Privacy

We promise to protect and respect your privacy. This is our privacy policy, and it relates to all the information we hold, and all the ways we communicate by email, letter, phone, in person and through our website.

1. Privacy Policy

1.1. Fire Fighters Charity respects your privacy, is committed to protecting your personal data, and being transparent about how we collect and use your data. This privacy policy relates to all the information we hold, and all the ways we communicate by email, letter, phone, in person and through our website.

1.2. This privacy policy applies to Fire Fighters Charity, registered office, Marine Court, Fitzalan Road, Littlehampton, West Sussex, BN17 5NF. Charity registered in England and Wales (1093387), Scotland (SC040096), and the Isle of Man (1363), and registered as a company limited by guarantee (4480058) and as a foreign company in the Isle of Man (006421F); and our wholly owned subsidiary company Fire Fighters Trading Limited registered office, Marine Court, Fitzalan Road, Littlehampton, West Sussex, BN17 5NF, company registration number 03816625.

1.3. Fire Fighters Trading Ltd exists to generate funds on a commercial basis, with all profits raised supporting the work of the charity. Charity Commission regulations allow charities to set up and operate subsidiary companies when all profits from those companies are donated to the charity, and as long as the money is used for its charitable purposes.

1.4. When using “We”, “Us” or “Our” this refers to both Fire Fighters Charity and Fire Fighters Trading Limited.

1.5. Our privacy policy relates to all the information we hold, and all the ways we communicate by email, letter, phone, in person and through our website. It covers how we use (process) the personal information you provide to us, and how we are committed to keeping it safe and managing it in line with data protection laws.

2. What is personal data?
3. What we do
4. How we use your data and on what basis
5. Special categories of personal data
6. Lawful basis for processing your data
7. Who we share your information with
8. How we keep your information safe
9. Your rights
10. How to contact us
11. Your communication preferences
12. What to do if you are not happy

2. What is personal data?

2.1. Personal data is defined by the UK General Data Protection Regulation as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.’

2.2. Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers. The personal data that we use is set out below.

3. What we do

3.1. We champion the fire service community and help its members with their health and wellbeing during and after service. We operate from three centres, throughout local communities and via online services.

3.2. To do this we have a database that contains personal data collected in the course of our interactions with service users, supporters, volunteers, customers, health and social care professionals, members and volunteers of the UK fire and rescue service community and our employees. We always aim to keep your information up to date, periodically we will use publicly available sources to do this for example the Royal Mail Postcode Address File.  We may also obtain limited personal data from publicly available sources or third parties where appropriate (for example, to maintain accurate contact details or support fundraising activities).

4. How we use your data and on what basis

This section describes what data we hold and what we use if for when you interact with us.

4.1 Providing services to our service users
4.2 Gathering insight through research and service user experience panels
4.3 Income generation
4.4 Volunteering
4.5 Marketing
4.6 Our website
4.7 Social media
4.8 Commercial services
4.9 Working with Fire & Rescue Services
4.10 Rental of accommodation at our centres
4.11 Recruitment
4.12 Company members
4.13 Complaints
4.14 Guest Wi-Fi at our premises
4.15 Tenants of our properties
4.16 Users of our community website
4.17 My Fire Fighters Charity App and website (MyFFC)
4.18 Self-employed contractors

For each of the activities described below, we rely on one or more lawful bases set out in section 6 (including contract, legitimate interests, consent and legal obligation). Where relevant, we identify the primary lawful basis within each subsection.

4.1. Providing services to our service users

Lawful basis: Contract, provision of health or social care (article 9 for special category data), legitimate interests and safeguarding (where applicable)

4.1.1. To deliver our services to our service users, we need to ask you for your information and to process it. We do this to ensure that we provide the most appropriate service to meet your needs. When you make an initial contact with us to enquire about our services, we collect this information via our application forms and thereafter during the delivery of our services to you. If appropriate for the service we are providing, we will also collect personal information relating to your health. We do this to ensure that the services we provide are appropriate, tailored to meet your needs and safety.

4.1.2. We also use the data we hold about you internally to analyse the support we provide. This helps us to understand how our services are being used and by whom, measure the performance and effectiveness of the support we deliver, generate impact and insight data that reflects the outcomes for service users, identify where our provision is working well and where improvement is needed, direct our focus and resources toward meaningful, evidence based service development.

4.1.3. To deliver services to you the information we hold about you may include:

  • Title
  • Name
  • Contact details, postal address, email and phone numbers
  • Date of birth
  • Gender
  • Marital status
  • Service user status
  • Fire and Rescue Service(s) you are associated with
  • Information about your role within the Fire and Rescue Service or connection with the Fire Service
  • Demographic details, such as your ethnicity and employment status
  • Employment status
  • Sickness status
  • Details of your GP details or other relevant healthcare professionals.
  • National Insurance number
  • Financial information – if requesting financial assistance
  • Your contact with us including attendance at our centres or at digital appointments, including the number of visits and visit lengths
  • Next of kin Information
  • Nominated contact information
  • Details of people who live with you, when relevant to the services you access
  • Records of communications/information sent to you and communications/information sent by you to us
  • Information relating to your health and your individual needs, to enable us to provide you with the services and information and advice most appropriate to you, or to refer you to appropriate external providers
  • Information about the outcomes of the support you receive, including goals, progress, feedback, follow-up information, service experience and outcome measures
  • For health/ social care professionals, your job title(s) and the organisation(s) you work for
  • Your contact and communications preferences

4.1.4. This information helps us to understand who we are supporting, and whether our services are reaching everyone who needs them.

