Rainforest Trust UK takes your privacy seriously and we ensure that appropriate safeguards are in place to ensure you remain informed and in control of your information, and to protect your privacy rights.

This Privacy Policy sets out how we will use and store your data, in full accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Regulators Code of Fundraising Practice (2016). Rainforest Trust UK is registered with the ICO and the UK Fundraising Regulator.

1. ABOUT US

Your personal data (i.e. any information which identifies you, or which can be identified as relating to you personally) will be collected and used by Rainforest Trust UK (Charity No. 1169111, registered with the Charity Commission of England and Wales). Our Registered Address is 120, Muirkirk Road, Catford, London SE6 1BH.

Rainforest Trust UK works closely with its partner charity Rainforest Trust (U.S.) and your personal data is managed by both organisations. For the purposes of EU and UK data protection law, Rainforest Trust UK and Rainforest Trust (U.S.) act as joint data controllers.

2. WHAT INFORMATION WE COLLECT

a. Personal Information

We collect personal data you provide to us. This includes the following:

• personal details (name, address, email address, telephone, etc.) when you make a donation to Rainforest Trust UK or request to be added to our database, e.g. by signing up for our newsletter online, or completing a form at an event or talk.
• financial information (payment information such as the last four digits of your credit/debit card or direct debit details, and whether donations are gift-aided).
• details of your interests and preferences (such as which projects you have donated to, any particular aspects of conservation you are interested in, etc.).

We do not collect or store special categories of personal data (such as information relating to health, beliefs or political affiliation) about supporters.

b. Non-Personal Information

For each visitor to the Rainforest Trust UK website, our web servers may automatically recognise and collect information that does not identify you personally (“Non-Personal Information”), such as cookies, in-bound domain names, your computer’s IP address, the type of browser in use and pages viewed. This data tells us which pages our users visit and what information they volunteer, such as survey information and/or site registrations which we use to improve our communication with our greater community.

• We use Google Analytics, which instals cookies on users’ browsers, to understand the performance of our website and content contained within including, but not limited to: number of visits and average time spent either to a single page or the entire site, number of pages viewed per session, or the sequence of pages visited. We may also customise site structure or navigation as well as certain web content based on these data as well as your browser type, bandwidth or other settings to optimise your site experience. Google Analytics also collects information about the devices that are used to access our site, including computer type (Windows or Macintosh), screen resolution, operating system and version, device manufacturer and model, language, and Internet browser type and version. Google uses this data to report web trends.
• We use Google AdWords to display text ads at the top of Google keyword searches. Anonymised information on specific keywords typed is provided.
• We use YouTube to host video content on conservation.org. Analytics for this platform include aggregated and anonymised data on length and location of views, basic demographic details, and engagement rates.

You can control the type of information collected through our Sites, for example by not accepting cookies from Rainforest Trust, by erasing all Rainforest Trust cookies from your browser, or by not providing Personal Information when prompted. To opt out of cookies installed by Google Analytics, please see:  https://tools.google.com/dlpage/gaoptout.

Your choice will impact your communications preferences, for example we will not be able to respond to inquiries when you do not share your email address with us.

3. HOW AND WHERE WE STORE YOUR DATA

From October 2022, your personal information is carefully inputted on a secure database (a Constituent Relationship Management Tool) managed and controlled by Rainforest Trust UK and Rainforest Trust (U.S.). The database is called Virtuous and all personal data is stored on its servers, which are located in the U.S. Virtuous uses Privacy Shield and has contractual clauses about processing personal data, which are approved by the European Commission and meet GDPR regulations (Article 46 of Regulation (EU) 2016/679 General Data Protection Regulation).

Personal data provided to us before October 2022 was stored and processed on a database called Charity Engine which also meets these standards. This data is being transferred to Virtuous during October 2022 and will then be permanently deleted from the Charity Engine system.

In addition, data may be managed and stored in spreadsheets saved within the Rainforest Trust UK shared folders, using Google Drive. We may also scan and save other supporting documentation (letters etc) into the shared Google Drive. We are trying to move to a paperless office, so if hard copy letters are sent to us, including any personal data, these are stored in locked filing cabinets before being scanned then shredded.

