Privacy notice

We are CAF

We are a leading charity that exists to accelerate progress in society towards a fair and sustainable future for all. We use our unique position to bring charities, business, and philanthropists together to simplify giving, allowing charities to focus more on the great work they do.

We make it easier to give when and how you want, in complete confidence. Our independent insight and advice helps your money go further.

We make it possible for you to give, and keep on giving, to make a bigger impact to the causes that matter to you.

We provide the financial support, advice, insight and expertise so you can get more help to where it’s needed.

We are Charities Aid Foundation and a registered charity (number 268369)

This Notice covers all personal information that is processed by CAF and the entities that form the CAF Group.

Please be assured, your personal information will not be shared with any outside organisation except as part of providing a product/service or when legally obliged to do so.

Back to the top ^

Your rights under the GDPR

Accessing the personal information we hold about you

You have certain rights under data protection legislation. Find out more information on what these are by visiting the Information commissioners Office (ICO) website.

You can request access to the personal information we hold by completing a Subject Access Request (SAR) form. You can also contact us:

By post: The Data Protection Officer, 25 Kings Hill Avenue, West Malling, Kent ME19 4TA

By email: dpo@cafonline.org 

By phone: 03000 123 000 (calls to this number may be recorded for training and monitoring purposes)

If you reside within the EU you can request access to your personal information by contacting Castlebridge NomRep Services Ltd.

By email: caf@gdprnomrep.eu

Letting us know if your personal information is incorrect

We will always endeavour to ensure that your personal data remains accurate, however if you think this information is incorrect or incomplete you have the right to have your information rectified.

To request your data be rectified, please contact us to let us know and we will take all reasonable steps to update or correct it for you.

If you want us to stop using your personal information

Under data protection legislation you have the right to:

• Erasure (known as the right to be forgotten) – you have the right to have your personal information erased where we do not have a legal basis to process it including where we are holding it for longer than required;
• Restrict Processing – there are occasions where you can ask us to restrict or block the processing of your personal information such as where you have requested we rectify your information, you might want us to restrict further processing whilst we verify and rectify it; and
• Object – where we are using consent or legitimate interest to process your personal information eg for marketing purposes or for research purposes, then you can ask us to stop this at any time.

To request any of the above, please contact us.

How to complain

Please let us know if you are unhappy with how we have used your personal information. You can contact us by any of these means.

If you have a concern about our data protection practices then you also have the right to complain to the Information Commissioner’s Office (ICO). Find out on their website how to report a concern.

Back to the top ^

Why we process personal data - our legal basis

Under data protection legislation we must have a reason or a ‘legal basis’ for processing personal information. In this section, you can see the reasons why we process personal information and what processing activities we undertake.

Back to the top ^

How we use information about you

There are some occasions where we will use legitimate interest to process your information. We will only do this where the activity supports our mission to make giving go further, so together we can transform more lives and communities around the world and we will always consider the impacts to your privacy and ensure that there are appropriate safeguards in place to protect it.

You can tell us you do not want us to use your information for our legitimate interest at any time by getting in touch with us.

Sharing donor information with recipient charities

Sharing this information with charities plays a huge part in how we support our mission to motivate society to give, it allows:

• CAF to connect donors to the charities they support
• charities the chance to reach out to their donors
• donors the opportunity to be involved with charities that they support
• the charitable sector to continue to work together with donors to strengthen the relationships and work that they do

When you make a donation your name, email and address (contact information) will be shared with the charity you have sent a donation request to. Each time you make a donation you will always be given the opportunity to make your donation anonymous so you have full control over what information the recipient charity receives. This should be clear to you at the time of donation.

If making regular payments to a charity eg from your CAF Charity Account by Standing Order and you now want to stop the charity receiving your personal data then you can cancel the Standing Order and set up a new one as anonymous so the charity will not receive your personal data going forward.

You can also contact the charity you are donating to, who is also subject to the same data protection legislation, to stop contacting you.

Telephone Recording

When you telephone us we may record the call for training or monitoring purposes.

Wherever possible we'll let you know that calls are recorded.

Profiles of your preferences

In order to give you the best possible service we may use your personal data to create a profile of your interests and preferences. What that means is we could use information you have given us, like your age or your location or your donation history, to get a better idea of who our customers are and how we can help.

That helps us make sure we send you information which is relevant to you and helps us develop our services so they work best for our customers now and in the future. We may occasionally commission insight companies or use industry standard profiling products offered by third parties to help us do this.

We believe this is one of our legitimate interests and have considered this carefully to ensure we work in a fair and balanced way, taking your rights into account.

It’s your right to opt out of your information being used for any profiling. To opt out of profiling you can let us know by contacting us.

Screening

As part of our legitimate interests, we have considered that screening can be an effective way to ensure we are contacting you with relevant messages and to develop our services so they are as relevant as possible to the people we serve. To help us do that, we may occasionally make use of third party wealth screening companies who combine information we provide with publicly available information to help us determine which of our services may be most relevant to you.

