Your Privacy Introduction The National Rheumatoid Arthritis Society (NRAS) is committed to protecting your personal data. We work within UK data protection law including: UK GDPR Data Protection Act 2018 Privacy and Electronic Communications Regulations (PECR) Data (Use and Access) Act 2025 This policy explains what we collect, why we use it, who we share it with, how long we keep it, and the rights you have. If you would like a printed copy of this privacy statement, please email data@nras.org.uk or call 01628 823 524 (Office). We review and update this policy regularly. This policy is effective from 20/08/2026. Please click on the following sections for more information: Who we are and how to contact us National Rheumatoid Arthritis Society is: a registered charity in England and Wales: 1134859 a registered charity in Scotland: SC039721 a company limited by guarantee: 07127101 the provider of JIA at NRAS services We are registered with the Information Commissioner’s Office (ICO): Z7759317. Data Protection Lead You can contact our Data Protection Lead: Address: 3 Beechwood, Grove Park Business Park, Maidenhead, Berkshire, SL6 3LW Email: data@nras.org.uk Phone: 01628 823524 What personal data we collect We may collect and use the following types of personal data, depending on how you interact with us: your name and contact details your date of birth, where we need it your membership, service or supporter history your donations, payments, purchases and Gift Aid details your health details, if you choose to share it with us your communication preferences records of calls, emails, forms or messages with us website data, such as cookies, IP address and browser details Why we use your data and our lawful basis We only use your data when the law allows us to. The main lawful bases we use are: Legitimate interest We use your data where this supports our charity work and does not unfairly affect your rights. This may include running services, improving support, keeping records, fundraising, and making our communications more relevant. Contract We use your data when we have an agreement with you. This means we need your data to provide what you asked for. Consent We use your data when you give consent. This means you agree to us using your data. Legal obligation We use your data when the law says we must. This includes tax, accounting, charity law, safeguarding, and data protection duties. Special category data Some data needs extra protection. This includes health information, ethnicity and other sensitive information. We only use this when we have a lawful basis and an extra condition under Article 9 UK GDPR. How we use your data We use your data to: provide information, support and services run our helpline, peer support, fundraiser support, events and education work manage membership, donations, Gift Aid, purchases, payments, raffles and prize draws reply to questions, requests and complaints send service updates, fundraising information and marketing, where allowed improve our services, website and communications carry out research, policy and advocacy work keep our records accurate and secure meet legal, regulatory, safeguarding, equality, diversity, inclusion and belonging duties Raffles and prize draws We use your data to: manage raffle and prize draw entries check that people are eligible to take part contact winners and arrange prizes keep records and meet legal requirements run fair draws using a random number selector comply with Gambling Commission and Fundraising Regulator rules share only the information needed to run the draw and contact winners Fundraising event support If you take part in a fundraising event, we use your data to: support you before, during and after the event send event information, fundraising tips and training advice provide safety updates, reminders and thank-you messages share updates about the impact of the event manage optional WhatsApp groups for participants help fundraisers communicate, encourage each other and share information keep event groups safe and relevant use only the information needed to support your fundraising activity If you join a WhatsApp group: joining is your choice other group members may be able to see your name, profile photo and phone number other group members may also see any messages or information you choose to share Payments and financial data We use payment data to: process purchase, donations and memberships manage our raffle meet legal requirements (such as tax) Communications, marketing and fundraising Service communications Our services include: helpline peer support education resources and information for healthcare professionals and people with RA or JIA events and conferences membership research participation advocacy work on behalf of people with RA or JIA We may contact you about services you use, ask about or sign up for. This may include appointment details, event information, changes to a service, safety information, membership updates, replies to your questions, and requests for feedback or assessment so we can improve our services. These messages are not marketing. You may still receive them even if you opt out of marketing, where we need to send them to provide or manage a service. Marketing and fundraising communications We may contact you about: services fundraising events campaigns research opportunities We contact you in these ways: by post or phone (legitimate interest) by email or electronic messaging e.g. SMS (only with consent) We do not sell or share your data for marketing. You can change your choices or opt out at any time by contacting us via post, telephone 01628 823524, or emailing us at marketing@nras.org.uk. For more details please look at Appendix 1. Who we share your data with and why We do not sell your data. We only share data when there is a clear reason and the law allows it. We share only the information needed. Service providers IT support providers, to keep our systems secure and working properly Payment providers, to process donations, memberships and purchases Mailing companies, to send information, resources or communications Database or software providers, to help us manage records, services, supporters and communications External fulfilment companies e.g. for Christmas merchandise Prospect research companies to gather information about you to inform our communications with you. This is available from publicly available resources Partners Referring practitioners, to inform them about their patient referral outcomes Research partners, where you have given consent or where data is anonymised so you cannot be identified Event companies, so they can provide NRAS fundraisers with further information and registration details Legal bodies