4.1.5. Some of our services are provided by external providers, so your data will be shared with those providers.  We have data sharing agreements in place with those providers, to protect confidentiality, and we undertake regular quality reviews to ensure your privacy is protected and appropriate data sharing is taking place.

4.1.6. We use CCTV at some sites to provide a safer, more secure environment for employees, volunteers, service users, and visitors, and to prevent vandalism and theft. We comply with the Information Commissioner’s Office CCTV Code of Practice.

4.1.7. Access security systems are used at our centres to support the security and safety of employees, volunteers, service users, visitors, and premises. The system restricts access to authorised individuals and helps monitor entry within secure areas. Data is collected through individually assigned tokens each time they are used and record the token users name, date and time of entry and the location accessed.

4.1.8. We use personal information for internal administration to support you accessing our services and we use aggregated and anonymised data, including outcome and impact information where relevant,  for reporting and analysis to inform development and strategy for the improvement of existing and the provision of future services.

4.2. Gathering insight through research and service user experience panels

Lawful basis: Legitimate interests, consent (for participation and where identifiable data is used), scientific/statistical purposes (where applicable under UK GDPR)

4.2.1. We may use your information to invite you to share your thoughts, experiences and feedback to help us learn and improve.  This may include; surveys and questionnaires about your experience of our services, focus groups or consultation sessions, service panels or advisory groups, research activities aimed at better understanding the needs of the people we support.

4.2.2. We run a service user panel, to which people can sign up at any time, and we may advertise it so people know about it.  As a member we will use the contact details you signed up with to involve you in any feedback, surveys, focus groups that allows the service user voice to shape our charities direction. Membership is voluntary, you can leave at any time, and leaving won’t affect your access to our support services.

4.2.3. You can decline any invitation to take part in research, surveys, without giving a reason, and you can ask to be removed from any service user involvement activity. Where we rely on consent to use identifiable information for research or feedback activity, you can withdraw that consent at any time without it affecting the support you receive from us. This will not affect anonymised or aggregated information that has already been used in reports or analysis, where you can no longer be identified.

4.2.4. When we ask children or vulnerable adults to be involved in our research or service user panel, will make sure that their participation is appropriate and properly supported.  The wellbeing of our research and service user panel participants will always take priority over any research or insight need.

4.2.5. Insights and findings from the panel may be shared with the relevant teams involved in the project. This information may be used to inform service development, strategic planning and projects. Where this happens, it is done under our internal governance procedures to ensure information is handled securely, shared appropriately and anonymised where needed. Panel data is never used for anything other than improving our services, and is never shared externally in way that could identify any individual.

4.2.6. From time to time we carry out research activities such as surveys, focus groups and interviews to better understand the needs and experiences of the people we support and to measure the impact of our services. Taking part is voluntary and we will always explain what is involved before you agree and you can opt out at any point without it affecting your support. In most cases the data is collected anonymously by design. We wont know who you are. We may ask for some details such as your age, or the country where you live but we will only ever collect the minimum information needed for the specific research activity.  If we do need more information about you, for example if you take part in a focus group, we will look after your information securely and use techniques such as pseudonymisation to protect your anonymity. Individuals will never be named in any report.

4.2.7. We may sometimes work with external researchers to help us with this, where that is the case we will always make that clear and they will be required to meet our data protection standards. Where we use third party platforms such as survey tools, we will make sure that these meet the legal requirements and are held only for as long as needed for the specific activity and are anonymised or deleted once that purpose is complete.

4.3. Income Generation

Lawful basis: Consent (for direct marketing where required), legitimate interests (postal fundraising, supporter engagement), legal obligation (e.g. Gift Aid records)

4.3.1. We could not provide our services to thousands of members of the fire services community each year without the support of our donors and supporters. The information you provide helps us to do this and, if you opt-in to receive communications from us, it allows us to keep you informed about our work.

4.3.2. We are committed to working in a transparent, ethical, responsible, and honest way. To reflect this commitment, we are registered with the Fundraising Regulator and work to the Fundraising Code of Practice. We are also members of the Institute of Fundraising and endeavour to follow best practice to deliver our fundraising campaigns.

  • The information we hold about you may include:
  • Title
  • Name
  • Contact details, postal address, email and phone numbers
  • Date of birth
  • Whether you are associated with a Fire and Rescue Service(s)
  • Records of communications sent to you
  • Your contact and communications preferences
  • The amount of your donation(s)
  • How you have donated
  • Payment information and reference numbers
  • Payroll number
  • Your Gift Aid status to allow us to claim Gift Aid on qualifying donations in accordance with the Gift Aid rules set by HMRC
  • Details of prizes that you have won from our Lottery or Raffles
  • Gift in your will enquiries and pledges
  • Information from your online fundraising pages on a social giving platform, like Just Giving, People’s Fundraising, Bequeathed, and similar services.
  • Delivery address details
  • Purchases and previous purchases from us
  • Event participation Information for example, dietary requirements, size for t-shirt, running vest, cycling jersey etc. next of kin information
  • Your job title(s) and the organisation(s) you work for

4.3.3. All payment information is processed either by us or using third parties that are fully compliant with the appropriate standards.

