Privacy Policy

Data protection is important to us

We have two separate data protection statements. These relate to:

our Centres and Red Balloon of the Air, their staff, students and families
our fundraising and marketing (below)

Your privacy: our policy for fundraising and marketing

In this policy, you will find important information about your personal rights to privacy, and how and why we use your personal information.

If you are a donor or a fundraiser, we have a fundraising promise which sets out our commitment to you as a Red Balloon supporter.

In line with the General Data Protection Regulations (GDPR) this policy:

sets out the rights you have regarding your data, such as how to amend it
details the ways in which we collect, store, share and use personal data and why
sets out the lawful grounds we rely on to process your data
describes how long we retain information
clarifies that we may collect sensitive personal information, if we have a valid reason to do so and permitted under GDPR

If you have any questions about any of these changes, please contact us and we’ll be happy to help.

What this policy covers

A quick note on what “Red Balloon” means
Our promise to keep your information safe
How we process your data
What is personal information?
How do we use your personal information?
If you / your child is learner with Red Balloon
How creating a record for you helps us to be more relevant
Marketing to you and talking about fundraising
Donations and other payments
How long do we keep your personal information?
What happens if you ask for your data to be removed?
Our lawful grounds for processing your information
What do we mean by ‘legitimate interests’?
Processing sensitive personal data
Will we share your personal information?
Security, storage and access to your personal information
Your rights
Changes to this notice
Links and third parties
How to contact us

1. A quick note on what “Red Balloon” means

In this privacy policy, “Red Balloon” means Red Balloon Learner Centre Group (registered charity number 1109606).

2. Our promise to keep your information safe

At Red Balloon, we are committed to protecting your privacy. We promise to respect any personal information you share with us (or that we receive from other organisations) at all times, and we promise to keep it safe.

3. How we process your data

This policy sets out how we process your data. It also explains your rights and options around how we use your personal information.

We collect information about you:

…when you give it to us directly. This might be when you:

make a donation
interact with us online
register with us
communicate with us
take part in an event
apply to work or volunteer for us
give us personal information in any other way, for example if you are a parent or guardian of a child receiving support from Red Balloon.

…when you give it to us indirectly. This is when your personal information is given to us by third parties. These might be:

websites such as JustGiving
business partners
sub-contractors in technical, payment and delivery services
event organisers
sponsors
advertising networks
analytics providers and search information providers.

You will always hear from them when this happens, and be told how and why we intend to use that information.

You might tell us through a third-party website (such as the London Marathon) that you’d like to fundraise for Red Balloon by taking part in an event.

When this happens, we will contact you by phone or email to check how you’d like to hear from us in the future, and to offer you support with your fundraising efforts.

...when others give it to us. If you are a parent or guardian of a child receiving support from Red Balloon, we may be given personal information about them from previous schools, mental health team or other professional related to their care.

…when it’s available publicly. Some information about you may be in the public domain, using public registers such as Companies House, the electoral roll and press reports. For example:

whether you have charitable interests
to establish possible common connections between Red Balloon’s network and yours.
Depending on your privacy settings for professional services such as LinkedIn.

…when you visit this website. When you visit this website, we automatically collect the following personal information:

technical information, including:

the internet protocol (IP) address used to connect your computer to the internet
your browser type and version
your time zone setting
browser plug-in types and versions
your operating systems and platforms
information about your visit to our website, including:
the uniform resource locator (URL) clickstream to, through and from this site

information about your visit to our website, including:

products/services you viewed and searched for
page response times
download errors
length of visits to certain pages
referral sources (how you arrived at the website)
page interaction information (such as scrolling and clicks)
methods used to browse away from the page.

Like most websites, we use ‘cookies’ to help make our site, and the way we use it, better. Cookies mean that a website will remember you. They’re small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier. We also collect this information so we can see what type of device and operating system you’re using to access our website. This helps us optimise our website for the most frequently used devices.

4. What is personal information?

If we receive it, we collect, store and use the following kinds of personal information:

Your name and contact details, including postal address, telephone number, email address and, where applicable, social media profile URL
Your date of birth
Financial information, such as bank details or credit/debit card details, where you provide them to make a payment. We don’t store credit or debit card details, but we’re required to store bank details in some circumstances, including when they’re used for direct debit payments.
Information about your computer/mobile device and your visits to and use of this website, including for example your IP address and geographical location
Information as to whether you are a tax payer so that we can claim Gift Aid.

If your child is receiving support from Red Balloon please see our separate policy which outlines what information we may hold.

