Privacy and security

 

This notice has been designed to meet the requirements of the UK Data Protection Act 2018 (DPA), the UK General Data Protection Regulation (UKGDPR), Data Protection (Jersey) Law 2018, The Data Protection (Bailiwick of Guernsey) Law (2017), Data Protection Act 2018 (Ireland) and successive legislation.

This notice applies to all the websites we control, our use of emails and text messages for marketing purposes, and any other methods we use for collecting information. It covers what we collect and why, what we do with the information, what we won’t do with the information, and what rights you have.

What is personal data?
Personal data is information that can be used to identify you, such as name, identification number, location data, or online identifiers. Some categories of personal information are more sensitive and referred to as 'special category data'. This includes information relating to health, race, ethnic origin, political opinions, religious beliefs, trade union membership, genetics, biometrics, sex life and sexual orientation.

What information do we collect and why?
The RNLI collects a variety of data categories to plan, support and deliver our lifesaving work. This includes personal and non-personal data such as rescue activity, processing donations, web pages accessed, and files downloaded. This helps us to understand how many people use our websites, how many people visit on a regular basis, and how popular our pages are. This allows us to monitor and improve our service. Please see our cookies notice for further information.

If you choose not to provide the information requested, we may not be able to provide the service you require such as ordering goods from RNLI Shop or processing a donation.

We will use the information you provide to:

• review services provided, including search and rescue, and identify any improvements that can be undertaken
• fulfil your requests – such as applications for membership, competition entries, participation in campaigns and research, and provision of information
• process sales transactions, donations, or other payments and verify financial transactions
• comply with charity law and other regulations
• handle orders, deliver products and communicate with you about orders
• record any contact we have with you
• provide tailored stewardship
• prevent or detect fraud or abuses of our websites and enable third parties to carry out technical functions on our behalf
• communicate with our supporters and customers, including marketing and promotion
• carry out research and analysis on the demographics, interests, behaviour, responses and feedback of our users and supporters. This helps us gain a better understanding of them and to enable us to improve our service. This research may be carried out internally by our employees or we may ask another company to do this work for us where appropriate contracts are in place
• provide a personalised service to you when you visit our websites – this could include customising the content and/or layout of our pages for individual users along with email personalised to an individual’s interests or location, where appropriate
• maintain a historical record of the RNLI’s activities
• organise and administer events and plan fundraising activities
• manage employees and volunteers (Hire to Retire), including training and competencies
• manage the RNLI operations, including rescue services, sites and facilities
• safeguard employees, visitors and members of the public
• undertake educational activities, including youth education
• manage operations of the RNLI College hotel

 

Records created by your interactions with the RNLI

Your interactions with the RNLI may also result in personal data being created. For example, if you make a donation, the date and amount, along with the campaign that you responded to will be recorded. If you interact with our rescue services we may record information about any service or treatment given.

If you engage with one of our campaigns or activities, or volunteer to help at an event, details of your involvement may be added to your record so that we can make sure that any future communications we have with you are tailored to your interests.

The RNLI process payment information by several methods. Where payments are made using a debit or credit card, the RNLI does not store or retain the card information.

If you visit the RNLI online shop and place items in your basket but do not complete the transaction a reminder email may be generated. In the same way if you begin a donation but do not complete a reminder may be sent.

Information from third parties

We may combine your personal data with publicly available information, such as the Electoral Roll or the Royal Mail Change of Address List to minimise the risk and cost of sending communications that do not reach or would not be appropriate to you and to personalise our interactions with you.

We may share information with organisations only where necessary and covered by a contract, but these could include:

• print and fulfilment firms, including couriers
• event providers
• giving platforms (for example, Just Giving, Eventbrite)
• media and social media companies
• financial institutions (for example, banks, payment providers and HM Revenue and Customs)
• insight providers (for example, Moody’s Analytics or Xapien)
• legal firms, institutions and professionals (for example, solicitors, coroner, employment tribunals.)
• regulators
• councils
• IT software companies (including support organisations)
• employment organisations (for example, recruitment agencies, credit agencies, expense providers, car leasing, childcare, benevolent funds,)
• health professionals (for example, general practitioners, occupational health professionals,)
• emergency services agencies (for example, police services, ambulanceservices, fire services, HM Coastguard,)
• insurance providers.

 

Visual imagery data

The RNLI captures images and video footage of its lifesaving activities via helmet or equipment mounted cameras used by lifeboat crews and lifeguards. Capturing visuals of these rescues provides valuable footage for training, public education and for publicity purposes to promote the work of the organisation (where appropriate consents are in place). We also use these images to raise vital funds to ensure lifesaving activities can be financially sustained into the future.

