Privacy Policy

About CLAPA

Cleft Lip and Palate Action (CLAPA) is the operating name of Cleft Lip and Palate Association, a registered Charity in England and Wales (1108160) and Scotland (SC041034), which is a company limited by guarantee registered in England and Wales (5206298).

CLAPA is committed to protecting your privacy and always using your data responsibly.

We know you’re putting your trust in us by sharing your personal data, and we want you to feel confident that we respect your privacy and rights. When you share your personal information with us, we’ll treat it with care and respect, and if you think we’ve made a mistake we’ll do everything we can to make it right.

This privacy policy (and any other documents referenced in it) explains how we use personal data which we collect from you or which you provide to us. By using our website (www.clapa.com) or providing any personal data as explained below, you are accepting and consenting to the practices described in this policy.

If at any time you’d like to change your information or how we communicate with you (or if you’d like to stop receiving communications from us altogether), get in touch at [email protected] or call us on 020 7833 4883. We won’t try to change your mind or ask for any more information other than what we need to process your request.

Data CLAPA may collect from you

In Short

We collect and process personal information which we need in order to operate as a charity, from contact details to health information (such as your connection to cleft lip and palate) to details of donations made and services used. In all cases, we do our best to make sure we’re not asking for any more than what we need for a specific purpose, and to make it clear what will happen to your information in each case. You have control over what you share with us, how we use it, and how long we keep it for.

When you use our website, we’ll also collect information that your browser or email platform shares with us, like where you are in the world or what links you click on. We don’t use this to identify you personally and don’t pass this data on to anyone else. When you open our emails (such as our CLAPA Connect e-newsletter), we also collect data about who opens and clicks on each email. Unless there’s a good reason for us to do so, we don’t look at individual people’s data; instead, we use overall statistics to help us improve our emails.

In Detail

CLAPA may collect and process the following kinds of data about you:

• Information you provide when signing up to our mailing list or when submitting any of the forms on our website, such as our fundraising inquiry form. This information may include personal contact details, your child(ren)’s date of birth, your ethnic origin, which of our services you may be interested in, and other information you provide when submitting one of these forms.
• Our website may collect information available from your browser, such as the country you’re in and the language you’re using, as well as resources you access. This is statistical data about our visitors’ browsing habits and does not identify you personally, though we do use it to better understand how people use our website.
  • This website uses cookies to distinguish you from other users. This helps us to give you a better experience when browsing our website and helps us to improve it for other users. We don’t use this information to identify you personally. See our cookie policy for more information.
  • Pages and articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website. These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
• Our emailing software (for e-newsletters) Campaign Monitor may collect information available from your browser or email client, such as when and where you opened any of our emails and which links you clicked on. Like almost all organisations, we use this to analyse how successful our emails are. We won’t access the tracking data for your email address unless it’s to provide you with a service you’ve asked for or process a request you’ve made. To avoid sending tracking data, you can set up your email client to not download/display external images automatically, and access any links by right-clicking on them, selecting ‘copy link location’, and pasting the link in a different browser window or tab.
• Information about your use of our services, such as your attendance at events or the use of our Parent/Peer Support Service. Sensitive details will be kept confidential and only shared with certain staff members.
• If you contact us, we may keep a record of that correspondence. If you send us personal information via email, we may keep your email address and the contents of your message for our records.
• We may ask you to complete optional surveys for research purposes and/or to help us improve our services. Unless clearly stated, we will not collect personally identifiable information in these surveys and will not connect you personally to your responses.
• Details of orders made through our online shop and the fulfilment of these orders. We use this information to process your orders and to help you with any issues with your orders. Please note credit and debit card information provided through our shop is sent directly to the payment processor (Shopify Payments) and is not held by CLAPA, nor is it accessible by staff. Certain staff members can access limited information about payments you make, but this is only so we can identify specific payments.
• CVs, application forms, references or other information about yourself which you provide to us for specific purposes.

