Information about Bupa Foundation
In this privacy notice, ‘we’, 'us’ and ‘our’ mean Bupa Foundation. For our contact details, click here.
If you apply for funding or register for updates the Bupa Foundation will process your information.
Scope of our privacy notice
This privacy notice applies to anyone who interacts with us about our funding and wellbeing programmes (‘you’, ‘your’).
This privacy notice applies to you if you ask us about, or participate in our funding and wellbeing programmes. It describes how we handle your information, regardless of the way you contact us (for example, by email, through our website, by phone and so on). We will provide you with further information or notices if necessary, depending on the way we interact with each other in the future.
If you have any questions about this, please contact us at firstname.lastname@example.org.
How we collect personal information
We collect personal information from you and from third parties. Please see below for more information:
We collect personal information from you through your contact with us, including by phone (we may record or monitor phone calls to make sure we are keeping to legal rules, codes of practice and internal policies, and for quality assurance purposes), by email, through our websites, by correspondence you send us in the post, by your filling in application or other forms, through social media or face-to-face.
We also collect information relating to individuals and organisations who have made grant funding applications from other sources as part of our due diligence process. This includes publicly available information from:
- Companies House;
- the Charity Commission;
- applicant websites;
- news articles or press coverage, and
- social media accounts.
Categories of personal information
We process one category of personal information about you:
- standard personal information (for example, information we use to contact you, identify you or manage our relationship with you)
For more information, see below:
Standard personal information includes:
- contact information, such as your name, address, email address and phone numbers;
- details of any contact we have had with you, such as correspondence, emails and call notes;
- financial details, such as bank details for grant payments;
- information about how you use our website, including IP addresses or other device information (please see our Cookies Policy for more details).
What we use your personal information for
We process your personal information for the purposes set out in this privacy notice. We have also set out some legal reasons why we may process your personal information (these depend on what category of personal information we are processing). We normally process standard personal information if this is necessary to provide the services set out in a contract, it is in our or a third party’s legitimate interests or it is required or allowed by any law that applies. Please see below for more information about this and the reasons why we may need to process special category information.
By law, we must have a lawful reason for processing your personal information. We process standard personal information about you if this is:
- necessary to provide the terms and conditions set out in our grant agreement − if we have an agreement with you, we will process your personal information in order to fulfil that contract (that is, to provide you and your dependants with our funding);
- in our or a third party’s legitimate interests − details of those legitimate interests are set out in more detail below;
- required or allowed by law.
We process your personal information for a number of legitimate interests, including managing all aspects of our relationship with you, to enable us to provide programme updates and notices, to help us improve our approach and programmes. More detailed information about our legitimate interests is set out below.
Legitimate interest is one of the legal reasons why we may process your personal information. Taking into account your interests, rights and freedoms, legitimate interests which allow us to process your personal information include:
- to manage our relationship with you, our business and third parties who provide services for us;
- to review and process funding applications;
- to keep our records up to date and to provide you with updates;
- to contact you about new upcoming programmes;
- to exercise our rights, to defend ourselves from claims and to keep to laws and regulations that apply to us and the third parties we work with.
Grant funding newsletters and updates
- We may use your personal information to send you grant funding newsletters and related information by post, by phone, through social media, by email and by text, unless you’ve told us you don’t want us to;
- If you change your mind about receiving emails from us, you can click on the ‘unsubscribe’ link that appears in all emails we send. Otherwise, you can contact us at email@example.com to update your contact preferences;
- You have the right to object to receiving grant funding updates from us. Please see the section about your rights for more details.
Sharing your information
We sometimes need to share your information with other people or organisations for the purposes set out in this privacy notice.
For all our contacts, we share your information with:
- people or organisations we have to, or are allowed to, share your personal information with by law (for example, for fraud prevention or safeguarding purposes including with the Charity Commission or auditors);
- the police and other law enforcement agencies to help them perform their duties, or with others if we have to do this by law or under a court order
- suppliers who help deliver products or services on our behalf.
Transferring information outside the European Economic Area
We use global information systems. As a result, we transfer your personal information to countries outside the EEA (the EU member states plus Norway, Liechtenstein and Iceland) for the purposes set out in this privacy notice. Not all countries outside the EEA have data-protection laws that are similar to those in the EEA and if so, the European Commission may not consider those countries as providing an adequate level of data protection.
We take steps to make sure that, when we transfer your personal information to another country, appropriate protection is in place, in line with data-protection laws. Often, this protection is set out under a contract with the organisation who receives that information. For more information about this protection, please contact us at firstname.lastname@example.org.
How long we keep your personal information
We keep your personal information in line with set periods calculated using the following criteria.
- How long you have been a grant applicant or recipient with us;
- How long it is reasonable to keep records to show we have met the obligations we have to you and by law;
- Any periods for keeping information which are set by law or recommended by regulators, professional bodies or associations;
- Any relevant proceedings that apply.
If you would like more information about how long we will keep your information for, please contact us at email@example.com.
You have the right to access your information and to ask us to correct any mistakes and delete and restrict the use of your information. You also have the right to object to us using your information, to ask us to transfer your information you have provided and to withdraw permission you have given us to use your information. You have the following rights (certain exceptions apply).
- Right of access: the right to make a written request for details of your personal information and a copy of that personal information;
- Right to rectification: the right to have inaccurate information about you corrected or removed;
- Right to erasure ('right to be forgotten'): the right to have certain personal information about you erased;
- Right to restriction of processing: the right to request that your personal information is only used for restricted purposes;
- Right to object: the right to object to processing of your personal information in cases where our processing is based on the performance of a task carried out in the public interest or we have let you know the processing is necessary for our or a third party’s legitimate interests;
- Right to data portability: the right to ask for the personal information you have made available to us to be transferred to you or a third party in machine-readable formats;
- Right to withdraw consent: the right to withdraw any consent you have previously given us to handle your personal information.
If you make a request, we will ask you to confirm your identity if we need to, and to provide information that helps us to understand your request better. If we do not meet your request, we will explain why.
In order to exercise your rights please contact firstname.lastname@example.org.
Data protection contacts
If you have any questions, comments, complaints or suggestions in relation to this notice, or any other concerns about the way in which we process information about you, please contact our Data Protection Officer and Privacy Team at email@example.com.
You also have a right to make a complaint to your local privacy supervisory authority. Bupa’s main establishment is in the UK, where the local supervisory authority is the Information Commissioner:
Information Commissioner's Office
Cheshire, United Kingdom
Phone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)