Privacy & data protection policy

PHAID DOR · Effective 28 October 2026 · Next review 28 October 2027

This policy explains how PHAID DOR collects and uses personal information, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It replaces our earlier "PHAID GDPR & Data Protection Policy".

Who we are

PHAID DOR is the data controller for the personal information described here. For any question about this policy or your information, contact Abid Husain at abid.husain@phaid.org.

Mailing list

What we collect: your email address, your name if you give it, whether you are a health care professional, whether you would like to hear about volunteering at our events (and that you live in the UK), a record of your consent (when you joined, the exact wording you agreed to, and any emails you have chosen to stop), when we last emailed you and, if you unsubscribe, when.

Why: only to send you information about future educational events and educational materials, choosing the emails most relevant to you (for example, content for health care professionals), and volunteering opportunities if you opted in to those.

Lawful basis: your consent (Article 6(1)(a)). You can withdraw it at any time.

Volunteering emails: we only email you about volunteering at our events if you choose "Yes – email me about volunteering opportunities" when you sign up. This is a separate choice from our educational emails, and we record it separately. You can stop volunteering emails on their own at any time and keep getting our educational emails.

Unsubscribing: every email has a link where you can choose to stop educational emails only, volunteering emails only, or all emails. You can also use the form at www.phaid.org/mailing-list. Changes take effect straight away. If you stop the only type of email you were still getting, you are unsubscribed from everything.

How long we keep it: while you get at least one type of email from us. If you stop all emails, your details are permanently deleted within 28 days.

Courses and certificates

What we collect: your name, email address, the course and date you attended, and any feedback you give on our attendance forms.

Why: to record attendance, issue and verify your certificate, and improve our courses. If you tick "Yes" to the mailing list question, you are added to the mailing list as above. If you don't, we won't send you marketing.

Lawful basis: our legitimate interests in running courses and issuing certificates (Article 6(1)(f)).

How long we keep it: 6 years after the course, so we can verify certificates. Feedback is kept anonymously after that.

Donations and Gift Aid

What we collect: your name, contact details, donation amounts and dates and, if you choose Gift Aid, your home address and Gift Aid declaration. Online payments are processed by PayPal; we do not see or store your card details.

Why: to process and acknowledge donations, keep financial records and claim Gift Aid from HMRC.

Lawful basis: legal obligation for financial and Gift Aid records (Article 6(1)(c)), and our legitimate interests in thanking donors (Article 6(1)(f)).

How long we keep it: 6 years after the end of the financial year of the last donation, as HMRC requires.

Volunteers and applicants

What we collect: contact details, CV or application information, qualifications and professional registration, references and identity documents where a role needs them. We only collect health information (such as immunisation status) with your explicit consent or where the law requires it.

Why: to assess applications, check people are qualified and safe for the role, and organise volunteering.

Lawful basis: our legitimate interests and steps before entering an agreement with you (Article 6(1)(b) and (f)); for health information, your explicit consent or a legal obligation (Article 9(2)(a) or (b)).

How long we keep it: 6 years after your volunteering ends. If an application is unsuccessful, 6 months.

Surveys and enquiries

What we collect: survey answers (anonymous wherever possible) and the details you give when you contact us.

Why: to answer your enquiry and to improve our work.

Lawful basis: our legitimate interests (Article 6(1)(f)), or your consent where a survey asks for it.

How long we keep it: enquiries for 2 years after our last contact. Identifiable survey responses for 2 years, then anonymised or deleted.

Who can see your information

Only people at PHAID DOR who need it for their role. People we authorise to write newsletters use a tool that never shows them anyone's email address. We never sell your information or share it with other organisations for their marketing.

We use trusted service providers who act on our instructions: Google (Workspace, Gmail, Forms, Sheets and Sites) to store information and send emails, and PayPal for donations. We share Gift Aid information with HMRC, and may share information where the law requires it.

International transfers

Our service providers may store data outside the UK. Where they do, the transfer is protected by legal safeguards such as UK adequacy regulations or the International Data Transfer Agreement.

Keeping it secure

Information is kept in access-controlled accounts. Access is limited to people who need it, and information is deleted when the periods above end.

Your rights

You have the right to:

• ask for a copy of your information;

• have it corrected or deleted;

• restrict or object to how we use it;

• receive information you gave us in a portable format;

• withdraw consent at any time, where we rely on it.

Email abid.husain@phaid.org to use any of these rights. We will reply within one month.

Data breaches

If a breach puts your information at risk, we will report it to the ICO within 72 hours where required and tell you if it is likely to affect you seriously.

Complaints

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We review this policy every year and whenever our use of personal information changes. The date at the top shows when it was last updated.