Privacy Notice

SSAFA, the Armed Forces charity is committed to protecting your personal data. This Privacy Notice details what personal data we collect and how we intend to use it. We continually review our policies and notices, updating them to reflect changes in data protection law and our own data processing activities. If we make any significant changes, we will make reasonable efforts to contact you. The Privacy Notice is effective from 30 November 2022.

1. Who are we?
2. Contact Us
3. What is personal data?
4. If you fail to provide personal data
5. How do we collect your personal data?
6. Children and young people
7. How and why we use your personal data
8. Our lawful basis for processing your personal data
9. Marketing and fundraising communications
10. Sharing your personal data
11. How we protect your personal data
12. Keeping your personal data up to date
13. Our use of cookies
14. Vulnerable circumstances
15. International data transfers
16. How long will we keep your personal data?
17. Your rights to your personal data
18. Your right to withdraw consent
19. Your right to lodge a complaint or raise a concern

1. Who are we?

SSAFA’s full legal and working titles are:

• Soldiers, Sailors and Airmen and Families Association – Forces Help: Registered charity in England and Wales (210760), Scotland (SC038056) and the Republic of Ireland (20202001)
• SSAFA Forces Help
• SSAFA, the Armed Forces charity

SSAFA is a company registered as:

• Soldiers, Sailors and Airmen and Families Association - Forces Help: company number: RC000571.
• SSAFA Forces Help Enterprise Limited, registration number: 02493614.
• SSAFA Family Health Services, registration number: 03137764
• SSAFA CMS Limited, company number: 11148063

2. Contact us

If you have any questions about this Privacy Notice or the way we use your personal data, you should contact the Data Governance Team as follows:

Data Governance Manager
SSAFA, the Armed Forces charity
Queen Elizabeth House
4 St Dunstan’s Hill
London
EC3R 8AD

Email: data.governance@ssafa.org.uk

You can also contact our Data Protection Officer, Robert Bond, by email: data.protection@ssafa.org.uk. 

3. What is personal data?

Personal data is information about a living individual who can be identified from that information (directly or indirectly). We collect, store and use (or “process”) personal data including:

• name;
• contact information;
• date of birth;
• your gender;
• age, nationality and ethnicity information (for monitoring purposes);
• bank details and credit card information (where these are required to make payment);
• information relating to your health (particularly if you are applying for a welfare grant or to access one of our services);
• (when we are a beneficiary in an estate) any information about you as an executor, next of kin or beneficiary;
• whether you are a taxpayer and would like to enable us to claim Gift Aid; and
• any other personal information we collect in accordance with the following:

We also process certain types of personal data which are in a ‘special category’ under data protection laws, as they are considered more sensitive. Examples of this type of sensitive data are information about your health, race, religious beliefs, political views, trade union membership, sex life or sexuality. These types of data will only be collected when we have a valid reason for doing so or the law allows us to, for example to safeguard the economic well-being of certain individuals in need of our support. We also must have additional and appropriate measures in place to ensure these types of data are protected.

4. If you fail to provide personal information

You are under no statutory or contractual obligation to provide data to SSAFA, but if you fail to provide certain information when requested we may not be able to perform the contract we have entered into with you. This could include providing you with goods or services (that need to be paid for), or we could be prevented from complying with our legal obligations (such as to ensure accurate financial and tax records).

5. How do we collect your personal data?

We collect your personal data directly where: 

• We obtain information from you to provide health, adoption, welfare, mentoring and social care services as specified by our constitution (for example when you apply for support or when you otherwise interact with us).
• We obtain your personal data when you participate in one of our fundraising activities or apply to be a volunteer or caseworker. Your personal details will be added to your record so that future communications with you are tailored to your interests.