4.3.4. We work with a number of third parties that enable us to maximise our income generation activities. For example, the Fire Fighters Lottery, our Raffles, suppliers to our Web shop. We also use third parties to work on our behalf to recruit new supporters, through various channels, including face to face agencies. We ensure that all are fully compliant with the appropriate standards when engaging them to do so.

4.3.5. As a fundraising organisation, we undertake in-house research and from time to time engage specialist agencies such as Prospecting for Gold to gather information about you from publicly available sources, for example, Companies House, the Electoral Register, company websites, ‘rich lists’, social networks such as Linkedin, political and property registers and news archives.

4.3.6. We may also carry out wealth screening to fast track the research using our trusted third-party partners. You will always have the right to opt out of this processing.

4.3.7. We may also carry out research using publicly available information to identify individuals who may have an affinity to our cause but with whom we are not already in touch. This may include people connected to our current major supporters, trustees or other lead volunteers. We also use publicly available sources to carry out appropriate due diligence on donors,  and to meet money laundering regulations.

4.3.8. This research helps us to understand more about you as an individual so we can focus conversations we have with you about fundraising and volunteering in the most effective way, and ensure that we provide you with an experience as a donor or potential donor which is appropriate for you. We conduct this work using the basis of Legitimate Interest.

4.3.9. If you would prefer us not to use your data in this way, please email us at [email protected] or call us on 01256 366566.

4.3.10. For all methods of income generation, we keep records of financial transactions for accounting, forecasting and planning purposes and use aggregated and anonymised data for reporting and analysis to inform development and future strategy.

4.4. Volunteering

Lawful basis: Contract (or pre-contract steps), legitimate interests, legal obligation (e.g. safeguarding, DBS checks)

4.4.1. We would not be able to support thousands of service users every year, at our centres and in our communities, without the support of our volunteers. Volunteers contribute to the innovation, effectiveness and efficiency of the charity, and provide us with vital links across our community.

4.4.2. To manage our volunteers the information we hold about you may include:

  • Title
  • Name
  • Date of birth
  • Contact details, postal address, email and phone numbers
  • Your volunteer role(s)
  • Current/former Fire and Rescue Service and role held
  • Your skills and qualities
  • Information about disability or health and medical conditions if we need to make reasonable adjustments
  • Details of training we have provided to you
  • Your referee details including their name, address, email, telephone number and record of permission to contact
  • Your references
  • Your declaration
  • Information about your criminal record if applicable
  • Emergency contact details
  • Anonymised diversity and inclusion monitoring information including, age, gender, marital status, nationality, ethnic origin, sexual orientation, caring responsibilities, disability information and religion/beliefs – (only if you choose to disclose this information to us)
  • Start and leaving date
  • Record of any recognition awards
  • Your driving details (if applicable); driving licence number, tax, insurance and MOT
  • Records of communications sent to you
  • Why you are interested in volunteering for us
  • Where you heard about us

4.4.3. We may process criminal records data to assess your suitability for volunteering both at the recruitment stage (through appropriate criminal records checks) and in the course of your volunteering.

4.4.4. We will use the email that you provided to us when you applied to volunteer to enable access to training via our e-learning portal.

4.4.5. We use CCTV at some sites to provide a safer, more secure environment for employees, volunteers, service users, and visitors, and to prevent vandalism and theft. We comply with the Information Commissioner’s Office CCTV Code of Practice.

4.5. Marketing

Lawful Basis:  Consent (email, SMS, some digital marketing), legitimate interests (post, some segmentation and engagement tracking)

4.5.1. We value our relationship with you, and we use your personal data to ensure we contact you in the most appropriate way, to improve our services and to ensure we work efficiently and effectively. We also want to make sure you only receive the information that you want and need from us.

4.5.2. Information that we hold in order to provide you with information about our services, our fundraising, volunteering and events may include:

  • Title
  • Name
  • Gender
  • Contact details, postal address, email and phone numbers
  • Date of birth
  • Whether you are associated with a Fire and Rescue Service(s)
  • Records of communications sent to you
  • Your contact preferences

4.5.3. Tools may be used to help us improve the effectiveness of our communications with you, including tracking whether the emails we send you are opened and which links are clicked within a message. These tools allow us to refine our communications, ensuring that we only communicate information that is relevant, appropriate and of interest to you. We monitor website visits, but do not record individual IP addresses, and use tools such as Google Analytics to improve our website and services.

