Privacy Notice

INTRODUCTION

All the information you are about to read is called a Privacy Notice. A Privacy Notice is how we explain what 'personal information' we hold about you, how we collect it, and how we use and share it. Data protection law requires us to tell you about how we process your personal information in a clear and transparent way.

This notice applies when you interact with the OCU Foundation, including through hardship support, donations, fundraising activities, events, awareness campaigns or charity partnerships. It is important that you take time to read and understand it.

This notice does not replace any other privacy notices that may apply to you in different contexts.

WHO WE ARE

The OCU Foundation is the charitable arm of OCU Group. We support colleagues, communities, charitable causes, and individuals or families who may need financial assistance. This notice explains how personal information is collected, used, stored, shared and protected when individuals interact with the OCU Foundation.

For the purposes of data protection law, the relevant 'controller' is the OCU Foundation. 'Controller' is a legal term used to describe the organisation that is responsible for deciding how and why your personal information is processed and for keeping it safe. If you have any questions, contact our Data Protection Team using the details in section 11.

THE INFORMATION WE COLLECT

The information we collect depends on how you interact with the OCU Foundation. We aim to collect only the information necessary for the relevant purpose. The categories are below, with full detail for each in the Data Processing Schedule at the end of this notice.

Hardship Fund applications and nominations: name and contact details, employment details where relevant, details of the support requested, information about personal circumstances, financial information or evidence of hardship, supporting information, and the outcome and records of assessment and decisions. This may include special category data.

Donations and fundraising: name and contact details, donation amount, payment reference or transaction information, Gift Aid information where applicable, and records of fundraising participation.

Events and activities: name, contact details, attendance information, dietary or accessibility requirements where relevant, payment or ticket information, and photographs or video content where appropriate and subject to the relevant permissions.

Special category data: A Hardship Fund application or nomination may include sensitive personal information, such as information about health, family circumstances, financial hardship, housing or other difficult personal situations. This is special category data, so we apply an additional lawful condition, explained in section 5.

Do you have to provide this information? You do not have to give us your personal information, and there is no obligation to apply for support, donate or take part in an event. However, if you are applying for or being nominated for support, we need enough information to assess and administer the request fairly. If that information is not provided, we may be unable to consider or progress the application. Where you take part in donations, fundraising or events, we only collect what is necessary to administer that activity.

HOW AND WHY WE USE IT

We use personal information for the purposes below. For each purpose we rely on a lawful basis, explained in section 5.

We may collect personal information directly from you, from someone nominating you for support, through an application form or supporting documents, through donation or fundraising forms, through event registration, through OCU internal systems, and through communication with the OCU Foundation's representatives. Where information is provided by a nominator, we expect them to provide it fairly, accurately and only where appropriate.

• Reviewing Hardship Fund applications and assessing eligibility: legitimate interests

• Making fair, consistent and documented decisions, and arranging approved support: legitimate interests / legal obligation

• Processing donations and maintaining donation records: legitimate interests

• Administering Gift Aid: legal obligation

• Organising events, fundraising activities, auctions, challenges and awareness initiatives: legitimate interests

• Sending information about OCU Foundation activities, fundraising and events: consent / legitimate interests

• Supporting partnership activity with external charities: legitimate interests

• Record keeping, accountability and meeting legal, financial, tax, audit and governance obligations: legal obligation / legitimate interests

OUR LAWFUL BASIS FOR PROCESSING

Data protection law requires us to have a valid lawful basis for using your personal information. Depending on the activity, we rely on the following. In assessing our legitimate interests, we consider the impact on individuals and ensure processing is necessary, proportionate and supported by safeguards such as transparency, limited access, defined purposes and limited retention.

Legitimate interests: our primary basis, for administering charitable support, assessing applications fairly, processing donations and fundraising, organising events, supporting charity partnerships, and maintaining records of Foundation activity.

Legal obligation: where processing is necessary to comply with our legal duties, including Gift Aid, tax, financial, audit, governance and other regulatory or reporting requirements.

