Myeloma UK – Privacy Policy

The information below describes how Myeloma UK manages your personal information in accordance with the law and your rights. Although we have tried to be as thorough as possible this policy cannot cover every situation, so please continue to read notices on forms, web pages or places where you give us information about yourself. These will describe the specific uses we make of the information, the reasons and legal basis for holding it as well as your rights. 

Myeloma UK is a charity managing many relationships with patients, fundraisers, volunteers, supporters, healthcare professionals and researchers, so we are constantly using personal information to allow us to make better decisions, fundraise more efficiently and, ultimately, to deliver on our strategy to prevent myeloma, effectively treat myeloma and support our community to live well with myeloma.  

How we collect information about you
  • you may give us information when you fill in forms, subscribe to our services (such as publications or to attend events), phone our Infoline or subscribe to email newsletters. Your calls or emails to Infoline/Ask the Nurse are always treated confidentially and can be anonymous if you want them to be.  
  • when you apply for a job or to volunteer with us, including to process applications and to monitor recruitment statistics. If you come to work for us, we will retain it to administer your employment including your pension. 
  • when managing feedback and complaints. 
  •  to support our fundraising operations. 

When you use our website, we collect your personal information using “cookies” and other tracking methods. There is more information on our use of cookies in our Cookie Policy

Information you provide to us indirectly

Your information may be shared with us by third parties, for example: 

  • if a friend or family member signs you up for one of our events 
  • independent event organisers or service providers, for example running events, fundraising sites like Just Giving, Facebook donations, Virgin Money Giving or providers that administer our lottery 
  • if you are a researcher and your information is shared with us by the principal investigator or an institution. 

We may receive data about you from subcontractors acting on our behalf who provide us with technical, payment or delivery services. 

You should check any privacy policy provided to you where you give your data to a third party.  

Social Media

Communication, engagement and actions taken through external social media platforms that we participate on are subject to the terms and conditions as well as the privacy policies held with each social media platform respectively. 

Information available publicly 

When undertaking research, we may gather information from publicly available sources, such as company and charity registers, company websites, the press or social media.  

We may also undertake research to ascertain whether you might like to support us if you are a personal charitable trust or foundation or interested in philanthropic giving. We may use publicly available information about you to do this (for example websites or social media). We will always contact you to see if you are happy to receive fundraising messages in these instances.  

When undertaking research, we may gather information from publicly available sources, such as company and charity registers, company websites, the press or social media. This may include conducting research on existing supporters and individuals not currently engaged with Myeloma UK, including individuals connected to our current major supporters, trustees or other lead volunteers.  

We do this work to understand the background of individuals, to make appropriate requests, ensure that individuals are not approached for support at inappropriate levels and to meet the expectation that supporters have of charities to minimise the costs of fundraising and administration where possible.  

What information might we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). 

We might collect, store and use the following kinds of personal information: 

  • your name 
  • your contact details (including postal address, telephone number, e-mail address and/or social media identity) 
  • your date of birth 
  • your gender identity 
  • your bank or credit card details where you provide these to make a payment 
  • if you volunteer for us or apply for a job with us, information necessary for us to process these applications and assess your suitability (which may include things like employment status, previous experience depending on the context, as well as any unspent criminal convictions or pending court cases you may have) 
  • information about your activities on our website(s) or social media platforms when you interact with us, and about the device you use to access these, for instance your IP address and geographical location 
  • information about events, activities, and products which we consider to be of interest to you 
  • information relating to your health (for example if you phone our Infoline or email our Ask the Nurse service). These services are always completely confidential and the data will often be anonymised and always upon request 
  • involvement in and information provided when partaking in volunteering panels relating to patient information, advocacy, and research 
  • where you have left us a legacy, any information regarding next of kin with which you may have provided us to administer this 
  • information as to whether you are a taxpayer to enable us to claim Gift Aid 
  • age, nationality, and ethnicity information for monitoring and targeting of services 
  • any other personal information you provide to us 
  • information on wealth, affinity, and capacity to make a donation 

Certain types of personal information are in a special category under data protection laws, as they are considered to be more sensitive. Examples of this type of sensitive data (known as “special category data”) would be information about health, race, religious beliefs, political views, trade union membership, sex life or sexuality or genetic/biometric information.

All calls to the Myeloma Infoline are confidential and can be anonymous if you want. Calls are not recorded but they may occasionally be monitored for quality and training purposes. All emails to “Ask the Nurse” are anonymised after they have been responded to, no identifiable personal information is stored however they may also occasionally be monitored for quality and training purposes.

We only collect this type of information about our supporters to the extent that there is a clear reason for us to do so, for example asking for health information if you are taking part in a sporting event, volunteering with us, and requesting advice on our Infoline or using our Peer Buddy service, where we ask for information for the purpose of providing appropriate facilities or support. 

