Privacy Policy

GDPR Privacy Statement for the General Public

What is the Purpose of this Document?

Chest Heart & Stroke Scotland (CHSS) is committed to protecting the privacy and security of your personal information.

This privacy notice describes how we collect and use personal information about you when you interact with us, in accordance with the General Data Protection Regulation (GDPR).

It applies to all members of the general public who engage with us either virtually or in person.

CHSS is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

This notice applies to all members of the general public who engage with us either virtually or in person. We may update this notice at any time but if we do so, we will provide you with an updated copy of this notice as soon as reasonably practical.

It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.

Data Protection Principles

We will comply with data protection law. This says that the personal information we hold about you must be:

Used lawfully, fairly and in a transparent way.
Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
Relevant to the purposes we have told you about and limited only to those purposes.
Accurate and kept up to date.
Kept only as long as necessary for the purposes we have told you about.
Kept securely.

The kind of information we hold about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

There are “special categories” of more sensitive personal data which require a higher level of protection, such as information about a person’s health or sexual orientation.

We will collect, store, and use the following categories of personal information about you:

Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
Date of birth.
Gender.
Next of kin and emergency contact information.
Financial details of any transactions that you have made with CHSS.

We may also collect, store and use the following “special categories” of more sensitive personal information:

Information about your health, including any medical condition or disability.

How is your personal information collected?

We collect personal information about the general public who engage with us through the use of Microsoft or other forms on our website or at events, referrals from other organisations, or via data being added directly to our databases.

How we will use information about you

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

Where we need to perform the contract we have entered into with you as a donor, fundraiser, or when you make a purchase from us.
Where we need to comply with a legal obligation.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

1. Where we need to protect your interests (or someone else’s interests).

2. Where it is needed in the public interest or for official purposes.

Lawful basis for processing

UK data protection laws require us to have a specific lawful basis for each purpose for which we process your personal information. We explain these purposes and the corresponding lawful basis in the section on How we use your data.

Personal information

We generally process your personal information on one of the following bases:

the processing is necessary for our legitimate interests, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal information;
we have obtained your consent to use your personal data for the stated purpose;
the processing is necessary for compliance with a legal obligation. to which we are subject; or
the processing is necessary for the performance of a contract. to which you are a party or in order to take steps at your request prior to entering into such a contract.

We may also rely on other bases (for example, where the processing is necessary in the performance of a task carried out in the public interest, or where the processing is necessary in order to protect your vital interests or those of another person) on an exceptional basis, if none of the above conditions apply.

Special category information

We collect special category data, generally health data, so that we can give you advice, refer you to services, or to provide other support to you.

In order to process any special category data, we need to ensure that we have a particular reason to do so in addition to the general lawful bases set out above.

We generally process your special category data only with your explicit consent.

However, we may also rely on other bases where neither of the above apply, including but not limited to where the processing is needed for legal claims, is necessary for substantial public interests (as set out in UK data protection law), is necessary for reasons of public interest in the area of public health, or exceptionally, where the processing is needed to protect your life or the life of another.

Information about criminal convictions

We may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

How is your personal information collected?

We collect personal information about the general public who engage with us through the use of forms on our website or at events, referrals from other organisations, or via data being added directly to our databases or if your information is available publicly or from external sources.

How we will use information about you

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

Where we need to perform the contract we have entered into with you as a donor, fundraiser, or when you make a purchase from us.
Where we need to comply with a legal obligation.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We may also use your personal information in the following situations, which are likely to be rare:

Where we need to protect your interests (or someone else’s interests).
Where it is needed in the public interest or for official purposes.

Situations in which we will use your personal information

We need all the categories of information in the list above primarily to allow us to perform our contract with you and to enable us to comply with legal obligations. In some cases we may use your personal information to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights do not override those interests. The situations in which we will process your personal information are listed below.

Sending thank you letters as a donor.
To keep you safe at one of our events.
Delivering goods purchased from CHSS to you.
To keep you up-to-date with the services that we offer at CHSS.
To keep you up-to-date with the ways in which your donations are aiding our service users.
To keep you up-to-date with the ways in which you can give us further support.
Dealing with legal disputes involving you, or other CHSS stakeholders.
For the purposes of providing you with the correct services.
For the purposes of evaluating the services we supply you with.
To carry out research into how to give you the best support possible.
To give you or your workplace the results of any educational tests or quizzes that you have undertaken with us.
To review publicly available information about those who support us to help us gain a better understanding of our supporters.

Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

If you fail to provide personal information

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as providing you with the services that you require), or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of the people at our events).

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

To allow us to better understand current and potential supporters:

Profiling

Profiling means gathering information about an individual or a group of individuals and analysing their characteristics or behaviour patterns in order to place them in a certain category or group, and/or to make predictions or assessments about their ability to perform a task, their interests or likely behaviour.

We believe that we have a legitimate interest in profiling supporters and potential supporters as explained below. Profiling allows us to understand our supporters better, so we can send you information that you are interested in and is relevant to you, and predict how you might be able to help us in the future, to make sure we don’t send marketing to vulnerable individuals, and to raise more funds, sooner, and more cost-effectively, than we otherwise would. It allows us to be more efficient with our resources, which donors consistently tell us is a priority for them, and to assess and improve our services more generally.

We also use profiling to identify which areas of Scotland have a particular need for our support, and we consider that we have a legitimate interest in carrying out this analysis to help us target our support to those areas where it is most needed.

If you would prefer us not to use your personal data in this way, please contact our Data Protection Officer at CHSS, 2nd Floor, Hobart House, 80 Hanover Street, Edinburgh, EH2 1EL or by email at data@chss.org.uk

Building a profile

In order to create a profile for you, we (or our trusted service providers) may use the information which you give us and which we collect from external resources, such as Prospecting for Gold or Experian, including information that is publicly available about you. We may also combine your information with data already held internally by Chest, Heart and Stroke Scotland.

This information may include:

Information you give us/ we collect from you such as name, age, gender, address, email address, bank account details, donation history, the events, campaigns and products you have engaged with, the results of any surveys you have completed for us, your volunteering status and any previous segmentation; and
Information from external sources such as age, gender, property prices and average earnings where you live, your job, directorships, your financial circumstances, networks, any previous donations you have made, your philanthropic interests (trusteeships and/ or support to other charities), and your estimated wealth.

Segmentation

We use Dataro for behavioural analysis on our supporters, to help us segment our supporter database (i.e. to put you into categories with other supporters with similar characteristics) and to enable us to profile other supporters, if we have a legitimate interest to do so.

We also use, and may engage independent companies to use, software tools and predictive analytics to help us analyse who is most likely to donate to us and to more accurately target our engagement with you. These tools use data we already hold on you, but may also obtain data from external sources, such as GI, YouGov or Experian, to help with this assessment.

We may also use this information to help us determine whether and in what ways you might be interested in getting involved in our other fundraising activities.

Profiling allows us to understand the background of the people who support us and use our services and helps us to:

ensure communications are relevant and timely, and to provide an improved experience to our supporters, for example, to send information about campaigns and services in your area (with your consent, where required);
find potential new supporters and invite them to be involved in supporting our cause;
determine whether and in what ways you might be interested in getting involved in our other fundraising activities;
better tailor our services to our supporters, for example by sending tailored communications which may be of interest to you, and making appropriate requests to supporters who may be able and willing to give more than they already do; and
to exclude people who may be vulnerable from marketing, for example, people living in care homes and minors (under 18s)

High Value Donors

We, like many other charities, carry out research in order to engage with suitable high value donors. This helps us identify people who have an interest in our cause and could potentially make a substantial donation.

We process personal information on existing and potential high value donors to help us support more people with cancer. We can achieve this aim by increasing the number of people we engage with who have the capacity to give £10,000 or more to us in a single donation.

Researching potential high value donors enables us to focus our fundraising resources whilst ensuring that our requests for support are tailored to each individual. Our personalised approach helps us to provide the best possible donor experience that is aligned with an individual’s interests and capacity to give.