4.5.4. We will obtain your explicit consent before using your story, images or recordings for promotional purposes.

4.5.5. Case Studies:  We will use your information to promote our services by publishing your story. In order to do this the information we may hold includes:

  • Title
  • Name
  • Gender
  • Contact details, postal address, email and phone numbers
  • Date of birth
  • Whether you are associated with a Fire and Rescue Service(s)
  • Records of communications sent to you
  • Your permission
  • Your contact preferences
  • Your story, including details of your reason(s) for accessing our services
  • An expiry date for your story i.e. the date at which we would remove it from publication until we have confirmed and updated your story with you
  • Videos, photographs and audio recordings

4.5.6. We will use your image or audio recording to promote our services and fundraising. In order to do this the information we may hold includes:

  • Photographic images
  • Video footage
  • Audio files
  • Title
  • Name
  • Gender
  • Whether you are associated with a Fire and Rescue Service(s)
  • Current or former role
  • Contact details, postal address, email and phone numbers
  • Your preferences
  • Your permission

4.5.7. Publications. If you have requested to receive our magazine Shout! we record this information.

4.5.8. Email Communications.  We send various email communications with updates on our services, information about our fundraising and products in our web shop, opportunities to volunteer and our events. If you have told us that you would like to receive news and information updates from us by email, we will record this and send these updates to you.

4.5.9. If you volunteer for us, we will use the email that you provided to us when you applied to volunteer for us to send you information relevant to your volunteer role.

4.5.10. If you are a member of a communications team in a Fire and Rescue Service we will use your work email to provide you with information to promote us and our activities to your work colleagues.

4.5.11. We send our emails out using an email management software that allows us to track whether you have opened our emails and how you have engaged with them e.g. which links you have clicked on. We record this information to enable us to tailor our communications to you and send you information that we think you will be interested in. To do this there is an element of automatic decision making by the software i.e. emails may be automatically sent to you based on your engagements with previous emails. This does not involve automated decision-making that produces legal or similarly significant effects on you. If you don’t wish us to do this, please let us know, but please be aware that if you do it may mean that we will not send you email updates in the future.

4.5.12. Removal.  We have a legitimate interest in keeping lists of people who no longer wish to be contacted, and/or have requested removal from our mailing or marketing lists to ensure that we do not unintentionally contact them in the future.

4.6. Our Website

Lawful Basis:  Legitimate interests (basic functionality, analytics), consent (cookies, tracking technologies where required)

4.6.1. When using our website, we collect information about you in order to deal with your queries and to provide you with the best possible service. If at any time we want to pass your details to other relevant organisations, we will clearly indicate this to you at the point where you leave your details.

4.6.2. The type of information we will collect about you may include:

  • Title
  • Name
  • Contact details, postal address, email and phone numbers
  • Whether you are associated with a Fire and Rescue Service(s)

4.6.3. What are cookies?
As is common practice with almost all professional websites, our website uses cookies, which are tiny files that are downloaded to your computer, to improve your experience. We will only set non-essential cookies (including analytics and marketing cookies) with your consent, which you can manage through our cookie banner.  Here we describe what information we gather, how we use it and why we sometimes need to store these cookies. We will also share how you can prevent these cookies from being stored, however this may downgrade or ‘break’ certain elements of our website’s functionality.

For more detailed information on the cookies we use and how to manage your preferences, please read our cookies notice.

4.6.4. How we use cookies
We use cookies for a variety of reasons detailed below. Unfortunately, in most cases there are no industry standard options for disabling cookies without completely disabling the functionality and features they add to our site.  You can choose which cookies you accept. Disabling some cookies may affect functionality.

4.6.5. Disabling cookies
You can prevent the setting of cookies by adjusting the settings on your browser (see your browser Help for how to do this). Be aware that disabling cookies will affect the functionality of this and many other websites that you visit. Disabling cookies will usually result in also disabling certain functionality and features of our site.

4.6.6. The cookies we set:

a) Google Analytics
Our site uses Google Analytics which is one of the most widespread and trusted analytics solution on the web for helping us to understand how you use the site and ways that we can improve your experience. These cookies may track things such as how long you spend on the site and the pages that you visit so we can continue to produce engaging content. For more information on Google Analytics cookies, see the official Google Analytics page. Please note that Google Analytics does not identify you specifically as an individual, just as an anonymised visitor to the website. While we do not have access to or record your individual use of our website, Google Analytics does allow us to record demographics in regard to our website visitors e.g. age, location, gender.

b) Marketing Tracking Cookies
Marketing cookies identify the business or organisation that website visitors belong to, based on a reverse IP Lookup. These cookies are also used to process this identification, and personal information about individual users is stored. Marketing cookies store information about your current web browsing session (pages viewed, time on site etc.) and the dates and times of previous website visits.  These cookies will only be used with your consent.

c) Link Tracking
Cookies allow us to provide important site functionality so you don’t have to re-enter lots of information. They also allow us to remember what links and pages have been clicked or viewed during a session. If you have provided us with personal data, completing a contact form for example, we may associate this personal data with other information. This will allow us to identify and record what is most relevant to you.

d) Email Post-click Tracking Cookies
These cookies are used to report on the pages of this site that have been viewed by visitors to the site who have followed links from our email marketing campaigns. This analysis helps us to understand additional content that is viewed by the contacts in our database and therefore allows us to improve and tailor future campaigns to those contact’s specific areas of interest.

e) Embedded content
Some of the content on our site is provided by third parties. This includes but is not limited to: Google Maps for interactive mapping, YouTube or Vimeo for hosted video and Flickr for images. When you visit a page containing content from one of these sites a cookie may be set. We do not have any control over these cookies and you should check the relevant third party website for more information about these.