We will also collect this type of information if you make it public or volunteer it to us – for instance if you tell us about your treatment in a call to our Infoline.

Wherever it is practical for us to do so, we will make clear why we are collecting this type of information and what it will be used for. 

How we use personal information
  • To support you when you use any of our services, for example, our Infoline or Peer Buddy service 
  • To process donations and claim gift aid 
  • To administer our volunteering programmes 
  • If you are a Healthcare Professional, we may process your data to provide you with educational resources and programmes to help you provide patients with the best possible treatment and care. 
  • To enable our fundraising and income generation we undertake research on a limited number of individuals who we believe may have an interest and the means to be supporters of Myeloma UK, or who are connected to organisations that could be supporters of Myeloma UK. We may analyse existing personal data, geographic and demographic information to help us profile and understand our current and potential supporters and other individuals and organisations, their areas of interest, whether we are offering our support in the most effective ways to meet patient need and in some cases to ascertain the likelihood of supporting Myeloma UK. To do this, we may use third party service providers. We occasionally conduct research into the wealth of individuals or engage third party specialists to do this on our behalf in line with this privacy notice.   
  • We also use publicly available sources to carry out due diligence on supporters in line with the charity’s Gift Acceptance Policy and to meet anti-money laundering regulations.  

We do this work to understand the background of individuals, understand how to identify and address unmet needs within our community, to make appropriate requests, ensure that individuals are not approached for support at inappropriate levels and to meet the expectation that supporters have of charities to minimise the costs of fundraising and administration where possible 

How and when will you hear from us

We will send you information when you request it from us online or via our patient Infoline.

If you are a healthcare professional or working for an NHS Trust or hospital we may contact you about our resources, events, or our Clinical Service Excellence Programme.

We wish to contact our supporters to let them know how their money is being spent and to say thank you for their generosity. We send information to individuals who have supported us to say thank you and provide updates on our work. We will tailor the amount and type of these communications depending on the ways in which you have provided support.

If you ask for details of, or register for an event or fundraising activity, we will send you information including, where relevant, ideas for fundraising, key information about the activity and reminders to submit any money raised.

We may send news, updates or fundraising communications, usually via email, including information about our events, campaigns, advocacy work and requests for donations or other support. We try to ensure where possible that content in these communications are interesting to you and relevant to your relationship with us. When you provide your details to us, you will be asked to opt in or opt out of receiving electronic marketing. 

If you’ve decided you don’t want to be contacted for the above purposes, we may still need to contact you for administrative purposes. This may include where we are processing a donation you’ve made and any related Gift Aid, thanking you for a donation or participation in an event, or keeping in touch with you about volunteering activities you are doing for us.

We will never sell or rent your information to third parties for marketing purposes.  

Managing your contact preferences 

We make it easy for you to tell us how you want us to communicate, in a way that suits you. Our forms have clear marketing preference questions, and we include information on how to opt out when we send you communications. If you don’t want to hear from us, that’s fine, and you can change your preferences at any time. Please let us know when you provide your data or contact us at myeloma@myeloma.org.uk 

We recognise that consent doesn’t last forever and that circumstances change. We will consider when you last provided permission and the nature of your support when deciding if it is still right for us to get in touch. You can change your mind about your preferences at any time by contacting us at myeloma@myeloma.org.uk  

Legal basis for processing 

Data protection laws mean that each use we make of personal information must have a “legal basis”. The relevant legal bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and the UK Data Protection Act 2018. 

Specific consent

We will use consent to send you any news, updates, event invites and fundraising communications via electronic channels for example email, telephone (where you are registered with the TPS) and text message. Where we use your information for a purpose based on consent, you have the right to withdraw consent for any future use of your information for this purpose at any time.  

Legal obligation

We have a basis to use your personal information where we need to do so to comply with one of our legal or regulatory obligations. For example, in some cases we may need to share your information with our various regulators such as the Office of the Scottish Charity Regulator (OSCR), Fundraising Regulator, Information Commissioner or the Gambling Commission, or to use information we collect about you for due diligence or ethical screening purposes. 

Performance of a contract / take steps at your request to prepare for entry into a contract

We have a basis to use your personal information where we are entering into a contract with you or performing our obligations under that contract. Examples of this would be if you are buying something from us (for example branded merchandise from our shop), applying to work/volunteer with us, or being funded to undertake research. 

Vital interests

We have a basis to use your personal information where it is necessary for us to protect life or health. For example, if there was a safeguarding issue which required us to contact people unexpectedly or share their information with emergency services. 

When using our services, including the Myeloma Infoline, Ask the Nurse email service and Peer Buddy Service, we may use vital interests to pass your data to relevant services in certain circumstances:  

  • an individual is perceived as at an immediate risk to themselves 
  • an individual is perceived as presenting an immediate risk to others 
  • there is an indication of abuse to any vulnerable adult or child 
  • there is an indication of possible terrorist action 
  • when an individual threatens staff or tries to prevent the service being used effectively to support others 
  • where there is concern for the health and safety of members of the Infoline team 

Legitimate interests

We have a basis to use your personal information if it is reasonably necessary for us (or others) to do so and in our/their “legitimate interests” (provided that what the information is used for is fair and does not unduly impact your rights).

