At The Connection we are committed to treating your personal information with respect and being open about what we do with it, whether you are a client, job applicant, volunteer or supporter.
This notice outlines how we use your data in accordance with the law.
When we say “we” or “us” in this notice, we are talking about the Connection at St Martin-in-the-Fields. You can find us on the Information Commissioner’s register of data controllers under Registration Number Z7919091.
If you have any questions about this notice or would like to exercise any data rights, please contact our Data Protection Officer at data.protection@cstm.org.uk. Alternatively, you can speak to any member of staff or call us on 020 7766 5544.
If you think we have misused your personal data or have not kept it secure, please contact our Data Protection Officer on data.protection@cstm.org.uk.
What we do with your personal data when you get involved to support us
Last updated 03.11.2025
Our main purpose is to provide vital services to people experiencing homelessness in central London. We want to make sure that we raise funds to fulfil this purpose in a way that is as effective as possible. When you support us, we use your information primarily to deal with the matter at hand and to fulfil our legal obligations. We also use it to build our understanding of our supporter group and improve how we manage our fundraising efforts.
Below you will find more information about specific circumstances where we process your information, where we get it from, who we share it with, how long we store it, and the lawful basis we rely on to process personal data.
When you make a donation
We use the data you give us to process your donation, acknowledge receipt and thank you for your support. We keep records of all the donations and Gift Aid declarations to comply with our accounting and fraud prevention obligations. We also use it to better manage our fundraising efforts.
We use payment processors for donations made via the forms on our website. When you make a card donation in person, this is processed by SumUp or Zettle who do not share your personal data with us.
Lawful basis: Legal obligation, Legitimate interest – to raise funds for our charity’s mission.
When you make a legacy pledge
If you indicate that you intend to leave a legacy to us, we will contact you to thank you and will keep you up to date with information about the charity. We will keep a record of your personal information, as well as information about any other person or organisation that you provide to us (for example, a family member or a solicitor). This is so that we are able to communicate with you about your support.
Lawful basis: Legitimate interest – to raise funds for our charity’s mission
When you sign up to our fundraising event
If you sign up to take part in an event, we will ask you to provide us with information as necessary to process your application, to provide you with branded clothing, to make a note of your preferences and as needed to arrange for you to participate, and for your safety. We will also keep records of associated payment or donation, to satisfy our accounting obligations.
We may take photographs and videos at events. We will always let you know if this is the case and give you the opportunity to opt out. These photographs are used to raise awareness of The Connection and to help us raise funds. They may be published on our website as well as on our social media channels.
We will keep your application form for some time after the event to allow us to deal with any queries. We also keep a record of your participation so that we understand the history of your support for our Charity.
If you signed up for an event run by a third-party organisation on our behalf, we will be able to access the sign up information you provided and keep a record of your participation, your contact details and information about any donation you make. We will contact you to support your fundraising and/or training efforts and to thank you for taking part.
Lawful basis: Legitimate interest – to raise funds for our charity’s mission
When you support us through your workplace
We benefit from financial and in-kind support from companies and other commercial organisations. We keep a record of the names, contact details and job role of key contacts at these organisations, and we retain a record of relevant correspondence between us. We may get these details from your employer or from other publicly available sources, such as your organisational website or professional networking.
If you work for one of our corporate supporters and you volunteer your time with us, we will collect some personal information about you (for example, your name, telephone number and email address, emergency contact details and any relevant health conditions in case of an emergency) so that we can make arrangements for your volunteering.
We keep a record of your volunteering activities as needed to respond to any queries. We may confirm attendance to your employer. If your volunteering involved contact with our clients, we will keep this record for a minimum of 7 years in case of safeguarding concerns.
Lawful basis: Legitimate interests – to raise funds for our charity’s mission, safeguarding. Legal obligation – Health and Safety
When you sign up to hear from us
By email: With your consent, we will use your contact details to send you updates and fundraising appeals. Our emailing tools help us collect information about how successful our mailings are, including the opening and click-through rates. For more information see also the ‘Social Media’ section of the Privacy Notice and our Cookie Policy.