If you would prefer us not to use your personal data in this way, please contact our Data Protection Officer at CHSS, 2nd Floor, Hobart House, 80 Hanover Street Edinburgh, EH2 1EL or by email at data@chss.org.uk

Identifying potential high value donors

We identify potential high value donors by:

Carrying out research on donors who have given £1,000 or more to us.
Asking our existing high value donors to give again.
Inviting potential high value donors to attend our supporter events as a way of engaging them with us. We also identify potential new donors by researching event attendees who were previously unknown to us.
Researching people who have not given to us in the past but who we believe may have a connection to our cause and have the capacity to give at a high level.
Asking our donors and influencers to open up their networks to us.
Asking our donors and influencers to introduce us to potential donors we have identified through our research and that they have a link to.
Our initial research is undocumented and involves some basic checks looking at publicly available information, e.g. using Google, a public LinkedIn profile and Zoopla.

We do not process health (or other special category) data at this stage, unless the individual in question has manifestly put it in the public domain (e.g. have themselves given interviews to media outlets or published articles/ public blog posts revealing this information). Fundraising teams do not have access to any information given to a Chest, Heart & Stroke healthcare professional about any health experience and we never use this information in any research into potential high value donors.

Creating Research Profiles

If our initial research is promising, or if someone has donated £10,000 or more to us, we will create a research profile of the individual using information sources such as BoardEx, Companies House, Who’s Who, The Charity Commission, JustGiving and Twitter as well as Prospecting for Gold’s Wealth Intelligence Database.

We also use these information sources to identify potential new donors who have previously given at a high level and may have an interest in our cause. If we discover that someone in our network knows a potential donor that we have identified, we might ask them to facilitate an introduction.

We sometimes ask existing supporters whether they would be prepared to open their networks up to us. An existing supporter may tell us about an individual previously unknown to us and facilitate an introduction. In this scenario we would advise our existing supporter about our data responsibilities and ask them to ensure that the individual in question is happy for an introduction to take place. Following the introduction, we would direct the individual to this privacy policy and ask them to confirm how they would like to hear from us.

In the two scenarios above, we may create a research profile on someone who we have never had any contact with before. In this case, we plan to make contact within 30 days to tell the person about this privacy policy. If we attempt to make contact but are unable to do so, we will try again within the next 30 days and delete the research profile if we are still unsuccessful.

After we’ve created a research profile, we score potential donors under each of the following headings:

Ability
Interest
Linkage

These scores are an estimation of an individual’s capacity to give to us, their interest in giving to us and any links they have to our cause. This helps us to prioritise our resources and develop more relevant funding proposals as we seek to generate support for people with our resources.

Lawful grounds for processing

We rely on legitimate interests as our lawful basis for identifying, researching, and otherwise processing the personal data of our potential high value donors as set out above.

It is important for us to know about our donors’ experience of our conditions, as we know that 75% of our donors have had an experience of a chest, heart, stroke or long covid condition and that this has a significant impact on their interest in supporting our work. This is classed as sensitive or ‘special category’ data: so, if we come across details of a potential donor’s experience with our conditions, we will only record this if the individual has manifestly made it public. If an individual tells us directly about their experience of one of our conditions, or shares any other special category data with us, we would only capture this data if we have their consent to do so.

Our Philanthropy and Fundraising teams foster long term relationships with our existing and potential donors. However, we are committed to only keeping data on individuals with whom we have an active relationship. We therefore remove the data captured in the ways described above if the existing or potential donor has not interacted with the Philanthropy or fundraising team in the previous five full calendar years.

To promote our cause through marketing and advertising

We may advertise on Facebook, TikTok, YouTube, Spotify, LinkedIn and Snapchat and other social media or digital platforms.

We may advertise to people signed up with an online platform based on what the platform knows about them. We use this method to promote Chest Heart & Stroke Scotland activities, events, fundraising and information about our services. We do not track individual responders unless they provide their information directly, we keep a tally of how many people clicked through to our information pages so we understand whether our advertising is effective. We also do not target individuals based upon any special category personal data, such as health conditions, but we would target a segment of people who may benefit from knowing about our services and health information.

On Facebook, we may use:

‘Look-alike’ / ‘Similar’ audiences: We send a list of ‘hashed’ email addresses to Facebook, which then matches these hashed email addresses to existing users, and creates a group of people with similar characteristics and presents our advertising to them.