4.6.7. External links disclaimer.  Where external links are provided to other websites or social media accounts, we do so for information purposes alone. We are not responsible or liable for content or accessibility on these pages and sites, or for the siting of links to or about the charity on external sites. We do not endorse the material on them and if you choose to follow links to other websites, you do so at your own risk.

4.6.8. Data collection forms on our website.  When we collect your data on our website, we will always tell why we are collecting it and what we are going to do with it.

4.7. Social Media

Lawful Basis:  Legitimate interests, consent (where interaction goes beyond reasonable expectations)

4.7.1. When you contact us via social media, we hold your information so that we can respond to you. We may also use your Social Media Profile to help us find more people like you, so that we can grow our supporter base.

4.7.2. The information we hold may include:

  • Username
  • Display name/handle
  • Your direct message
  • Information from Facebook “About” section

4.8. Commercial Services

Lawful Basis:  Contract, legitimate interests, provision of health or social care (for health-related data)

4.8.1. We engage organisations across the UK, with a view to generating high value income through the sale of services on a commercial basis.

4.8.2. If you access our services as a commercial services client, the information we hold about you may include:

  • Title
  • Name
  • Contact details, postal address, email and phone numbers
  • Date of birth
  • Gender
  • Marital status
  • Service user status
  • Organisation that you are associated with, if applicable
  • Demographic details, such as your ethnicity and employment status
  • Employment status
  • Sickness status
  • Details of your GP details or other relevant healthcare professionals.
  • Your contact with us including attendance at our centres or at digital appointments, including the number of visits and visit lengths
  • Next of kin information
  • Records of communications/information sent to you and communications/information sent by you to us
  • Information relating to your health and your individual needs to enable us to provide you with the services and information and advice most appropriate to you
  • Information about the outcomes of the support you receive, including goals, progress, feedback, follow-up information, service experience and outcome measures
  • Your contact and communications preferences

4.8.3. We use personal information for internal administration to support you in accessing our services.   As part of our commercial client arrangement, we provide the contracting organisation with aggregated, anonymised reporting.  The information is provided to enable an understanding of the reach and impact of the service that has been funded.  This reporting may include:

  • The number of individuals who have accessed the service during a given period
  • High level patterns of support accessed
  • Impact measurement data, where available and appropriate, reflecting the overall outcomes and effectiveness of the service delivered

4.8.4. We do not share personal identifiable information with commercial clients as part of our reporting. Reports are prepared using aggregated and anonymised information, and we take steps to reduce the risk that any individual could be identified.

4.8.5. In addition to reporting provided to our commercial clients, data from our commercial service is also included into our own internal reporting. This allows for us to measure and understand the overall reach of our services from both a service user and commercial client perspective and inform strategic planning and service development across our service pathways.

4.9. Working with Fire and Rescue Services

Lawful Basis: Legitimate interests

4.9.1. Although we work independently from Fire and Rescue Services (FRS) we share high level aggregated and anonymised data with them, to demonstrate FRS staff are accessing the full range of support available, and also to help FRS understand engagement patterns to enable them to best support a fit and resilient workforce.

4.9.2. All data shared is fully aggregated and anonymised, meaning, no individual persons can be identified from anything we share.  Names, contact details, clinical information or any other personal identifiable data are never included, the data reflects engagement and activity patterns across Fire and Rescue Services nationally.

4.10. Rental of accommodation at our centres

Lawful Basis:  Contract, legal obligation

4.10.1. We raise income by making accommodation at other centres available to rent to members of the fire service community and the public. When enquiring or renting one of our properties the information we hold on you may include:

  • Title
  • Name
  • Contact details, postal address, email and phone numbers
  • Date of stay
  • Length of stay
  • Records of financial transactions
  • Whether you are associated with a Fire and Rescue Service(s)
  • For overseas visitors, we hold passport details and onward address as required by Immigration (Hotel Records) Order 1972

4.11. Recruitment

Lawful Basis:  Contract (pre-contract steps), legal obligation (right to work checks, employment law), legitimate interests

4.11.1. If you have any queries about the process or how we handle your information please contact us at [email protected].

4.11.2. All the information you provide during the recruitment process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary.

4.11.3. We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes or store any of your information outside of the United Kingdom or the EU. The information you provide will be held securely by us whether the information is in electronic or physical format.

4.11.4. We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.

4.11.5. We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

4.11.6. The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it might affect your application if you don’t.

4.11.7. If you use our online application system, this will be collected by us via our webhosting company.

4.11.8. We ask you for your personal details including name, address and contact details. We will also ask you about your previous experience, education, referees and for answers to questions relevant to the role you have applied for. Our people team and the recruiting manager will have access to this information.

4.11.9. You will also be asked to provide equal opportunities information via our Recruitment Monitoring Form. This is not mandatory information – if you don’t provide it, it will not affect your application. This information will not be made available to any employees outside of our people team, including recruiting managers, in a way which can identify you. Any information you do provide, will be used only to produce and monitor equal opportunities statistics.

4.11.10. Shortlisting.  Our recruiting managers shortlist applications for interview. They will not be provided with the information from your Recruitment Monitoring Form if you have provided it.

