This Privacy Policy recognises our commitment to safeguarding the privacy of anyone who provides any of their personal information to us via our website (currently www.babymilkactiom.org) or by any other means. This Policy explains what personal information we may collect about you and how we will use any such information. It applies to the information that we collect about:

  • People who are members of Baby Milk Action
  • People who make enquiries to us
  • People who purchase something from our shop or donate to us
  • People who apply for a job with us
  • People who volunteer for us
  • People who register for our newsletter or campaign updates
  • People that visit our Website

This Privacy Policy applies to everybody who submits their personal data to us in any of the above circumstances (whether it is submitted via our website, paper, email, telephone or in person). You will ensure that any information you supply to us is accurate at time of submission, and inform us if any information requires updating.

If you have any concerns with regard to our processing or use of your personal information you have the legal right to lodge a complaint with the Information Commissioner’s Office.

This policy was last updated on 22 May 2018. Any changes reflect requirements of new data protection regulations and legislation and do not reflect changes to the way we use your data.

Contents

Who we are
Information we collect and how we use it
Withdrawing consent
Disclosing personal information
Your rights
Data retention
Data security
Third Party Websites and Social Media
Changes to this Privacy Policy
Further Questions

Who we are

Baby Milk Action is a company limited by guarantee in England and Wales under registered company number 1924050. Our registered office is at 4 Brooklands Avenue, Cambridge, Cambridgeshire, CB2 8BB, United Kingdom.

Our Data Protection Office can be contacted by post at our above registered office address or by email at info@babymilkaction.org.

We work to ensure all personal information held by us is treated in accordance with data protection legislation. We are registered as a data controller with the Information Commissioner’s Office.

Information we collect and how we use it

People who are members of Baby Milk Action

When you sign up as a member of Baby Milk Action, we will collect the following information from you for use as necessary in our legitimate interest in processing your application, administering your membership on an ongoing basis, and contacting you with news and information relating to Baby Milk Action’s work and organisational developments you need to be made aware of:

  • Your name
  • Your contact details
  • Your date of birth
  • Your reasons for joining Baby Milk Action (optional)

Your monthly membership payments are administered by a third party payment provider. Our payment providers are accredited in accordance with industry standards. We only receive basic information from them to identify who has paid a membership fee and what amount. These providers keep your details secure.

If your membership expires or you choose to end it, you will no longer receive communications from us unless you have specifically opted in to do so. We will retain your information for 12 months following the last date of your membership in case of any follow-up enquiries from you regarding your time as a member.

People who make enquiries to us

If you contact us by phone, email, social media, post or to make a general enquiry and have no other connection or established relationship to us then we will make you aware of any information that we are going to record on our database. We will use the information that you provide as necessary for our legitimate interests in dealing with your enquiry, training, and quality monitoring or evaluating the services we provide.

Your details will be retained for 12 months following our final response to your enquiry, in case you contact us again on the same matter. After this, the response to the enquiry will be retained for our general reference and training, but all personal information linked to the enquiry will be deleted.

People who purchase something from our shop / People who donate to us

If you have a financial interaction with us, either through making a donation or purchasing something from our shop, we will usually collect (for use where necessary in connection with our legitimate interests of processing and administering the donation or purchase):

  • Your name
  • Your contact details
  • Your date of birth

When you make a payment to us using our website, your financial information will not be stored by us (it will be stored and processed by our third party payment providers). Our payment providers are accredited in accordance with industry standards. We only receive basic information from them to identify who has purchased an item/donated to us and the amount. These providers keep your details secure.

Where it is appropriate we may also ask for why you have decided to donate to us. Answering this questions is not compulsory, and we only want to know the answer if you are comfortable telling us (answering means that you consent to us using that information to better understand the reasons people donate to us).

We will also use your data where necessary for our legitimate interests in:

  • Providing you with the products or services you bought or information you requested;
  • Administering your donation, including processing gift aid;
  • Keeping a record of your relationship with us, to ensure future transactions can be conducted more effectively;
  • Ensuring we know how you prefer to be contacted (if you have consented to further contact); and
  • Understanding how we can improve the services, products or information you asked for, for example by reviewing our processes or documentation or training our staff.

We may also use your personal information to aid us in trying to detect and reduce fraud and credit risk where it is necessary.

People who apply for a role with us

When we are recruiting, we will post details of available positions at Baby Milk Action on our website and social media channels. You may send your application to us through the post or electronically. We will retain the information you submit for as long as it may be necessary for the purpose of considering you for appointment to a role with Baby Milk Action (which will not be for longer than 24 months). If appointed to a role, you will be provided with an employee’s data protection policy which outlines how your personal information will be used as an employee of the organisation, as well as a separate organisational data protection policy outlining your responsibilities in terms of protecting, handling and managing the personal data of others.

If we cannot offer you a job at that time, we may (with your explicit consent) retain your details on file for up to 24 months following submission and contact you if any future vacancies arise that you may be interested in. You may always withdraw your consent to us doing this at any time, but if you do so we will no longer be able to alert you to new vacancies.

People who wish to volunteer for us

We are grateful for the efforts of all those who volunteer for us. Similarly to job vacancies,we will also advertise opportunities to volunteer for Baby Milk Action on our website and social media channels. If you become a volunteer, your personal information will be held on file for the duration of your application and period of volunteering. You will be provided with a separate volunteer agreement which will detail how we will use your personal information during your time as a volunteer.

If we are unable to provide a supported volunteer opportunity to you at that time, we may (with your explicit consent) retain your details on file for up to 24 months and contact you if any future opportunities within Baby Milk Action arise that you may be interested in. You may always withdraw your consent to this at any time. But if you do so we will no longer be able to offer you any new opportunities.

