Website Privacy Policy – Updated July 2024
Who we are and what we do
Every day, supporters of the Anne Frank Trust (the “Charity”) make a valuable difference by supporting our mission to empower young people aged 9-15 to challenge all forms of prejudice. We value building long-lasting relationships with our supporters based on trust, transparency and compassion. Processing your information helps maintain a secure, well-managed database and adhere to best practices so that your data and preferences are updated.
The data we collect on you helps us better understand you and be more appropriate when communicating with you. For instance, we can recognise and acknowledge your support and commitment to the Charity over the years. This also equips us to handle enquiries, deliver materials, and process payments. Above all, it facilitates our providing quality support.
The Charity is registered with the Charity Commission (charity numbers 1003279 and SC040488 (Scotland)) and Companies House (company number 02612141). It is also registered with the Information Commissioner’s Office as a data controller (registration number ZB016998). Our Data Protection Officer can be contacted via email at info@new.annefrank.stag.sprout.posi.info.
This Privacy Policy sets out the basis for processing any personal data we collect from you or that you provide. Please read this Privacy Policy carefully to understand our views and practices regarding your data and how we will treat it.
In meeting its charitable purposes, the Charity, as a data controller, processes the personal data of the following categories of people:
- Supporters
- Programme Participants, Ambassadors & Teachers
Audience-specific privacy notices covering each of the above categories support this Privacy Policy. We encourage you to read those relevant to your relationship with us for greater detail on how we manage and use your data.
We may need to change or update this Privacy Policy occasionally; if we do so, we will post the changes here. Where the changes are significant, we will inform individuals.
Dated: July 2024
Your personal data
The personal data we may collect about you, why we collect it, and what we do with it will depend on your relationship with us. We collect personal data in many ways, such as when you sign up for a programme, subscribe to our email newsletter, or donate to us.
Please see the audience-specific privacy policies, which can be found below, for more details.
Your rights
Under data protection law, you have rights, including:
- The Right of Access. You have the right to ask us for copies of your personal information.
- The Right to Rectification. You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- The Right to be Forgotten. You can ask us to erase your personal information in certain circumstances.
- The Right to Restrict Processing. You have the right to ask us to restrict the processing of your personal data in certain circumstances.
- The Right to Object. In certain circumstances, you have the right to object to the processing of your personal data.
- The Right to Withdraw Consent. If we rely on consent to process your personal data, you can withdraw that consent at any time.
- The Right to Portability. You have the right to ask that we transfer the personal data you gave us to another organisation or you in certain circumstances.
If you make a request, we have one month to respond. If you have any questions, please contact us at info@new.annefrank.stag.sprout.posi.info. Please note that not all the above rights are absolute, and requests may be refused where exceptions apply.
Subject Access Request
You can ask us to confirm if we are keeping any personal information about you, and you can also request to receive a copy of that personal information – this is called a Subject Access Request.
To make a Subject Access Request, we may ask you to provide proof of identity, such as a copy of your passport, birth certificate, or driving license, before your request can be processed. Please try to be as straightforward as possible about the information you seek, as this will help us respond to your request more efficiently.
If you make a request, we have one month to respond. If you have any questions, please contact us at info@new.annefrank.stag.sprout.posi.info.
You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data. The ICO’s address is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Alternatively, you can phone their helpline at 0303 123 1113 or complete an online form via the ICO website (https://www.ico.org.uk).
Updating your communication preferences
We will respect your email privacy. This means we carefully manage the communications we send you to ensure that we are contacting you in the most relevant way.
You will only receive communications from us that you have requested, except where we may write to thank you for a donation or send you administrative paperwork such as a receipt. You can change your email preferences or unsubscribe at any time by:
- clicking the “unsubscribe” link at the end of any emails you receive from us.
- by contacting info@new.annefrank.stag.sprout.posi.info or calling 020 7284 5858.
- Alternatively, you can unsubscribe from other email communications by replying to the sender.
Please note that we may embed links to third-party websites or pages not managed by the Charity. If you follow any of these links, please note that they have privacy policies. Please check those third-party policies before submitting personal information to those websites. We do not accept any responsibility or liability for these policies.
How do we keep your information secure?
The security of your personal data is essential to us, and to protect your data, we take several necessary measures, including the following technical and organisational measures:
- Limiting access to your personal data to those employees, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to duties of confidentiality.
- Procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data), including notifying you and/or the Information Commissioner’s Office where we are legally required.
- Training all staff when they join the Anne Frank Trust UK and at regular intervals after that.
- Entering into Data Processing Agreements with any third party who processes your personal data on our behalf.
- Data protection and IT policies and procedures reduce the risk of data loss, alteration, accidental or unlawful destruction, and unauthorised disclosure.
Contact us
You can contact us anytime to change your communication preferences or let us know when something changes. If you have any queries about our Privacy Policy or want to raise a concern about how we process the information we hold about you, please email info@new.annefrank.stag.sprout.posi.info or write to The Data Protection Officer, Anne Frank Trust UK, Camden Gateway, 349 Royal College Street, London NW1 9QS. You can also call us on 020 4583 9050.
Audience-Specific Privacy Notices
- Supporters
- Programme Participants, Ambassadors & Teachers
- Trustees
Supporters
What data do we collect?
- Identity data: full name, title
- Contact data: address, email address(es), telephone number, mobile phone number.
- Financial data: donation amount, gift aid declarations, credit card details
- Organisation data: business name
- Profile data: preferences and interests, donation history.
- Opinion data: your views on our services and activities.
- Technical data: (read our Cookie Policy) IP address, browser type and version, operating system.
How do we use your data (and the legal basis for processing)?
