Privacy Statement

This privacy policy describes how we will collect and use your personal data.

Our Contact Details

Our site https://www.thecalmzone.net is owned and operated by the Campaign Against Living Miserably, a Charity registered in England and Wales (1110621) and Scotland (SC044347), whose registered address is 5 Wootton Street, London, SE1 8TG.

Our ICO registration number is Z1041135. Our Data Protection Officer can be contacted via email at dpo@thecalmzone.net.

Please read this policy carefully, and if you have any questions, please contact us on 0203 697 9331 or complete a contact form.

What Data We Collect and How?

We currently collect and process the following information:

Contact Data

Full name, email address, postal address, telephone number, mobile phone number.

Event Registration data

First name, surname, email, gender, postal address, phone number, social media handle(s), fundraising page handle, Meta event link, in member of, relationship to ‘in memory of’.

Financial data

Payment card details, bank details (if paying via BACS transfer), gift-aid declaration.

Profile data

Gender, clothing size, date of birth, organisation/society/school/Uni association, reasons for supporting CALM.

Health data

Medical conditions (only for sporting or high-risk event registrants). Experience with mental health and bereavement.

Technical data (e.g., cookies and other technologies such as pixels)

IP address, browser type and version, and operating system.

How We Use Your Personal Data (and the legal basis for processing)

Most of the personal data we process is provided directly by you. Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing this information. The table below lists the processing purposes and the lawful basis.

Helpline and Webchat Service

The CALM helpline and Webchat Service do not, as a matter of course, ask for names or contact details or process or store personal or identifying information about users. The CALM helpline respects and seeks to preserve the confidentiality of callers. Confidentiality is based on the common law ‘duty of confidence’ and is shared between the caller and the helpline service, not the individual worker.

In exceptional circumstances, confidentiality may be broken, and personal or identifying details will need to be processed or saved. The helpline will always endeavour to get the permission of the user when it is judged that a third party has to be involved. Situations when confidentiality will be broken without the consent of the caller are:

- When a caller has informed the helpline that they have serious intent or injury and have acted to take their own (or someone else’s) life at this time.

- When a caller has informed the helpline that they have information or knowledge about current or future terrorist activities.

- When a caller has revealed that they are abusing a child or vulnerable adult.

- Should it be considered essential to a caller’s wellbeing, and the caller requests it and provides information detailing name, location, contact details and current situation, this will be passed on to the emergency services, in appropriate circumstances, where a caller is unable or unwilling to do this for themselves.

In the above situations, where we need to process personal information, it will only be used for the immediate action needed. No further data processing will occur, and we will never use the information to contact a user in the future.

We also receive personal information indirectly from the following sources:

- Independent event organisers such as TCS London Marathon.

- Fundraising sites include Just Giving, Virgin Money Giving, and BT My Donate.

- Family members or friends, for example, if they are signing up multiple people for an event.

- Information available publicly, for example, information found on Companies House or through the electoral roll and information published in articles/newspapers.

Who do we share your data with?

We share your personal information with the following third parties:

If any of your personal data is shared with a third party, as described above, we will ensure that your personal data is handled safely, securely, and per your rights, our obligations, and the third party’s obligations under the UK GDPR.

Your personal data may be transferred to a third party if we sell, transfer, or merge parts of our charity or assets. Any new owner of our charity may continue to use your personal data in the same way(s) we have used, as specified in this Privacy Notice.

Do we transfer your personal data outside of the United Kingdom?

We store some or all your personal data in countries outside of the UK. These are known as “third countries”. We will only store or transfer personal data in or to countries deemed to provide adequate protection for personal data.

How do we store your personal data?

The security of your personal data is essential to us, and to protect your data, we take several necessary measures, including the following:

- Limiting access to your personal data to those employees, agents, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to duties of confidentiality.

- Procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data), including notifying you and/or the Information Commissioner’s Office where we are legally required.

- Training staff on data protection and cybersecurity at induction and offering refresher training on an annual basis.

- Procedures for managing data protection compliance include but are not limited to, data protection policies, handling individual rights requests, and retention schedules.

- Data processing agreements are signed with suppliers acting as data processors.

How long will we retain your personal data?

We will only keep your personal data as long as necessary and will be kept for up to 10 years. Per our Retention and Data Disposal Policy, we will securely destroy your personal data.

What are your Individual Rights?

Under data protection law, you have rights, including:

The Right of Access

You have the right to ask us for copies of your personal information.

The Right to Rectification

You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to update information you think is incomplete.

The Right to be Forgotten

You can ask us to erase your personal information in certain circumstances.

The Right to Restrict of Processing

You have the right to ask us to restrict the processing of your personal data in certain circumstances.

The Right to Object

You can object to processing your personal data in certain circumstances.

The Right to Withdraw Consent

If we rely on consent to process your personal data, you can withdraw that consent at any time.

The Right to Portability

You have the right to ask that we transfer the personal data you gave us to another organisation or to you in certain circumstances.

You are not required to pay any charge to exercise your rights. If you make a request, we have one month to respond.

How to Complain

If you have any concerns about our use of your personal information, you can complain to us at dpo@thecalmzone.net.

You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data. The ICO’s address is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Alternatively, you can phone their helpline at 0303 123 1113 or complete an online form via the ICO website (https://www.ico.org.uk).

Date last reviewed: 27/02/2024.