People who register for our newsletter or campaign updates

You can sign up to our newsletter / campaign updates (for example by registering via our Website). If so, we will use your name and email address to send you newsletters in accordance with your mailing preferences.

People who visit our website

Please note that our website uses cookies – please see our Cookies policy for further details.

Through our website, we may also collect information about where you are on the Internet (such as the last URL you visited prior to this and your IP address), your browser type, your geographic location, what webpages you viewed and any search terms entered during your visit. We may collect this information even if you do not submit any information via forms or make any purchases or donations via the website. We will use this information for our legitimate interests in administering and improving our website, (including performance, speed, content analysis, research and optimisation and accessibility purposes) and to keep our website safe.

Withdrawing consent

You can withdraw your consent at any time (for example, if you no longer want to receive further news from us). To do this, email us at info@babymilkaction.org or write to Data Protection Officer at Baby Milk Action 4 Brooklands Avenue, Cambridge, Cambridgeshire, CB2 8BB, United Kingdom or click on the ‘unsubscribe’ link of any promotional email or follow the ‘unsubscribe’ instructions.

Please note that any such withdrawal of consent will not affect the legal basis of our processing based on your consent before you withdrew it.

Disclosing your personal information

We may share personal information that you have submitted to us in the following cases:

  • With third parties who are directly involved in handling any request, order or enquiry submitted by you, such as a fulfilment company for shop orders;
  • Where we are legally required to do so;
  • In connection with criminal investigations, legal proceedings or prospective legal proceedings as necessary for our legitimate interests and permitted by law;
  • In accordance with our legitimate interests in establishing, exercising or defending our legal rights (such as providing information to others for the purposes of fraud prevention) and permitted by law; Where we explicitly state or inform you so at point of acquiring your consent.

When we use third parties to process data for us, information is only shared for the purpose of the services being provided by said third party. We may, for efficiency and strategic purposes, use the services of a supplier outside the European Economic Area (EEA) for certain tasks, which means that your personal information is also transferred, processed and stored outside the EEA. This may include third party software for managing our social media accounts or marketing emails. We consider each piece of third party software that we use carefully, and ensure that these organisations have in place the appropriate policies and safeguards either through the individual agreements we hold with them or by confirming they operate in accordance with the EU-US Privacy Shield Framework (find out more about this at www.privacyshield.gov).

Apart from the circumstances outlined above, we will not share personal information with third parties without your explicit consent (including direct marketing). We do not sell personal information under any circumstances.

Your rights

It is your legal right to be able to see a copy of the personal information that we keep about you and you can insist that we correct any inaccuracies in said information, subject to certain exemptions. Depending on the circumstances you may also have the right to:

  • Request that we permanently delete any personal information we hold about you;
  • Restrict our processing of your personal data (if you wanted to pause processing while reason for doing so was established, for example);
  • Request that data we hold is transferred to a third party; and
  • Object to our processing of your personal data.

Any of the above requests, including a request to correct inaccuracies in data should be made in writing to Data Protection Office at Baby Milk Action 4 Brooklands Avenue, Cambridge, Cambridgeshire, CB2 8BB, United Kingdom. We will do our best to respond as soon as possible and within a maximum of 28 days from the date of receiving the request. It is possible that we may reject any such request or limit the scope of our response (for example if the right does not apply to you in this instance) if we are legally permitted.

In accordance with best practice data security processes, we may request proof of your identity before complying with any requests such as those detailed above.

There will usually be no charge for exercising your rights as detailed above. However, we may charge a small fee if you make a request to see a copy of your personal information which is demonstrably unfounded or excessive. We may also refuse to carry out your request in such a situation.

Data retention

We keep your personal information for as long as it is needed for the reason we collected it (for example, to deliver a service or order), or, for members, volunteers, and those who have consented to receive news and/or marketing materials, until you withdraw your consent for us to continue using it. Once you withdraw consent, your personal data will be removed from all distribution lists as soon as is possible and no later than within 48 working hours of receiving the request.

If you need to update your personal information, you can do so by post, email or via a link included in our promotional/marketing emails.

Data security

We have procedures in place to make sure that the personal information you share with us is kept secure and up to date. Personal information is kept only for as long as is necessary for the purposes for which it was collected and it is then securely destroyed.

Third Party Websites and Social Media

The Baby Milk Action website contains links to other websites which we do not control. If you access other websites using the links on our website, the owners of those websites may collect personal information from you which will be subject to their own privacy policies and not ours. We are not liable for the privacy policies or practices of such third party websites and how they use your personal information.

Any information that you send to our social media channels via private messages will be treated with confidence by Baby Milk Action staff and volunteers, but remember that such information is also subject to the relevant social media organisation’s privacy policy as they are the owner of that platform. Please review each privacy policy to see how they will use your data.

Please note that where you provide information to a third party, they will be the controller of any information that you provide to them and will assume corresponding responsibilities under applicable data protection legislation. This personal information will be subject to the third party’s privacy policy. Baby Milk Action is not liable for the privacy policies or data protection practices of any such third parties in respect of your personal information.

Changes to this Privacy Policy

This Privacy Policy may be updated in line with organisational or legislative changes. Any changes will be shared via a link on the Baby Milk Action homepage and by email. The latest version of the Privacy Policy can always be accessed via the link on the Baby Milk Action homepage.

Further Questions

If you have any questions about this Privacy Policy or our treatment of your personal information, please contact our Data Protection Officer at the contact details given above.