HMRC, to meet tax, Gift Aid and financial reporting requirements regulators, authorities or law enforcement bodies, where the law requires us to share information or where it is needed to protect people, prevent fraud or respond to legal claims Advisors solicitors, auditors, accountants and insurers, to get professional advice, manage risks, meet legal duties or deal with claims data protection consultants, to help us comply with data protection law and improve how we protect personal data Where another organisation processes data for us, we require them to keep it safe, follow our instructions and use it only for the agreed purpose. For more details please look at Appendix 2. Sending data outside the UK We sometimes send personal data outside the UK. We may do this ourselves or use trusted companies to process data for us. We only send personal data when safeguards are in place. We may send personal data to organisations in: the European Union (EU) the United States (US) For more information about the safeguards we use see Appendix 3. How long we keep your data We keep data only for as long as we need it. This depends on why we collected it and any legal rules we must follow. Example: financial data is kept for 7 years We may keep data longer if: required by law or to comply with regulations needed for research (anonymised) Our data retention schedule, which outlines how long different types of data are retained, can be requested by emailing data@nras.org.uk or calling 01628 823524. Research, statistics and profiling We may use data for research, statistics and service improvement. Where possible, we use anonymised data so you cannot be identified. We do this to help us understand supporters improve communication improve fundraising We may also: check data against external databases e.g. bereavement registers track email, social media and website engagement use public information e.g. Companies House, ‘rich lists’, social networks like LinkedIn To opt out of wealth screening, please email us at data@nras.org.uk or call us on 01628 823524. We do not make decisions about you based only on automated processing if the decision would have a legal or similarly significant effect, unless the law allows this and safeguards are in place. Volunteering View the full volunteers privacy policy here. Cookies and similar technologies Cookies are small files stored on your device. We use them to: recognise your device remember preferences improve the website Some cookies: track how you use the website help us improve content We only use non-essential cookies if you give consent. You can change your cookie choices at any time. For more details please look at Appendix 4. Your rights You have the right to: access your data correct your data delete your data restrict how we use it object to how we use it withdraw consent make a complaint To exercise any of these rights, please contact our Data Protection Lead: By email: data@nras.org.uk By phone: 01628 823524 By post: Data Protection Lead, NRAS, 3 Beechwood, Grove Park Business Park, Maidenhead SL6 3LW Please tell us which right you want to use and give us enough information to identify you and understand your request. We will respond as soon as we can and within the time required by data protection law. You also have the right not to be subject to a decision based only on automated processing if it has a legal or similarly significant effect on you, unless the law allows this and safeguards apply. Making a complaint If you are unhappy with how we use your data, please contact us first. We will aim to resolve or address your complaint. Contact the Data Protection Lead at NRAS: By email: data@nras.org.uk By phone: 01628 823524 By post: Beechwood Suite 3 Grove Park Industrial Estate White Waltham Maidenhead Berkshire SL6 3LW If we cannot resolve your complaint you can contact the Information Commissioner’s Office (ICO). The ICO is the UK regulator for data protection. You can contact Information Commissioner’s Office: From the website: ico.org.uk By phone: 0303 123 1113 By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Appendix 1: Data Use Summary The table below provide more information about the types of personal data that we use, what we use them for and the legal basis for processing: Type of Data Purpose Legal basis for processing Name, address, phone, email, date of birth, and other relevant contact information membership and donation history, employment status, gender, history of support and engagement in services, activities & events, professional contacts For the administration of donations, and to support your fundraising, including processing gift aid. To provide you with the services, products or information you asked for, or remind you about your appointments with NRAS. To keep a record of your relationship with us. To understand our supporters better so we can tailor our communications and relationship with you and provide a better service. To enable NRAS to provide accessible services to the RA and JIA community. To provide support to fundraisers via WhatsApp. Please refer to the Profiling and data research section of this policy for more information. For direct marketing purposes. To identify known donors and those who may have an interest in donating in future. To analyse donation patterns. To verify that you are old enough to access our services, play our lottery, prize draws, raffles or be a member. Legitimate interest (article 6, 1 (f) UK GDPR) – this information is necessary for the purposes of collecting donations, administering, and maintaining our supporter base and ensuring sustainable fundraising including wealth screening. Legal Obligation (article 6, 1 (c) UK GDPR) – in some cases we collect data to meet legal requirements – for example we are legally obliged to pass details of your donations to HMRC for tax purposes. Name, contact information To manage and administer our raffles and prize draws including processing your entry, conducting the draw, notifying winners, and arranging prize fulfilment. Legitimate interest (article 6, 1 (f) UK GDPR) – this information is necessary for processing entries, administering, and maintaining our supporter base and ensuring sustainable fundraising including wealth screening. Contract (Article 6(1)(b) UK GDPR) – to properly run the draw, notify winners and distribute prizes. Legal Obligation (article 6, 1 (c) UK GDPR) – in some cases we collect data meet legal requirements – for example we are legally obliged to comply with Fundraising Regulator and Gambling Commission regulations. Personal data such as name and contact information, health and ethnicity data including details relating to your condition – diagnosis date, medication and medical