personal information will be processed in accordance with your employment contract, in accordance with internal WaterAid policies, and our Worker Privacy Notice that you will have access to.
WaterAid may also process your personal data in order to provide a job reference regarding you where we are requested to provide this.
When we keep your information accurate and up to date
WaterAid has a responsibility to make sure all of the personal data it processes is accurate and up to date. We periodically use a third-party provider to screen segments of our active data against publicly available databases (such as the Post Office’s National Change of Address database) to check whether supporter addresses are still current.
Our Lawful Basis for processing personal data
Data privacy law requires us to have one or more lawful grounds to process your personal information. The following grounds are relevant to our use of your information:
- In many cases we will seek consent to process your personal information, for example to send you marketing and fundraising emails, and text messages. Where we do rely on consent, you are entitled to withdraw it at any time and can do so by contacting our Supporter Care Team on 0207 793 4594 or email at email@example.com.
- To protect your vital interests. For example to ensure you get urgent medical assistance if needed when taking part in a fundraising event.
- Where we have a contractual relationship with you. Though the majority of our relationships are voluntary, if we enter into a contract with you (such as when you purchase something from our shop) we will process information to administer that contract.
- Legal obligations. We will sometimes pass on personal information to comply with legal obligations such as providing tax and gift aid information to HMRC.
- “Legitimate Interests”. Where it is appropriate we rely on the processing being in our legitimate interests, provided we are confident that such processing is not likely to override your own legitimate interests or rights and freedoms. For example, sending you marketing and fundraising post, provided this is done in an unobtrusive manner.
WaterAid’s legitimate interests are ultimately in pursuit of our charitable objectives, including:
- Governance and operational management, such as statutory reporting and intergroup transfers with our trading company, and employee and volunteer administration and management
- Publicity and income generation such as marketing, fundraising, and events.
- Sending key administrative communications to keep supporters informed and up to date
- Taking and using photos and/or films of event participants and attendees
- Recruiting and managing volunteers
- Performing supporter analysis, profiling and wealth screening to maximise charitable income and ensure we understand the demography of our supporters and contact them in appropriate ways
- Carrying out background research on potential high net-worth donors or business partners Carrying out market research, such as sending out surveys and conducting focus groups
Who we share your personal data with
We do not sell any of your personal data to third parties for marketing purposes. We will only share your data in order provide our services to you, in order to enhance our services, or in accordance with a legal obligation. Please see below for more details of the different groups we may share personal data with:
Our suppliers and subcontractors
Sometimes we use external organisations to process personal data on our behalf – for example suppliers and subcontractors, payment providers, mailing houses, legacy administrators and external fundraising entities and platforms. Before working with these companies we perform due diliegence checks to ensure they provide appropriate safeguards in respect of your personal data and treat it in accordance with the law. We always ensure we have a contract in place with these third party suppliers, and those contracts include robust data protection requirements. A list of our main suppliers is below:
Mosaic (mailing house) https://www.mosaic-online-systems.com/home.html
Angel (call centre) https://www.helloangel.co.uk/
Microsoft (storage and authentication systems) https://www.microsoft.com/
CloudThing (software support) www.cloudthing.com
Loquate (data quality support) https://www.loqate.com/en-gb/
Within the WaterAid Group
We may share your personal information between WaterAid and our wholly owned trading subsidiary, WaterAid Trading where this is relevant to our relationship with you (e.g. you have indicated wishing to hear more about the work of WaterAid to our trading subsidiary or vice versa).
WaterAid does not typically share personal data with other members of the WaterAid Federation (see the Who We Are section above) and would only do so in circumstances where a clear legal basis is established, in compliance with data privacy law, and where we have put in place appropriate safeguards to ensure the security of the data.
Where we are legally required to, or it is in the public interest
We might need to share your personal information with external organisations if we are under a duty to do so, to comply with a legal obligation, or in order to protect the rights, property or safety of WaterAid, our employees, volunteers, supporters or others. This includes for example sharing details with the police or for regulatory reasons or sharing safeguarding information as part of a job reference.
We may also share information with regulators such as the Information Commissioner’s Office (ICO), the Charity Commission, and Fundraising Regulator.
With Fundraising Partners
WaterAid may also partner with an organisation(s) in order to deliver an event or fundraising initiative. Sometimes personal data will be shared in order to achieve these aims (such as sharing dietary requirements or communication preferences with an event partner). We always ensure that we have appropriate safeguards, contracts, and transparency in place.
International Data Transfers
Financial or technical considerations may occasionally lead us to use the services of a supplier based outside the European Economic Area (EEA), which in turn might lead to your personal information being transferred, processed and stored outside of the EEA. We always take steps to provide suitable safeguards to protect your personal information in these situations so that these transfers are compliant with data protection laws.
How long we keep your information for
Generally, we hold your personal information on our systems for as long as is necessary for the relevant activity, for example, in general we will only keep your contact information for as long as our interactions with you continue and for six years thereafter.
After such a period, within our database, we anonymise records so we can reference behavioural patterns in our data analytics, but the information is no longer personal to you.
We may keep certain data for a longer period, such as data in connection to Legacy Gifts or Safeguarding.
Data privacy law gives you a number of rights that WaterAid works to uphold. These include:
- The right to rectification: To have personal information amended if it is inaccurate or incomplete. You can ask us to check the personal data that we hold about you if you are unsure.
- The right of access: To request a copy of the personal data we process regarding you. Please note that we will seek proof of your identity before proceeding with an access request.
- The right to erasure: To request the erasure of your personal data. Please note that the right to erasure is not an absolute right, but we will erase your data where we are processing it under the basis of your consent, your information is being unlawfully processed, or it is no longer necessary for us to process it.
- The right to data portability. Where we are processing your information on the basis of consent you can request it to be transferred from one service provider to another in a suitable format.
- The right to object. You can ask us to stop processing your personal information in certain circumstances, including an absolute right to ask us to stop processing for direct marketing.
- The right to restrict processing. If there is any disagreement about the accuracy or legitimate usage of your personal information, you can ask us to “hold” it but not use it further, whilst the issue is resolved.
- You also have rights in relation to “automated decision making”. WaterAid does not currently undertake this activity, which involves complex computerised processes which produce legal effects.
If you want to enforce any of these rights in respect to your personal information, please email firstname.lastname@example.org.
Where we are processing your personal data with your consent (e.g. to send you email marketing) then please be advised that you can withdraw this at any time.
If you would like to withdraw your consent then please email email@example.com or call us on 0207 793 4594 – our Supporter Care Team will be happy to assist you.
If you do ask us to stop sending marketing communications, please note that we will continue to send you administrative communications as needed, and that we may be unable to stop some marketing communications that you had been selected for prior to you withdrawing consent.
If you would like to make a complaint about how we process your personal data, please contact our Data Protection Officer at firstname.lastname@example.org.
You are entitled to make a complaint to the Information Commissioner’s Office at any time. However, we are grateful for the opportunity to address your concerns before you feel this step is necessary.
Please note that you can also register with the following services to stop receiving unsolicited marketing communications from a selected charity or charities:
- The Mail Preference Service (MPS), in relation to postal communications.
- The Telephone Preference Service (TPS), in relation to phone calls.
- The Fundraising Preference Service (FPS), in relation to email, telephone, addressed post and/or text messages. We will ensure any new FPS preferences take effect within 28 days.
This policy may change from time to time. If we make any significant changes to this policy, we will publicise these changes clearly on our website or contact you directly with more information.
Please revisit this policy each time you consider giving your personal information to WaterAid.