Privacy policy

At Candlelighters, we're committed to protecting your personal information and being transparent about why we need it and what we do with it.

This notice clearly explains how and why we obtain, use, and protect your personal information. It is written following the Data Protection Act 2018, the Privacy and Electronic Communication (EC Directive) Regulations 2003 and the UK General Data Protection Regulations.

When you provide us with personal information, it will only be used to support your relationship with Candlelighters and in line with this notice.

If you are 16 or under, you must get your parent or guardian’s permission before you provide any personal information.

This privacy notice applies to all aspects of Candlelighters’ operations, including our website. By using our website, you are agreeing to the processing of your personal information following this notice.

Candlelighters is a registered charity (no. 1045077). We are listed on the Information Commissioner’s register of data controllers (registration reference Z3254693) and are a member of the Fundraising Regulator.

If you have any queries about this notice, please email us at [email protected] or call 0113 322 9283. If you have any concerns about our use of personal information you should write to: The Data Protection Manager, Candlelighters, 8 Woodhouse Square, Leeds LS3 1AD or email us at the above address.

Personal information is any information you give us that allows you to be identified. This may include your name, home address, date of birth, and personal email address. It also includes photographs and case studies.

We process and hold personal information needed to run the charity and for which there is a valid lawful basis. This includes information on families we support, employees, job applicants, volunteers, donors and supporters.

‘Processing’ means anything we may do with personal information, such as obtaining, accessing, recording, disclosing, destroying or using it in any way.

We collect personal information from you when you ask about our activities, register with us, (e.g. registering for an event), order products and services (such as publications and email newsletters), donate, fundraise on our behalf, apply for a job, volunteer, or provide it in any other way.

We may also obtain personal information about you from other sources, such as if a family member or friend contacts us on your behalf, or if a fundraiser passes on your details. We may also combine your personal information with other information we collect from third parties (see Profiling Supporters section).

To understand how we use information about the communications devices you use, such as IP address (the location of your computer on the internet) and cookies, please see our cookie policy page.

We process your personal information securely to ensure protection against unauthorised or unlawful processing and accidental loss or destruction. Your information is processed only by authorised individuals who have received appropriate data protection training.

We will not sell your details to any third parties. We may sometimes share your information with our trusted service providers who are authorised to act on our behalf, this includes organisations who fundraise on our behalf. 

We may share information with financial and legal advisers to obtain advice and protect our legal rights.

Candlelighters are responsible for collecting your personal information. When we collect your personal information, we use strict procedures and security features to prevent unauthorised access. However, no data transmission over the internet is 100% secure. As a result, while we try to protect your personal information, Candlelighters cannot guarantee the security of any information you transmit to us, and you do so at your own risk.

We may try to better understand our supporters by researching them using publicly available sources to tailor and target our fundraising events and communications to those most likely to be interested in them. This includes identifying those who may be able to support Candlelighters with a larger gift. This ensures that our communication with supporters is as relevant and timely as possible, helps us not to send irrelevant or inappropriate communication, and provides you with the best possible experience of Candlelighters. It also ensures that we spend your donations wisely, using research and analysis to inform our decisions so our fundraising efforts are as effective as possible.

We undertake in-house research and may also engage third-party organisations such as Experian, Factary or Milestone Research, to supplement what we know about you with information from third-party sources. We take the information you have already given us and enhance it with information from publicly available records such as the electoral roll, land records, ‘rich lists’, Who’s Who publications, and Companies House. The information we collect may be related to your employment and philanthropic activity. We may estimate your gift capacity based on visible assets and your connection to Candlelighters.

Our suppliers will not share your information with any other organisation, and it will only be used for the purposes set out above. You can opt out of your data being used for profiling by contacting [email protected].

Candlelighters treats your contact with us as confidential unless there is a risk of serious harm or abuse to you or someone else. In this instance, we may have to pass this information on to a third party such as the emergency services.

We use your information to run the charity efficiently, provide effective support for families, and develop our understanding of donors and supporters. This helps ensure that our communication with you is effective and in an appropriate manner. 

We will only use your information where we have a valid lawful basis to do so and will always respect your rights.

We use your information when you have given your consent or there is a legitimate interest for us to do so.  Where we use legitimate interest to process your information, we will always ensure that this is done in a fair way that respects your rights.  We also use your information where we have a legal obligation to do so, or to fulfil contractual obligations. 