procedures/operations To match volunteers to relevant opportunities and to match callers or referred patients to volunteers for peer support calls. We use anonymised data to identify trends or groups of the population that require additional support or services. Also to determine the impact of the NRAS services and support. Legitimate interest (article 6 (1) (f) UK GDPR) and for the purpose of providing social care services (UK GDPR art 9(2)(h)) – NRAS will be better able to provide services for, and campaign on behalf of its community as a patient led organisation Personal, such as name and contact information, health and ethnicity data including details relating to your condition – diagnosis date & medication To connect with you for a particular opportunity relating to your specific medical or demographic profile for e.g. to identify suitable candidates for involvement in research studies and industry partner collaborations. Legitimate interest (article 6 (1) (f) UK GDPR) and for scientific or historical research purposes (UK GDPR art 9(2)(j)) – NRAS will be better able to select diverse volunteers to participate in survey and research studies so the results from the work better represents the wider RA or JIA community. Bank and payment card details. To process membership subscriptions, donations, lottery subscriptions, raffle ticket purchases and shop purchases. Legitimate interest (Article 6 (1) (f) UK GDPR) – one off and recurring payments and donations Legal obligation (Article 6 (1) (c) UK GDPR)– VAT and other applicable taxes Records of payments for purchases you have made from our online shop or catalogue. To enable us to follow up any problems, complaints or disputes relating to your order. Legitimate interest (Article 6 (1) (f) UK GDPR) for recording purchases and managing stock We may record and keep track of conversations you have with us including phone calls, letters, emails, live chats, video chats and any other kind of communication We use these records to check your instructions to us, assess, analyse and improve our service, and to train our staff Legitimate interest (Article 6 (1) (f) UK GDPR) – this information is necessary for the purposes of collecting donations, administering, maintaining our supporter base, ensuring sustainable fundraising. Also to monitor and improve our services, to offer appropriate support and services to those who contact us. Helpline call information including personal and health data relating to the caller To inform the support team so they can follow up on calls and provide relevant support and advice. Or to determine the impact of the NRAS services and support. Or to inform our policy and advocacy work of trends/concerns about health services etc. Legitimate interest (Article 6 (1) (f) UK GDPR) and for the purpose of providing social care services (UK GDPR Art 9(2)(j) Schedule 1 Part 2(para.16) – ensuring we provide relevant and appropriate support and information to callers. Your volunteering history (including the activities, training & events you have taken part in, number of hours you worked) To keep a record of your relationship with us, so we can keep you informed about developments in the charity and improve your volunteering experience; to help us identify which types of events/methods of volunteering are most effective and demonstrate the value of volunteering. Legitimate interest (Article 6 (1) (f) UK GDPR) – NRAS has an interest in analysing which activities are most effective and the volunteers who are best able to help us organise events and gather donations Gift aid forms To record when you authorise NRAS to collect gift aid from HMRC. Legal obligation (Article 6 (1) (c) UK GDPR) – To enable us to claim Gift Aid back from HRMC and to comply with financial audit requirements. Details of any complaints you have made against NRAS. To enable us to investigate and resolve your concerns and understand how we can improve our services, products or information and influence change with external stakeholders and/or intervene/advocate on your behalf. Legitimate interests (Article 6 (1) (f) UK GDPR) –this information is necessary for us to identify areas where we can improve the service we provide Your marketing preferences for contact by email, post, phone and electronic messaging e.g. SMS So we know how you prefer to be contacted in terms of promotion of services, the charity’s work, promotion of charitable activities and fundraising Legitimate interests (Article 6 (1) (f) UK GDPR) – for postal and telephone communication. Consent for email and direct messaging including SMS (Article 6 (1) (a) UK GDPR and Regulation 22 PECR) We may use photographs, videos, and testimonials taken or submitted to NRAS and JIA-at-NRAS (events, case studies). This may include special category data such as medical conditions To promote our cause, including raising awareness of Rheumatoid Arthritis (RA) and Juvenile Idiopathic Arthritis (JIA), and supporting our campaigns and initiatives. These materials may appear on our website, magazine, e-news bulletins, social media pages, and other promotional or educational content. We will use these materials as long as they continue to support our mission and the purpose for which they were collected. You have the right to object. For more details information please see our Photo and Video Statement. Legitimate Interest (Article 6(1)(f), UK GDPR) as it is in NRAS’s legitimate interest to use photographs, videos, and testimonials to promote public awareness and understanding of RA and JIA, and to support our charitable goals. Also, Substantial Public Interest (Article 9(2)(g), UK GDPR) for special category data (e.g., health information included in testimonials), we rely on this basis under Condition 16, Schedule 1 of the Data Protection Act 2018, which allows processing for not-for-profit organisations furthering public awareness and understanding. Records of your fundraising activities To record how much income each event or method of fundraising generates. To keep a record of your relationship with us. Legitimate interest (Article 6 (1) (f) UK GDPR) – NRAS has an interest in analysing how income is generated to manage future fundraising campaigns and events. Information relating to your lottery subscription. So NRAS understands when and how long you have played our lottery. Contractual purposes (Article 6 (1) (b) UK GDPR) and legal obligations (Article 6 (1) (c) UK GDPR) imposed under the Gambling Act 2005 Information on the health state of people who want to sign up for fundraising events. For health and safety purposes. We need to check whether you have any underlying health conditions that would make it unsuitable for you to participate in an event. Consent (Article 6 (1) (a) UK GDPR). Contact profiles such as social group, age bracket, wealth indicators. We create profiles of our contacts to help us to communicate effectively with them. Please refer to our information about creating profiles below. Legitimate interest (Article 6 (1) (f) UK GDPR) – database segmentation to enable us to undertake effective direct marketing and communications activities. Appendix 2: Data sharing This table shows more detail about the types of organisation we share data with and why: Recipient/Category of organisation Purpose of sharing IT support companies We may share some areas of your data with an IT support company so they can investigate software issues. Secure online payment provider We use a secure online payment provider to process your card and bank details when process payments via our website. These payments may be for purchases, membership subscriptions or donations. Referring practitioners We inform referring organisations about their patient referral outcomes. Mailing companies We use mailing companies to process and post out resources and materials to our supporters and beneficiaries. Data support providers We use trusted companies to help keep our records accurate and up to date. They may: remove duplicate records check public records to help us avoid contacting people who have died check mailing, telephone and fundraising preference services update address details if someone has moved and not told us add missing information, such as interests or other profile information. For more information about how we use this information, please see the Profiling and data research section of this policy. Software platform providers We use external companies to host our charity records database Internet and social media hosting company We use external companies to host and develop major changes to the NRAS and JIA websites and use social media provided by Facebook, Twitter, Linked In and Instagram. Research & External Stakeholder Partners If you have consented to participating in a research project or external stakeholder’s activity it will be necessary for us to share your contact details with them to arrange communication. This will only happen with documented consent to do so. HMRC Where you have made a Gift Aid declaration, we will pass the details to HMRC to claim back tax Data protection consultancy We may share personal data with a data protection consultancy when seeking advice and support on data protection issues Solicitors We may share personal data with solicitors while obtaining legal advice and support. External Product Manager We use external fulfilment companies to process purchases on our behalf. For example, Christmas merchandise Event companies Where you have informed us that you want to participate in challenge events to raise money for NRAS then we may share your contact details with the event organisers so they can provide you with further information and registration details. External Lottery Manager We use an external company to process lottery applications on our behalf External Prospect Research company We periodically use an external company to gather information about you from publicly available sources, for example, Companies House, the Electoral Register, company websites, ‘rich lists’, social networks such as LinkedIn, political and property registers and news archives. We use this information to inform our communications with you. We may also disclose your personal information to third parties from time to time: if we are under a duty to disclose or share your personal data to the police and other law enforcement agencies/courts/insurance companies, pensions, other health services, practitioners, local authority for social care/support to comply with any legal obligation; to fulfil any order that you place with us (e.g. we would share data with our retail partner, mailing houses, credit card companies and banks etc.); to enforce or apply our terms of use and other agreements; to protect the rights, property, or safety of our business, our customers, or others including exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction. Appendix 3: Internation data transfer safeguards Legal safeguards we may use when sharing data internationally include: Adequacy Regulations Binding Corporate Rules International Data Transfer Agreements Standard Contractual Clauses UK Extension to the EU–US Data Privacy Framework Other safeguards allowed under UK data protection law Appendix 4: Cookies Necessary (no consent required) Cookie Name Time Saved Description CookieLawInfoConsent 365 days Records the default button state of the corresponding category & the status of CCPA. It works only in coordination with the primary cookie. cookielawinfo-checkbox-necessary 365 days Records the default button state of the corresponding category. It works only in coordination with the primary cookie. cookielawinfo-checkbox-non-necessary 365 days Records the default button state of the corresponding category. It works only in coordination with the primary cookie. viewed_cookie_policy 365 days Is the primary cookie that records the user consent for the usage of the cookies upon ‘accept’ and ‘reject’. It does not track any personal data and is set only upon user action(accept/reject). __stripe_mid 365 days Used to provide fraud prevention. Analytics (Exempt from consent and you can opt out) Cookie Name Time Saved Description _ga* 407 days Google Analytics uses this persistent cookie to distinguish unique users. _gat 365 days This cookie is used to throttle request rate. These are third party cookies that place on your device to allow us to use the Google Analytics service. These cookies collect information about how visitors use our website. We use this information to compile reports and to help us improve the website. Marketing (Consent required) Cookie Name Time Saved Description _gcl_au 365 days Google Adsense uses this cookie to track and store conversions. Embedded content from other websites Some pages include content from other websites. These may: collect data use cookies track your activity They may also track how you use embedded content, especially if you have an account and are logged in to that website. Previous privacy policies You can view our previous privacy policy here: Privacy policy updated June 2019 Privacy policy updated February 2022 Privacy policy updated November 2024
Who we are and how to contact us National Rheumatoid Arthritis Society is: a registered charity in England and Wales: 1134859 a registered charity in Scotland: SC039721 a company limited by guarantee: 07127101 the provider of JIA at NRAS services We are registered with the Information Commissioner’s Office (ICO): Z7759317.
