Privacy policy
Introduction
Aid to Church in Need (ACN UK) is an international Catholic charity which supports the Catholic Church and its members around the world – particularly where it or they experience(s) suffering and persecution, or where our members need pastoral support. Our charitable work includes volunteering, generating awareness and raising funds. Like most organisations, ACN UK needs to collect and use personal information so that it can carry out its work. In doing so, ACN UK is committed to conducting its business in line with applicable data protection law. ACN UK is a “controller” of your personal information: this means that we are legally responsible for our use of your personal information. Accordingly, this privacy policy sets out how and why we use your personal information and provides information about your related rights and options.
1. What personal information do we collect, and how do we collect it?
We collect personal information directly from you when you interact with us and over the course of our relationship with you. Where appropriate and lawful, we also collect personal information from third parties. In more detail, the personal information we collect about you may include:
Personal details and contact information e.g. name, title, gender, postal address, phone numbers and email addresses, and in certain cases date of birth, NI number. Images and audio. | We collect this information when you contact us or donate by post, telephone, on our website and in-person at parish appeals and events. Taken at ACN or related Events. |
We do collect Bank details – name, sort code and account number. | When you set up a regular gift, e.g. Direct debit or a standing order with us. |
The communications you exchange with us and the communications we exchange with you. | When you email, write a letter or call us and we record details of the mailings, letters we exchange with you, notes from any relevant meetings and details of the events you attend. |
We collect personal information such as IP addresses, details of web pages visited, and files downloaded. | When you use our website. Website usage information is collected using |
Your posts, messages, and images on social media direct to ACN. | When you interact with us on social media platforms such as Facebook, X, Instagram, YouTube, TikTok, or LinkedIn. |
Information about how our website is used, such as your searches for information. | When you navigate on our website – this information is also collected by cookies. |
We collect personal information as part of our staff, volunteer or Ambassador recruitment process. | When you apply for a job or for volunteering opportunities with ACN or |
Your giving history, philanthropic interests, and capacity. | To help us communicate with you in the most appropriate way about your giving, your wishes and any associated conditions, or to consider whether you may have the capacity and/or desire to donate to ACN |
We collect personal information necessary for legacy administration. | When a benefactor has died, leaving a legacy to ACN, and you are the executor, or you have an interest in the estate. |
Information that helps us understand your interests and engage with you about our work in the most appropriate way. | From your interactions and transactions with us (including information collected by cookies about how you use our website) and, where appropriate and lawful, third parties providing us with services or acting on our behalf, and/or from publicly available sources. |
2. Marketing Attribution Information
When you make a purchase on our website, we collect certain information about how you arrived at our site. This may include marketing attribution data such as UTM parameters (for example, utm_source, utm_medium, utm_campaign) that indicate the source of your
visit (e.g., Facebook, Google, email campaign).
We use this information to:
• Understand which marketing channels lead to purchases.
• Measure the effectiveness of our campaigns.
• Improve our marketing and customer experience.
This data is linked to your order and may be associated with your name and purchase details for reporting purposes. For example, we may record that a specific order came from a particular campaign or platform.
We also collect personal information from third parties, depending on the nature of our relationship with them and the services they provide. For example (and non-exhaustively):
We use the personal information collected from benefactors for the following purposes:
1. We collect personal information from Fundraise Up, our donation optimisation service provider, who help us to capture and share information with us about how you are using the ACN UK Webpage and interacting with us and our content on social media, and information about what online or social media advertising you clicked through to arrive at our donations page. It is useful for us to collect this information so we can analyse the efficacy and impact of our fundraising and promotional efforts, and carry out statistical and trend analysis so that we can improve and expand our fundraising efforts to assist our ultimate beneficiaries.
2. JustGiving, which helps us with fundraising efforts by providing an online platform with a wider reach and connecting us to willing donors who may be interested in the types of causes we serve. When JustGiving processes your donations to ACN we will receive personal information that you share with them, such as your name, contact details, reasons for donating, and payment details (for the purposes of recordkeeping)
3. Google Analytics, in that cookies set by Google Analytics collect information about your use of our website, social media pages, and other internet pages.
4. Eventbrite – an online event organisation platform provider that helps us to run our in-person and online events and to promote and sell tickets to those events. Eventbrite shares personal information which you provide so that you can attend an event, such as your name, contact details, payment information, and any access /dietary requirements as may be applicable to the nature of the event.
3. Sensitive personal information
There are certain types of personal information that are categorised as more sensitive under applicable data protection law, on the basis that they are considered innately more private and that the adverse impact in case of misuse is likely to be more severe.
The categories are listed here.
In the main, ACN UK does not seek to collect and use these categories of sensitive personal information, but in practice, we may end up doing so depending on the nature of our relationship:
• Given that we are a religious philanthropic organisation, you are likely to share with us – or it is likely that we may be able to infer – information about your religious beliefs, for example, when you discuss or explain your reasons for your interest in a particular cause.
• Where you work for or volunteer with us, we may need to process personal information about your health (for example, to manage resourcing in case of sickness absence).