We consider our legitimate interests to include all of the day-to-day activities Myeloma UK carries out with personal information. Some examples not mentioned under the other bases above where we are relying on legitimate interests are: 

  • analysis and profiling of our supporters or potential supporters to improve the efficiency of our fundraising 
  • use of personal information when we are monitoring use of our website or apps for technical purposes 
  • use of personal information to administer, review and keep an internal record of the people we work with, including healthcare professionals, supporters, volunteers and researchers 
  • sharing of personal information between relevant teams, volunteers and fundraising partners 
  • where you have signed up with us on a charity place for a third-party event sharing personal information with the third-party event organiser so they can administer the event 

We only rely on legitimate interests where we consider that any potential impact on you (positive and negative), how intrusive it is from a privacy perspective and your rights under data protection laws do not override our (or others’) interests in us using your information in this way.

When we use special category personal data (please see the “What information might we collect” section above), we require an additional legal basis to do so under data protection laws, so will either do so on the basis of your explicit consent or another route available to us at law for using this type of information (for example if you have made the information manifestly public, patient and research panels, we need to process it for employment, social security or social protection law purposes, your vital interests, or, in some cases, if it is in the public interest for us to do so). 

How we keep your information safe

We ensure that there are appropriate technical and organisational controls (including physical, electronic and managerial measures) in place to protect your personal details. For example, our online forms are always encrypted, and our network is protected and routinely monitored.

Some of our suppliers run their operations outside the United Kingdom, including within the European Economic Area (EEA). This includes countries which do not have the same data protection laws as in the UK. In these circumstances, we will make sure they provide an adequate level of protection in accordance with UK data protection law and confirm that appropriate safeguards are in place. 

How long we keep your information for

As long as necessary for the purpose/s, it was collected for. This will vary depending on the type of information, legal requirements or other justifications permitted by Data Protection Law. We keep records with evidence of ongoing engagement and use a retention schedule set out in our Retention Policy to determine how long to keep our records.  

Who do we share your personal information with?

We will never sell your personal data to third parties and will only pass your data to those third parties providing a service for Myeloma UK, as set out in this privacy notice, or where under a duty to do so in order to comply with any legal obligation.

Personal data will not be shared with service providers other than those acting on the instructions of Myeloma UK. Where this is the case, a written sharing agreement will be put in place between the us and the provider, including the security measures that must be in place to ensure that the service provider only uses your data for the agreed purpose.

Some of our providers include (please note this list is not meant to be exhaustive):  

  • Blackbaud – supplier of our CRM software 
  • Raisely – providing online donations and forms 
  • Mailchimp – e-marketing platform handling email 
  • Xledger – financial/accounting software 
  • BreatheHR – storing employee data and HR functionality  
  • Unity Lottery (Sterling) – administering the Myeloma UK lottery 
Information we collect on the website

This includes the IP address of your computer to: 

  • help keep our site safe and secure. 
  • help us diagnose faults with the website. 
  • ensure that content from our site is presented most effectively for you and your computer. Please refer to our section on cookies. 
  • to understand how users make use of our website, using Google Analytics and similar technology allowing us to improve it. Information collected using Google Analytics is collected anonymously, and it will not identify you. 

Website cookies

Our website uses cookies to distinguish you from other users of our website. For more information on cookies please visit our Cookie Policy.  

Your rights

You have the right to: 

  • ask us not to process your personal information for fundraising or other non-administrative purposes. If you wish to do this, please contact us. 
  • see copies of information held about you. Please send your request in writing to our head office. We may ask you for ID before fulfilling this request. We will respond as soon as possible and not longer than one month from receipt. 
  • ask us to amend, update or delete your information in some circumstances or withdraw consent to our processing of your information for particular purposes by contacting our Head Office. 

If you are unhappy with the way we are managing your personal information, please contact us. If you are still unhappy, you can complain to the Information Commissioner’s Office.

Changes to this Policy

We may change this Privacy Policy from time to time. If we make any significant changes in the way we treat your personal information we will make this clear on the Myeloma UK website or by contacting you directly. 

Who to contact

For queries about this privacy statement, or any data protection issues, please contact keith.scott@myeloma.org.uk or by post at Myeloma UK, 22 Logie Mill, Beaverbank Business Park, Edinburgh, EH7 4HG.

Close-up photograph of a hand holding a mobile phone.

Stay in touch

We’d love to stay in touch. Join our mailing list to receive updates from Myeloma UK including our monthly newsletter and updates about our services, research, campaigns and other ways you can get involved.