Data Protection Lead You can contact our Data Protection Lead: Address: 3 Beechwood, Grove Park Business Park, Maidenhead, Berkshire, SL6 3LW Email: data@nras.org.uk Phone: 01628 823524
What personal data we collect We may collect and use the following types of personal data, depending on how you interact with us: your name and contact details your date of birth, where we need it your membership, service or supporter history your donations, payments, purchases and Gift Aid details your health details, if you choose to share it with us your communication preferences records of calls, emails, forms or messages with us website data, such as cookies, IP address and browser details
Why we use your data and our lawful basis We only use your data when the law allows us to. The main lawful bases we use are: Legitimate interest We use your data where this supports our charity work and does not unfairly affect your rights. This may include running services, improving support, keeping records, fundraising, and making our communications more relevant. Contract We use your data when we have an agreement with you. This means we need your data to provide what you asked for. Consent We use your data when you give consent. This means you agree to us using your data. Legal obligation We use your data when the law says we must. This includes tax, accounting, charity law, safeguarding, and data protection duties. Special category data Some data needs extra protection. This includes health information, ethnicity and other sensitive information. We only use this when we have a lawful basis and an extra condition under Article 9 UK GDPR.
How we use your data We use your data to: provide information, support and services run our helpline, peer support, fundraiser support, events and education work manage membership, donations, Gift Aid, purchases, payments, raffles and prize draws reply to questions, requests and complaints send service updates, fundraising information and marketing, where allowed improve our services, website and communications carry out research, policy and advocacy work keep our records accurate and secure meet legal, regulatory, safeguarding, equality, diversity, inclusion and belonging duties Raffles and prize draws We use your data to: manage raffle and prize draw entries check that people are eligible to take part contact winners and arrange prizes keep records and meet legal requirements run fair draws using a random number selector comply with Gambling Commission and Fundraising Regulator rules share only the information needed to run the draw and contact winners Fundraising event support If you take part in a fundraising event, we use your data to: support you before, during and after the event send event information, fundraising tips and training advice provide safety updates, reminders and thank-you messages share updates about the impact of the event manage optional WhatsApp groups for participants help fundraisers communicate, encourage each other and share information keep event groups safe and relevant use only the information needed to support your fundraising activity If you join a WhatsApp group: joining is your choice other group members may be able to see your name, profile photo and phone number other group members may also see any messages or information you choose to share Payments and financial data We use payment data to: process purchase, donations and memberships manage our raffle meet legal requirements (such as tax) Communications, marketing and fundraising Service communications Our services include: helpline peer support education resources and information for healthcare professionals and people with RA or JIA events and conferences membership research participation advocacy work on behalf of people with RA or JIA We may contact you about services you use, ask about or sign up for. This may include appointment details, event information, changes to a service, safety information, membership updates, replies to your questions, and requests for feedback or assessment so we can improve our services. These messages are not marketing. You may still receive them even if you opt out of marketing, where we need to send them to provide or manage a service. Marketing and fundraising communications We may contact you about: services fundraising events campaigns research opportunities We contact you in these ways: by post or phone (legitimate interest) by email or electronic messaging e.g. SMS (only with consent) We do not sell or share your data for marketing. You can change your choices or opt out at any time by contacting us via post, telephone 01628 823524, or emailing us at marketing@nras.org.uk. For more details please look at Appendix 1.
Who we share your data with and why We do not sell your data. We only share data when there is a clear reason and the law allows it. We share only the information needed. Service providers IT support providers, to keep our systems secure and working properly Payment providers, to process donations, memberships and purchases Mailing companies, to send information, resources or communications Database or software providers, to help us manage records, services, supporters and communications External fulfilment companies e.g. for Christmas merchandise Prospect research companies to gather information about you to inform our communications with you. This is available from publicly available resources Partners Referring practitioners, to inform them about their patient referral outcomes Research partners, where you have given consent or where data is anonymised so you cannot be identified Event companies, so they can provide NRAS fundraisers with further information and registration details Legal bodies HMRC, to meet tax, Gift Aid and financial reporting requirements regulators, authorities or law enforcement bodies, where the law requires us to share information or where it is needed to protect people, prevent fraud or respond to legal claims Advisors solicitors, auditors, accountants and insurers, to get professional advice, manage risks, meet legal duties or deal with claims data protection consultants, to help us comply with data protection law and improve how we protect personal data Where another organisation processes data for us, we require them to keep it safe, follow our instructions and use it only for the agreed purpose. For more details please look at Appendix 2.