4.11.11. Selection.  We might ask you to participate in assessment days; complete tests; and/or to attend an interview – or a combination of these. Information will be generated by you and by us. For example, you might complete a written test or we might take interview notes. This information is held by us.

  • Conditional offer. If we make a conditional offer of employment, we will ask you for information so that we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to a confirmed offer.  Depending on the role, we may ask you to complete an application for a Disclosure Check via the Disclosure and Barring Service, and/or Disclosure Scotland.

4.11.12. We will contact your referees, using the details you provide in your application, directly to obtain references.

4.11.13. We will also ask you to complete a questionnaire about your health. This is to establish your fitness to work.

4.11.14. Verification.  We are required to confirm the identity of our prospective employees, their right to work in the United Kingdom and seek assurance as to their trustworthiness, integrity and reliability.  You will therefore also be asked to provide:
• Proof of your identity – you will be asked to provide original documents and we will take copies.
• Proof of your qualifications, professional memberships and registrations where applicable – you will be asked to provide original documents and we will take copies.

4.11.15. Confirmation of Employment.  Information collected during the recruitment process will form the basis of your employee file. We also collect and process personal data relating to your employment to manage the employment relationship. You will receive a copy of our Employee Privacy Policy at the start of your employment with us.

4.12. Company Members

Lawful Basis:  Legitimate interest, legal obligation (maintaining statutory registers where applicable)

4.12.1. We use the personal information you provide for administration purposes, which include processing your application, administering your membership of the Fire Fighters Charity, maintaining our register of company members, communicating with you and inviting you to attend meetings e.g. AGM and get togethers.

4.12.2. The information we hold about you may include:

  • Title
  • Name
  • Contact details, postal address, email and phone numbers
  • Date of birth
  • Your association with the Fire and Rescue Service
  • Diversity and inclusion monitoring information; ethnic origin, sexual orientation and religion/belief – only if you choose to disclose this information to us
  • Records of communications sent to you
  • Your contact preferences

4.13. Complaints, Comments and Compliments

Lawful Basis:  Legitimate interest, legal obligation (where complaints handling is required)

4.13.1. We collect and record information relating to any complaints, compliments or comments you make about us.  This helps us to understand your experience, respond appropriately, and learn from your feedback, whether it is positive, constructive or critical.  Information recorded as part of a compliment, comment or complaint may also be used internally to identify themes and trends across all feedback we receive, this reporting is always anonymised, meaning individuals are not identifiable in any summaries or reports.  Findings are used to inform service improvement and are shared with relevant staff as appropriate. Your personal details are never shared as part of this reporting process. We hold the following information when you make a complaint to us:

  • Title
  • Name
  • Contact details, postal address, email and phone numbers
  • Nature of complaint
  • Communication from you and to you regarding the complaint.

4.14. Guest WiFi at our premises

Lawful Basis:  Legitimate interests (network security, misuse prevention), legal obligation (crime prevention where relevant)

4.14.1. When using our Guest WiFi we store information about your device and the activity you undertake on the Guest WiFi network will be logged against your device details. We retain this data to monitor compliance with our Terms of Use, to prevent and detect crime and to monitor usage of Guest WiFi.

4.14.2. This monitoring is proportionate and limited to what is necessary to maintain network security and prevent misuse

4.15. Tenants of our properties

Lawful Basis:  Contract, legal obligation (right to rent checks, tenancy law)

4.15.1. For tenants in properties managed by us we may hold the following information:

  • Title
  • Name
  • Contact details, postal address, email and phone numbers
  • Records of financial transactions
  • Records of communication
  • For tenants in properties managed by third parties on our behalf we hold:
  • Name and address details.
  • Evidence of right to rent in the UK

4.16. Users of our community website

Lawful Basis:  Contract (terms of use), legitimate interests, consent (for publishing user-generated content where required)

4.16.1. Our community website is a public forum and the discussions on the community website are recorded and accessible by the community website administrators. When posting on the community website, please remember that any personal information you include in your posts may be read, collected, or used by other community website members. We are not responsible for the personal information you choose to submit when posting across the community.

4.16.2. When registering to become a user of our community website, the information we collect may include:

  • Title
  • Name
  • Contact details, postal address, email and phone numbers
  • Your association with the Fire and Rescue Service
  • Records of communications sent to you
  • Your contact preferences

4.17. My Fire Fighters Charity App and website (MyFFC)

Lawful Basis:  Contract, legitimate interests, legal obligation (regulatory requirements)

4.17.1. To access MyFFC, you must have an account, the minimum information we need to set up your account includes:

  • First name
  • Last name
  • Email address

4.17.2. You must also confirm that you are 18 or over and have read and consented to the statement below:
Please note that certain information (such as information relating to health, race, religion, sexual orientation or criminal convictions) receives a high level of legal protection. Any content that you post on MyFFC which is your personal data will be made public and visible to anyone using MyFFC, so please be aware of this before posting. If you post your personal information, you consent to it being held on MyFFC. If you wish to edit or delete your posts you can do so at any time using the dropdown menu beside each post. Please do not include information on other people/users as above i.e. that receives a high level of legal protection.