You can opt out of email updates at any time by clicking on a link in the bottom of the email or by contacting us on data.protection@cstm.org.uk.
By post: We may also send updates to you by post if we have your consent or a legitimate interest to do so. For example, if you have donated to one of our appeals we may contact you to report on how we used the funds and to ask if you wish to support us again. You can opt out of this by contacting us on data.protection@cstm.org.uk.
By phone: We do not regularly carry out telephone marketing and we never use automated calling systems. We will only contact you in this way if we have your consent or a legitimate interest to do so and we will always check the telephone preference service and our own marketing preference records before we call you. You can opt out of this by contacting us on data.protection@cstm.org.uk .
Prospect research and profiling
We may use your data for in-house research to personalise our requests to current and prospective donors, who may be able to support us at a higher level. This involves finding out more about you from external sources and combining it with the information you might have given us in the past.
We use publicly available information such as Companies House, Charity Commission and other charity registers, Electoral Roll, newspaper articles, publications, company websites and biographies on professional networking sites, as well as geographic and demographic information based on your postcode.
We make note of the information that indicates whether you are likely to want to support us, including your interests, your past charitable activities, and any association you may have with Westminster or Central London. If you are not a current or recent supporter, we will let you know that we are doing this as soon as possible, or delete your information.
If you would prefer us not to use your data in this way please contact us at data.protection@cstm.org.uk.
Lawful basis: Legitimate interests – to raise funds for our charity’s mission
Queries and complaints
If you contact us by post, email or telephone using the contact details on our website, we will use the personal information you provide to us (for example, your name and the name(s) of any other individuals involved) in order to process your query or complaint, respond to you, take any follow up action and carry out organisational learning and anonymised reporting. If you tell us you no longer want to be contacted by us we will add your name to a suppression list.
Lawful basis: Legitimate interests – to raise funds for our charity’s mission
How long we will keep your information
The time we keep your personal data depends on legal obligations and business needs. In general, we keep donor and subscriber information for 7 years from last contact. We regularly delete the information we no longer need or make it anonymous.
Joining efforts with our sister charities
We sometimes partner with our sister charities The Friends of The Connection (charity no. 1040560), St Martin-in-the-Fields Trust (charity no. 1110406), and St Martin-in-the Fields Charity (charity no. 1156305) to make joint fundraising appeals or to conduct marketing research.
We may temporarily disclose your basic personal details to them to ensure you are not getting repeated communications about the same activity from all of us. They will not use your personal data for any other purpose.
If you don’t wish to be included in such initiatives, please let us know and we will not share your information.
Processors and international data transfers
We use companies to process data on our behalf. This includes software providers, database consultants and marketing analysts. Where we use such companies, they may have access to your data. We put contracts in place that ensure that they only process your data as necessary to provide us with these services.
Some of our software providers are based outside of the UK. Where those countries do not have equivalent data protection laws, we put additional contractual measures in place, such as the UK International Data Transfer Addendum, or rely on the company’s certification under the Data Privacy Framework.
If you wish to obtain a full list of our processors with access to your data or to obtain a copy of safeguards employed for international data transfers, please contact data.protection@cstm.org.uk.
Your data protection rights
Under data protection law, you can:
If you want to do any of the above, please email data.protection@cstm.org.uk .
How to complain
If you have any concerns about our use of your personal information, please let us know at data.protection@cstm.org.uk and we will do our best to put things right.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
What we do with your personal data when we support you
1. Why do we collect personal information about you?
The main reason why we collect personal information about you is so that we can work out what your situation is and provide the right advice and support.
We also use information about you for other reasons, which include:
You do not have to tell us the information we need but this may mean that we give you the wrong advice or limit what we can do for you.