Custom audiences/ Customer matches: We use a similar method to send information and support to people who have engaged with us, including volunteers, supporters, fundraisers and people who have purchased products from us. We send a list of hashed email addresses and Facebook matches these email addresses to users.

We also use ‘Saved’ audiences to remember which supporters on Facebook are most likely to respond to our fundraising, campaigning and marketing requests.

The hashed data that we share with Meta is deleted after a short period of time and not used for any other purpose.

For more information, about how Facebook processes personal data please review their respective privacy policies, the UK versions of which are available at https://en-gb.facebook.com/policy.php

We believe we have a legitimate interest to use targeted advertising to personalise and improve experience with our advertisements.

If you fail to provide personal information

Change of purpose

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How we use particularly sensitive personal information

“Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

We may process special categories of personal information in the following circumstances:

In limited circumstances, with your explicit written consent.
Where we need to carry out our legal obligations or exercise rights in connection with employment.
Where it is needed in the public interest, such as for equality and diversity monitoring.

Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

Our obligations as an organisation who holds external events

We will use your particularly sensitive personal information in the following ways:

We will use information relating to your medical information to make decisions about your health and safety at our external events.

Our obligations as an organisation who provides Health Services

We will use your particularly sensitive personal information in the following ways:

We will use information relating to your medical information to make decisions about which Services we will provide to you.

Do we need your consent?

We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your engagement with us that you agree to any request for consent from us.

Information about criminal convictions

Automated decision-making

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:

Where we have notified you of the decision and given you 21 days to request a reconsideration.
Where it is necessary and appropriate measures are in place to safeguard your rights.
In limited circumstances, with your explicit written consent and where appropriate measures are in place to safeguard your rights.

If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so.

Data sharing

We may have to share your data with third parties, including third-party service providers.

We require third parties to respect the security of your data and to treat it in accordance with the law.

We do not currently transfer your personal data to countries outside of the EU apart from where it is necessary for data processing purposes, and in all instances the data protection addendum is compliant with the UK GDPR.

If this changes, you can expect a similar degree of protection in respect of your personal information.

Why might you share my personal information with third parties?

We will share your personal information with third parties where required by law, where it is necessary to administer the engagement that we have with you or where we have another legitimate interest in doing so.

Which third-party service providers process my personal information?

“Third parties” includes third-party service providers (including contractors and designated agents). The following third-party service providers may process your data on our behalf: Splice, Swiftaid, PayPal, the HMRC, Access Paysuite, and the Charities Trust for the management of your financial information. Mailchimp, Mail Marketing and J Thomson Printers for the administration of our email distribution lists. We also utilise Dataro and Prospecting for Gold for the processing of our marketing and fundraising information. We use a third-party SEO analysis tool called SE Ranking to track website performance, analyse keywords, and monitor search engine rankings. This service may collect information such as search queries. We utilise the services of Derek Anderson for photography for our marketing information. We also have data sharing agreements in place with the NHS boards in Scotland and Scottish Opera in order to provide an integrated service with them for our service users. This list will be subject to review.

How secure is my information with third-party service providers and other entities in our group?

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

When might you share my personal information with third parties?

We may share your personal information with other third parties, for example in the context of the possible expansion of service provision in the charity. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction.

We may also need to share your personal information with a regulator or to otherwise comply with the law.

Transferring information outside the EU

Data security

We have put in place measures to protect the security of your information. Details of these measures are available upon request.

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data retention

How long will you use my information for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Rights of access, correction, erasure, and restriction

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Data Team.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the data@chss.org.uk. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Data Protection Officer

We have appointed a Data Protection Officer to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the Chief Operating Officer. You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.

Changes to this policy

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

If you have any questions about this privacy notice, please contact Allan Cowie, Chief Operating Officer, Chest Heart & Stroke Scotland, 2nd Floor Hobart House, 80 Hanover Street, Edinburgh, EH2 1EL. Telephone 0131 346 3650. Email: data@chss.org.uk

We may change this Privacy Policy from time to time. If we make any significant changes in the way we treat your personal information, we will make this clear on the CHSS website or by contacting you directly.

Revised March 2025