5. How do we use your personal information?

We use your personal information to:

provide you with information you’ve asked us for
provide further information about our work, services, activities or products
allow you to purchase goods
process your donations
further our charitable aims, including for fundraising activities
research the impact and effectiveness of our work and services
register, administer and personalise online accounts
register and administer your participation in events you’ve registered for
administer and keep our website safe and secure and for internal operations, including troubleshooting, data – analysis, testing, research, statistical and survey purposes
improve your interactions with our website, for example by making sure that content is presented in the most relevant and effective manner for you and for your computer/mobile device
report on the results and impact of our work, services and events
analyse and improve our work, services, activities, products or information (including our website) or for our internal records
use IP addresses and monitor website use to identify locations, block disruptive use, record website traffic or – personalise the way information is presented to you
to process your application for a job or volunteer role with us
training and/or quality control
audit and/or administer our accounts
satisfy legal obligations which are binding on us, for example arising from contracts entered into between you and us or in relation to regulatory, government and/or law enforcement bodies with whom we may work
prevent fraud, misuse of services or money laundering and to perform due diligence in respect of larger donations
reduce credit risk
communicate with you in any other way
for the establishment, defence and/or enforcement of legal claims

6. If you/your child is a student with Red Balloon

This statement should be read in conjunction with the data protection policy listed among the Centres’ policies. If you/your child is a learner at one of our Red Balloon Centres, your details may be shared with Red Balloon Group – the umbrella charity which supports and oversees the development of individual Centres. This will be restricted to staff who require access to the data to perform their job.

7. How creating a record for you help us to be more relevant

We may use your personal information to create a record of your interests and preferences. This means we can make our contact with you more relevant, timely and appropriate.

It also helps us understand the background of our supporters to help us make sure that what we’re asking is appropriate.

8. Marketing to you and talking about fundraising

We use your details to give you information about our work, events, services and/or products which we think might interest you.

For example, we might contact you about services you’ve used in the past, or send you updates about our fundraising appeals, volunteering opportunities and latest campaigns.

Where we do this via email, SMS or phone (if you are registered with the telephone preference service), we’ll only do this with your prior consent.

9. Donations and other payments

When you use our secure online donation or payment pages, you’ll be directed to a specialist supplier company, who will receive your credit card number and contact information to process the transaction. We don’t retain your credit or debit card details.

The information of children wishing to fundraise – Where we capture children’s data online, we’ll seek parental consent for any children under 13. We won’t actively market to under 18s.

10. How long do we keep your personal information?

Please see our data retention policy for details of how long we will keep your information. But we will remove it at any time if:

your personal information is no longer required for the purpose you shared it with us
we’re no longer lawfully entitled to process it
you ask us to remove it

If you or your child is a learner at one of our Centres, then please see the accompanying data protection statement.

11. What happens if you ask for your data to be removed?

If you ask to receive no further contact from us, we’ll keep some basic information about you to make sure we don’t send you unwanted materials in the future.

12. Our lawful ground for processing your information

GDPR requires us to rely on one or more lawful grounds to process your personal information. These are the grounds we think are relevant.

Where you’ve given your consent for us to use your personal information in a certain way.
For example, we’ll ask for your consent to use your personal information to send you electronic direct marketing/fundraising, and we may ask for your explicit consent to share sensitive personal information with us.
Where necessary so that we can comply with a legal obligation (for example, where we need to share your personal information with regulatory bodies which govern our work and services).
Where necessary for the performance of a contract which we have with you or to take steps before entering a contract (for example, if you work for/volunteer with us).
Where it is in your/someone else’s vital interests (for example, in case of medical emergency suffered by learner attending one our centres).
Where there is a legitimate interest in us doing so (for example, writing to supporters to let them know about our work and ways of supporting us).

13. What do we mean by ‘legitimate interests’?

GDPR allows us to collect and process your personal information if it is reasonably necessary to achieve ours or others’ legitimate interests, as long as that processing is fair, balanced and does not unduly impact your rights.

Red Balloon’s legitimate interests
In broad terms, our “legitimate interests” means running Red Balloon as a charitable entity in pursuit of our aims and ideals. For example, by:

processing donations
administering events
taking applications for staff and volunteers.

Your legitimate interests
“Legitimate interests” can also include your interests, such as when you have requested information or certain goods or services from us, and those of third parties (for example, learners participating in our centres).

How do we balance these interests?
When we legitimately process your personal information in this way, we consider and balance any potential impact on you (both positive and negative), and your rights under GDPR regulations.