4. How and why do we use personal information?
Broadly, we use your personal information for the following reasons:
• To enable your donation(s) to reach your chosen project country or project type.
o We offer options about how and where benefactor donations are used. We ensure that donations are allocated appropriately to our various funds and geographical project areas
• To manage your donations requests, or calls to action.
• To process your donations.
• When you interact with us, we use your information to perform our services such as dealing with your donation, dealing with your queries and request and processing responses to our campaigns and advocacy work.
• To fundraise and promote ACN’s work in both financial and non-financial ways
o We know how fundamental our supporters and donors are to the work we do. In order to develop and foster your ongoing support, we want to keep intouch you through feedback and further opportunities and invitations to support our work in both financial and non-financial ways.
• To communicate with you and manage our relationship with you
o Occasionally we may need to contact you by mail, email and/or telephone for administrative or operational reasons.
• To personalise and improve your experience when engaging with ACN
o We continually strive to improve the information and services we offer to our supporters so that we can be good stewards of the resources entrusted to us
• To inform you about our news and ways you may be able to help ACN
o We may send you marketing communications via mail or email, if you have indicated that you are happy to receive these, for example, when you have donated or completed a campaign action, and you haven’t opted out of such communications.
• To maintain and improve our own accounts, records and organisational processes, to fulfil our administrative purposes and protect our charitable interests. The purpose for which we will use your information include accounting, billing and audit, credit or other payment card verification, fraud screening, safety, security and legal purposes, statistical and marketing analysis, legacy administration, systems testing,
maintenance and development.
o We will use your information to enable your donation to be allocated to your chosen priority, so you may be contacted in the event of a specific query needed to resolve any issue with the processing of your donation.
• Research and profiling: We use profiling and targeting systems to enable us tocommunicate in the most appropriate and acceptable way with our benefactors. Where you have previously made a significant donation, we may use third-party AI tools to assess your potential capacity for future giving. This involves analysing publicly available information - such as data from Companies House or social media - to help us tailor our fundraising efforts appropriately. To discuss our processes and to tailor your wishes, please contact our Supporter Care team via our online contact form, on 020 8642 8668 or via email at [email protected].
5. How do we secure your personal information?
Aid to Church in Need is committed to keeping your personal information safe and secure and we have data protection and information security policies and both technical (i.e. IT-based and electronic/digital) and physical (i.e. office-based and in-person) security measures in place to help protect your personal information in our custody. We will put in place procedures and technologies to maintain the security of all personal information from the point of collection to the point of deletion for as long as we hold your data. Personal information will only be transferred to a third party service provider company if they are approved by us and agree to comply with these procedures and policies, or if they put in place adequate security measures. We carry out specific data protection due diligence on all of our services providers and contract with them on the basis of terms which are required under applicable data protection law.
All our employees who process data are obliged to comply with our strict information security procedures, and are given data protection compliance training. Electronic data communication comprising personal information is always encrypted so that it is not read by anyone except the person responsible for the data.
In particular, we are committed to ensuring that your personal financial information is kept secure. If you use your credit or debit card to donate to us, buy something from us or make any other kind of payment online to us, we will ensure that the transaction is processed securely and in accordance with the Payment Card Industry Data Security Standards. We use trusted commercial partners to process online transactions for single and regular donations and purchases made via this website.
Your personal information processed by ACN (UK) is stored on ACN’s own servers based in Belgium and managed by ACN International’s Helpdesk Department who oversee the Content Management Systems of ACN’s offices around the world to maintain data and results reporting integrity. They have an additional responsibility for overseeing Data Protection standards across all offices. Your personal information is held on secure servers operated by ACN UK and the ACN international Help Desk. Paper files are stored and kept in a secured filing system and locked all the time except in time of in need for reference by a member of a staff. For the purpose of guaranteeing confidentiality and compliance with applicable data security standards we have taken permanent measures as follows:
• electronic access control system,
• security doors and windows,
• alarm system,
• special protection of the server space,
• individual log-ins and password procedures,
• additional log-ins for certain applications,
• automatic locking for the clients (Timeout),
• managing permissions,
• documentation of permissions, and
• many other measures.
6. Lawful Basis for processing your personal information
ACN is only entitled to collect and process your personal information where we have a “lawful basis” to do so. In practice, a lawful basis is just a reason for collecting and using personal information that is accepted and recognised by applicable data protection law. There are 6 lawful bases, but only 4 of them are likely to apply to ACN’s use of your personal information:
• where it is necessary for us to fulfil a contract with you, or to take steps at your request prior to entering into a contract
• where you give us your express consent
• where necessary to comply with a legal obligation applicable to ACN
• where it is necessary for purposes of our, or a third party’s, “legitimate interests”.
In brief, legitimate interests is the broadest lawful basis: any good and genuinely-held operational, legal, charitable, religious, commercial, developmental etc reason can qualify. It can be the interests of a third party other than ACN (as is often the case, i.e. our beneficiaries), or even the broader public interest (which we do consider applies to our work).
With that said, this lawful basis can only be used where the proposed use of your personal information does not pose an undue risk of adverse impact to you.
