ShareGift Privacy and Data Protection
ShareGift (The Orr Mackintosh Foundation) is a registered charity in England and Wales (1052686) and a registered company in England and Wales (3150478). We are committed to protecting your privacy and security.
This policy explains how and why we use your personal data, and who, under certain circumstances we share your data with. Our practices are aligned with the General Data Protection Regulation (GDPR), and the existing ePrivacy regulation, called the Privacy and Electronic Communications Regulation (PECR). GDPR is effective from 25 May 2018 and replaces the Data Protection Act 1998.
The charity ShareGift does not fundraise and we do not send unsolicited mailings. We will only contact you in connection with the donation of shares you wish to make. We will never share your details with any third party other than for the purposes of completing your donation, or for claiming Gift Aid as per your instructions. A list of the third parties we may share data with is listed in section 6.
As part of ShareGift’s induction process, all staff and volunteers sign a confidentiality agreement and in so doing agree to follow regulatory practices and this policy. New staff receive training in data protection in order to maintain best practices at ShareGift, and we have refresher training on an annual basis.
Any staff member’s behaviour which breaches this policy will be taken very seriously by ShareGift and will be subject to investigation and disciplinary action where appropriate.
What this policy covers
What ‘processing’ means
What database we use
Why we collect your information
What information we collect
How we collect your information
Information we collect directly from you
Information we collect indirectly from you
Why your information is important to us
How we combine and analyse your information
Cookies and Google Analytics
Why consent is important both to you and to ShareGift
Data Storage Policy
Our work with third parties
1. Useful information
1.1 What 'processing' means
‘Processing’ is the action that ShareGift, or a trusted third party (typically our custodian and/or a Company’s registrar), takes when collecting, updating and uploading an individual’s personal information to enable us to legally transfer your shares into our name. When transferring shares via a Company’s registrars we are typically confirming data already held by them in respect of the shares you are donating. Where a donation of cash has been made together with an election for Gift Aid, we will share the relevant details with HMRC in order to reclaim Gift Aid.
1.2 What database we use
We use a database called Microsoft 365, which is a ‘Customer Relationship Management’ (CRM) system.
2. Collecting information about you
2.1 Why we collect your information
The information we request from you is necessary to transfer your shares. The transfer of shares requires the completion of a legal document which the donor signs in order to transfer beneficial ownership of the shares. We need certain information so that we can complete the transfer documents, and thereby your donation.
2.2 Information we collect directly from you
We may collect information directly from you whenever you come into contact with ShareGift. For example, when you contact ShareGift in order to make a charitable donation of shares you provide us with your personal information at your discretion. We record this in our database. This enables us to contact you in order to complete the documentation required to transfer shares.
Your name, email, address, telephone etc.
We may also collect date of birth, nationality and National Insurance Number in circumstances where we are required to do so as the share transfer falls under the FCA’s MIFID2 rules on Transaction Reporting
Your Gift Aid declaration for claiming Gift Aid, This is only relevant if you havedonated cash to us directly or via a corporate dealing service where you elected for Gift Aid.
Under data protection law, certain categories of personal information are recognised as sensitive personal data (such as National Insurance details). In these limited cases, we may collect sensitive personal data about you in order to facilitate the transfer of the shares.
We collect this sensitive personal data only if there is a clear reason for doing so in order to comply with legal and regulatory requirements.
2.3 Information we collect indirectly from you
We may also receive information when you interact with third parties working on ShareGift’s behalf. For example, if you donate shares to us via a dealing service run by one of the registrars, and elect for Gift Aid, the registrars will send us copies of your Gift Aid form. We are obliged to retain these records for 7 years, in line with HMRC rules.
3. Using your information
3.1 Why your information is important to us
We cannot transfer shares, and thereby complete your requested donation, without the information we request from you.
3.2 Your information and marketing tools
We will only ever contact you in connection with the donations you have informed us that you wish to make. Data retained by us on our CRM is not subsequently shared with any third party. We never undertake any form of unsolicited mailing.
3.3 Cookies and Google Analytics
You can always opt-out of Google Analytics cookies by using Google’s opt-out tool
4.1 Why consent is important both to you and to ShareGift
ShareGift is committed to being clear and transparent about how we use your data when it is provided.
By disclosing information to ShareGift you are consenting to the collection, storage and processing of information in the manner described in this policy, unless clearly stated otherwise.
4.2 Your rights
A summary of your rights follows. These are:
The right to access a copy of the personal data we hold. You, or an organisation with legal purpose, can request a copy of your personal data for legitimate purposes. This is known as a ‘Subject Access Request’ and you can make such a request by emailing firstname.lastname@example.org
Please note that proof of identity and the reason for your request will be necessary in order for ShareGift to respond appropriately. We may ask for further details if needed.
The ‘right to be erased’. You can request that ShareGift deletes the data we hold on you. Please note that this will not apply if we have a lawful duty to retain the data.
The right to rectify inaccurate data. As detailed above, you can make corrections to the data we hold about you.
5. Data Storage Policy
Unless you inform us otherwise, under your right to be erased we will retain the information you provided us for 10 years. In the tenth year all information, other than your surname and details of the shares you have donated, will be deleted.
We need to retain the data for a period of 10 years because we can receive queries from donors several years after a donation has been completed and this enables us to provide the history of any donations.
Under HMRC rules, we have to retain Gift Aid declarations for a period of 7 years. These are locked in secure storage and are destroyed in the 8th anniversary year.
6. Third Parties
We may, as part of our legal and regulatory requirements, need to share your information with the following third parties:
Registrars - Registrars maintain the share register of a Company. Registrars can be independent third party organisations, or the Company may maintain their own register. When we are sharing your details with registrars we are confirming details that they already hold about you, in order to effect a share transfer.
Our custodians, who maintain our share portfolio (currently Platform Securities)
Our stockbrokers (currently Killik & Co)
Our website hosts (currently Smarter Web Company) who have access only to information submitted through the secure messaging system on our website.
HMRC – in respect of Gift Aid claims