We use video editing to conceal the identity of individuals and to edit around footage where there may be privacy concerns of showing the unedited footage.In addition, visual imagery may be captured in the form of photography and video footage from RNLI events. It is also used for identification purposes (for example, photo ID for employees).

Therefore, if you are visiting a RNLI lifeguarded beach or coastal area in the vicinity of a RNLI lifeboat station, or a RNLI event you should be aware that video footage or photos may be captured of you. We will always endeavour to inform participants, and bystanders at events that we are recording the event and that your image(s) may be used to support the work of the RNLI.

The RNLI also uses Closed Circuit Television (CCTV) at RNLI locations to:

• prevent and detect crime
• protect the RNLI’s buildings and their assets
• increase personal safety and reduce the fear of crime
• support law enforcement agencies in a bid to deter and detect crime
• assist in identifying, apprehending and prosecuting offenders
• protect members of the public and private property

• in accordance with the RNLI disciplinary policy and/or the volunteer problem solving policy and following a robust privacy risk assessment in line with the organisation’s CCTV policy.

CCTV is used on a limited number of beaches purely for the collection of statistical non personal data, for example providing counts of the number of people in different areas of the beach and sea.

CCTV footage will not be used for any other purposes and its use will be reviewed regularly. CCTV images will be retained for no longer than 30 days, after which they will be disposed of, unless there is an ongoing reason to keep them for the purposes named above. CCTV images are stored securely and can only be accessed by authorised individuals. With the exception of law enforcement bodies in the instance of crime, auditors or RNLI insurance companies in the instance of damage to property, images will not be provided to third parties.

Lawful Basis for Processing Your Personal Data

Personal information

Data protection law requires us to identify the lawful basis under which we collect and use your personal information. Depending on why we process your data one, or sometimes more than one of the following bases may be relevant.

• Legitimate Interest - processing where we consider it is in the legitimate interest of the RNLI to process your data. We will always balance any potential impact on you and your rights against the identified legitimate interests.
• Consent - where you have given your consent for the RNLI to use your personal data for a particular purpose.
• Legal obligation - where the processing of personal data is required to ensure compliance with a legal obligation.
• Contract - where the processing of personal data is required to meet our contractual obligations.
• Vital Interest - in rare cases we may process personal data under the basis of vital interests where necessary to protect life.

Special Category Data

Where we do process special category information such as health data, we need an additional legal basis to do so. We may do this under:

• Explicit consent
• Employment, social security and social protection
• Health or social care
• Vital interests
• Archiving, research and statistics

 

How we use your information

Using your information for marketing

Marketing information may include information from the RNLI Shop and RNLI College about the goods and services sold, fundraising appeals by the RNLI, and information about our rescues and the other work we do.

We may send you communications about our news, activities and appeals by post or phone unless you have previously told us that you do not want to be contacted in this way. We rely on legitimate interest for this processing as we believe the RNLI has a legitimate interest in promoting the charity.

We will send marketing information by text or email if you have consented to receive information this way. You can unsubscribe from these messages at any time by clicking the unsubscribe link to withdraw your consent.

You can add, amend, or remove your marketing preferences at any time by:

• using the preference form on the RNLI website
• clicking the unsubscribe option at the bottom of all marketing emails
• emailing data_protection@rnli.org.uk
• calling our Supporter Experience team on weekdays, 8am–6pm on 0300 300 9918 (from within the UK), 01 511 9837 (from the Republic of Ireland) or +44 1202 663234 (from outside the UK).

If you ask us to stop sending marketing information, we will update your record and do so as quickly as we can but please note that occasionally you may receive further mailings that were already in progress.

Profiling and Segmentation

Profiling and segmentation allow the RNLI to manage their resources more efficiently by providing information which helps us to continually review and improve our fundraising and services.

To create a profile, we (or one of our trusted third parties) may combine information you provide to us with publicly available data such as house prices, salaries in your area, your interests, or your estimated wealth. We typically use sources such as the Electoral Roll, Office National Statistics, and credit score companies to inform our research.

Using this information, we may segment our supporter database, putting supporters into groups with similar characteristics. We may use this information to help us determine if you might be interested in getting involved in other fundraising or volunteering activities or to send information that we feel may be of interest.