We have a Records Management Policy which details how long we keep different kinds of records, why we keep them, and what happens when it’s time to delete these records. We regularly clean up our database and other systems to make sure we’re not holding onto any more information than we need. Our staff also receive regular data protection training to ensure they’re up to date on the latest legislation.

How CLAPA stores your data

In Short

We store your data in a few different secure systems for different purposes. All these systems comply with all UK and EU data laws. We do not store or have access to payment information provided online.

In Detail

We store your data in six key places:

• Salesforce database: this holds most of the personal data and contact information we collect.
• CLAPA’s IT system: this is where CLAPA’s files are stored, and this may include temporary copies of mailing lists, copies of letters we’ve sent you, etc. This is also where any information you send us via email is stored until deletion.
• Formstack, Gravity Forms, Microsoft Forms: these systems process the information you send us through one our forms. In some cases, they send it directly to our Salesforce database and/or e-mailing lists. We will always indicate on a form what we’ll do with any personal data and where it will be stored.
• Campaign Monitor: this is what we use to create our e-mailings (such as CLAPA Connect), and where we store names and email addresses for mailing lists.
• CLAPA’s Shopify shop: we run our shop through Shopify, which stores names and addresses of customers, as well as information on what they’ve ordered. We do not store payment information. Shopify has its own privacy policy which is available in our shop.
• Xero accounting software: this is where we store information on our customers and anyone we have financial dealings with, e.g. volunteers claiming expenses. We do not store credit card information.

Everywhere we store your data complies with strict UK and EU regulations on data security and protocols. This includes data centres based in the USA which work to ensure they are fully compliant for organisations, like CLAPA, based in Europe.

By submitting your personal data to us, you agree to us transferring, storing or processing your data in this way. We take all reasonable steps to ensure your data is treated securely and in accordance with your right to privacy.

Payment transactions are handled by Shopify and are encrypted. Select CLAPA staff have access to Shopify but for each payment we can only see very limited information. This helps us track down payments in case of any issues.

How CLAPA may use your data

In Short

We’ll use your information in the way you’ve asked us to. For example, to send you emails or other communications, to provide you with a service you’ve signed up for, or to help you with fundraising. You can ask for us to change your details or preferences (or to remove you from our database altogether) at any time (see ‘Your Rights’ below).

We’ll also analyse your information as part of our wider database to find out more about our community and make sure our services are working as well as they can be for everyone.

In Detail

Your data will only be used for the purposes indicated when you submit the data or as laid out in this privacy policy.

We use personal information held about you in the following ways:

• To update and enhance our records. Please note that while we work to ensure the data we hold on you is accurate and up to date, CLAPA cannot be held responsible for confirming the ongoing accuracy of your personal information. You can contact us at any time to change or update your information.
• To provide you with the information, products and/or services you’ve requested from us.
• To provide you with the most relevant information and announcements. This may include invitations to take part in research studies which we think may be particularly relevant to you.
• To send you the kinds of communications you’ve asked to be sent when signing up, e.g. CLAPA Connect e-newsletters. You can opt in or opt out of any kinds of content we send you by following the instructions on the relevant content, by contacting us directly, or by updating your preferences (see ‘Your Rights’ below).
• To make sure the content on our website and in our emails is presented in the best way for you and your browser or device.
• To review our services and the content we provide to make sure it’s right for our community.
• We may analyse your data as part of a large set to compile information on our community so we can make sure our services are appropriate and accessible to all. For example, looking at how many people in our community have children of a certain age, or how many people clicked on a particular link in one of our emails.
• We do not currently (and have no plans to) use paid telephone, street or door-to-door fundraising services. We will only ever contact you by post or email to ask for a donation, and you may unsubscribe or change your preferences at any time by contacting us.

How CLAPA may share your data

In Short

We won’t give, trade or sell your information to anyone else so they can contact you directly without your explicit consent.

We only pass on your information to others if they’re working for us (e.g. to send out fundraising materials you’ve asked for), and we make sure they take good care of this data while they have it.