Consent: for certain communications, and for the use of photographs or promotional content, where we rely on your permission. You can withdraw consent at any time.

Special category data (Article 9): a Hardship Fund application or nomination may include health-related information or other sensitive personal circumstances. Where we process this special category data, we rely on the Article 9(2)(d) condition for not-for-profit bodies carrying out their legitimate charitable activities, subject to appropriate safeguards and confirmation that the condition applies. We only process this information where a lawful condition applies.

WHO WE SHARE YOUR INFORMATION WITH

Access to personal information is limited to individuals who need it for OCU Foundation purposes, such as Foundation Trustees, Foundation administrators and authorised representatives, relevant OCU Group teams (for example Finance, HR, Legal or Data Protection), and event organisers where relevant. For Hardship Fund applications, information is only accessible to those involved in reviewing, administering or processing the application. We share personal information only where necessary, and with appropriate safeguards in place, with:

• OCU Group internal teams involved in administration, payment, governance or compliance.

• Event platforms and event organisers, and website or IT service providers supporting Foundation activity.

• Partner charities, where relevant (see below).

• Professional advisers, auditors, regulators and public authorities, where required.

Charity partnerships: The OCU Foundation may work with partner charities to support fundraising, awareness and charitable activities. Where a donation is made in support of a partner charity, we may share limited donor information with that charity in relation to the donation. You can opt out if you do not want your information shared in this way. We only share information that is necessary for the relevant purpose, and we do not share donor information with partner charities for their own marketing purposes unless this has been clearly explained and an appropriate permission or lawful basis is in place. If you engage directly with a partner charity, their own privacy notice may also apply. We do not sell your personal information.

TRANSFERS OUTSIDE THE UK

Personal information that we process is held at OCU offices, on OCU-managed systems, and on systems operated by third-party service providers who support Foundation activity such as payments, events and communications.

There are instances where your personal information may be transferred internationally, for example where a service provider processes data outside the UK. When we transfer your personal information outside the UK, we do so only where the destination country has data protection laws assessed as adequate, or where appropriate safeguards (such as the UK International Data Transfer Agreement, the UK Addendum, or EU Standard Contractual Clauses) are in place to protect your information.

You can obtain a copy of the safeguards we rely on for any such transfer, or details of where they are made available, by contacting our Data Protection Team at dpo@ocugroup.com.

HOW LONG WE KEEP IT

We keep personal information only for as long as necessary for the purpose it was collected. Retention periods vary depending on the type of information, and any legal, financial or reporting requirements that apply.

• Hardship Fund applications: retained on a continual basis to monitor support provided, subject to review

• Donation records: 7 years, linked to financial and reporting requirements

• Gift Aid records: 7 years, subject to HMRC requirements

• Event attendance records: retained on a continual basis until an individual opts out

• Marketing and communications preferences: retained until withdrawn or updated, subject to review

KEEPING YOUR INFORMATION SECURE

We take steps to protect personal information from unauthorised access, loss, misuse or disclosure. These include restricting access to authorised individuals, using OCU-managed systems where appropriate, applying permissions to folders, files and systems, limiting sharing to what is necessary, and maintaining confidentiality expectations for those handling OCU Foundation information.

For sensitive hardship-related information, additional care is taken because applicants may disclose private financial, family, health or personal circumstances. We keep appropriate records of decisions and processing activity, and review how sensitive information is stored and accessed.

YOUR RIGHTS

You have a number of rights over your personal information. To exercise any of them, contact our Data Protection Team using the details in section 11. Where our processing is based solely on our legitimate interests, you have the right to object on grounds relating to your particular situation; if you object we can no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise or defence of legal claims.

• Be informed: about how we use your information.

• Access: request a copy of your data (a Data Subject Access Request).

• Rectification: have inaccurate information corrected.

• Erasure: ask for your data to be erased in certain circumstances.

• Restrict processing: limit how we use your information.

• Data portability: receive certain data in a portable format.

• Object: object to processing based on legitimate interests.