4.17.3. So that you get the most benefit from MyFFC we will also ask to collect the following details:

  • Contact details, postal address and phone numbers
  • Fire and Rescue Service
  • Primary Fire Station/location
  • Employment status
  • Job role
  • Other fire services community role
  • The information you share when requesting support
  • The information you share when “Contacting Us”

4.17.4. Your profile information is visible to all users of the MyFFC, you can change your profile visibility in the My Preferences section.

4.17.5. Your activity on the MyFFC is visible to all users of MyFFC, including, your posts, reactions, comments, questions, recognition, points score, ‘knows about’ and how you have voted in polls.

4.18. Self-employed contractors

Lawful Basis:  Contract, legitimate interests, legal obligation (regulatory requirements)

4.18.1. For self-employed contractors we may hold the following information:

  • Name
  • Contact details, postal address, email and phone numbers
  • Practice address / office address
  • Assessment of your employment status
  • Your self-employed agreement
  • UTR number
  • Evidence of your insurance/s
  • Year of qualification
  • Date of expiry of enhanced DBS / Protection of vulnerable groups scheme
  • Professional registration number
  • Records of communications sent to you

5. Special categories of personal data

5.1.1. We hold some health and social care information on service users who contact us for help and support, this is for the purpose of providing the appropriate services and information to them. This information is retained for this purpose only, and access to it is restricted to employees and volunteers providing these services. Medical information, including details of the clinical interventions provided by us, are retained in alignment with current legislation.

5.1.2. Where we process special category data (such as health information), we do so in accordance with Article 9 UK GDPR, including for the provision of health or social care, safeguarding of children and adults at risk, or with your explicit consent where required.

5.1.3. Aggregated, anonymised reports are made from this data to inform service development and strategy.  No individuals are identifiable in this reporting, and this reporting is used to:

  • Review and improve the services we currently provide, ensuring they remain effective, relevant and responsive to need.
  • Identify gaps in provision and inform decisions about how we develop or adapt our services in the future
  • Understand the profiles and needs of the people we support so our services are shaped around real experience rather than assumption
  • Support strategic planning and organisational decision making at a leadership and governance level.
  • Contribute to funding applications, impact reporting and external accountability where required.

5.1.4. Sometimes we will refer our service users to external providers (including individual BACP registered therapists) for external therapy or counselling.  If an external referral is made this is done with consent of the service user. The personal data, including health data, of the service user will be shared with the provider for direct care or counselling purposes. Service users will be given access to the provider’s privacy policy.

5.2. Children’s information

5.2.1. We will seek consent from a parent or guardian before collecting personal information in relation children, except when another lawful basis applies. We do process information about children, when they are visiting one of our centres, are part of a family to whom we are providing support in the community or are fundraising for us.

6. Lawful basis for processing your data

6.1.1. Consent (opt-in)

  • Where your consent (or opt-in) is needed for us to process your information or send communications to you, we will try to obtain your consent when you initially give us your personal information. We are required to refresh your consent regularly and will contact you to do this, provided we have your initial consent. If we have consent from you by more than one route, we will work to your most recent consent or opt-ins. You may withdraw your consent at any time.
  • If you provide us with contact details for a particular method of communication we will treat this as an indication of your consent to be contacted via that method, unless you have told us otherwise. Contact details provided directly by you will update any previous preferences in relation to this channel, unless you inform us otherwise.
  • If you are registered with the Telephone Preference Service (TPS) but provide us with a telephone number and consent for us to phone you, we will assume that we have your consent to call you on this number.
  • You can update your communications and contact preferences at any time by following the link. Update your communications preferences.

6.1.2. Legitimate Interest

  • When we use legitimate interest as the appropriate lawful basis to record your information, we will demonstrate that the processing is necessary for our legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect your personal data which overrides those legitimate interests.  Where we rely on legitimate interests, we carry out a balancing test to ensure that our interests do not override your rights and freedoms
  • Legitimate interest may be used when the processing is not required by law, but is of a clear benefit to us or others; provided that there’s a limited privacy impact on any individual; the individual should reasonably expect us to use their data in that way; and we cannot, or do not want to, give the individual full upfront control (i.e. consent) or bother them with disruptive consent requests when they are unlikely to object to the processing. For example, we may send you our Shout! magazine because you have a link to the fire and rescue service or have fundraised for us but have never asked you for your explicit consent to do this. However, when we send you our Shout! magazine we do provide you with the information of how to let us know if you don’t want to receive it again in the future.
  • We process personal data where necessary to safeguard children and adults at risk; to respond to emergencies affecting an individual’s health, safety or welfare; or to detect or investigate crime, fraud or other unlawful activity.  Where applicable, this processing is carried out in reliance on recognised legitimate interests under UK data protection law

6.1.3. Contract
When you apply to use our services, agree to a donation, sign up to an event or buy something from us we are entering in to a ‘contract’ with you and we will use your data to fulfil your request and for ongoing management.

6.1.4. Legal obligation
Where we have a legal duty for which particular personal data needs to be processed or retained we will comply with any legal obligation. For example, when you receive services from the charity which relate to your health and social care needs we will create a health and/or social care record for you or we will keep information on you and your donations that we have claimed Gift Aid on. These records will be retained in line with the charity’s retention schedule which is informed by professional and legal obligations.

