As from 25 May 2018, under the General Data Protection Regulation, the Jubilee Sailing Trust (JST) will rely on legitimate interest as per GDPR Article 6(1)(f) for some of its processing of personal data.
This permits the organisation to contact its beneficiaries and supporters by post. Individuals are free to opt out of postal contact at any time.
Clear information about how individuals can opt out of contact or change their contact preferences is prominent on our website and printed materials with a data capture element.
An up to date privacy statement is available on the JST’s website www.jst.org.uk.
JST is a high-profile organisation whose work is known throughout the UK and internationally. Many of the individuals whose information we hold on our database have booked a voyage so we believe that they are fully aware of the nature of their relationship with us and the mutually beneficial reasons for remaining in contact. Our detailed rationale for claiming legitimate interest is as follows:
The purposes for which we will use individuals’ personal information
- Sending Friends scheme communications and renewal letters
- Sending fundraising appeals and updates to JST donors who wish to support our work
- Sending voyage programme information to JST supporters who may wish to book voyages
- Sending events information to JST supporter who may wish to attend
- Providing information whilst on our ships for eg. during events, visits or voyages
Without these contact opportunities, JST’s income generation potential is put at risk, affecting the sustainability and survival of the charity:
- Friends scheme benefits are heavily weighted towards post: Welcome Home (from a voyage) Packs and Welcome to the Friends Scheme Packs have to be sent by post
- The income generation opportunity is greatly increased among the current donor base if fundraising appeals are sent by post – direct mail appeals generate higher response rates
- The voyage experience is enhanced, and contributions towards voyages are promoted, if previous voyage crew who are happy to be contacted can be told about our voyage programme and income generation opportunities by both post and e-mail.
Articles 47 and 48 of the GDPR say that direct marketing activity is a legitimate interest; in particular, in the context of a relevant and appropriate relationship between the organisation (JST) and the individual (the recipient), there would be a reasonable expectation that postal details are used for these purposes.
The legitimate interests of third parties
In order to deliver the direct marketing described above, JST may provide individuals’ personal contact details to mailing and fulfilment houses, supplied from our own secure database.
We may also occasionally brief suppliers to carry out analysis, sometimes using personal data and at other times anonymised data, to help determine market trends and opportunities around donating and visiting. This insight enables us to provide the best possible experience for our visitors, beneficiaries and supporters.
We make every effort to ensure the data we send to suppliers is secure at every point of transfer and during all the stages of data processing. Our reputable suppliers are required to provide their security protocols on demand. Personal data will always be held on servers within the EU and is securely deleted by our suppliers as soon as each mailing activity has been completed.
Necessity for the data processing of personal information
JST’s income generation programme is highly dependent on mail for delivering information about JST’s work. Certain hard copy information is required upon booking and hard copy documents are the only method of supplying information on-board the ships during a voyage due to lack of mobile phone reception and internet access.
Without post-based Welcome Home (from a voyage) Packs, appeals and voyage programme information, JST’s ability to continue to generate most of its income from voyage bookings and general donations would be compromised.
If supporters’ ability to book a voyage or donate were to be hindered, the opportunity to earn income would in turn be reduced.
Direct postal mail based fundraising appeals sent by post to existing supporters are crucial to the charity’s income generation activities.
Rights and freedoms of the individual
JST will do the following with the personal information it holds. None of these activities infringe the rights or freedoms of individuals under the terms of the GDPR:
- Securely transfer data to third party suppliers for the purposes of producing personalised direct mail materials (see above)
- Send both generic and personalised content by post – and, where the individual has given explicit permission, by e-mail
- Retain the individuals’ data for as long as the active relationship lasts with JST, for marketing, business analysis and administration purposes
- Retain the individuals’ data for a period after the relationship has ceased, for the same purposes (i.e., no donations have been received). This will be for a maximum of 7 years after the last recorded activity by the individual. These timings are consistent with JST’s statutory responsibilities to retain data for Gift Aid and other tax purposes.
- We will only record and store personal data with the knowledge of the individual
- We will not send promotional or marketing information to people under 18 years of age
– Young people sail with us with the permission of an adult, but
- We may use external data sources to enhance the personal data we store as permitted by Article 22 of the GDPR
- We will not use marketing data obtained from a third party without proof of third party consent for mailing having been obtained by the data owner
Nature of personal information held by JST and processed in reliance on legitimate interests
- Title, first name, surname, address, postcode, country
- Transactional data relating to the dates and amounts paid for voyage bookings and donations
- Bank details are held securely on our Finance systems only for processing Direct Debits, for example for payments relating to regular gifts and lottery products. These payments are protected by the Direct Debit Guarantee. Card details are not retained for one-off purchases
- Other data required – as detailed in our RoPA – in order to safely provide voyages, in the case of an emergency, for planning care during the voyage, and to ensure our voyage crews comprise of people with mixed abilities and circumstances. This data includes dates of birth, Next of Kin, relevant medical information and potential risks such as allergies. This data is held confidentially and only medical and relevant staff have access.
The individuals whose details JST holds fall into these primary categories. They may be active or lapsed. JST claims legitimate interest as outlined above for the purposes of communications, via post, for communication and income generation purposes.
Former employees’ and former volunteers’ data will be dealt with according to the requirements of GDPR:
- Non-transactional supporters
Business to business and corporate partnership relationships
JST is claiming legitimate interest to keep in touch, using their business addresses, with named individual business and corporate partnership contacts with whom the organisation already had a relationship prior to the introduction of the General Data Protection Regulation on 25 May 2018.
This legitimate interest does not extend to contacting these individuals using their personal contact details unless, as private individuals, they fall into one of the categories listed above in ‘Primary relationships’, in which case JST claims legitimate interest for contact by post and will only make e-mail or telephone contact if the appropriate consents are in place.
For new relationships in these categories created with named individuals after 25 May 2018, consent for future contact will be sought and managed in full compliance with the General Data Protection Regulation.
Please direct any queries regarding this statement to the CEO.
Phone: +44 (0)2380 449108