Broadly, we consider it within our, and our beneficiaries’, legitimate interests – as well as in the broader public interest – for ACN to attract attention to and knowledge about its causes and to try and raise funds for the various individuals and communities identified as being in need. Activities carried out in pursuance of these overriding legitimate interests include social media advertising, sending you promotional and fundraising information via post and carrying out profiling and wealth screening of benefactors and prospective benefactors.
Lawful basis for processing sensitive personal information
Where ACN UK processes the types of sensitive personal information referenced in section 3 above, we are required to have an additional lawful basis from a further set of lawful bases which apply specifically to sensitive personal information. These are set out here and here.
To the extent we collect and process personal information about your religious beliefs, we do so on the basis that there are Pontifical Foundation and religious charity processing your personal information in the course of our legitimate activities.
To the extent we process personal information about your health, this is for the purpose of exercising rights or carrying out obligations under applicable employment law, or for the purposes of occupational health or medicine, assessment of working capacity and medical
diagnosis.
7. How long do we keep your personal information?
We will only keep your personal information as long as genuinely required to fulfil the purposes for which we collected it, or a related purpose. So that we can do this in practice, we carry out periodical sweeps of our records and databases to consider whether personal information held therein is still genuinely required.
Where we no longer have a genuine reason to continue to process your personal information, it will be securely deleted or destroyed so that it cannot be retrieved or reassembled. Where we may have a genuine reason to continue to process your personal data in certain foreseeable circumstances that have not yet come to pass, but have no other good reason to hold it, we will put that personal information in a secure archive
such that it is put beyond the daily use of the organisation and can only be used as and when it is required.
8. Do we provide personal information to other parties?
We share your personal information with the authorised third-party suppliers set out in section 2 above so that they can provide their services. We also share your personal data with other third-party services providers who assist us with other aspects of our work, for example delivering goods you have ordered to you or helping us with benefactor / prospective benefactor wealth-screening and research.
Where you share your personal information with, or provide access to your personal information to, third-party services providers we only do so after we have carried out data protection due diligence and ensured that they have entered into contract terms specifically required under data protection law.
We may on occasion be required by law to pass on your personal information. For example, we would have to pass on information for a Gift Aid audit by Her Majesty’s Revenue and Customs.
Where lawful and appropriate to do so, we may share your personal information with Your Catholic Legacy. YCL is a consortium of over 20 Catholic charities that have come together to promote the benefits of making a will and to highlight how a legacy to a Catholic charity can make a lasting and impactful difference to individuals and communities in need.
If we find it necessary to transfer, process or store personal information outside the European Economic Area (EEA), we will put in place suitable safeguards, including using the Information Commissioner’s Office’s approved standard contractual clauses in data transfer contracts.
9. Your choices/ rights
By virtue of the fact that we collect and use your personal information, you have a series of
rights and options which you can exercise against us or carry out. In overview, those rights
and options are as follows:
• Your right of access - You have the right to ask us for copies of documents and records which contain your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which apply so as to mean that you may not receive all the information you ask for. Read more about the right
of access.
• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing - You have the right to ask us to ask us to stop using your personal information in a certain way. Read more about the right to restriction of processing.
• Your right to object to processing - You have the right to object to the processing of your personal data, and we can only continue doing so if certain conditions are satisfied. Read more about the right to object to processing.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.
Your right to complain – if you are not satisfied with how we have processed your personal information, you are entitled to make a complaint to the Information Commissioner’s Office (the UK Data protection regulator). Details of how to do this are set
out at https://ico.org.uk.
Please note that, while some of these rights apply broadly, some are only available to exercise in certain circumstances. Clicking the links set out above in relation to each right will explain more about when each right may apply and be exercised.
If you wish to exercise any of these rights, please use the contact details in section 12 below to do so.
10. Children's personal information
ACN encourages youth engagement within parishes, schools and groups, or it may be that a person under 18 wishes to donate to an ACN cause, and so we may collect and process children’s personal data. Legislation allows for the recruitment from the age of 16 years with permission from a parent or guardian. Aid to the Church in Need will only collect and use personal information of those under the age of 18 with parental/guardian permission.
11. Updates to our Privacy Notice and links to other sites
We may make changes to this Privacy Notice from time to time. We will update the privacy notice as necessary and will publish any new version.
We may provide links on our site to the websites of other organisations. We cannot give any assurances as to the data protection practices of those organisations. You should consider those organisations' privacy notices when you click through to their websites, as they will contain information as to how and why those organisations use your personal information, which will be different from how ACN uses your personal information.
12. ACN UK's Contact information and controller details
If you have any questions, concerns or complaints about how and why we use your personal information, or if you would like to exercise any of your data protection rights, or if you would like to change your preferences or change how you hear from us, please get in touch with us using any of the following options:
Calling: 020 8642 8668
Emailing: [email protected]
Writing to Data Protection Officer at
Aid to the Church in Need,
12-14 Benhill Avenue,
Sutton SM1 4DA.
Charity Registration Number: (England and Wales) 1097984; (Scotland) SC040748
Aid to Church in Need is registered as a Data Controller with the Information
Commissioner's Office (ICO). Its registration number is: Z7989628