Sending data outside the UK We sometimes send personal data outside the UK. We may do this ourselves or use trusted companies to process data for us. We only send personal data when safeguards are in place. We may send personal data to organisations in: the European Union (EU) the United States (US) For more information about the safeguards we use see Appendix 3.
How long we keep your data We keep data only for as long as we need it. This depends on why we collected it and any legal rules we must follow. Example: financial data is kept for 7 years We may keep data longer if: required by law or to comply with regulations needed for research (anonymised) Our data retention schedule, which outlines how long different types of data are retained, can be requested by emailing data@nras.org.uk or calling 01628 823524.
Research, statistics and profiling We may use data for research, statistics and service improvement. Where possible, we use anonymised data so you cannot be identified. We do this to help us understand supporters improve communication improve fundraising We may also: check data against external databases e.g. bereavement registers track email, social media and website engagement use public information e.g. Companies House, ‘rich lists’, social networks like LinkedIn To opt out of wealth screening, please email us at data@nras.org.uk or call us on 01628 823524. We do not make decisions about you based only on automated processing if the decision would have a legal or similarly significant effect, unless the law allows this and safeguards are in place.
Cookies and similar technologies Cookies are small files stored on your device. We use them to: recognise your device remember preferences improve the website Some cookies: track how you use the website help us improve content We only use non-essential cookies if you give consent. You can change your cookie choices at any time. For more details please look at Appendix 4.
Your rights You have the right to: access your data correct your data delete your data restrict how we use it object to how we use it withdraw consent make a complaint To exercise any of these rights, please contact our Data Protection Lead: By email: data@nras.org.uk By phone: 01628 823524 By post: Data Protection Lead, NRAS, 3 Beechwood, Grove Park Business Park, Maidenhead SL6 3LW Please tell us which right you want to use and give us enough information to identify you and understand your request. We will respond as soon as we can and within the time required by data protection law. You also have the right not to be subject to a decision based only on automated processing if it has a legal or similarly significant effect on you, unless the law allows this and safeguards apply.
Making a complaint If you are unhappy with how we use your data, please contact us first. We will aim to resolve or address your complaint. Contact the Data Protection Lead at NRAS: By email: data@nras.org.uk By phone: 01628 823524 By post: Beechwood Suite 3 Grove Park Industrial Estate White Waltham Maidenhead Berkshire SL6 3LW If we cannot resolve your complaint you can contact the Information Commissioner’s Office (ICO). The ICO is the UK regulator for data protection. You can contact Information Commissioner’s Office: From the website: ico.org.uk By phone: 0303 123 1113 By post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Appendix 1: Data Use Summary The table below provide more information about the types of personal data that we use, what we use them for and the legal basis for processing: Type of Data Purpose Legal basis for processing Name, address, phone, email, date of birth, and other relevant contact information membership and donation history, employment status, gender, history of support and engagement in services, activities & events, professional contacts For the administration of donations, and to support your fundraising, including processing gift aid. To provide you with the services, products or information you asked for, or remind you about your appointments with NRAS. To keep a record of your relationship with us. To understand our supporters better so we can tailor our communications and relationship with you and provide a better service. To enable NRAS to provide accessible services to the RA and JIA community. To provide support to fundraisers via WhatsApp. Please refer to the Profiling and data research section of this policy for more information. For direct marketing purposes. To identify known donors and those who may have an interest in donating in future. To analyse donation patterns. To verify that you are old enough to access our services, play our lottery, prize draws, raffles or be a member. Legitimate interest (article 6, 1 (f) UK GDPR) – this information is necessary for the purposes of collecting donations, administering, and maintaining our supporter base and ensuring sustainable fundraising including wealth screening. Legal Obligation (article 6, 1 (c) UK GDPR) – in some cases we collect data to meet legal requirements – for example we are legally obliged to pass details of your donations to HMRC for tax purposes. Name, contact information To manage and administer our raffles and prize draws including processing your entry, conducting the draw, notifying winners, and arranging prize fulfilment. Legitimate interest (article 6, 1 (f) UK GDPR) – this information is necessary for processing entries, administering, and maintaining our supporter base and ensuring sustainable fundraising including wealth screening. Contract (Article 6(1)(b) UK GDPR) – to properly run the draw, notify winners and distribute prizes. Legal Obligation (article 6, 1 (c) UK GDPR) – in some cases we collect data meet legal requirements – for example we are legally obliged to comply with Fundraising Regulator and Gambling Commission regulations. Personal data such as name and contact information, health and ethnicity data including details relating to your condition – diagnosis date, medication and medical procedures/operations To match volunteers to relevant opportunities and to match callers or referred patients to volunteers for peer support calls. We use anonymised data to identify trends or groups of the population that require additional support or services. Also to determine the impact of the NRAS services and support. Legitimate interest (article 6 (1) (f) UK GDPR) and for the purpose of providing social care services (UK GDPR art 9(2)(h)) – NRAS will be better able to provide services for, and campaign on behalf of its community as a patient led organisation