2. Where do we get the information from?
Generally, we get the information directly from you.
Sometimes it may also come from someone else. This could be because someone contacts us to share information about you, or it could be because we contact them, for example when you get referred to us or we ask another agency you have been in contact with about the support you have received.
We check the pan-London homelessness database (CHAIN) to see if you’ve had contact with Outreach services and what kind of support and advice you’ve received.
We sometimes get information from other homelessness, health, social care or enforcement agencies if they are worried about your safety or safety of others.
In very rare situations we may look at information that’s publicly available. We would only do this if we have a serious concern about your safety or safety of others.
3. What kind of information we may need
It depends on your situation and what we can offer you. At different times we may record and use any of the following:
- Contact details (your name, telephone number, email address, next of kin)
- Basic details (e.g. date of birth, gender, nationality, immigration status)
- Housing history
- Contact with other organisations
- Income
- Employment history
- Record of our meetings
- Participation in activities, volunteering or use of services
- Outcomes or achievements
- Information that relates to your safety or safety of others
- CCTV footage
It is also likely that we will need to collect and use the following special categories of your personal information:
- Data about your race or ethnicity, political opinions, religious or philosophical beliefs, sexuality or sex life
- Data about your health, including any medical condition
- Data about criminal convictions, offences and legal claims against you, or any related security measures
4. When do we share information with others?
Your information is confidential. This means we will only ever share information about you with others when it is necessary, on a need-to-know basis.
At The Connection, we work in teams so we share information about you with others in the teams you are in contact with.
We may also share information about you with external organisations to help you get linked with them or to advocate on your behalf. Normally, we will not share your information unless you give us permission (consent). We will be specific as to what information is being shared, with whom and for what purpose so you can make an informed decision. You can withdraw your consent at any time and we will no longer share it.
Where it’s necessary, we may share information about you without your consent. The most common situations where this happens are:
- Outreach teams (e.g. SOS), if you have been in touch with them. We will discuss your situation with them to ensure you are receiving the right support
- The Passage, West London Mission to check if they are working with you
- Organisations that share our building including Homeless Heath Service and Department of Work and Pensions.
- If we give you advice about your immigration situation, our notes may be accessed by our Immigration Advice regulator (OISC) when they check the quality of our advice, or our current legal partner who supervise the work of our immigration advisers. We will never share anything about you with the Home Office without your consent.
- Other quality auditors, such as Advice Quality Standard or Matrix,
- The provider of our database system (Homeless Link) and our third-party IT contractor, Silverbug, in order to receive technical support;
- External interpreting services, so that we can communicate with you in a language you understand
Other situations where we may share information without your consent are where:
- We have concerns about your safety and wellbeing, or the safety and wellbeing of others
- To protect our staff and property
- We are required to do so by law, e.g. a court orders us to do so
- It’s necessary in connection with a legal claim
In future, we may also need to share personal data with other legal entities, on a temporary or permanent basis, for the purposes of a collaboration, reorganisation, change of legal form, dissolution or similar event.
In some circumstances we may anonymise your personal data so that you can’t be identified, in which case we may use and share such data without further notice to you.
5. Our lawful basis for using your information
We will only use your personal information when we are satisfied that it is fair and we can do so lawfully. Our lawful bases for processing personal information may sometimes overlap and there may be several grounds which justify how we use it. The lawful basis are as follows:
We have a legitimate interest, for example:
- To assess your situation and to provide you with confidential advice
- To make applications, submit forms, obtain documents, buy tickets etc. on your behalf
- Keep copies of documents on your behalf (for example, correspondence, birth certificate, medical records)
- To coordinate our work with other organisations that support you (e.g. outreach teams)
- To alert others that we are seriously concerned about you or about other people in relation to you
- To monitor and evaluate our services so that we can constantly improve them
- To carry out any special research projects using data about clients or ex-clients
- To defend legal claims
It’s necessary for a contract, such as a licence agreement at St. Martin’s House.