• Withdraw consent: where we rely on consent, withdraw it at any time.

HOW TO CONTACT US OR COMPLAIN

If you have any questions about this notice, or you want to exercise your rights, please contact our Data Protection Team. We would always prefer to resolve any concern directly, so please contact us first. If you are not satisfied with our response, or you do not receive a response within one month, you have the right to complain to the ICO.

Data Protection Team, OCU Foundation dpo@ocugroup.com info@ocufoundation.com

Information Commissioner's Office, the UK's data protection regulator ico.org.uk/make-a-complaint · 0303 123 1113

DATA PROCESSING SCHEDULE

This schedule lists, in detail, the personal information the OCU Foundation processes, its purpose, lawful basis, who it is shared with, and where it is processed.

Hardship Fund applications and nominations

Data we collect: name and contact details, employment details where relevant, details of the support requested, information about personal circumstances, financial information or evidence of hardship, supporting information, and the outcome and records of assessment and decisions. May include sensitive information about health, family circumstances, financial hardship or housing (special category).

Whose data: applicants and people nominated for support. How collected: from you directly, from a nominator, or through an application form and supporting documents.

Why we use it: to assess eligibility and administer requests for financial support, and to make fair, consistent and documented decisions.

Lawful basis: legitimate interests; legal obligation where applicable; for special category data, the Article 9(2)(d) not-for-profit condition.

Shared with: those involved in reviewing, administering or processing the application; relevant OCU Group teams where necessary.

Where processed: OCU-managed systems in the UK; see section 7 on transfers outside the UK.

Donations and fundraising

Data we collect: name and contact details, donation amount, payment reference or transaction information, Gift Aid information where applicable, and records of fundraising participation.

Whose data: donors and fundraising participants.

How collected: through donation or fundraising forms, and OCU internal systems.

Why we use it: to process donations, maintain donation records, and administer Gift Aid where it applies.

Lawful basis: legitimate interests; legal obligation for Gift Aid and financial records.

Shared with: OCU Group finance and administration teams; payment and IT service providers; HMRC for Gift Aid; partner charities where a donation is made in their support (you can opt out).

Where processed: OCU-managed systems and approved service providers; see section 7 on transfers outside the UK.

Events and activities

Data we collect: name, contact details, attendance information, dietary or accessibility requirements where relevant, payment or ticket information, and photographs or video content where appropriate.

Whose data: event attendees and participants.

How collected: through event registration, and at events subject to the relevant permissions.

Why we use it: to organise charity events, fundraising activities, auctions, challenges and awareness initiatives.

Lawful basis: legitimate interests; consent for photographs, promotional content and certain communications.

Shared with: event platforms and organisers; relevant OCU Group teams; IT service providers.

Where processed: OCU-managed systems and approved event platforms; see section 7 on transfers outside the UK.

Charity partnerships

Data we collect: limited donor information relating to a donation made in support of a partner charity.

Whose data: donors who give in support of a partner charity.

How collected: through donation and fundraising activity linked to the partnership.

Why we use it: to support fundraising, awareness and charitable activities with partner charities, and to pass on donations made in their support.

Lawful basis: legitimate interests; you can opt out of your information being shared in this way.

Shared with: partner charities, limited to what is necessary; not shared for their own marketing unless clearly explained and a lawful basis is in place.

Where processed: OCU-managed systems and the partner charity's systems; see section 7 on transfers outside the UK.

Communications and record keeping

Data we collect: contact details, communication preferences, and records of Foundation activity, decisions, donations and support.

Whose data: individuals who interact with the OCU Foundation.

How collected: from your interactions with the Foundation and its representatives, and OCU internal systems.

Why we use it: to provide information about Foundation activities, fundraising and events, and to maintain records for accountability, audit and governance.

Lawful basis: consent or legitimate interests for communications; legal obligation and legitimate interests for records.

Shared with: relevant OCU Group teams; professional advisers, auditors, regulators and authorities where required.

Where processed: OCU-managed systems and approved service providers; see section 7 on transfers outside the UK.