Sometimes you may be asked to access a third-party site for example to complete a survey, enrol at an event, or submit a form. Where possible we minimise the amount of personal data we ask for and we check the website’s security meets UK GDPR before asking you to use it.

4. HOW WE USE YOUR INFORMATION

We only use your personal data with your consent and for the purpose for which it was provided. This includes:

• to promote the work of Rainforest Trust UK;
• to periodically alert you about our news, events and campaigns;
• to ask for your financial support of our conservation projects;
• to respond to your enquiries.

We also use personal data for administrative purposes (i.e. to carry on our charity and conservation work). This includes:

• receiving donations (e.g. via debit/credit card through our online forms, direct debits or Gift-Aid instructions);
• maintaining databases of supporters; and
• helping us respect your choices and preferences (e.g. if you ask not to receive marketing material, we’ll keep a record of this).

You can change your preferences or opt out of receiving marketing communications at any time by contacting UK@RainforestTrust.org or calling us on 0203 488 4495.

We may evaluate, categorise and profile personal data in order to tailor materials, services and communications (including targeted email communication) and prevent unwanted material from filling up your inbox. This also helps us understand our supporters, improve our organisation and carry out research. When you receive a communication, we may collect information about how you respond to or interact with that communication, and this may affect how we communicate with you in future.

We may aggregate and anonymise personal data so that it can no longer be linked to any particular person. This information can be used for a variety of purposes, such as recruiting new supporters, or to identify trends or patterns within our existing supporter base. This information helps inform our actions and improve our campaigns, products/services and materials.

We may from time to time need to contact you by post if we believe that this is in our legitimate interest to do so, for example, if we need to confirm a donation or Gift Aid form with you and have been unable to contact you via another preferred method of communication. However, please be assured that if you opt out of contact by post, you will not be sent any marketing information, newsletters or details of appeals.

We will never sell or rent your personal data. We will not share your Personal Information with any organisations or individuals outside of Rainforest Trust UK and Rainforest Trust (U.S.) without your consent, except under the following circumstances:

• to Rainforest Trust UK and Rainforest Trust (U.S.) service providers for the purposes set forth above;
• to Rainforest Trust UK and Rainforest Trust (U.S.) partners, approved vendors, and their service providers;
• when we are required to do so by law, for example, in response to a court order or other legal obligation;
• in special cases when we have reason to believe that disclosing this information is necessary to identify, contact or bring legal action against someone who may be causing injury to or interference with our rights.

As a charity, we rely on donations and support from others to continue our conservation work. From time to time, we will contact supporters with fundraising material and communications. This might be about an appeal, a competition we’re running, or to suggest ways you can raise funds (e.g. a sponsored event or activity, or even buying a product if Rainforest Trust UK will receive some of the proceeds).

As with other marketing communications, we’ll only contact you specifically about fundraising if you’ve opted in to receiving marketing from us (and you can, of course, unsubscribe at any time).

We may use Non-Personal Information for any purpose, unless restricted by applicable law. In some instances, we may combine Non-Personal Information with Personal Information. If we do, we will treat the combined information as Personal Information as long as it is combined.

We also undertake in-house research and from time to time engage specialist agencies to gather information about you from publicly available sources. We may also carry out wealth screening to fast track the research using our trusted third-party partners. You will always have the right to opt out of this processing.

We may also carry out research using publicly available information to identify individuals who may have an affinity to our cause but with whom we are not already in touch. This may include people connected to our current major supporters, trustees, or other lead volunteers. We also use publicly available sources to carry out due diligence on donors and to meet money laundering regulations.

This research helps us to understand more about you as an individual so we can focus conversations we have with you about fundraising and volunteering in the most effective way and ensure that we provide you with an experience as a donor or potential donor which is appropriate for you. We conduct this based on Legitimate Interest.

If you would prefer us not to use your data in this way, please email us at UK@RainforestTrust.org or call us on 0203 488 4495.