We use your information in the ways set out below:

  • To give you the information, support, services, or products you ask for.
  • To understand your situation so we can develop and offer you the best possible personalised services.
  • For internal administrative purposes (such as our accounting and records) and to tell you about changes to our services or policies.
  • To send communications about our work and how you can help us, for example, information about our campaigns, volunteering and fundraising activities. You can let us know if you would prefer not to receive these communications at any time by emailing [email protected], calling 0113 322 9283 or writing to us at Candlelighters, 8 Woodhouse Square, Leeds LS3 1AD.
  • We may combine your information with other information (for example, from public records or social media) and create a profile of your interests and preferences. We do this to help us determine whether and in what ways you might be interested in helping us or getting involved in our activities.
  • To investigate and respond to complaints, legal claims or other issues.
  • To claim Gift Aid on your donations.
  • We may also use your personal information for other purposes which we specifically notify you about and, where appropriate, obtain your consent.

Information we hold

Supporters

You may give us your personal information directly by donating, signing up for an event, or communicating with us by post or telephone. Sometimes your information may be collected by an organisation working on our behalf such as a professional fundraising agency. In these cases, they will process your personal information in line with our instructions and we are responsible for your information at all times.

You may give us your personal information indirectly through independent event organisers, such as The Great Run, or on fundraising websites such as JustGiving, Enthuse or Charities Aid Foundation. These independent third parties will only share information with Candlelighters with your consent. You should check their privacy policies to understand how they process your information. We will not contact you without explicit permission given by you on these sites.

When we ask for your personal information, we will discuss communication preferences with you and on any subsequent communications you will have the ability to opt-out or change these preferences.

In some cases, we may use information in the public domain to support our fundraising purposes. It should be noted that UK GDPR doesn’t apply to information already in the public domain (such as Companies House data). Any information we collect is done in a manner that follows data protection regulations.

We do not give or sell your personal information to any other organisations, except those that are employed directly by us to raise funds or manage fundraising events for us. If you donate to Candlelighters, sign up for an event, or sign up to receive communications from us, we will normally collect your name and contact details. We will retain your bank account information if you are making a regular donation. We may also keep other information you give us, such as your date of birth, to understand our donors and help identify potential new supporters. If you’re taking part in a sporting or challenge event, we will also keep your emergency contact details for the duration of the event.

We use this information to thank you for supporting us and to provide you with further information about our activities where legitimate interest or consent allows. We also use it to fulfil our legal responsibilities for financial and Gift Aid reporting, to run our events and to allow us to process your donations.

We only hold your information for as long as is necessary until the end of your relationship with us, following our Data Retention and Destruction Policy. You can request a copy of this by emailing [email protected].

If you use your credit or debit card to donate to us, buy something, or pay for a registration online, we will use a specialist payment processor. We will also ensure that card details are handled securely under Payment Card Industry Data Security Standards (PCI DSS).

If you provide your card details to donate by phone, only Candlelighters staff who are authorised and trained to process payments will be able to collect or see your card details. We never store your credit or debit card details following the completion of your transaction. All card details and validation codes are securely destroyed once the payment or donation has been processed.

Families

We process and hold personal information that is needed by us to run the charity and for which there is a valid lawful basis. If your family is receiving support from us, we may need to obtain up-to-date medical and social care information to provide a safe and effective service, in the best interest of the child or young person.

We do not share sensitive information or confidential health information without your consent unless under legal obligation. We will only share information after families have signed a ‘consent to share’ form at the start of our service delivery, which details the circumstances in which we may share information.

In certain circumstances, such as to provide comprehensive support or in cases of safeguarding, we receive and will share personal information with other professional organisations, such as hospitals, GPs, community nursing teams, Local Authorities and schools.

We obtain personal information from you when you opt in to receive any of our services. We may also obtain personal information about you from other professionals involved in your child’s care.

We may use your personal information to:

  • Provide you with services or information that you have requested.
  • Keep a record of our communications with you.
  • Comply with our legal obligations, policies and procedures.

The safety of children is very important to us. We’ll only display the name of a child or family and any associated information if we have consent from the family members involved, unless otherwise required to do so by our legal obligations.

We may use your personal information for analysis and profiling to help us understand family needs. On occasion, we may also make use of publicly available demographic information. We will only use data collected in this manner for the purposes to which you have consented.

We will not sell or share personal details with any third party for their marketing.

We may disclose your personal information to third parties if we are obliged to by law, if the disclosure is necessary for national security or criminal investigation, or if we have your consent.