7. Who we share your information with

7.1.1. We may share your personal data with trusted third parties where necessary to deliver our services, meet our legal obligations, or support our operations. We only share the minimum information necessary and ensure appropriate safeguards are in place.

7.1.2. Depending on your interaction with us, we may share your information with the following categories of organisations:

  • Healthcare and support providers, such as therapists or other health and wellbeing professionals involved in your care
  • Service delivery partners and external providers who support the delivery of our services
  • IT service providers, including providers of systems, cloud storage, and technical support
  • Professional advisers, such as legal advisers, auditors, and insurers
  • Payment processors and financial service providers, where you make a donation or payment to us
  • Regulators, authorities, or law enforcement bodies, where required by law or for safeguarding purposes
  • Fundraising and marketing partners, where you have consented to receive communications or where we are permitted to do so under relevant legislation
  • Survey and research providers, where you choose to take part in research or feedback activities

7.1.3. Where we share your information with third parties, we ensure that appropriate contractual arrangements and safeguards are in place to protect your personal data

8. How we keep your information safe

8.1.1. We use appropriate security measures to keep information safe. These include technical measures, our security policies and employee training.

8.1.2. Where we use third parties to process your information we ensure they have robust security and clearly defined data protection obligations as the data processor under their contract with us.

8.1.3. We do not share your information with other charities, nor do we sell your data on. Where we hold joint events with other charities, if they are the main organiser your information will be processed and held by them, not by us, and vice versa. Similarly, if we promote someone else’s event, they will hold your information, not us.

8.1.4. If you request a copy of the information we hold on you (via a Subject Access Request) we will take reasonable steps to verify your identity before providing it to you, as we do not want to give your personal information to someone else.

8.1.5. Most of our processing takes place in the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in line with UK GDPR, such as adequacy regulations or approved standard contractual clauses.

8.2. Keeping your information

8.2.1. The information you provide will be retained by us in accordance with the applicable law. We set retention periods for all personal information based on how long it is legitimately needed to run the charity and legal requirements. We will take reasonable steps to destroy or anonymise personal information when it is outside its retention period.

8.2.2. Details of retention periods for key categories of data are:

  • Service user records (health and wellbeing services): typically, 8 years from the last contact
  • Children and young people’s records: retained in accordance with legal and professional requirements, typically until at least age 21 and in some cases up to age 25
  • Supporter and donor records: typically, 6–7 years from the end of the financial year in which the last transaction took place
  • Financial records and transactions: typically, 7 years to comply with HMRC and accounting requirements
  • Employee records: generally, 6 years after employment ends (with some records retained longer where required by law, e.g. health records)
  • Recruitment records (unsuccessful applicants): up to 12 months
  • CCTV footage: typically retained for a short period (e.g. between 5 and 30 days) unless required for investigation
  • Complaints and enquiries: typically retained for up to 3 years after resolution

8.2.3. In some circumstances we may retain information for a different period, for example for legal, safeguarding or regulatory purposes.  Our full Records Management and Data Retention Policy can be obtained on request.

8.2.4. Please note that if you have publicly shared information with us (for instance via social media) it may well have been copied by other people or organisations outside of our control.

9. Your rights

9.1.1. While we hold information about you, you will always have the right to:

  • be informed how we use your information (via this privacy policy)
  • request a copy of the information we hold about you (Data Subject Access Request)
  • update, amend or rectify the information we hold about you
  • change your communication preferences at any time
  • ask us to remove your information from our records (note there are limitations on this, such as where we must retain data for HMRC or legal purposes)
  • withdraw consent, wherever it is the basis for our use of your information
  • object to any automated processing we are doing of your information
  • and you have the right of judicial review if you feel we have refused a legitimate request about the above.

9.1.2. For any enquiry or concern about our privacy policy, or to request access to your personal data, please contact us using the channels below.

9.1.3. If you ask for a copy of your personal data, we will provide it to you within one month. If you request further copies we may charge a reasonable fee based on our administrative costs. If you make the request by electronic means, unless you ask otherwise, we will provide your information in commonly used electronic forms. Evidence of proof of your identity may be required.

10. How to contact us

10.1.1. This privacy policy was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of our collection and use of personal information. However, we are happy to provide any additional information or explanation needed.

10.1.2. Any requests for this should be sent to the information below.

By email:
Fire Fighters Charity – [email protected]
Fire Fighters Trading – [email protected]

By post:
Fire Fighters Charity
Marine Court
Fitzalan Road
Littlehampton
West Sussex
BN17 5NF

By telephone 01256 366566

10.1.3. You can write to our Data Protection Officer at the above address or by email [email protected]

11. Your communications preferences

11.1.1. You can update your communications preferences at any time on our website.

12. What to do if you are not happy

12.1.1. Please talk to us. We will promptly respond to you and correct any information that we hold about you if it is found to be incorrect, especially your contact and communications preferences.

12.1.2. You have the right to contact the Information Commissioner’s Office (ICO) either via their helpline 0303 123 1113 or online at www.ico.org.uk

 

Implementation date: July 2026
Last review date: October 2025
Next review date: July 2028
Version number: 5
Author: Director of Finance, Risk & Compliance