Information collected indirectly:

In certain circumstances, and when we have a lawful reason to do so, we will obtain your personal data from third parties such as:

• Other individuals making applications for support – for example a family member if they are applying for support on the basis of your military service. We will not always tell you if this is the case, as we provide our services on a confidential basis
• Mail order companies or Marketing Service Providers you have subscribed to and where a legitimate interest applies. A balance of your interests is carefully considered and scrutinised to ensure that your needs are balanced and beneficial rather than intrusive.
• Prospect researchers such as Prospecting for Gold who use publicly available information – for example: industry directories, on-line sources, newspapers and journals - for the purpose of wealth screening for major gifts fundraising.
• Fundraising platforms such as Virgin Money Giving, Charity Checkout and Just Giving
• The Armed Forces and Ministry of Defence (for example to confirm service records)
• Subcontractors, business partners, researchers and search/analytics providers
• From a military charity or organisation so that we can provide assistance to you – we coordinate support with other military charities so that you receive support from the most appropriate source
• Social Media platforms such as Facebook, WhatsApp, Twitter or LinkedIn, depending on your privacy settings on those social media platforms (for example when you choose to interact with us by ‘liking’ our page)

Information from other sources

• When you visit our website, we automatically collect technical information about your device including the IP address used to connect your device to the internet.
• Using Google Analytics, we track which pages visitors to our website click on. Please see section 13 below on Cookies

We combine your personal data from these different sources for the purposes set out in this Policy.

6. Children and young people

We seek consent from parents/guardians for children who wish to participate in any fundraising activity. We always make clear to under 18s the purpose for which we are processing their data and comply with the Fundraising Regulator’s Code of Fundraising Practice.

In other circumstances, we will obtain consent directly from a child, where that child is at least 13 years old and/or our health and social care practitioners determine that the child is mature enough to make their own decision in line with Gillick Competencies and Fraser Guidelines. Our practitioners who work with children, will balance the need to listen to the child’s wishes with the responsibility to keep them safe depending on the child’s maturity, understanding and the nature of the consent required.

7. How and why we use your personal data

For those who approach SSAFA for help and support, you should refer to our more specific Privacy Notice, called How military charities will use my personal information to understand how we use your personal data to provide support to you.

We use your personal data for the following purposes: -

• to promote the interests of the charity and to enable us to provide a voluntary service for the benefit of the public in a geographical area as specified in our constitution;
• to provide you with our services which you have requested, and assess your eligibility to access those services (including grants);
• to communicate with you in general;
• to provide co-ordinated services across military charities;
• for administration purposes, including to administer payments (donations to us, and grants to service users);
• for publicity and profile-raising purposes (for example sharing success stories) and to fundraise to further our charitable purposes;
• to maintain our own accounts and records (including the processing of gift aid on your donations);
• to consider your application for a job or volunteer role with us;
• to inform you of news, events, activities and services of SSAFA;
• to report on the impact and effectiveness of our work;
• to administer our website;
• to satisfy legal and regulatory obligations;
• for the establishment, defence and/ or enforcement of legal claims;
• to detect and prevent crime and keep our employees, tenants and the public safe where we capture your image on our CCTV systems;
• to detect and prevent fraud or misuse of our services;
• to conduct market research: Including research on the demographics, interests and behaviour of current and prospective supporters in order to help us gain a better understanding of different audiences and enable us to improve our service and seek support for our work. This research will be carried out internally by our employees or we may ask another company to do this work for us. Data will be anonymised where possible;
• Profiling and analysis: Our profiling and analysis activities can be broken into three categories:
  • Segmentation so that we can offer supporters information relevant to them. This type of activity is not aimed at identifying specific individuals to target, but rather those individuals who fall within a certain segment of supporters.
  • Data matching: We will, on occasion, combine the personal information you have given us with data obtained from external sources, such as the Office for National Statistics, Google, Social Media, The Electoral Roll or postcode-based segmentation tools to help us understand social, demographic and financial characteristics, so we can tailor our communications and services to better meet your needs or the needs of others like you based on the insight we gain from the profile we build. We will not use the results of this data matching activity in a way that unduly intrudes on your privacy or your previously expressed privacy preferences, and you can ask us not to undertake this activity.
  • Major donor analysis: Our Major Donors Team will, on occasion, use your personal data to create profiles of our supporters or potential supporters. We use information our supporters have given us voluntarily to identify those who wish to support our work with a major gift. We also use information already in the public domain, for instance industry directories, on-line sources, newspapers and journals and Companies House to identify individuals who may be interested in supporting our work with a major gift or are known to our existing major supporters. We also carry out due diligence checks on all new major supporters and ensure that the information we have on our major supporters is accurate and up to date. 
  • You can object to such use of your personal data for profiling at any time by contacting us at supporter@ssafa.org.uk. 