It is your right to opt out from your information being screened. To opt out of screening you can let us know by contacting us.

Publicly available information

We occasionally carry out research of our own to identify individuals who may be interested in supporting CAF or receiving information about our policy and research work, and gain insight into people of public standing. This makes use of publicly available information, such as newspaper reports, published lists and corporate websites.

Research

Because our mission is to encourage people to give ever more effectively, we analyse trends in the donations made through CAF both to improve our service and to draw wider lessons and insight for the charity sector as a whole. We do occasionally make anonymised data from our operations available to carefully-selected academic researchers to allow them to conduct research into broader trends in giving, for the benefit of charities. We do ensure that any data which might identify individuals is removed.

It is your right to opt out from your information being used for research purposes. To opt out of research you can let us know by contacting us.

Marketing

From time to time we will send out communications about our work, our products and services, events and other related information. This is ‘marketing’.

We normally send out our marketing communications by email. We will only send these where you have agreed to receiving them.

It is your right to opt out from your information being used for direct marketing. To opt out of receiving marketing from us you can let us know by contacting us or you can click the unsubscribe link at the bottom of every email we send.

The most effective way to opt out of receiving marketing or research is by clicking the unsubscribe link at the bottom of each message, as this is actioned instantly. When you use another method to opt out of receiving marketing, this may take a little longer to action, although we aim to honour all opt-out requests as soon as we receive them.

If you decide to opt out of receiving marketing emails you will still receive service communications about your product or service eg changes to Terms and Conditions.

We do not share your data with any other third party for them to market to you.

Back to the top ^

Who we might share your information with and why

CAF will only share your personal information with trusted suppliers of services where it is appropriate to do so.

We may share your personal information with other members of the CAF Group which will only be done where there is a legitimate reason for doing so.

When we decide to work with suppliers and third parties we always make sure that:

• they have appropriate standards and processes in place to protect and are suitable to look after your personal information
• they only retain your personal information for as long as is required
• they only use your personal information for the purposes that we have trusted it to them
• there is a written contract or agreement in place between us and them to protect personal data; and
• we regularly review and monitor to ensure they remain appropriate and ethical

Back to the top ^

How long we keep your personal information

CAF will only keep your personal information for as long as we believe necessary. Our retention periods incorporate our legal and regulatory requirements that we have.

Where we cannot delete personal data for legal, regulatory or technical reasons we will always only retain it whilst making sure that your privacy is protected and will only use it for those purposes.

We have two categories with regards to how long personal data is retained, these are:

Customer relationship

Where you have taken out a product or a service ie signed up to terms and conditions, we will retain your information all the while the product or service is active and for seven years after the end of the relationship ie when you request we close your account

Prospect/non-customer relationship

Where you have not taken out a product or service eg you make enquiries into a service or you begin the process to open an account but decide not to go ahead, we will retain your information for no longer than three years.

Back to the top ^

CAF Bank

Fraud Prevention and Detection

The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. If fraud is detected, you could be refused certain services, finance or employment. Find out how your information will be used by us and these fraud prevention agencies, and your data protection rights.

CAF Bank Lending

Automated decision-making - Approving Credit

We use a system to decide whether to lend money to you or to your organisation, when you apply for credit such as a loan or an overdraft. This is called credit scoring. It uses past data to asses how you’re likely to act while paying back any money that you borrow. This includes data about similar accounts that you may have had before.

Credit scoring uses data from three sources:

• Your application form
• Credit Reference Agencies
• Data we may already hold

It gives an overall assessment based on this. Banks and other lenders use this to help make responsible lending decisions that are fair and informed.

At CAF Bank we use this information to help inform our decision on lending. All applications are manually assessed and not made based on the automated score alone.

Credit Reference Agencies

We carry out credit and identity checks when you apply for a CAF Bank lending product or service for you or for your organisation. We may use Credit Reference Agencies (CRAs) to help us with this

If you use our services, from time to time we may also search information that the Agencies have, to help us, manage those accounts.

We will share your personal information with CRAs and they will give us information about you. The data we exchange can include:

• Name, address, date of birth
• Credit application
• Details of any shared credit
• Financial situation and history
• Public information, from sources such as the electoral register and Companies House.

We will use this data to:

• Assess whether you or your organisation is able to afford to make repayments
• Make sure what you’ve told us is true and correct
• Help detect and prevent financial crime
• Manage accounts with us
• Trace and recover debts

We will go on sharing your personal information with CRAs for as long as you are a customer. This will include details about your settled accounts and any debts not fully repaid on time. It will also include details of funds going into the account and the account balance.

IF you borrow, it will include details of your repayments and whether you repay in full and on time. The CRAs may give this information to other organisations that want to check credit status. We will also tell the CRAs when you settle your accounts with us.

When we ask CRAs about you or your organisation, they will note it on your credit file. This is called a credit search. Other lenders may see this and we may see credit searches from other lenders.