We adopt appropriate data collection, storage, processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction of your personal data stored on our database or systems.

All the information that you provide to us or which is shared with us is stored on our secure database.

We retain your personal information in line with our Data Retention and Destruction Policy. You can request a copy of this by emailing [email protected].

Role applicants

In our activities and legal obligations, we will process personal data (which may be held on paper, electronically, or otherwise) about our applicants. We recognise the need to treat it appropriately and lawfully, following UK GDPR.

We process the personal information you provide to us when you apply for a job or to volunteer with us. We may also receive personal data from third parties such as independent recruitment agencies.

We use this information to assess your suitability for the role applied for and where applicable, during the interview process.

We only request information from you that is required to satisfy legitimate recruitment information, relevant health and safety requirements and relevant equal opportunities legislation. It will also be used to obtain third-party references or to meet statutory obligations.

Your personal information will only be held and processed for the selection process and, if successful, with subsequent employment.

All the personal information we hold about you will be processed in a secure environment by authorised HR personnel and shared with relevant managers as part of the recruitment process.

We will only share your data with independent third parties with your consent and when directly required as part of the recruitment process. In these circumstances, they will only process your personal information in line with our instructions and we are responsible for your information at all times.

We keep the personal information of unsuccessful candidates for 12 months after the application closing date. After this time, it will be securely destroyed.

We do not hold speculative CVs sent to us for any reason.

For information on how Candlelighters processes the personal information of employees, interns and work placements, please refer to the Candlelighters Employee Privacy Notice. You can request a copy of this by emailing [email protected]. 

For information on how Candlelighters processes the personal information of volunteers, please refer to the Candlelighters Volunteer Privacy Notice. You can request a copy of this by emailing [email protected]. 

Sharing experiences with Candlelighters

You may share information with us about the support you and your family have received from Candlelighters or the fundraising or volunteering activity you have carried out for us.

Families and supporters kindly let us use images, videos and their stories to help bring our fundraising and campaign activity to life. These could include details about the health of their child and the experiences they have had.

We keep this content stored securely and will only use it with the subject’s permission. The safety of children is very important to us. If we display a child’s story, we do not display their personal or contact details unless we have permission to do so.

To promote Candlelighters, we use photographs and stories of children and families we support for our fundraising, charity literature and media purposes where consent has been discussed and agreed. By featuring photographs and stories we can engage with people in a much more tangible and visual way. The photographs and stories express what we do from families who know us best and help us in our efforts to seek support for the charity.

We will keep and use this information until you notify us otherwise. You can withdraw consent for your story, photos or videos at any time by emailing [email protected] or calling 0113 322 9283. If you decide to withdraw consent, your content will not be used going forwards, however previous publications may remain in circulation.

Our website uses cookies to ensure visitors get the best experience on our website and to provide information on how our site is being used, which helps improve the online experience. For example, cookies may tell us whether you are visiting our site for the first time or returning. Some cookies are necessary to allow visitors to move around the website and use its features, such as shopping baskets, or to collect performance information. Others allow for functionality like remembering language choices and passwords. Some cookies allow targeting or advertising based on browsing habits.

You can choose whether to accept these cookies and give your preferences in your browser settings. The 'help' menu in the toolbar will tell you how to manage these, including how to be notified when you receive a new cookie and how to disable them.

For more information, you can view our cookie policy.

Candlelighters use social media to promote our work. We may use personal data already in the public domain from social media sites such as Facebook, X, LinkedIn, Instagram and YouTube depending on your settings and the privacy policies of these sites. We collect meta donations through social media platforms.

If members of the public engage with our posts or publish content relevant to our work, we may like the posts, follow them, reply or write to them. We research what people say on public social media platforms to better understand how people feel about our sector and to improve our work. This research may be done by staff or companies we work with.

If you are a social media user, we will use social media tools as part of our relationship with you. These tools include Facebook custom and lookalike audiences. We may provide some of your data to the social media platform to allow them to identify your social media profile. You could then be shown advertising from Candlelighters which may interest you. Social media platforms will use your profile to identify those with similar characteristics to you who may also be interested in hearing about our work. These individuals will then be shown advertising about Candlelighters. You can object to your information being shared with social media platforms. Please contact [email protected] if you wish to object.

To change privacy settings on your social media, please refer to the privacy notices for individual sites which will tell you how to do this.

We use a third-party email service provider to deliver some of our emails. We collect statistics around email opens and clicks using industry-standard technologies to help us monitor and improve our communications. 