We believe we have a legitimate interest in undertaking this work which allows us to understand our supporters further so we can:

• ensure communications are relevant and timely
• ensure we send information that we believe is of interest to you (for example appeals in your local area)
• understand how you may be able to help us in the future
• raise funds in the most cost-effective ways, ensuring we spend donor’s money wisely
• exclude anyone who may be vulnerable from receiving marketing e.g. under 18’s or people living in care

If you would prefer us not to use your personal data in this way, please contact our Data Protection Officer at West Quay Road, Poole, BH15 1HZ or by email data_protection@rnli.org.uk.

Creating Research Profiles

We may carry out work to identify individuals who have potential as high value donors or advocates. We do this by researching individuals who we believe may have an interest in the RNLI. We may also research some of our existing supporters, volunteers and advocates and their networks with the aim of asking them to introduce us to potential high value donors or advocates we have identified.

We may create a research profile when preparing for one-to-one meetings and bespoke events using publicly available or paid for information such as Companies House, Twitter or data analytics companies. These sources can also help us identify new potential supporters who may have an interest in our work.

We will also undertake research for due diligence purposes on major donations to ensure we can accept the donation in line with our Donation Acceptance Policy.

Once a research profile is created for any of the purposes outlined, we will either:

• decide to take it no further, in which case we will securely delete the profile,
• aim to contact the individual within 30 days to tell them about our work, direct them to our privacy policy and give them the opportunity to cease all contact at this stage.

Research profiles will only be retained as long as required to fulfil the purpose after which they will be securely deleted.

As a charitable organisation funded by donations, we believe we have a legitimate interest in identifying and researching potential high value donors or advocates using the methods described to help us focus our conversations about fundraising or volunteering in the most effective way.

If you would prefer us not to use your personal data in this way, please contact our Data Protection Officer at West Quay Road, Poole, BH15 1HZ or by email data_protection@rnli.org.uk.

Social Media Advertising

We will only ever use social media platforms (such as Twitter and Facebook) in accordance with their own terms and conditions. If you have an account on one of these platforms, you will have agreed to these terms and conditions yourself. All social media platforms must comply with data protection laws when processing or storing the personal data of individuals from the UK and Ireland and have a responsibility to store and process data in a fair and transparent way.

Custom Audiences

If you have given us permission to use your email address, we may match it with your social media accounts so we can share relevant information with you such as fundraising events linked to your interests. We also do this to exclude some of our supporters from social media advertising to make sure we’re not wasting RNLI funds on communications which aren’t relevant to you. For example, if you’re already an RNLI member, we don’t want to send you adverts inviting you to sign up for membership.

Lookalike Audiences

We may also use the information you give us to identify other users of social media platforms who we think may also be interested in finding out more about the work we do. We upload email addresses to a secure portal these are then encrypted by the social media site. They then look for users in their community which have similar characteristics to those uploaded emails and who may therefore be interested in supporting the work of the RNLI.

If you would prefer us not to use your personal data in this way, please contact our Data Protection Officer at West Quay Road, Poole, BH15 1HZ or by email data_protection@rnli.org.uk.

On some RNLI websites, we have a social media tracking code in place. This allows our social media accounts and websites to share data with one another. This is entirely anonymised data so we can’t see information about any individuals, but it will tell us, for example, what percentage of our Facebook page followers have recently visited our website. This relates to official RNLI websites and channels only.

You can find out more about how we use social media tracking code in our cookies notice.

Media

The RNLI uses public and social media channels to promote the work that we do. If you take part in an RNLI activity, planned or unplanned, we may seek your permission to use your personal data in media activity. In some cases, where a story is deemed newsworthy it may not be possible to obtain your consent prior to use. These will be infrequent, and we will employ high ethical standards to ensure that graphic, embarrassing or inappropriate material is not publicised. We will always consider the impact to the data subjects before agreeing to release data. This could include video footage of rescues.

Sharing your information

We will only share your information if:

• we’re legally required to do so, for example by a law enforcement agency legitimately exercising a power or if compelled by an order of the court
• we believe it’s necessary to protect or defend our rights, property or the personal safety of our people or visitors to our premises or websites
• we’re working with carefully selected partners that are carrying out work on our behalf, such as mailing houses, marketing agencies, IT specialists and research firms. The kind of work we may ask them to do includes: processing, packaging, mailing and delivering purchases, answering questions about products or services, sending postal mail, emails and text messages, carrying out research or analysis, processing card payments.
• we only choose partners we can trust. We will only pass personal data to them if they have signed a contract or agreed to terms of service that require them to: abide by the requirements of the Data Protection Act, General Data Protection Regulation and successive legislation, treat your information as carefully as we would, only use the information for the purposes for which it was supplied (and not for their own purposes or the purposes of any other organisation), allow us to carry out checks to ensure they are doing all these things.

