How we use your information: Malvernian Society (including fundraising) privacy notice

Introduction

This notice explains how and why Malvern College and the Malvernian Society use your personal information for fundraising, development and alumni purposes.

A reference in this notice to "we", "our", "us" is a reference to both the College and the Society.

The College and the Society work closely together to support Malvern College and to provide events, activities and support to members of the Malvern College community including current and prospective pupils, alumni, donors and current, former and prospective parents and staff. Further information on the Society can be found here: www.malverniansociety.org.uk.

To use data protection terminology, both the College and the Society are a "controller" of the personal information they use. This means that each is responsible for its compliance with data protection law.

If you have any questions about this notice please contact the Data Protection Officer whose contact details are [email protected] or +44(0)1684 581 500. If the Data Protection Officer is not available, you can contact the Malvernian Society Office on +44(0)1684 581 517, [email protected] or Malvernian Society, Malvern College, College Road, Malvern, WR14 3DF, UK in relation to any of the matters set out in this document. You can also contact the Development Office directly if you prefer on +44(0)1684 581 607, [email protected] or Malvern College, College Road, Malvern WR14 3DF, UK.

What is personal information?

Personal information is information that identifies you as an individual and relates to you. This includes your contact details, your relationship with the College and financial information.

You provide us with information about yourself during the course of our relationship with you. For example, when you sign up to receive communications from us or when you book to attend one of our events.

How is your information shared between the College and the Society and what is it used for?

Your information is held on databases accessible by both the College and the Society. If you tell the Development Office that your contact details have changed, they will update the central record which means that the Society will know about the change as well. The types of information shared between the College and the Society are as follows:

• your name and contact details;
• the dates when you or your child attended the College (if applicable);
• If you are a former staff member the dates when you worked at the College;
• information about your achievements and interests e.g. which sports team you were part of as a pupil;
• where you attended university and your occupation (if applicable);
• how you like to hear from us e.g. whether you have signed up to receive emails from us;
• your involvement with us e.g. if you carry out career-mentoring of current pupils;
• records of any donations;
• your Gift Aid status if applicable;
• information from articles in the media and other publicly available sources;
• any dietary requirements for catering purposes that you have provided; and
• any disability which you may have so that we may make reasonable adjustments for you.

Information is only shared on a "need to know" basis.

We use your information in the following ways:

• to keep you informed about events and activities and in relation to your attendance at those events. The Society and the College co-host a number of events. For example, the Society will host lectures which are open to pupils, parents, staff, alumni and other members of the College community;
• to facilitate interaction between members of the Malvern community;
• to keep you informed about what is happening, for example, by sending you College and Society newsletters;
• in connection with providing financial support (including making donations to the College or the Society, specific campaigns, such as for sports facilities, the theatre refurbishment and Assisted Places etc.);
• in connection with the other ways in which you might support us. For example, we might ask you to help with the hosting of our events, mentoring/careers talks or to give lectures; and
• to tell you about products sold to benefit the College such as clothing and sports goods. This includes both Malvern College and Old Malvernian branded merchandise.

We will contact you for the above purposes by email, telephone or post but we will only do this where we are allowed to do so under data protection law. If you tell us that you do not want to be contacted for any of these purposes, then we will of course respect that.

We will use the information we have about you to make sure that our communications are relevant. This includes using information that we have obtained from publicly available sources. We obtain information from LinkedIn, Companies House, business websites, internet search engines as well as Trustfunding.org to identify trusteeships. For example, we may use information about where you work to invite you to talk at a careers event or to help us build up a picture of your interests.

On occasion we use information from public sources to build up a picture of your philanthropic interests and wealth so that we can tailor our fundraising communications to you. We may also hold wealth screening data provided by trusted third-party partners to better understand you as an individual and your ability to support us. This may include wealth capacity ratings (estimated asset worth), philanthropic interests and internal classifications and ratings based on your engagement (attending events etc.) and past and potential donations.

Should you wish to limit or object to any such use, or would like further information about them, please contact the College's Data Protection Officer via [email protected]. You always have the right to withdraw consent, where given, or otherwise object to direct marketing or fundraising.