It’s necessary in relation to work we do on behalf of public authorities (public task), for example providing accommodation or outreach services.
There is a substantial public interest (for example: when we provide confidential advice or support to you; to monitor equality of treatment; to safeguard adults and children at risk, or where we need to share data for the purposes of detecting and preventing unlawful acts)
We will typically ask for your consent to pass your information to other organisations, except for the circumstances described in the previous section. We will always ask for your consent if we would like to use information about you for publicity or fundraising purposes.
Less commonly, we may use your personal data where we need to protect your vital interests, where we have a legal obligation (for example when we are required to do so by a court) or in relation to legal claims.
6. How long do we hold your information?
Your personal details, as well as the record of your attendance and any support you have received from us will be held securely on our case management system (In-Form) for 7 years from the last time we had contact with you, in case you need our support again. We also need it to monitor our work, comply with audits, produce statistics about homelessness, as well as to defend any legal claims.
If you give us documents for safekeeping we will hold on to them for 1 year from last contact with you, unless you tell us to destroy them earlier.
If you use our address as your postal address, any letters you don’t pick up will be returned to sender after 1 month, unless you tell us to destroy them before then.
7. Your information rights
Under some circumstances, by law you have the right to:
- Request access to your personal data (also known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you
- Ask us to correct personal data that we hold about you which is incorrect, incomplete or inaccurate
- Ask us to erase your personal data from our files and systems but only where there is no good reason for us continuing to hold it. Please be mindful that we do need to hold on to the record of our work with you for a period of time so we won’t be able to delete everything on request
- Object to us using your personal data for a legitimate interests or for public task. When requesting this, please provide us with as much detail as you can about your reason for the request as we will need to balance your request against our organisational needs
- Ask us to restrict or suspend the use of your personal data, for example if you want to stop us from deleting it
- Ask us to transfer your personal data to another person or organisation
If you want to do any of the above, please speak to your key worker. If they are absent, you can speak to any member of staff or email data.protection@cstm.org.uk.
If you gave us consent to share your information and you are no longer happy with that, you can withdraw your consent at any time. To do it, please speak to a member of staff or e-mail data.protection@cstm.org.uk. and we will stop sharing it.
You can also make complaint at any time to the Data Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
Effective from 01.08.2023
What we do with your personal data when you apply for a job with us
Updated 24 June 2025
This notice explains how and why we collect and use your personal information during the recruitment process and how we might continue using it afterwards.
WHY AND HOW DO WE USE YOUR PERSONAL DATA?
1. To assess your suitability for the job
We collect information about your skills, experience, and qualifications to decide if you’re right for the job. This includes:
- What you tell us in your application and supporting statement.
- Notes and scores from interviews.
You don’t have to provide everything we ask for, but missing information may affect your chances of getting the job.
If we make a conditional offer of employment, we will carry out pre-employment checks and vetting to safeguard our clients, meet legal obligations and protect the charity and our employees:
- For roles that involve working directly with clients, we carry out an enhanced DBS check under the Safeguarding Vulnerable Groups Act 2006. For all other roles, we do a basic DBS check. We use a service called Verifile to carry out these checks and only keep a record of whether or not the check was successful. We also keep copies of your DBS request and the supporting documents for six months to enable us to deal with queries. If your check raises concerns, we may ask you to share your copy of the DBS record to help us decide whether to proceed with the job offer. These records, and any risk assessments, are shared with the hiring manager.
- Confidential references – We use the reference contact details you provided to ask for dates of your past employment and job title, any disciplinary and safeguarding issues, reason for leaving and whether you would be considered for employment in the future. We also ask how many days of parental leave you took in past year, to assess your remaining entitlement for the year. Note that we do not always receive all information we ask for.