We won’t use your personal information for activities where our interests are overridden by the impact on you. For example, where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted by law).

14. Processing sensitive personal data

GDPR prohibits the processing of sensitive personal data (special category data) unless additional conditions are met.

We think the following condition is relevant, in each case in accordance with the relevant safeguards:

where the processing is necessary for the provision of education and care

15. Will we share your personal information?

We never share, sell or rent your information to third parties for marketing purposes.

However, in general, we may disclose your personal information to selected third parties in order to achieve the other purposes set out in this policy.

These may include (among others):

healthcare professionals or education establishments involved in providing the care of your child
business partners, suppliers and sub-contractors
analytics and search engine providers
IT service providers
other beneficiaries, executors and legal advisers, when administering a legacy.

In particular, we reserve the right to disclose your personal information to third parties:

if substantially all of our assets are acquired by a third party, personal information held by us may be one of the transferred assets
if we are under any legal or regulatory duty to do so; and/or
to protect the rights, property or safety of Red Balloon, its personnel, Learners, visitors or others.

16. Security, storage and access to your personal information

We promise to keep your personal information safe and secure. We have appropriate and proportionate security policies and organisational and technical measures in place to help us do this.

Only appropriately trained staff, volunteers and contractors can access your information. It is stored on secure servers with features to prevent unauthorised access.

In general, the personal information that we collect from you will be stored at a destination within the UK or European Economic Area (“EEA”). However, we use agencies and suppliers to process personal information on our behalf. Your personal information may therefore be transferred or stored outside, and/or otherwise processed by contractors operating outside the UK or EEA who work for us or for one of our suppliers.

Please note that some countries outside of the EEA have a lower standard of protection for personal information, including lower security requirements and fewer rights for individuals.

Where your personal information is transferred, stored and/or otherwise processed outside the EEA, we will take all reasonable steps necessary to make sure the recipient implements appropriate safeguards (such as by entering into standard contractual clauses) designed to protect your personal information and to ensure that your personal information is treated securely and in accordance with this Policy.

Unfortunately, no transmission of your personal information over the internet can be guaranteed to be 100% secure.

17. Your rights

These are your rights in relation to how we process your personal information:

Right to be informed
You have the right to be told how your personal information will be used. This policy and other policies and statements used on this website and in our communications provide you with a clear and transparent description of how your personal information may be used.

Right of access
You can write to us to ask for confirmation of what information we hold on you and to request a copy of that information. Provided we are satisfied that you are entitled to see the information requested and we’ve successfully confirmed your identity, we’ll give you your personal information (subject to any exceptions that apply).

Right of erasure
You have the right to ask us to delete your personal information, and we’ll do this when you ask us to. In some cases, we may check to see if you’re happy for us to make it anonymous first, rather than delete it completely.

Right of rectification
If you believe our records of your personal information are inaccurate, you have the right to ask us to update those records. You can also ask us to check the personal information that we hold about you if you are unsure whether it is up to date.

Right to restrict processing
You have the right to ask us to restrict the processing of your personal information if there is disagreement about its accuracy or legitimate usage.

Right to object
You have the right to object to processing where we are:

processing your personal information on the grounds of legitimate interest
using your personal information for direct marketing or
using your personal information for statistical purposes.

Where we rely on your consent to use your personal information, you have the right to withdraw that consent at any time. This includes the right to ask us to stop using your personal information for marketing or fundraising by electronic means (for example to be unsubscribed from our email newsletter list).

Where we take automated decisions (ie with no human involvement) in relation to your personal information, you have the right to ask us for human intervention or to challenge any such decision.

How to exercise your rights
To exercise any of these rights, please send a description of the personal information in question using the contact details below. We reserve the right to ask for:

personal identification
further information.

If you have any concerns about our marketing or fundraising, please see our guidelines on ‘how to raise your concerns’.

18. Changes to this notice

We may update this policy from time to time so please check back periodically. We will notify you of significant changes by placing a notice on our website. This policy was last updated in December 2019.

19. Links and third parties

We link our website directly to other sites. This policy does not cover external websites and we are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policies of any external websites you visit via links on our website.

20. How to contact us

Please let us know if you have any questions or concerns about this policy or about the way in which your personal information is being processed by contacting us at the following channels:

By email: admin@rbet.ac

By phone: 01223 366052

By post:

Fundraising and marketing team

Willow Lodge

37 High Street

Milton, Cambridge

CB24 6DF

Last updated 20 September 2022