If you contact us for any reason we'll usually collect your:

• name
• email
• phone number
• address

When you donate we may also ask for:

• your bank or credit card details (which are stored under PCI Compliance regulations).
• date of birth through our face-to-face fundraising to check you’re over 18.

We may also record:

• information about your health, if it affects your ability to donate (eg if you’re hard of hearing we need to make sure we contact you in a way that suits you), in accordance with our Vulnerable Persons Policy. This is with your consent only.
• When you leave a comment on one of our blogs, we may also collect any information you provide to us in your comments.

When you sign up for a survey or fundraise for us we may also ask:

• what your interests are eg medical interests or countries we work in
• which age bracket you’re in
• what social media channels you use

If you sign up for our Access Campaign website your data will be collected by our Geneva office. Please read their policy to find out more about how they look after your data.

We use your data to:

• deal with your enquiries and requests
• process and acknowledge your donations
• keep a record of your engagement with us
• send you updates, marketing and fundraising communications 
• understand how we can improve our services and information
• analyse our fundraising activity

We won’t sell your details to any third parties or other charities. Read our donor promise for more info.

How we use your data depends on why you’re providing it:

Online forms and feedback

We’ll use your personal information to respond to your questions, requests or register you for events.

Surveys

We use surveys to understand who visits our websites and how they use it, helping us to create better content for you and make our websites easier to use.

We may ask for your email address if you’re happy to be involved in future surveys or testing. We’ll only use this to ask you to help us with these types of requests.

Donations

We use your information to process and keep a record of your donation. We also use it to claim Gift Aid if you've selected this option.

Blogs

Any information you post on our blog sites may be published and moderated.

Direct marketing

We use direct marketing to let you know what MSF is doing and how your support makes a difference. We may use it for emergency fundraising or to ask for other support. We'll always respect your preferences and endeavour to send you information that you’ll find interesting, in the format you prefer.

We'll send you direct marketing by post unless you indicate that you don't want to hear from us this way. We send these communications on the basis of it being within our legitimate interests to do so or if you've consented to receive this. Please see the “Legal Basis for Processing Data” section below for more information on this.

We'll also send you direct marketing by e-mail, SMS and phone if you've consented to hear from us this way.

The types of marketing that you can expect to receive from MSF UK include:

• Our quarterly ‘Dispatches’ magazine
• Monthly email 'Frontline' updates 
• Emergency appeals
• Event invites

Our email direct marketing has ways to opt out or update your preferences in the footer of each email. You can opt out at any time.

If you don’t want to hear from us, that’s fine. Just let us know on 0207 404 6600 or at uk.fundraising@london.msf.org.

Social media

We may use publicly available information linked to your social media profile to anonymously target you with posts that may interest you.

We’ll never ask for personal or sensitive information on social media. We may repost or share your posts on social media if it relates to MSF and our work.

We may respond to questions, queries or comments left on our social media channels. We may use information found on your profile to help us answer these.

Check your social media accounts if you want to change the information you make public.

Our websites use sharing buttons which share our web pages to social media platforms. Use these buttons at your own discretion. 

Social media platforms may track these shares through your accounts.

Trained staff

Your information is only accessible by trained staff, volunteers and contractors. We regularly review who has access to your information.

We do comprehensive checks on any contractors before we work with them. We always put a contract in place that sets out how they manage the personal data they collect or have access to.

Data processors

We use other companies to help us manage and store personal data and to carry out certain activities on our behalf.  Our main data processors are listed below, but we may enlist the services of others from time to time:

• Woods Valldata – our donation processing partner
• Dynamics – our in-house fundraising database
• Angel – our inbound call centre
• Communicator Corporation – our direct e-marketing platform
• ONEPOST and MBA – our direct mail partners
• EverGiving -  our face-to-face fundraising tool
• Braintree - our Apple pay partner
• Mosaic – our fundraising resource ordering platform
• Survey Monkey – surveys and competitions
• Association website – we store association member’s login details
• Taleo – UK office staff recruitment portal
• HERO – field staff recruitment and HR database
• Disqus – our blog comment service

We’ll only disclose your personal data to third parties, without your consent, when we have to by law, for example to authorised statutory agencies or authorities.

We do not transfer your personal data outside the European Economic Area (“EEA”).

We use appropriate technical and organisational measures and precautions in order to protect your personal data and to prevent the loss, misuse or alteration of your personal data.

We have lots of technical measures, eg we encrypt our online forms and routinely monitor our network and we use industry standard SSL certificates and PCI compliance.

While we make sure to keep your data safe, no data transmission over the Internet is 100 percent secure. We can't guarantee the security of any information you send us and you do so at your own risk.

We keep your information for as long as it’s necessary. For example, we keep your financial data for at least seven years.

If you request to receive no further contact from us, we'll keep some basic information about you on our suppression list in order to avoid sending you unwanted materials in the future.

Organisations need a lawful basis to collect and use personal data under data protection law. The law allows for six ways to process personal data (and additional ways for sensitive personal data). Four of these are relevant to the types of processing that MSF carries out.