In rare and extreme circumstances, we may have a legal obligation to share information with the police or other parties.

In Detail

All CLAPA Staff have some access to our secure database which holds most of the personal information we may collect. The level of access they have depends on the data they need to do their job day to day. Other personal information, e.g. sent in emails to staff, may be stored on our database if staff feel it is necessary to gather a complete record of your history with us.

Selected volunteers may access this database if their work with us necessitates this, e.g. if they are helping us ‘cleanse’ our database of old addresses, or if they are working with us long-term as an intern. These volunteers sign a data protection agreement, and their work is carefully monitored.

Third Parties

• We will never pass on your information to a third party so they can contact you directly without your explicit consent. Your information will also never be sold to or ‘swapped’ with a third party, including other charities or the NHS.
• We may pass on your data to carefully screened third parties for processing to help us clean up our database (e.g. by removing records of the deceased), or for the purposes of mass-mailing. These organisations follow strict data protection procedures and do not keep your data longer than is necessary.
• We will not pass on your data for ‘wealth screening’, nor will we use any information (except about your previous donations to CLAPA) to target you for future fundraising.
• We may disclose your personal information to third parties without your explicit consent if we have a legal obligation to do so, or to enforce or apply any other agreements you’ve entered into with us. These occasions are extremely rare.

How we Protect Your Data

CLAPA takes data protection very seriously. Our staff receive data protection training as part of their induction processes, and we hold refresher training at least once per year. We have a transparent and solution-focused culture at CLAPA, so staff are empowered to speak up if they have any questions or concerns.

As a small organisation, we might still make mistakes, but we are committed to doing everything we can to make these right. We want to treat your data as carefully as if it were our own, and if there’s a mistake we think you’d want to know about, you can count on us to get in touch.

CLAPA’s Fundraising Practices

CLAPA is committed to transparent, ethical fundraising practices, and we do everything we can to make our donors and fundraisers feel confident in how we use their data. Below is a summary of how we may use your information for fundraising.

• We will not pass on your data for ‘wealth screening’, which is where third parties use your information to tell charities who to target for fundraising or legacies.
• We may use our own information about your previous donations or fundraising for CLAPA to contact you about future fundraising. If you are actively fundraising, we may call you to catch up or confirm the details of your donations, etc.
• We will only ever contact you by post or email to invite you to fundraise or donate, and you can opt out of these asks at any time.
• We do not currently (and have no current plans to) use paid telephone, street or door-to-door fundraising services.
• We will not pass on your data for ‘wealth screening’, nor will we use any information (except about your previous donations to CLAPA) to target you for future fundraising.
• We will not phone or visit you personally to solicit donations – anyone claiming to do this on behalf of CLAPA may be committing fraud.
• We will not share or swap your data with other charities without your explicit consent, including other cleft charities.

The Fundraising Preference Service is a way for the public to opt out of different kinds of communications from specific charities, including direct mail and fundraising appeals. You’re welcome to submit a request through this service to change how you receive communications from CLAPA. You can also contact us directly to change your preferences (or unsubscribe altogether). We won’t try to change your mind, and we’ll process your request as soon as possible.

If you have any concerns about our fundraising practices, especially if it’s to do with how we handle your data, please get in touch with [email protected] or call us on 020 7833 4883. We take concerns like this very seriously and will do everything we can to make it right.

Your rights

At any time you can email [email protected] or call 020 7833 4883 to ask for:

• CLAPA to change or remove some or all of the information we store on you
• CLAPA to change the way we contact you, and/or the type of content you receive
• A full record of all the information we hold on you as per your rights to a Subject Access Request under GDPR.

We’ll comply with any requests like these to the best of our ability, and we’ll make it as easy as we can for you.

Please note that other websites we may link to should have their own privacy and data protection policies, and CLAPA does not accept any responsibility or liability for these policies. Please check these carefully before submitting any personal data to these websites.

Find out more about your rights as an individual.