Personal, such as name and contact information, health and ethnicity data including details relating to your condition – diagnosis date & medication To connect with you for a particular opportunity relating to your specific medical or demographic profile for e.g. to identify suitable candidates for involvement in research studies and industry partner collaborations. Legitimate interest (article 6 (1) (f) UK GDPR) and for scientific or historical research purposes (UK GDPR art 9(2)(j)) – NRAS will be better able to select diverse volunteers to participate in survey and research studies so the results from the work better represents the wider RA or JIA community. Bank and payment card details. To process membership subscriptions, donations, lottery subscriptions, raffle ticket purchases and shop purchases. Legitimate interest (Article 6 (1) (f) UK GDPR) – one off and recurring payments and donations Legal obligation (Article 6 (1) (c) UK GDPR)– VAT and other applicable taxes Records of payments for purchases you have made from our online shop or catalogue. To enable us to follow up any problems, complaints or disputes relating to your order. Legitimate interest (Article 6 (1) (f) UK GDPR) for recording purchases and managing stock We may record and keep track of conversations you have with us including phone calls, letters, emails, live chats, video chats and any other kind of communication We use these records to check your instructions to us, assess, analyse and improve our service, and to train our staff Legitimate interest (Article 6 (1) (f) UK GDPR) – this information is necessary for the purposes of collecting donations, administering, maintaining our supporter base, ensuring sustainable fundraising. Also to monitor and improve our services, to offer appropriate support and services to those who contact us. Helpline call information including personal and health data relating to the caller To inform the support team so they can follow up on calls and provide relevant support and advice. Or to determine the impact of the NRAS services and support. Or to inform our policy and advocacy work of trends/concerns about health services etc. Legitimate interest (Article 6 (1) (f) UK GDPR) and for the purpose of providing social care services (UK GDPR Art 9(2)(j) Schedule 1 Part 2(para.16) – ensuring we provide relevant and appropriate support and information to callers. Your volunteering history (including the activities, training & events you have taken part in, number of hours you worked) To keep a record of your relationship with us, so we can keep you informed about developments in the charity and improve your volunteering experience; to help us identify which types of events/methods of volunteering are most effective and demonstrate the value of volunteering. Legitimate interest (Article 6 (1) (f) UK GDPR) – NRAS has an interest in analysing which activities are most effective and the volunteers who are best able to help us organise events and gather donations Gift aid forms To record when you authorise NRAS to collect gift aid from HMRC. Legal obligation (Article 6 (1) (c) UK GDPR) – To enable us to claim Gift Aid back from HRMC and to comply with financial audit requirements. Details of any complaints you have made against NRAS. To enable us to investigate and resolve your concerns and understand how we can improve our services, products or information and influence change with external stakeholders and/or intervene/advocate on your behalf. Legitimate interests (Article 6 (1) (f) UK GDPR) –this information is necessary for us to identify areas where we can improve the service we provide Your marketing preferences for contact by email, post, phone and electronic messaging e.g. SMS So we know how you prefer to be contacted in terms of promotion of services, the charity’s work, promotion of charitable activities and fundraising Legitimate interests (Article 6 (1) (f) UK GDPR) – for postal and telephone communication. Consent for email and direct messaging including SMS (Article 6 (1) (a) UK GDPR and Regulation 22 PECR) We may use photographs, videos, and testimonials taken or submitted to NRAS and JIA-at-NRAS (events, case studies). This may include special category data such as medical conditions To promote our cause, including raising awareness of Rheumatoid Arthritis (RA) and Juvenile Idiopathic Arthritis (JIA), and supporting our campaigns and initiatives. These materials may appear on our website, magazine, e-news bulletins, social media pages, and other promotional or educational content. We will use these materials as long as they continue to support our mission and the purpose for which they were collected. You have the right to object. For more details information please see our Photo and Video Statement. Legitimate Interest (Article 6(1)(f), UK GDPR) as it is in NRAS’s legitimate interest to use photographs, videos, and testimonials to promote public awareness and understanding of RA and JIA, and to support our charitable goals. Also, Substantial Public Interest (Article 9(2)(g), UK GDPR) for special category data (e.g., health information included in testimonials), we rely on this basis under Condition 16, Schedule 1 of the Data Protection Act 2018, which allows processing for not-for-profit organisations furthering public awareness and understanding. Records of your fundraising activities To record how much income each event or method of fundraising generates. To keep a record of your relationship with us. Legitimate interest (Article 6 (1) (f) UK GDPR) – NRAS has an interest in analysing how income is generated to manage future fundraising campaigns and events. Information relating to your lottery subscription. So NRAS understands when and how long you have played our lottery. Contractual purposes (Article 6 (1) (b) UK GDPR) and legal obligations (Article 6 (1) (c) UK GDPR) imposed under the Gambling Act 2005 Information on the health state of people who want to sign up for fundraising events. For health and safety purposes. We need to check whether you have any underlying health conditions that would make it unsuitable for you to participate in an event. Consent (Article 6 (1) (a) UK GDPR). Contact profiles such as social group, age bracket, wealth indicators. We create profiles of our contacts to help us to communicate effectively with them. Please refer to our information about creating profiles below. Legitimate interest (Article 6 (1) (f) UK GDPR) – database segmentation to enable us to undertake effective direct marketing and communications activities.