8. Our lawful basis for processing your personal data

Data privacy law requires us to rely on one or more lawful bases in order to process your personal data. We consider the bases below to be relevant:

• Your consent (for example we will ask for your explicit consent to collect special categories of your personal data)
• Where processing is necessary for the performance of a contract to which you are a party
• Where processing is necessary for compliance with our legal obligations such as where we are obliged to share your personal data with law enforcement agencies, judicial bodies, government entities, tax authorities or regulating bodies.
• Where processing is necessary to protect your vital interests or that of another person;
• Where processing is necessary for the purpose of a legitimate interest pursued by us or a third party, except where your rights override our legitimate interest. Any legitimate interest we rely upon is subject to an assessment based on the specific context and circumstances.

9. Marketing and fundraising communications

We have evaluated the basis upon which we lawfully collect, hold and process personal data for marketing and fundraising. The balance test we carried out concludes that we have a lawful basis to communicate with existing and potential supporters and volunteers. We therefore rely on legitimate interest to communicate with you.

With your consent and where you have not opted out:

• we will use your contact details to provide you with information about our work and services, or to seek donations/ legacies; and
• we will send fundraising and marketing materials to you.

When communicating with you, we will offer you the opportunity to ‘opt out’ of receiving communication from us in future. You can also opt out of receiving communications from SSAFA by registering your name and contact details on the Fundraising Preference Service (FPS) website.

We will send fundraising and marketing materials to you if you have opted in to receive communication via email, telephone (landline and mobile) or/and SMS (text messaging).

Where you have provided us with your consent previously, you can change your mind at any time and choose to withdraw that consent. If you do not wish for us to contact you with marketing and fundraising communications, please let us know by emailing
supporter@ssafa.org.uk.

10. Sharing your personal data

If you request assistance, SSAFA will share your personal data with other military charities that provide support for a request for assistance and to co-ordinate providing you with support. 

We share your personal data where it is necessary to achieve the purposes set out in this Policy. This includes sharing your personal data with:

• suppliers and sub-contractors – for example IT service providers such as website hosts or cloud storage providers;
• insurers;
• professional service providers such as accountants and lawyers; 
• regulators, government and local authorities, including Child Services where appropriate;
• we use third parties such as WorldPay, PayPal, and GoDonate to process online donations.

We reserve the right to share your personal data with third parties in the event that we sell or buy any business or assets or if our assets (including your personal data) are acquired by a third party, and/ or to protect the rights, property or safety of SSAFA, its personnel, users, visitors or others.

If you are an executor of an estate bequeathed to SSAFA, your details will, on occasion, be shared with co-beneficiaries and third parties such as solicitors, for the purpose of administrating the gift.

We do not sell your personal data to other charities or other third parties.

11. How we protect your personal data

We use appropriate technical and organisational safeguards to ensure we keep your personal data secure. We have security measures in place to help protect against the loss, misuse, and alteration of the data under our control. For example, where appropriate, data is encrypted when in transit and storage, access is limited and subject to confidentiality commitments.

We only use personal data for the purposes for which it was supplied (and not for any non-business purposes). We limit access to personal data on a need-to-know basis and take appropriate measures to ensure that our people are aware that such information is only used in accordance with this Privacy Policy.

12. Keeping your personal data up to date

We take reasonable steps to ensure your personal data is accurate and up to date.

Where appropriate and lawful we will use publicly available sources (such as the Royal Mail) to identify deceased records or whether you have changed address.

We really appreciate it if you let us know when your contact details change, please let us know by emailing supporter@ssafa.org.uk.

13. Our use of cookies

SSAFA uses cookies and other tracking technologies to assist with navigation of our website and the ability to provide feedback; to analyse the use of our products and services; to assist with our promotional and marketing efforts as well as to provide content from third parties. To find out more about the types of cookies we use, please visit our Cookie Policy page.

14. Vulnerable circumstances

We are committed to protecting vulnerable supporters, and beneficiaries, whilst appreciating that additional care will be needed when we use their personal data. We recognise that on occasions it will be necessary for us to contact individuals who are not able to make decisions on their own such as donating to our charity. We observe the Fundraising Regulator’s Code of Fundraising Practice when dealing with people who are in vulnerable circumstances.