- We check your right to work in the UK and keep the evidence of having made the check
- Depending on the role, we may access publicly available information from Insolvency Service, Companies House, the Charity Commission, newspaper articles and, with appropriate safeguards, social media. If anything we find might affect your job offer, we’ll tell you and give you a chance to respond.
If you disclose information about your lived experience of issues affecting our clients, we will ask if any records exist on CHAIN or CSTM In-Form. If this is the case, we will ask the system administrators to ensure these are no longer accessible to homelessness staff before you start. We will keep a record of your request for accountability.
UKGDPR Lawful basis: Contract, Legal obligation, Legitimate interest (vetting of candidates). Conditions for processing special category data and data relating to criminal offences: UK GDPR Article 9(2)(b): employment, social security and social protection law, Article 10, DPA 2018 Schedule 1 Part 1 Employment, social security and social protection
2. To contact you throughout the process
We will use the email, phone number and address you provide in your application to keep in touch during the recruitment process.
UKGDPR Lawful basis: Contract
3. To make reasonable adjustments for your interview
We ask if you need any adjustments for your interview so we can make the necessary arrangements and meet health and safety requirements. It’s your choice whether to tell us, and it won’t affect your job application.
If we offer you the job, we’ll ask for more details about any adjustments you need at work. We may refer you to an occupational health assessment with Spire, who will advise us on what support to put in place. This information will be shared with relevant staff so the adjustments can be ready when you start.
UK GDPR Lawful basis: Legal obligation, Article 9(2)(b): employment, social security and social protection law, Article 10, DPA 2018 Schedule 1 Part 1 Employment, social security and social protection
4. To monitor the diversity of applicants
The information you provide to us via the Verifile diversity monitoring form is separate from your application and presented to us as statistics. This means that we cannot attribute the information to any individual, except in the unlikely event that you are the only applicant. In this event, we have safeguards in place to prevent anyone from making this connection. Providing this information is voluntary and will not affect your application.
UK GDPR Lawful basis: Legitimate interest – diversity monitoring. Conditions for processing special category data: Article 9(2)(g): substantial public interest. Schedule 1 DPA 2018: Equality of opportunity or treatment
PROCESSORS
We use external companies for providing us with IT systems and support, including the storage of your data. We have contracts in place to ensure that your information is kept confidential, only processed on our instructions and not used for the company’s own purposes. Full list of processors is available upon request.
HOW LONG DO WE HOLD YOUR INFORMATION?
We regularly delete the information we no longer need, or make it anonymous. The time we keep it depends on legal obligations, for accountability in case of a legal claim, or for business needs. We sometimes review the retention periods. In general, we store any documents relating to the recruitment process for 6 months from the finish date the process. If you are successful, the relevant information is transferred to your personnel file and is kept for 7 years after the date you leave our employment.
More details are available upon request.
OVERSEAS TRANSFERS OF PERSONAL DATA
Your personal data may be transferred overseas, including to countries that do not have data protection laws equivalent to those in the UK. This happens, for example, if we use an IT service based abroad. In those situations, we put additional contractual safeguards in place, such as the UK Data Transfer Addendum, and we require the same from our processors.
YOUR DATA PROTECTION RIGHTS
Under data protection law, you can:
- Request access to your personal data (also known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you.
- Ask us to correct personal data that we hold about you which is incorrect or incomplete.
- Ask us to erase your personal data from our files and systems but only where there is no good reason for us continuing to hold it. Note that we often need to hold on to recruitment information for legal and accountability purposes.
- Object to us using your personal data for a legitimate interest. When requesting this, please provide us with as much detail as you can about your reason for the request as we will need to balance your request against our organisational needs.
- Ask us to restrict or suspend the use of your personal data, for example if you want to stop us from deleting it, or to hide your homelessness records in the databases.
If you want to do any of the above, please email data.protection@cstm.org.uk.
HOW TO COMPLAIN
If you have any concerns about our use of your personal information, you can make a complaint to us at data.protection@cstm.org.uk.