5. LEGITIMATE INTEREST

We have carried out a Legitimate Interest Assessment to ensure that when we use ‘legitimate interest’ as the legal basis for processing your personal information, we will consider and balance any potential impact on you and your rights and freedoms before we process your personal information. We will only then proceed where we believe our interests are not overridden by the impact on you. Our legitimate interests include the interests of our organisation in conducting and managing our operations to enable us to give you the best service and the best and most secure experience, and where we believe it to be in the public interest to process your personal information. Specific examples of this include:

• Sending you thank-you letters, information or marketing materials to your postal address;
• Analysis and profiling of our supporters;
• Use of personal information to monitor use for our technical purposes.

6. DATA PROTECTION

We employ a variety of physical and technical measures to keep your data safe and to prevent unauthorised access to, or use or disclosure of your personal information.

Electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means).

All electronic forms that request financial data will use the Secure Sockets Layer (SSL) protocol to encrypt the data between your browser and our servers.

If you use a credit card to donate to Rainforest Trust UK, or to purchase something online, we will pass your credit card details securely to your selected payment processor. Rainforest Trust UK uses multiple payment processors including Stripe, PayPal, and Global Payments. Rainforest Trust UK’s service providers comply with the payment card industry data security standard (PCI-DSS) published by the PCI Security Standards Council. Rainforest Trust UK will never store payment card details.

Of course, we cannot guarantee the security of your home computer or the internet, and any online communications (e.g. information provided by email or via the donations page on the Rainforest Trust website) are accessed at the user’s own risk.

7. THE RAINFOREST TRUST WEBSITE

The Rainforest Trust website incorporates reasonable and appropriate safeguards, using industry standard technology to heighten the security, accuracy and privacy of any personal data collected by Rainforest Trust UK and its partner organisations.

All online donation transactions are encrypted compliant with modern industry standards. Rainforest Trust UK uses Fundraise Up for online transactions on the rainforesttrust.org website. You can learn more about Fundraise Up compliance here.

8. KEEPING YOU IN CONTROL

We want to ensure you remain in control of your personal data. Part of this is making sure you understand your legal rights, which are as follows:

• We need your consent to store and process your personal information and you may give this consent verbally or in writing. Usually this will be when you complete a donations form;
• The right to confirmation as to whether or not we have your personal data and, if we do, to obtain a copy of the personal information we hold (this is known as a ‘subject access request’);
• The right to have your data erased, sometimes known as ‘the right to be forgotten’ (though this will not apply where it is necessary for us to continue to use the data for a lawful reason);
• The right to restrict the way we use your personal data (as an alternative to erasure);
• The right to have inaccurate data rectified;
• The right to object to your data being used for marketing or profiling or to use of your data based on legitimate interests; and
• Where technically feasible, you have the right to personal data you have provided to us which we process automatically on the basis of your consent or the performance of a contract. This information will be provided in a common electronic format;
• The right to withdraw consent at any time. You can do this by contacting us at UK@RainforestTrust.org 

If you wish to update your Personal Information with us or change your communication preferences, or if you no longer wish to receive communications from us, please tell us so by email, phone, or written letter. You can also opt-out of receiving emails from us by clicking the unsubscribe link in any email. When you contact us to change your preferences, please include your exact name and contact details so that we can correctly remove you from our mailing list.

If you choose to have your data erased, and you have made donations to Rainforest Trust UK, we will anonymise your transaction history and disassociate it with your personal information. We do this so we can maintain accurate records of our income.

9. DATA RETENTION

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Our default retention period for personal data is 7 years from the date we receive the information, unless otherwise specified by law. However, we may extend or reduce this if we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.

10. COMPLAINTS

You can complain to Rainforest Trust UK directly by contacting us at UK@RainforestTrust.org if you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office, which regulates and enforces data protection law in the UK. Details of how to do this can be found at www.ico.org.uk.

11. CHANGES TO THIS PRIVACY POLICY

We’ll amend this Privacy Policy from time to time to ensure it remains up to date and accurately reflects how and why we use your personal data. The current version of our Privacy Policy will always be posted on the Rainforest Trust UK home page on the Rainforest Trust website.

Any questions you have in relation to this policy or how we use your personal data can be sent to us at UK@RainforestTrust.org.

RTUK Privacy Policy, LR updated May 2024