The Care Trust Privacy Statement
Purpose And Scope of The Care Trust Privacy Statement
The Care Trust Privacy Statement explains how personal data relating to you will be handled by The Care Trust (“we”, “us”, or “our”) and sets out how and why your personal data will be collected and processed by The Care Trust and/or on its behalf by its third-party service providers.
For the purpose of this Statement, the controller of your personal data is The Care Trust.
The Care Trust has appointed a Privacy Lead responsible for overseeing data protection compliance. If you have any queries regarding this Statement or how your data is processed, you may contact our Data Protection Officer at:
Email: DPO@give.ie or thecaretrust@give.ie
Application Of The Care Trust Privacy Statement
This Statement applies to the way we collect and process your personal data. Personal data will be collected and processed by The Care Trust when you or a company with which you are connected engage with us and/or avail of our services through www.thecaretrust.ie (our “Website”) or otherwise.
We will collect personal data when you:
- Visit or engage with The Care Trust
- Make a contribution/donation to us or make a pledge to leave us a gift in your Will
- Subscribe to our e-newsletters, request information from us or join a campaign
- Visit our website or social media pages via tools such as cookies and online identifiers, while respecting the cookies acceptance decision when accessing our website
- Take part in our prize draw
- Apply for a job with us
- Contact us or become involved with us in any other way
- Engage with supporter segmentation or limited profiling activities designed to tailor communications to you
The Personal Data We Process
The information we may collect from the above interactions may include, but is not limited to:
- Your name, address, telephone number, mobile number, and email address, along with your communication preferences
- Your year of birth or date of birth
- Financial information provided to us in connection with contributions/donations, including banking details, CHY forms and PPS numbers for the Charitable Tax Rebate scheme and company information for payroll giving
- Information you enter onto our website, including individual details
- Navigation through our website
- Records of your contribution/donation history, correspondence and campaign actions
- Images, photographs or video if you engage with The Care Trust
- Technical information such as IP address, browser type, device type and usage data
- Information from publicly available sources (such as media reports, company records or public professional profiles) in limited circumstances where relevant to major gift fundraising and Supporter research
- Any other information you choose to provide
We do not store credit or debit card details. Payment processing is handled securely by authorised third-party payment providers. PPS numbers collected for Charitable Tax Rebate purposes are stored securely and retained only for as long as legally required.
We may also collect information relating to your use of our website through cookies and similar technologies. Further details are available in our Cookies Policy.
If you apply for a job with us, we may process certain sensitive personal data where required for recruitment purposes. A separate recruitment privacy notice will be provided where applicable.
How And Why We Process Your Personal Data
We use personal data for the following purposes:
- Providing you with information you have requested
- Registering you for events
- Administering your donation, including processing Charitable Tax Claims
- Keeping a record of your relationship with us
- Managing your communication preferences
- Understanding how we can improve our services, events, and communications
- Inviting you to events
- Statistical analysis at a generic level to improve engagement
- In limited circumstances, analysing personal information together with publicly available information to better understand your interests and potential engagement with The Care Trust. This profiling is conducted proportionately. You have the right to object to this processing at any time.
- Recruiting and processing job applications
- Managing employee records and organisational administration
- Preventing fraud and ensuring proper governance of charitable funds
Supporter Research and Profiling
As part of our fundraising activities, The Care Trust may carry out Supporter research and propensity profiling to better understand supporter engagement and to ensure that fundraising approaches are appropriate and proportionate. This may include reviewing donation and engagement history held within our CRM system and consulting publicly available information such as media reports, published rich lists, public company records and professional profiles (such as LinkedIn). We do not purchase third-party datasets and we do not access private or restricted information.
Where appropriate, we may engage specialist third-party consultants to assist with this research under contractual arrangements and Data Processing Agreements. This processing is based on our legitimate interests in supporting the effective and sustainable operation of the charity. It does not involve automated decision-making and all engagement decisions involve human review.
You have the right to object at any time to this processing, and profiling information is retained in accordance with our Retention Schedule.
Legal Basis For Processing
We process your personal data under the following legal bases:
Contract
| Purpose | Personal data processed | Legal basis (and legitimate interests pursued, if applicable) | Data use and retention period |
|---|---|---|---|
| Processing Donations and Charitable Tax Rebate Claims To process donations, administer gift aid / CHY tax rebate claims, and maintain accurate Supporter records. | • Name and surname • Postal address • Email address • Phone number • Donation details • Financial information • PPS number (where required for CHY forms) | Contract – Processing is necessary to fulfil donation-related obligations and administer associated tax claims. In certain circumstances, processing of financial data may also be required to comply with SEPA or Revenue requirements. | Donation and financial records are retained for up to 7 years in accordance with statutory obligations. Tax-related records may be retained for longer where required under Revenue legislation. |
| Lottery/Draw Registration and Participation To register individuals for lotteries/draws and administer participation. | • Name • Contact details • Date of birth (where required) • Payment details (if applicable) | Contract – Processing is necessary to register you and administer the lottery/draw. | Lottery/draw participant data is retained in accordance with our Retention Schedule and generally for up to 7 years from the date of the draw unless otherwise required. |
| Event Registration and Participation To register individuals for events and administer participation. | • Name • Contact details • Date of birth (where required) • Payment details (if applicable) | Contract – Processing is necessary to register you and administer the event. | Event participant data is retained in accordance with our Retention Schedule and generally for up to 7 years from the date of the event unless otherwise required. |
| Grant and Supplier Administration To administer grants and manage supplier contracts. | • Contact details • Professional information • Financial and payment information | Contract – Processing is necessary to perform contractual obligations with partners and suppliers. | Retained for the duration of the contractual relationship and for up to 7 years thereafter in line with statutory requirements. |