You can also complain to the ICO if you are unhappy with how we have used your data, or seek remedy through courts.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
What we do with your personal data when you apply to volunteer with us
Privacy Notice for Volunteering Candidates
This document explains how and why The Connection at St Martin-in-the-Fields uses your personal information during and after you volunteer with us.
When we refer to “we” or “us” in this document we are referring to The Connection at St Martin-in-the-Fields. We are listed on the Information Commissioner’s register of data controllers under Registration Number Z7919091.
When we use the term personal information we mean any information that relates to you from which you can be identified. This might include your name, your home address, your personal email contact details, or your telephone number. Personal information does not include information where it is not possible to identify you (i.e. anonymous data).
We use the term special categories of personal information to mean information about your race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health and sexual orientation.
This notice does not form part of any contract of employment or other contract to provide services. We may update this notice at any time but if we do so, we will provide you with an updated copy of this notice as soon as reasonably practical.
Why we collect and use information about you
The majority of information we collect comes directly from you. There are some situations, where we collect it from different sources. These include:
- The Disclosure and Barring Service;
- Persons providing you with a reference;
- Information collected in the course of your activities, depending on your role within CSTM.
Below is the list of the types of information we collect about you and the reasons why we do it:
Data we collect: Contact information, including your name, address, telephone number and email address.
What we use it for: To contact you about your volunteering and your involvement with the Connection at St Martin’s, including to circulate information via our volunteer newsletter.
Data we collect: Recruitment information (references and other information collected as part of the application process).
What we use it for: Making a decision about your recruitment as a volunteer.
Data we collect: The information you’ve given us about your interests and your reasons for applying, your start date, end date and record of attendance, as well as record of induction and training you have received and meetings with your supervisor.
What we use it for: To manage our relationship with you as a volunteer and to be able to provide references about you if you request us to do so.
To allow us to meet our legal obligations, for example in relation to health and safety.
To help us monitor the quality of our Volunteering programme.
To enable us to establish or defend legal claims.
Data we collect: DBS check (if appropriate for the role).
What we use it for: To make a decision about your recruitment as a volunteer.
Once the check has been completed we hold a record of the result but do not hold on to any details of your criminal history.
Data we collect: Information about your race or ethnicity, religious beliefs, and sexual orientation collected as an optional question only.
What we use it for: For equality and diversity monitoring.
Data we collect: Information about your health, including any medical condition.
What we use it for: To comply with our health & safety obligations and enable any reasonable adjustments to be made.
Data we collect: CCTV images.
What we use it for: To manage the security of our property and the safety of persons using our building. For prevention and detection of crime.
Data we collect: Photos and case studies.
What we use it for: Photos are used for creating and maintaining your ID card. With your explicit consent, we may use your photos and story for fundraising purposes.
Data we collect: Swipe card records, if you are issued with one.
What we use it for: To manage the security of our building.
The lawful grounds on which we use information about you
We will only use your personal information when the law allows us to. We process your personal information for the above purposes relying on one or more of the following lawful grounds:
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. In broad terms our legitimate interest is fulfilling the charitable purpose of CSTM, which involves contacting our volunteers to plan and administrate activities, taking steps to ensure and monitor compliance with our legal obligations and internal standards and procedures, assessing suitability of volunteers for potential roles and keeping records of volunteer activities and performance.
- Where it is necessary for us to comply with a legal obligation, e.g. compliance with Health and Safety legislation
- Where you have consented; for example, to us using your image in our fundraising materials.
- Where it is necessary to protect your vital interests or those of others
When we process your special category and criminal offence data we do it:
- Where you have consented,
- It’s necessary to protect your vital interests (or those of someone else) in an emergency
- We have a need to use such information in connection with a legal claim
- It is necessary in public interest; for example safeguarding adults and children
Who has access to your information
Your information will be shared internally with people involved with managing our relationship with you. This includes members of the Recovery and Opportunities Team, volunteer supervisors in the service where the role is based, internal and external IT systems support staff, and business insight teams if access to the data is necessary for the performance of their roles.