You can find more about CRAs on their websites, in the Credit Reference Agency Information Notice. This includes details about:

• Who they are
• Their role as fraud prevention agencies
• The data they hold and how they use it
• How they share personal information
• How long they can keep data
• Your data protection rights

The three main CRAs are:

• Callcredit
• Equifax
• Experian

The Information Commissioner’s Office also publishes advice and information for consumers in its 'Credit Explained' leaflet.

Back to the top ^

Recruitment

Charities Aid Foundation is the data controller for the information you provide during the process unless otherwise stated. If you have any queries about the process or how we handle your information please contact us at humanresources@cafonline.org.

What will we do with the information you provide to us?

All of the information you provide during the process will only be used for the purpose of progressing your application to assess your suitability for the role you have applied for, or to fulfil legal or regulatory requirements if necessary.

We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes or store any of your information outside of the European Economic Area. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or paper format.

We will use the contact details you provide to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.

What information do we ask for, and why?

We do not collect any more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary.

The information we ask for is used to assess your suitability for employment. You don’t have to provide what we ask for but it might affect your application if you don’t. 

Application stage

We ask you for your personal details including name and contact details. We will also ask you about your previous employment, experience, and education and whether you require any reasonable adjustments during the recruitment process.

Shortlisting

All our recruiting managers are trained in recruitment at CAF, or will be working with a trained recruiting manager.  Our recruiting manager’s shortlist applications against the role profile for interview using the information you provide.

Assessments

We might ask you to participate in assessment days; complete online or work based tests or occupational personality profile questionnaires; and all roles will require you to attend an interview.  It is most likely that we will ask you to participate in a combination of these. Information will be generated by you and by us. For example, you might complete a written test or we might take interview notes. This information is held securely by CAF. Our HR Team and the recruiting manager(s) will have access to all of this information which will be stored securely in electronic format by our Human Resources team.

If you are shortlisted for an interview you will also be asked to provide anonymous equal opportunities information. This is not mandatory information – if you don’t provide it, it will not affect your application. This information is used to monitor the demographics of each recruitment campaign and will not be made available to any staff outside of the HR Team, including recruiting managers. Any information you do provide will be used only to produce and monitor equality and diversity statistics. You will also be asked at this stage to bring along your proof of eligibility to work in the UK so we can verify and take a copy of your original document.

Conditional offer

If we make a conditional offer of employment we will ask you for information so that we can carry out relevant pre-employment checks which must be satisfactory to CAF in order to progress to employment. We are required to confirm the identity of our employees, their right to work in the United Kingdom and seek assurance as to their suitability to work for CAF in the role that has been offered.

You will therefore be required to provide the information below: 

• Your full name and any previous names
• Your DOB
• Your NI number and passport number (if you have one)
• Your full contact details including your address, for the past 5 years  email address and  telephone number
• Proof of your identity address
• Proof of your qualifications or training

You will be asked to complete a (standard for certain roles such as SMCR) DBS check which will verify your declaration of unspent convictions. CAF will refund any cost associated with this. A personal details form which covers all the required information to enable us to verify your identity, CV and obtain the required data for pre-employment checks, this includes sharing with us your:

• Bank details – to process salary payments
• Emergency contact details – so we know who to contact in case you have an emergency at work
• Your referee details – so we can request references using the details you provide
• Whether you have a disability or any special requirements so we can consider reasonable adjustments in the workplace
• Whether you have any unspent criminal convictions or charges pending

We will also ask you to complete a medical questionnaire about your health. This is to establish your fitness to work and to support us with making reasonable adjustments if required. This is done through our third party PHC who will keep your information confidential and will simply let us know of your fitness for the role you have been offered.

Who we might share your information with and why 

CAF will only share your personal information with trusted suppliers of services where it is appropriate to do so.

When we decide to work with suppliers and third parties we always make sure that:

• they have appropriate standards and processes in place to protect and are suitable to look after your personal information;
• they only retain your personal information for as long as is required;
• they only use your personal information for the purposes that we have trusted it to them;
• there is a written contract or agreement in place between us and them to protect personal data; and
• we regularly review and monitor to ensure they remain appropriate and ethical.

How we make decisions about recruitment?

Final recruitment decisions are made primarily by recruiting managers and where required with the input of HR. All of the information gathered during the application and assessment process is taken into account.

Psychometric testing results for ability are generated automatically. Occupational Personality Questionnaires are not results driven and the data gathered from such questionnaires are self generated and will be used to assess an individuals work style preferences against the requirements of the role they have applied for.

You are able to obtain further information on our employee privacy notice and ask about decisions made about your application by speaking to the recruiting manager or a member of our HR Team by emailing us at humanresources@cafonline.org.

How long is your information retained for?

• If you are successful, the information you provide during the application process will be retained by us as part of your employee file for the duration of your employment plus seven years following the end of your employment.
• This includes the outputs of your criminal records declaration, fitness to work, records of any security checks and references.
• If you are unsuccessful at any stage of the recruitment process, the information you provide until that point will be retained by us for 12 months from the closure of the recruitment campaign.

 Back to the top ^