Although the College and the Society work closely together, sometimes we will do things separately. For example, the College may from time to time carry out mailings and events without input from the Society. Some of the Society's activities are run independently from the College. This includes OM Connect and the activities of the OM clubs. In such circumstances, the entity carrying out the activity will be the controller for data protection purposes.

If you wish to make a donation, particularly a donation of a substantial value, we may need to verify your identity and/or carry out financial due diligence on you. This may involve taking and retaining copies of your identification documents and obtaining your personal information from the sources listed above (LinkedIn, Companies House etc). This is to comply with our legal obligations.

We may take photographs or videos of you if you attend an event to use in our publicity or on our social media platforms and website. If we consider that the photograph or video is more privacy intrusive then we may ask for consent first.

Where you interact with us through our websites, we may also collect data including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our websites. We use this information for running the website, provision of administration and IT services, network security and to provide services to you.

How and why do we share your personal information with third parties?

• If you attend one of our events, then we may share your information with event booking platforms such as Ticketsource.
• If you make a regular gift by Direct Debit, we will share your information with the Charities Aid Foundation (CAF) who process our Direct Debits.
• In accordance with our legal obligations, will share information with local authorities/the Independent Schools Inspectorate/Ofsted/the Department for Education, for example, where we have any safeguarding concerns.
• On occasion, we may need to share information with the police for the prevention and investigation of crime and the prosecution of offenders.
• We may also need to share information with our legal advisers for the purpose of obtaining legal advice.
• We will need to share information if there is an emergency, for example, if you are hurt whilst on College premises or at one of our events.
• We use contractors to help us with our work (e.g. a printing company for our literature) or where we store our database in the cloud.
• We may share your information with representatives (such as volunteers) who organise our events.
• The Malvern College online shop is a collaboration between the College and the Society. If you order something from the shop, then your personal information will be shared with Malvern College Enterprises who run the shop on our behalf.

Our legal bases for using your information

This section contains information about the legal basis that we are relying on when handling your information.

Legitimate interests

This means that we are using your information when this is necessary for our legitimate interests, except when your interests and fundamental rights override our legitimate interests. We rely on legitimate interests to use your information for all of the purposes described above unless any of the alternative basis in the table below apply. Specifically, we have a legitimate interest in:

• ensuring that there is an active community of supporters which will benefit the College, the Society and members of the College community, such as current and former pupils and parents;
• promoting the objects and interests of the College and the Society. This includes raising funds and fundraising e.g. if we want to raise money for new buildings;
• using your personal information to administer our events;
• safeguarding and promoting the welfare of our pupils with whom you may be in contact e.g. if you arrange work experience or mentor a pupil; and
• ensuring that we comply with our legal obligations.

If you object to us using your information where we are relying on our legitimate interests as explained above, please speak to the Data Protection Officer at [email protected].

Consent

In some cases, we are processing your personal information because you have given us your consent to do so.

If we ask for your consent to use your personal information you can take back this consent at any time. Any use of your information before you withdraw your consent remains valid. To withdraw your consent please contact the Secretary, Malvernian Society at [email protected].

Necessary for a contract

We will need to use your information in order to perform our obligations under a contract with you, for example, when you purchase something from the Malvern College online shop.

Legal obligation

On some occasions we will need your information to comply with a legal obligation. For example, we may need to keep a record of who is attending an event so that we can comply with our health and safety obligations.

Vital interests

For example, to prevent someone from being seriously harmed or killed.

The College and Malvernian Society must also comply with an additional condition where it processes special categories of personal information. These special categories are as follows: personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric information, health information, and information about sex life or orientation.

Our bases for processing special personal information will depend on the circumstances:

Vital interests:

To protect the vital interests of any person where that person cannot give consent, for example, if they are seriously hurt and are unconscious.

Legal claims:

The processing is necessary for the establishment, exercise or defense of legal claims. This allows us to share information with our legal advisors and insurers.

These two conditions may also apply if we ever need to process information about criminal convictions and offences.

Substantial public interest

This allows us to process information about your health, for example, where we need this in connection with your attendance at, or participation in, any of our events or activities.