Members of the team you are based in will be able to access basic information about you, including your name and date of birth and your contact details to enable them to record the hours you spent volunteering with them and to contact you in case of emergency.
Google may use your personal data if given consent by you on our website. Find more out here.
Less commonly, we may share your information where you have given us specific consent to do so, or where we have to comply with our legal obligations, where we have a legitimate interest to do so, such as administering our relationship with you, conducting quality audits or protecting our property.
How long do we hold on to your information?
If your application to volunteer is successful, personal data gathered during the recruitment process will be transferred to your volunteering file. All information in this file is retained during the time you are volunteering with us and for seven years after.
Your rights as a Data Subject
The Data Protection legislation specifies the rights you have in relation to the information we process about you. Below is the information what they are and how to exercise them.
- Right of Access – we have an obligation to provide you with a copy of your information if you request it.
- If the information we hold about you is incorrect, you have the right to have it corrected.
- In some circumstances you have the right to have your information deleted – this right applies only when we do not have a good reason for keeping information about you, for example where we rely on your consent to keep it and you have withdrawn the consent.
- You can object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.
- You can ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
- Ask us to transfer your personal information to another person or organisation.
- If you have given us consent for processing your information, you can withdraw this consent at any time.
Queries and Complaints
If you have any questions about this privacy policy or how we handle your personal information, please contact your supervisor, the Volunteer Coordinator, call us on 02077665544 or email data.protection@cstm.org.uk.
You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
Last updated 02.06.2021
How we use information from social media
We use social media platforms, such as Facebook, Instagram and Twitter, to stay in touch with people interested in our work and give updates about our activities. We also use it as a cost effective way to raise funds and promote our events.
We use the available tools provided by these platforms, such as Custom Audiences and Lookalike Audiences, to better target our adverts. These are based on:
- the information you have provided directly to the social media site;
- your interactions with our content on these sites;
- your visits to our websites, via Facebook Pixel;
- purchases you have made from our shops Show Your Connection and Poster Bakes
This information is then used to identify others who may be interested in supporting the work we do, as well as to target or exclude you from seeing our ads. It also enables us to see how effective our adverts are and if they provide value for money.
You can find more information here:
Our legal basis for us using your information in this way is our legitimate interest to raise funds for our work in the most cost effective way. Where we use information the social media provider already has about you, we are acting as joint controllers.
Please bear in mind that we do not have a direct access to the personal data used for the purposes outlined above and don’t hold any copies.
Your Data Rights
You can opt out of receiving adverts from us as well as from your information held by the social media platform being used by advertisers, by using the ads settings provided by the platform provider. You can also exercise your other data rights, such as access, deletion, correction and portability on those platforms, as explained in their respective privacy notices.
We set the Facebook Pixel only if you give us consent via the cookie banners on our websites. If you do not wish to be tracked in that way, please change your settings via the banner on the website you visited.
If you have any concerns about how we use your data, or have any questions, please contact us on data.protection@cstm.org.uk. If we don’t resolve the issue, contact the Information Commissioner. On contacting the ICO, please use the registration ID as listed above this notice. See how to contact them via their website: www.ico.org.uk
What we will do with your data if you bought items from The Connection
What we will do with your data if you bought items from The Connection
This notice relates to personal data we collect when you shop with us. If you purchased any goods from us before 06/02/2024, your data has been transferred to The Connection at St Martin’s (CSTM) due to the dissolution of our trading subsidiary Show Your Connection. CSTM is now the Controller for this data and is responsible for its lawful use and security.
How and why do we use your personal data?
To process orders made via our websites, by phone or in person.
The information you give us when ordering goods online is shared with the website platform providers Shopify, so that they can provide website services to us.