| Recruitment and Job Applications To assess applications and manage recruitment processes. | • Name • Contact details • CV and employment history • Interview notes • References | Contract (pre-contractual steps) – Processing is necessary to assess suitability prior to entering into an employment contract. | Recruitment records are retained in accordance with our Recruitment Retention Schedule (generally up to 1 year for unsuccessful candidates and longer where legally required). |
Legitimate Interests
| Purpose | Personal data processed | Legal basis (and legitimate interests pursued, if applicable) | Data use and retention period |
|---|---|---|---|
| Website Administration and Improvement Providing access to our website, improving performance, monitoring usage, and maintaining security. | • IP address • Device and browser information • Usage data • Cookies (non-essential subject to consent) | Legitimate Interests – Ensuring website functionality, performance and security. We conduct balancing assessments to ensure our interests do not override your rights and freedoms. | Website analytics data is retained in line with our Cookies Policy and Retention Schedule. |
| Administration and Governance of the Charity Maintaining records, ensuring proper governance, fraud prevention and safeguarding. | • Name • Contact details • Transaction data • Correspondence | Legitimate Interests – Ensuring effective governance, fraud prevention and safeguarding of charitable resources. | Retained in accordance with statutory and regulatory requirements, generally up to 7 years. |
| Fundraising Communications and Stewardship Thanking you for support and providing updates on how donations are used (where not requiring consent). | • Name • Contact details • Donation history | Legitimate Interests – Keeping supporters informed and maintaining ongoing engagement. You have the right to object at any time. | Communications retained in line with marketing retention periods (generally up to 4 years from last engagement). |
| Supporter Research, Segmentation and Propensity Profiling Conducting research and segmentation to support appropriate and proportionate fundraising engagement. | • Name and contact details • Donation and engagement history • Publicly available professional and corporate information • Publicly reported indicators of philanthropic activity | Legitimate Interests – Ensuring effective and sustainable operation of the charity. You have the right to object at any time. | Retained in accordance with our Retention Schedule, generally up to 7 years from last engagement unless legal obligations require longer. |
We conduct legitimate interest assessments where required to ensure that our processing does not override your fundamental rights and freedoms.
Compliance With Legal Obligations
| Purpose | Personal data processed | Legal basis (and legitimate interests pursued, if applicable) | Data use and retention period |
|---|---|---|---|
| Revenue and Tax Compliance Complying with Revenue requirements and administering tax rebates. | • Name • Address • Donation records • PPS numbers (where required) | Legal Obligation – Compliance with Revenue legislation and tax regulations. | Retained in accordance with statutory tax retention requirements (generally up to 7–15 years depending on circumstances). |
| Charity Regulation and Governance Meeting regulatory reporting and governance requirements. | • Supporter records • Financial records • Governance documentation | Legal Obligation – Compliance with charity regulation requirements. | Retained in line with statutory governance obligations. |
| Anti-Money Laundering and Fraud Prevention | • Transaction records • Identity verification information (where required) | Legal Obligation – Compliance with anti-money laundering legislation. | Retained in accordance with statutory requirements. |
| Employment and Data Protection Law Compliance | • Employee records • HR documentation • Compliance documentation | Legal Obligation – Compliance with employment and data protection legislation. | Retained in accordance with statutory employment and data protection retention requirements. |
Disclosure Of Personal Data
We may disclose your personal data to:
- Regulatory authorities
- IT service providers
- Payment processors
- Fundraising platforms (including Evergiving)
- Email campaign providers (including Mailchimp)
- Digital marketing agencies
- HR service providers
- Professional advisors such as legal, tax and accounting advisors
- Event partners or hosting providers
All third-party processors are contractually required to process personal data in accordance with applicable data protection law and under appropriate Data Processing Agreements.
Transfers Of Your Personal Data
We store and process personal data within the European Economic Area (EEA).
Some third-party service providers may process personal data outside the EEA, including in the United States or Australia.
Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as:
- Transfers to countries subject to an adequacy decision by the European Commission; or
- The use of Standard Contractual Clauses approved by the European Commission.
You may request further information about these safeguards by contacting us.
Retention Of Your Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting and regulatory requirements.
In general:
- Donation and financial records are retained for up to 7 years
- Recruitment records are retained in accordance with our Recruitment Retention Schedule
- Marketing data is retained until you withdraw consent or object to processing
We operate a documented Retention Schedule governing retention periods across different categories of data.
Data Security
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures include:
- Encryption of devices and systems
- Role-based access controls
- Multi-factor authentication
- Secure cloud infrastructure
- Regular system backups
- Physical security controls
- Database encryption
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission and affected individuals where required by law.
Your Rights And How To Exercise Them
Under data protection law, you have the following rights (subject to certain limitations):
- Right to be informed
- Right of access
- Right to rectification
- Right to erasure
- Right to restriction of processing
- Right to object
- Right to data portability
- Rights relating to automated decision-making and profiling
You may exercise any of these rights by contacting us at: DPO@give.ie
We may request proof of identity before fulfilling your request.
You also have the right to lodge a complaint with the Irish Data Protection Commission:
Website: www.dataprotection.ie
Telephone: +353 (0)761 104 800
Cookies
We use cookies and similar technologies on our website. For detailed information about the cookies we use, their purposes, duration and how to manage your preferences, please refer to our Cookies Policy.
You can withdraw or amend your cookie consent at any time via the cookie preference tool available on our website.
Changes To This Statement
We may update this Statement from time to time to reflect changes in our practices or legal requirements. Where material changes are made, we will notify you via our website.
Contact
If you have any concerns about how your personal data is being used or processed by The Care Trust, please contact:
Email: DPO@give.ie