In addition, to ensure we aren’t writing to individuals who do not wish to hear from us, i.e., sending direct mail from SSAFA when there’s been no prior relationship, the prospective donor acquisition data list(s) will be screened against the Mailing Preferential Service (MPS), Fundraising Preference Service (FPS), and SSAFA’s own mailing suppression file prior to sending any postal communication.

15. International data transfers

Generally SSAFA stores all your personal data on computers located in the UK, as part of its work to support the Armed Forces, veterans and their families, in some instances SSAFA transfers personal data to some countries outside of the UK. These countries include Brunei, Canada, Cyprus, Falkland Islands, France, Germany, Gibraltar, Ireland, Italy, Kenya, Nepal, the Netherlands and Thailand.

Cyprus, France, Germany, Gibraltar, Ireland, Italy and the Netherlands are all subject to the European Union General Data Protection Regulation (EU GDPR). Canada’s data protection regime is considered (for businesses) to be ‘adequate’ by the European Commission.

Brunei, Kenya, Nepal and Thailand do not currently have an EU or UK adequacy finding. Where necessary SSAFA has put in place safeguards, such as ICO-approved Standard Contractual Clauses (SCC) within contracts and data sharing agreements, to protect your personal data.

16. How long will we keep your personal data?

We ensure that personal data is retained only for as long as necessary for the above purposes and to comply with applicable laws. In certain circumstances we are required to retain your personal data for a number of years (generally six years after our interaction with you ceases) in order to satisfy legal or contractual obligations, or in order to establish, exercise or defend legal claims. When your personal data is no longer necessary for these purposes, where we are no longer lawfully entitled to process it, or where you validly exercise your right to erasure (see section 17 below), the personal data will be deleted. 

If you ask us to stop contacting you, we will keep some basic information about you on a ‘suppression list’ in order to comply with your request and ensure we do not send you unwanted communications in the future.

17. Your rights to your personal data

You have rights under data protection law over your personal data. You are entitled, to request:

• access to (i.e. ask for a copy of) your personal data
• correction of your personal data if it is incorrect
• erasure of your personal data, in certain circumstances
• that we stop using your personal data if you believe that the information we hold is wrong, or that we don’t have a valid reason for using it
• that we stop using your personal data where you object to us using it
• that we transfer the information you gave us from one organisation to another or give it to you.

These rights are subject to eligibility and to legal exemptions, and so we will need to verify your identity before we are able to respond to your request. To exercise any of these rights you should contact us at Data.Governance@ssafa.org.uk, or writing to:

Data Governance Manager
SSAFA, the Armed Forces charity
Queen Elizabeth House
4 St Dunstan’s Hill
London
EC3R 8AD

We will respond within one month, on receipt of your written request. Please note that we might refuse to comply with subject access requests which would reveal sensitive information about third parties, such as those who access our services, even if they are a family member or are otherwise known to you.

18. Your right to withdraw consent

Where you have given us your consent, please note you have the right to withdraw that consent at any time. If you wish to exercise any of your individual rights including your right to withdraw consent, you can do so by contacting us at Data.Governance@ssafa.org.uk, or writing to:

Data Governance Manager
SSAFA, the Armed Forces charity
Queen Elizabeth House
4 St Dunstan’s Hill
London
EC3R 8AD

We will respond within one month, on receipt of your written request.

19. Your right to lodge a complaint or raise a concern

If you are in any way concerned about how we have collected or used your personal data you can raise a complaint with our Data Protection Officer, who can be contacted by email at data.protection@ssafa.org.uk, or you can raise a complaint using our online complaints form.

You also have the right to lodge a complaint with the UK’s Supervising Authority: The Information Commissioner's Office (ICO).

If you require further information and advice about data protection law or you wish to make a complaint, you can contact the Information Commissioner's Office:

Information Commissioner's Office
Wycliffee House
Water Lane
Wilmslow
Cheshire
SK95AF

Telephone: 0303 123 1113

Contact form: https://ico.org.uk/global/contact-us/email/

or if you are in the Republic of Ireland,

21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland

Telephone: 01 7650100 / 1800437 737

Contact form: https://www.dataprotection.ie/en/contact/how-contact-us

Please note: SSAFA is not a ‘public authority’ as defined under the Freedom of Information Act and we will not therefore respond to requests for information made under this Act.