We may use your email address and phone number to find your social media accounts and show you Candlelighters content while using these services. We will only do this where you have opted in to our marketing emails or phone calls, and your personal data is kept secure at all times. We may also use this information to identify other users of these sites whom we believe would be interested in Candlelighters, to show them our content.

We keep your personal information only for as long as we need to use it for the purposes set out in this notice.

Our Data Retention and Destruction Policy details the periods we retain personal information for. You can request a copy of this by emailing [email protected]. The criteria we use for determining these retention periods are based on:

  •       Our legal requirements
  •       The purpose for which we hold data
  •       Whether there is a legitimate reason for continuing to store it (such as to deal with any future legal disputes)
  •       Guidance issued by regulatory authorities including but not limited to the Information Commissioner's Office (ICO).

Personal information that we no longer need is securely disposed of or anonymised so you can no longer be identified from it. Some personal information may be retained by us in archives for statistical or historical research purposes although we will do this in a manner that complies with applicable data protection law.

We continually review the personal information and records we hold and delete what is no longer required. We never store payment card data after the transaction has been completed.

The Candlelighters website may include links to other sites, not owned or managed by us. We cannot be held responsible for the privacy of information collected by websites not managed by us.

The law requires us to set out the lawful grounds on which we collect and process your personal information as described in this notice. Depending on the purposes we use your data for, one or more of the grounds listed below may be relevant:

We rely on the ‘legitimate interest’ ground for processing where we believe it is in the legitimate interests of you as the data subject, or of Candlelighters, to process your data. When we process your personal information in this way, we also consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We will not use your personal information for activities where our interests are overridden by the impact on you, for example where collection and use of your information would be excessively intrusive (unless, for instance, we are otherwise required or permitted to by law). We will only use your information according to the purposes described in this notice. Examples of processing based on legitimate interest are:

  • Sending direct marketing material to supporters by post for fundraising purposes.
  • Researching to better understand who our supporters are and better target our fundraising activity.
  • To measure and understand how our audiences respond to a variety of marketing activities so we can ensure our activity is well-targeted, relevant and effective.
  • Taking and using photographs and/or films of event participants and attendees.
  • To run events.
  • For staff recruitment and accepting applications or contacting volunteers about their role.
  • The use of CCTV recording equipment in and around our premises for monitoring and security purposes.
  • Promoting Candlelighters on social media, Google, YouTube and other online platforms.

In some instances, we will obtain consent to use your personal information in a certain way. This might include asking for consent to send you email marketing and updates or consent to share sensitive personal information with us.

We may need to collect, process and disclose personal information to comply with a legal obligation. For example, when ordered by a court or regulatory authority, or holding donor transaction details for Gift Aid or accounting/tax purposes. We may also use personal information to cross-check and prevent known malicious activities on Candlelighters operated services.

If you purchase something from our online shop or agree to work for us, we will process your information to meet our contractual obligations.

Under UK GDPR, you have certain rights concerning your personal information, although those rights will not apply in all cases or to all the information we hold about you. For example, we may need to continue to hold and process information to establish, exercise or defend our legal rights. 

We recognise your rights under UK GDPR and will act upon them accordingly. Under certain circumstances, by law, you have the right to:

  • Be informed of why, where and how we use your information.
  • Request access to your personal information.
  • Have your personal information corrected if it is inaccurate or incomplete.
  • Have your personal information erased from our systems if we no longer need to continue holding it (e.g. HMRC or other legal requirements).
  • Restrict the use of your information, where you have previously provided us with your consent.
  • Ask us to transfer your personal information to another person or organisation.
  • Object to how your information is used.

Where you have provided consent to be contacted or to receive a service, you have the right to withdraw that consent at any time. We will complete all requests within 28 days of receipt.

To withdraw your consent or if you have any questions, please email [email protected], or call us on 0113 322 9283.  

Once we have received notification that you have withdrawn your consent, we will no longer process your personal information except where legally required and subject to our retention policy, we will dispose of your data securely.

For further information please refer to the Information Commissioner’s guidance.

If you are unhappy with the way that we handled your personal data at any point, you can make a complaint by emailing us at [email protected], calling us on 0113 322 9283, or writing to us at Candlelighters, 8 Woodhouse Square, Leeds LS3 1AD.  You can also complain to the Information Commissioner’s Office (ICO).

We may update this policy from time to time to reflect changes in how we use your information. You may wish to check this policy each time you provide your information to Candlelighters.

This policy was last updated November 2024.