As you go through checkout, the site may auto-complete your shipping and billing address by sharing what you type with the Google Places API and returning suggestions to you to improve your checkout experience.
When you make a payment, you give your information directly to the payment processor, e.g. ShopPay, Stripe or PayPal for online purchases and SumUp for in-person purchases. Note that these providers may send information to countries outside of the UK/EEA.
We may pass your details to Evri, who delivers the products on our behalf.
We will keep all the details of your purchase afterwards for as long as it takes us to fulfil any contractual obligations, such as refunds, etc.
Lawful basis: Contract, Legitimate interest (when fulfilling orders made by someone else but sent to your address)
To send you information about your order
We may email you with messages about your order or account activity. For example, we may email you to tell you that:
It’s not possible to unsubscribe from these messages.
We share your contact information with Shopify, our website hosting providers, as well as the shipping provider (Evri), so they can send these emails to you on our behalf.
Lawful basis: Contract
To respond to your queries, refund requests and complaints.
We will use the information you send us, as well as your contact details and purchase history to enable us to deal with your query or complaint. We will keep a record of it to keep track of our communication with you and to help make our services better.
Lawful basis: Contract, Legitimate interest (service improvement)
Direct marketing
We will send you emails about new products based on your marketing preferences, along with news and updates about The Connection. You can unsubscribe from those emails at any time by clicking the link within the email.
We use Mailchimp to send these emails, which is a service based in USA. As this is a country with less strict data protection laws than the UK, we have in place additional contractual measures to ensure your data remains protected.
If you have previously bought goods from us through Poster Bakes or Show Your Connection, but have not subscribed to The Connection’s Newsletter, we will not send you any updates unless you ask us to by subscribing here: Subscribe to The Connection Newsletter
Lawful basis: Consent
Marketing research
We use the personal information that you provide, sometimes together with data obtained elsewhere, to manage our fundraising efficiently and effectively so we can raise more to make a difference to the lives of homeless people in London. We use the information we collect about you to effectively target and tailor our communications, for example, so we can make appropriate requests to donors who may be able to support us at a higher level.
We also use publicly available information such as Companies House, Charity Commission and other charity registers, Who’s Who and Debrett’s guides, Electoral Roll, reputable newspaper articles, publications, company websites and biographies on professional networking sites, as well as geographic and demographic information based on your postcode, to find new potential supporters and invite them to be involved in supporting our cause through tailored communications which may be of interest to them or to gain a better understanding of our supporters.
We may share your information with our sister charities: St Martin-in-the-Fields Trust, St Martin-in-the-Fields Limited, The St Martin-in-the-Fields Charity and The Friends of The Connection when we ask them to contact you about fundraising related activities and to process payments on our behalf, or when we join our forces to build fundraising strategies.
If you would prefer us not to use your data in this way please contact the Fundraising Team on fundraising@cstm.org.uk or 020 7766 5555.
Lawful basis: Legitimate interest – Marketing research
Fraud prevention
We will use the information provided in the course of your purchase to investigate orders we think may be fraudulent.
Lawful basis: Legitimate interest – fraud prevention
To fulfil our legal obligations
We will also use your personal data to fulfil legal obligations, such as those around accounting and data protection.
Lawful basis: Legal obligation
Transferring your data overseas
UK data protection law requires organisations transferring personal data to a country that does not offer a similar level of protection to put measures in place ensuring your rights are respected. When we do so, for example to make use of IT services based abroad, we put contractual measures in place such as the International Data Transfer Addendum.
How long we will keep your information
We regularly delete the information we no longer need, or make it anonymous. The time we keep it depends on legal obligations and business needs.
Your data protection rights
Under data protection law, you can:
If you want to do any of the above, please email our Data Protection Officer at data.protection@cstm.org.uk.
If you have any concerns about our use of your personal information, you can make a complaint to us at data.protection@cstm.org.uk.
You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
Last updated 19.02.2022