Most of the personal data we process is provided directly by you. Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing this information. The table below lists the processing purposes and the lawful basis.
| Purpose for Processing | Legal Basis |
| To process your donation(s) and any gift aid | Legal Obligation |
| To process grant and trust payments, and any legacy gifts. | Legal Obligation |
| Seeking views on the services or activities AFT carry out so that we can make improvements. | Legitimate Interest |
| Sending invitations for events AFT are holding, decide on catering. | Legitimate Interests |
| To subscribe you to the Anne Frank Newsletter(s) | Consent |
| To send you communications that may be of interest to you (these may include information about our services and activities, campaigns, appeals asking for donations, and other fundraising activities, for which we seek support). | Consent |
| To maintain our organisational records to ensure we know how you prefer to be contacted. | Legitimate Interests |
| To use profiling and database segmentation techniques to analyse supporter data and to create a profile of your interests, preferences, and ability to donate. | Consent |
| To cultivate relationships to increase the level of donation. | Legitimate Interests |
| To identify and manage income generation opportunities. | Legitimate Interests |
We may process personal information indirectly from the following sources:
- A table host who has invited you to attend the Anne Frank Annual Lunch.
- We may conduct due diligence research on existing and potential supporters to ensure that donations accepted are unlikely to cause reputational damage to the Charity that could impact our ability to fundraise from other sources or to provide our services.
- We may hold data about people with whom we do not have a relationship. Still, we need to know who we believe will support the charity: local philanthropists, those known to help our area of work or anyone else interested in supporting the charity. In these instances, we may research these people using the above methods and hold their data for up to three years before contacting them. At this point, we will collect the individual’s communication preferences.
Who do we share your data with?
We share your personal information with the following third parties:
| Recipient Activity | Carried Out | Location |
| Salesforce CRM | Our central fundraising and education programme platform. | United States. |
| Creative Clinic | Design of fundraising materials and the Anne Frank Trust website. | United Kingdom. |
| MailChimp | To create, store and disseminate the Anne Frank Trust newsletter. | United States. |
| Microsoft Office 365 | To correspond with individuals. | EEA |
| Xero Accounting Software | To reconcile donations and gift-aid | United States. |
Your data may be transferred to a third party if we transfer or merge parts of our organisation or assets. Any new owner of our organisation may continue to use your data in the same way(s) we have used, as specified in this Privacy Notice.
Do we transfer your data outside of the UK?
We store some of your data in countries outside the UK, which are known as “third countries.” We will only store or transfer personal data in or to countries:
- Deemed to provide adequate protection for personal data via an Adequacy Decision.
- Using Adequate Safeguards, such as the UK’s International Data Transfer Addendum.
How long will we retain your data?
We will not keep your data any longer than necessary, and it will be kept for the following periods:
| Type of Personal Data | Retention Period |
| Financial Data | Six Years |
| Identity, Contact, Opinion, and Organisation Data | Ten Years |
Per our Retention and Data Disposal Policy, we will securely destroy your data.
Programme Participants, Ambassadors & Teachers
What data do we collect?
We currently collect and process the following information:
- Identity data: full name, title
- Contact data: address, email address(es), telephone number, mobile phone number.
- School data: school name, job title, profession
- Attendance data: programmes attended, dates of attendance.
- Profile data: photos, video and audio content, age
- Special categories of data: ethnicity, disability, medical information, food allergies, and language(s) spoken.
- Impact Questionnaire data: comparing views/opinions before and after attending the programme/workshop.
- Technical data: (read our Cookie Policy) IP address, browser type and version, operating system.
How do we use your data (and the legal basis for processing)?
Most of the personal data we process is provided directly by you. Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing this information. The table below lists the processing purposes and the lawful basis.
| Purpose for Processing | Legal Basis |
| To organise and curate case studies or stories from young people. | Consent. |
| To cultivate relationships to increase the level of donation from the annual lunch. | Legitimate Interests |
| To organise and manage peer education programme and workshops with primary and secondary schools across the UK. | Legitimate Interests |
| To organise and manage live online events. | Legitimate Interests |
| To appoint peer educators into the Anne Frank Ambassador Programme. | Legitimate Interests |
| To mentor individuals on the Anne Frank Ambassador Programme. | Legitimate Interests |
| To evaluate and monitor the Anne Frank education programmes | Legitimate Interests Special categories of personal data: explicit consent. |
| To organise and manage the annual National Youth Conference | Legitimate Interests |
| To safeguard the welfare of children and young adults participating in an Anne Frank education programme or workshop. | Legal Obligation |
We also receive personal information indirectly from the following sources:
- Teachers from Primary and secondary schools who are participating in one of our peer education programmes or workshops.
Who do we share your data with?
We share your personal information with the following third parties:
| Recipient Activity | Carried Out | Location |
| Salesforce CRM | Our central fundraising and education programme platform. | United States. |
| Youth Empowerment Panel | To appoint peer educators into the Anne Frank Ambassador Programme | United Kingdom. |
Your data may be transferred to a third party if we transfer or merge parts of our organisation or assets. Any new owner of our organisation may continue to use your data in the same way(s) we have used, as specified in this Privacy Notice.
Do we transfer your data outside of the UK?
We store some of your data in countries outside the UK, which are known as “third countries.” We will only store or transfer personal data in or to countries:
- Deemed to provide adequate protection for personal data via an Adequacy Decision.
- Using Adequate Safeguards, such as the UK’s International Data Transfer Addendum.
How long will we retain your data?
We will not keep your data any longer than necessary, and it will be kept for the following periods:
| Type of Personal Data | Retention Period |
| Identity, Contact, Assessment data, and School Data, and special categories of personal data. | Two Years |
| Safeguarding data | Ten Years |
Per our Retention and Data Disposal Policy, we will securely destroy your personal data.