Sending your information to other countries

We may send your information to countries which do not have the same level of protection for personal information as there is in the UK. For example, we may store your information on computer servers based overseas.

The European Commission has produced a list of countries which have adequate data protection rules. The list can be found here: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm.

If the country that we are sending your information to is not on the list, or is not a country within the EEA (which means the European Union, Liechtenstein, Norway and Iceland), then, in the absence of any other safeguards, it might not have the same level of protection for personal information as there is in the UK.

Where appropriate we may put in place additional safeguards, for example, if we are using a third party to process a payment then we may ask them to contract with us using model data protection clauses provided by the European Commission in the absence of any other appropriate safeguard. If you would like more information about the safeguards that are in place please contact the Secretary, Malvernian Society.

For how long do we keep your information?

We will keep information about you for as long as we need to do so, in compliance with our data protection and other legal obligations. For example, we will need to retain contact details for you for so long as you want to be part of the school community so that we can communicate with you.

We will also need to keep a record if you tell us that you do not want to hear from us anymore, so that we do not inadvertently add you to our mailing list in the future.

We will keep information about you for a very long time or even indefinitely if we need this for historical, research or statistical purposes. For example, if we consider the information might be useful if someone wanted to write a book about the College.

The College will also keep information for a long time as part of its wider legal and regulatory obligations, even if that information is no longer needed for marketing, development or fundraising purposes. This is especially relevant to former staff, pupils and parents. For more information on how personal information is used by the College more widely please contact the MIS Manager.

Our information and records retention policy sets out how long we keep different types of information. Please click on this link: https://www.malverncollege.org.uk/MainFolder/SupplementaryPolicies/2018/Information-and-Records-Retention-Policy.pdf to view the policy or contact the Data Compliance Officer on +44(0) 1684 581 675, or at [email protected] for a copy of our retention policy which sets out how long we keep information for.

What decisions can you make about your information?

From May 2018 data protection legislation gives you a number of rights regarding your information. Some of these are new rights whilst others build on your existing rights. Your rights are as follows:

Rectification: if information held about you is incorrect you can ask us to correct it.

Access: you can also ask what information we hold about you and be provided with a copy. We will also give you extra information, such as why we use this information about you, where it came from and what types of people we have sent it to.

Deletion: you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information.

Portability: you can request the transfer of your information to you or to a third party in a format that can be read by computer in certain circumstances.

Restriction: our use of information about you may be restricted to simply storing it in some cases. For example, if you tell us that the information is inaccurate we can only use it for limited purposes while we check its accuracy.

Object: you may object to us using your information where:

• we are using it for direct marketing purposes (e.g. to send you the College newsletter);
• the legal bases on which we are relying is legitimate interests. Please see the section "Our legal bases for using your information" above;
• we are using it for historical or scientific research purposes or archiving purposes. For example, we may keep photographs of your class for historical reasons.

The Secretary, Malvernian Society can give you more information about your data protection rights. To exercise any of your rights you can submit your request in writing to The Secretary, Malvernian Society at Malvernian Society, Malvern College, College Road, Malvern, WR14 3DG or [email protected].

Further information and guidance

This notice covers how your personal information is used for fundraising, development and Malvernian Society purposes. For more information about how Malvern College uses your information more widely (for example, in relation to the provision of education to pupils) please ask the Data Compliance Officer for a copy of the appropriate privacy notice. The Data Compliance Officer can be contacted as follows: +44(0) 1684 581 675, [email protected] or Malvern College, College Road, Malvern, WR14 3DF.

This notice is to explain how we use your personal information. The Secretary, Malvernian Society can answer any questions which you may have.

Please speak to the Secretary, Malvernian Society if:

• you object to us using your information for marketing purposes e.g. to send you information about fundraising events or initiatives. We will stop using your information for marketing purposes if you tell us not to; or
• you would like us to update the information we hold about you.

If you consider that we have not acted properly when using your personal information you can contact the Information Commissioner's Office – www.ico.org.uk .

Rob Breare, Secretary, Malvernian Society
Reviewed October 2023