This includes information that is processed on the basis of:

• A person’s consent (eg to send you direct marketing by e-mail or SMS);
• Processing that is necessary for compliance with a legal obligation (eg to process a gift aid declaration); and 
• Our legitimate interests (please see below for more information).

Personal data may be legally collected and used if it's necessary for a legitimate interest of the organisation using the data, as long as its use is fair and doesn't adversely impact the rights of the individual concerned.

Our legitimate interests include:

• Charity Governance; including delivery of our charitable purposes, statutory and financial reporting and other regulatory compliance purposes;
• Administration and operational management; including responding to solicited enquires, providing information and services, research, events management, the administration of volunteers and employment and recruitment requirements. 
• Fundraising and Campaigning; including administering campaigns and donations, and sending direct marketing and thank you letters by post. 

If you'd like to change our use of your personal data in this manner, please get in touch with us using the details below.

Contact us at uk.fundraising@london.msf.org or 020 7404 6600 if you'd like to:

• Update your personal information
• Change your personal information
• Change your contact preferences

You have a number of rights under data protection legislation:

• You can request any information we hold on you. Email us at uk.fundraising@london.msf.org and ask for it in writing. We'll supply any information you ask for as soon as possible, but this may take up to 30 days. You may be asked for proof of identity.
   
• You have the right to ask us to stop using or to restrict the processing of your personal data in certain cases, eg where it’s not needed to do what you provided it to us for, or if there is some disagreement about its accuracy or legitimate use.
   
• You can withdraw your consent to us processing your data at any time (where such processing is based on consent eg to send you electronic direct marketing).
   
• If you believe our records are inaccurate you have the right to ask for those records concerning you to be updated. To update your records please get in touch with us using the details above.
   
• In some cases, you have the right to be forgotten (ie to have your personal data deleted from our database), or transferred to another organisation (“data portability”). Where you have requested that we don't send you marketing materials we'll need to keep some limited information in order to ensure that you're not contacted in the future.

Kristen Veblen-McArthur is our data protection lead. You can contact her if you’ve any queries about data protection.

If you have any concerns about the way your data is being used or if you’d like to make a complaint please contact us using the details above. You're also entitled to make a complaint to the Information Commissioner’s Office and the Fundraising Regulator.

We change this Privacy Notice when we need to. If we make any significant changes in the way we treat your personal information we’ll make this clear on our websites or by contacting you directly.

This privacy notice was prepared to be as comprehensive as possible, but it doesn't include an exhaustive list of every aspect our collection and use of personal information. However, we'd be happy to provide any further information or explanation about our practices.

If you’ve any questions, comments or suggestions, please let us know by contacting us.

This describes how MSF UK (“we”) collects, holds and processes personal and sensitive data about its employees, ex-employees, individuals on the register waiting to be assigned to a mission, volunteers and anyone going through an application process – referred to as ‘you’ below.

MSF UK is a Data Controller in terms of the Data Protection Act 1998. We maintain information about you (your personal and sensitive data) in paper and electronic form. This is managed by the Human Resources Team. For certain services, such as payroll, we share this information with other parts of MSF UK (i.e. Finance) and sometimes with external partners who provide HR services on our behalf, for example payroll processing. We also share your contact details with the MSF Association UK/IE and our Fundraising team, solely for the purpose of sending you information about the work of MSF. Depending on the nature of your contract or work with us, we may also need to share your personal data with other partners within the MSF Movement. This will only be shared and used for the same purposes detailed below.

What personal data we collect and why

We use this information to administer payroll, pensions, insurance, training and appraisals, monitor equal opportunities, obtain visas, book travel and manage your access to various services such as IT and buildings. We cannot offer you an employment contract without having specific personal information about you. We also have certain legal obligations to keep information for a set period of time and on specific occasions disclose information to the appropriate authorities.

Some personal data about you is collected as part of our Equal Opportunities monitoring. Reports from this only use data in an anonymised form (so you cannot be identified from it) and are only shared within relevant internal functions. We also conduct an annual staffing audit containing some of your personal data, which is shared only internally to authorised personnel.

How we keep your data secure

MSF UK takes information security very seriously, particularly in relation to personal and sensitive data. We undertake regular audits and checks of personal data management and failure of our staff to comply with our Data Protection Policy is a disciplinary offence.

IT Facilities

Your name and, where relevant, work email address and phone number, will be included in the MSF UK Active Directory to enable us to provide IT services to you. Under the Regulation of Investigatory Powers Act 2000 and The Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 we have the right to monitor the use of computer and telephone facilities for purposes such as preventing and detecting criminal acts, investigating unauthorised use, making sure that policies are being followed and for training and quality control.

External Disclosures

Sometimes we will pass information about you to third parties, where the law allows it. For example, we may confirm the dates and nature of your employment to a prospective employer. We do not give or sell your information to other organisations.

When you leave

If you decide to leave MSF UK’s employment, your personnel file is kept for seven years from the date you leave. If you were a member of a pension scheme, some information will be kept longer to allow payment of a pension.

Accessing your personal data 

You have a right to see all the information that we keep about you. This is called a subject access request; if you wish to do this, please contact the Data Protection Officer. Our overall Data Protection Policy is found on this page. All MSF UK employees, contractors and suppliers are expected to comply with this policy.