Data Subject information statement - Supporters

Walk the Walk Worldwide a company limited by guarantee registered in Scotland under company number SC201169 which is also registered as a charity with the Office of the Scottish Charity Regulator under number SC029572 (the Charity) and Walk the Walk in Action Limited a company limited by shares registered in Scotland under company number SC201976 (Trading) both of whose registered office is at 5 Atholl Crescent, Edinburgh, Midlothian, Scotland, EH3 8EJ and WalkWear Limited, a company limited by shares registered in England under company number 04926894 (WalkWear) whose registered office is at Kemp House, 152 City Road, London, EC1V 2NX (together the Group) Process your Personal Data in accordance with the General Data Protection Regulation (the GDPR), the Data Protection Act 2018 (the DPA),  and the information set out in this subject information statement.

1. Background
   • The Charity provides grants in respect of breast cancer research and cancer care and also provides specialist equipment to the NHS and other healthcare providers. The Charity raises money through:
     • Trading by means of organising the MoonWalks and other specialist walking events.; and
     • WalkWear by means of developing, manufacturing and selling specialist walking clothing and accessories.
   • The Charity and Trading also organise teams to enter events organised by third parties.
   • You are a general supporter of the Charity, either providing financial support or having entered into events organised or promoted by the Charity and Trading, or having purchased goods through WalkWear. You may also have been in contact with the Group either to obtain information, ask for updates, attended an event or the Group Processes your Personal Data because of your role or interest in the work of the Charity and the events organised by Trading.
2. Purposes and Legal Basis
   • The Group Processes your Personal Data and, where you have provided it, your Special Categories of Personal Data, for the following purposes:
     • to keep in contact with you;
     • providing you with information about the activities of the Charity, Trading, WalkWear and their partners, including but not limited to information about the events organised by Trading for the Charity and the sale of clothing, accessories and other products;
     • fundraising;
     • administration in relation to any support that you may provide to the Group;
     • statutory and regulatory compliance;
     • processing any enquiries or complaints raised by you and responding to any communications from you; and
     • (if you explicitly consent) sending electronic marketing communications to you keeping you informed about the DPA activities falling into any of the above categories.
   • The legal basis on which the above Processing takes place is legitimate interests.
   • In order to Process your Personal Data for the purpose of providing you with electronic information we are required to obtain your consent. Where you have already provided that consent, no further action is taken, if you have not provided such consent, please register to receive information by entering your email address at [email protected] and choosing the option to receive electronic update.
   • You have given consent to the Group to send you electronic marketing communications. Please note that you may withdraw consent at any time. Should you withdraw your consent the Group shall cease to Process your Personal Data. You may revoke your consent to receive such updates by using the unsubscribe function included in each update.
   • The legitimate interests which permit the Processing set out above to take place are:
     • that it is reasonable for the Group to keep in contact with you as a result of our initial contact or to hold information due to any positions or roles that you hold;
     • that the Processing is reasonable in relation to the activities to which they relate;
     • the Processing is such as you would reasonably expect to be undertaken by the Group in respect of the management of your donation;
     • that the Processing is necessary in respect of the activities that are undertaken and is in the interests of the Operator and certain third parties and does not limit your interests or fundamental freedoms guaranteed by the GDPR and/or the DPA;
     • that if you sought to terminate your consent to due to your role and/or position it may still be necessary for the Group to be in contact with you.
   • Notwithstanding the legitimate interests of the Group in Processing your Personal Data there are circumstances in which you can limit the Processing undertaken by the Group and these are explained in Section 7 below.
3. Source
   • Whilst you have provided some of the Personal Data which is Processed by the Group, we have also obtained Personal Data from public sources.
4. Recipients
   • The Group may transfer your Personal Data to the following organisations or category of organisations:
     • our sub-contractors engaged in supporting the activities of the Group; and
     • our regulators and government agencies.

5. International Transfers
   • It is the intention of the Group that your Personal Data will remain within the countries forming the European Economic Area (the EEA) and countries where the European Union has decided that the country has adequate data protection laws in line with those in the European Union.
   • Your Personal Data will only be transferred outside of the EEA or a country which has been declared as having adequate data protection laws, where:
     • the transfer is necessary for the performance of any contract with you;
     • you have entered the information into our Website and the information has been transmitted from your server to our server using systems based outside of the EEA;
     • we have entered into an appropriate contract protecting your rights and freedoms, which is enforceable by you or the data protection authorities; or
     • we have obtained your explicit consent.

6. Storage
   • We will generally store the Personal Data that we hold in relation to you for the duration of our relationship with you and for seven years after that relationship ends.
7. Your Rights
   • You have a right to obtain from the Group confirmation as to whether or not your Personal Data are being Processed and, if your Personal Data are being Processed by the Group, to access the Personal Data and for the specific information set out in Article 15 of the GDPR. To access your Personal Data please contact the Data Protection Administrator. Please note that we will not provide any Personal Data to you until you have provided evidence to us to establish your identity. This may include a copy of your passport or other identification document. We will only provide information to you at an address which we have verified as belonging to you.
   • You have a right to rectification of any inaccurate Personal Data which we Process about you, or where Personal Data is incomplete to have the information completed. To obtain rectification or completion you will need to provide the correct information to the Group, an explanation of why you believe the information is inaccurate or incorrect would also be of assistance.
   • Where certain grounds, as set out in Article 17(1) of the GDPR, apply you will be entitled to have the Group erase certain Personal Data relating to you. Where you wish to exercise your right of erasure, please contact the Data Protection Administrator setting out your reasons for requesting erasure of Personal Data which the Group holds about you. This will be assessed by the Group and if applicable the erasure will then take place.
   • Where certain grounds, as set out in Article 12(1) of the GDPR, apply you will be entitled to have the Group restrict the Processing of certain Personal Data relating to you. Where you wish to exercise your right to restrict Processing, please contact the Data Protection Administrator setting out your reasons for requesting the restriction.
8. Complaints
   • If you have any complaint about the Processing of your Personal Data undertaken by the Group, please contact the Data Protection Administrator.
   • Please note that you have a right to lodge any complaint about the Processing of your Personal Data by the Group by contacting the Information Commissioner’s Office.
   • The Group is not required to have a data protection officer under the GDPR and one has not been appointed, therefore please address all communications in relation to personal data to the Data Protection Administrator.
9. Definitions
   • The following terms have the following meaning in this Statement:
     • Personal Data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
     • Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
     • Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
     • Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
     • Special Categories of Personal Data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

10. Contact
    • The Data Protection Team can be contacted:
      • writing to the Data Protection Team, Walk the Walk Worldwide, 6 Genesis Business Park, Albert Drive, Woking, Surry, GU21 5RW;
      • sending an email to [email protected]; or
      • by telephone by calling +44 1483 741430.

11. Further Information
    • It is not intended that the Group will undertaking any further Processing of your Personal Data other than that which is set out in this statement. However, if this position does change the Group will provide you with further information.
    • This statement was last updated on 30 November 2018.