We never sell or share your information to other organisations to use for their own purposes.

Storing your information

Information is stored by us on computers located in the UK (including Jersey, Guernsey and the Isle of Man) and the Republic of Ireland. In addition, we may process your data in other countries both within and outside the European Economic Area but only where tightly controlled by appropriate contractual arrangements. We may also store information in paper files.

We place great importance on the security of all information. We have security measures in place to protect against the loss, misuse and alteration of data under our control. For example, we control who can access each of our systems and we use encryption on our website data before it is sent to us.

Unfortunately, the transmission of data across the internet is not completely secure. While we do our best to try to protect the security of your information, we encourage the safe sharing of data across the internet and advise that care is taken when sending personal, or sensitive data over a public connection.

We cannot ensure or guarantee that loss, misuse or alteration of data will not occur while data is being transferred.

Where you or we have provided a password enabling you to access parts of our websites or use our services, it is your responsibility to keep this password confidential. Please don't share your password with anyone.

How long we keep your personal information

We keep your information only for as long as we need it to

• provide you with the goods, services or information you have requested.
• Administer your relationship with us,
• Inform our research into the causes and prevention of drowning
• Carry out profiling, segmentation and research as outlined in the relevant sections above
• Send you relevant materials we believe may be of interest to you in accordance with our contact policy.
• When we no longer need information, we always dispose of it securely, using specialist companies if required. We have an information and data retention policy, which we review regularly.

Some personal information we hold is retained to fulfil statutory obligations, for example there is an HMRC requirement to retain of Gift Aid declarations for a period of 6 years.

Heritage information

The RNLI was founded in 1824 and we hold many historic records, which enable us to learn about the work of the RNLI over the decades and improve how we make decisions in the future.

To ensure we have an ongoing record of the RNLI’s lifesaving activities, which may be of interest and importance in the future, we keep certain information for heritage purposes This includes information about activities carried out by our crews and lifeguards.

Your rights

The UK General Data Protection Regulation (UKGDPR) gives you certain rights over your data and how we use it. These include the right to:

• access to the personal information we hold about you, known as a subject access request
• object to our processing (automated or otherwise) of your personal information
• object to your information being used for marketing purposes
• restrict the processing of your personal information
• obtain a copy of your personal data in a portable format so that you can reuse it
• rectify your personal information if you believe it is incorrect – we want to ensure that all information we hold about you is accurate and up to date so please do let us know if anything changes
• request the erasure of your personal information (please note that in certain circumstances we may need to retain your data for a specified period to comply with our legal obligations).

If you make a request relating to any of the rights listed above, we will consider each request in accordance with all applicable data protection laws and regulations. No administration fee will be charged for complying with such a request unless the request is deemed to be excessive in nature.

If you wish to exercise any of these rights please contact our Data Protection Officer in writing at RNLI, West Quay Road, Poole, BH15 1HZ or by emailing data_protection@rnli.org.uk. You can find more information about your rights under data protection legislation from the Information Commissioner’s Office at ico.org.uk.

 

Freedom of Information
The RNLI is not a ‘public authority’ as defined under the Freedom of Information Act and we will not therefore respond to requests for information made under this Act; using the funds generously donated to us by our supporters for such activities is not in accordance with our charitable purposes.

Children’s data
Some of the services we offer are aimed specifically at children (for example our Storm Force membership club and Swim Safe programme). To deliver these services safely it is necessary for us to collect data and store participants details on our database. Before we knowingly collect data from any supporter under 18, we will always ask them to:

obtain the permission of a parent or guardian before registering with us
let an adult know before they use our sites to obtain information about fundraising, campaigning or supporting our work.
It is our policy not to request donations or subscriptions or accept product orders for age restricted goods from children under 18.

Links to third-party websites
Our websites contain links to third-party websites that we believe may be of interest to our website visitors. This privacy notice only governs our websites, and we are not responsible for the privacy policies that govern third-party websites, even where we have provided links to them. If you use any link on our website, we recommend you read the privacy information of that website before sharing any personal or financial data.

Any questions?
If you have any questions about this notice or how we use your data please contact our Data Protection Officer at RNLI, West Quay Road, Poole, BH15 1HZ or by emailing data_protection@rnli.org.uk. In Europe, please contact EU Representative, Airside, Swords, Dublin, Ireland or email EURepresentative@rnli.org.uk.

 

The RNLI’s Open Information Principles sets out our approach to sharing information to external stakeholders. It is also provides explanation as to the information we cannot share.

Open information principles - download PDF 194KB