Appendix 2: Data sharing This table shows more detail about the types of organisation we share data with and why: Recipient/Category of organisation Purpose of sharing IT support companies We may share some areas of your data with an IT support company so they can investigate software issues. Secure online payment provider We use a secure online payment provider to process your card and bank details when process payments via our website. These payments may be for purchases, membership subscriptions or donations. Referring practitioners We inform referring organisations about their patient referral outcomes. Mailing companies We use mailing companies to process and post out resources and materials to our supporters and beneficiaries. Data support providers We use trusted companies to help keep our records accurate and up to date. They may: remove duplicate records check public records to help us avoid contacting people who have died check mailing, telephone and fundraising preference services update address details if someone has moved and not told us add missing information, such as interests or other profile information. For more information about how we use this information, please see the Profiling and data research section of this policy. Software platform providers We use external companies to host our charity records database Internet and social media hosting company We use external companies to host and develop major changes to the NRAS and JIA websites and use social media provided by Facebook, Twitter, Linked In and Instagram. Research & External Stakeholder Partners If you have consented to participating in a research project or external stakeholder’s activity it will be necessary for us to share your contact details with them to arrange communication. This will only happen with documented consent to do so. HMRC Where you have made a Gift Aid declaration, we will pass the details to HMRC to claim back tax Data protection consultancy We may share personal data with a data protection consultancy when seeking advice and support on data protection issues Solicitors We may share personal data with solicitors while obtaining legal advice and support. External Product Manager We use external fulfilment companies to process purchases on our behalf. For example, Christmas merchandise Event companies Where you have informed us that you want to participate in challenge events to raise money for NRAS then we may share your contact details with the event organisers so they can provide you with further information and registration details. External Lottery Manager We use an external company to process lottery applications on our behalf External Prospect Research company We periodically use an external company to gather information about you from publicly available sources, for example, Companies House, the Electoral Register, company websites, ‘rich lists’, social networks such as LinkedIn, political and property registers and news archives. We use this information to inform our communications with you. We may also disclose your personal information to third parties from time to time: if we are under a duty to disclose or share your personal data to the police and other law enforcement agencies/courts/insurance companies, pensions, other health services, practitioners, local authority for social care/support to comply with any legal obligation; to fulfil any order that you place with us (e.g. we would share data with our retail partner, mailing houses, credit card companies and banks etc.); to enforce or apply our terms of use and other agreements; to protect the rights, property, or safety of our business, our customers, or others including exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
Appendix 3: Internation data transfer safeguards Legal safeguards we may use when sharing data internationally include: Adequacy Regulations Binding Corporate Rules International Data Transfer Agreements Standard Contractual Clauses UK Extension to the EU–US Data Privacy Framework Other safeguards allowed under UK data protection law
Appendix 4: Cookies Necessary (no consent required) Cookie Name Time Saved Description CookieLawInfoConsent 365 days Records the default button state of the corresponding category & the status of CCPA. It works only in coordination with the primary cookie. cookielawinfo-checkbox-necessary 365 days Records the default button state of the corresponding category. It works only in coordination with the primary cookie. cookielawinfo-checkbox-non-necessary 365 days Records the default button state of the corresponding category. It works only in coordination with the primary cookie. viewed_cookie_policy 365 days Is the primary cookie that records the user consent for the usage of the cookies upon ‘accept’ and ‘reject’. It does not track any personal data and is set only upon user action(accept/reject). __stripe_mid 365 days Used to provide fraud prevention. Analytics (Exempt from consent and you can opt out) Cookie Name Time Saved Description _ga* 407 days Google Analytics uses this persistent cookie to distinguish unique users. _gat 365 days This cookie is used to throttle request rate. These are third party cookies that place on your device to allow us to use the Google Analytics service. These cookies collect information about how visitors use our website. We use this information to compile reports and to help us improve the website. Marketing (Consent required) Cookie Name Time Saved Description _gcl_au 365 days Google Adsense uses this cookie to track and store conversions.
Embedded content from other websites Some pages include content from other websites. These may: collect data use cookies track your activity They may also track how you use embedded content, especially if you have an account and are logged in to that website.
Previous privacy policies You can view our previous privacy policy here: Privacy policy updated June 2019 Privacy policy updated February 2022 Privacy policy updated November 2024