Introduction

This Privacy Notice explains when and why Lupus UK (“we”, “us”) collects personal information, how we use it, the conditions under which we may disclose it to others, and how we keep it secure. It also explains your rights under UK data protection law and how to exercise them. This Notice applies to our services delivery data subjects, human resources and our fundraising and marketing activities.

Who We Are
Lupus UK is a registered charity (No. 1200671). For the activities described in this Notice, Lupus UK generally acts as a data controller. Where you choose to take part in research or involvement activities led by external organisations, those organisations will act as the data controller for your personal data.

Contact Information, Queries and Complaints
If you have questions about this Privacy Notice or how we process your personal data, or if you wish to exercise
your rights, please contact us at:

•  Email: [email protected]
•  Telephone: 02081 830 651
•  Post: LUPUS UK, The Finsbury Business Centre, 40 Bowling Green Lane, Clerkenwell, London, EC1R 0NE

What Personal Data We Collect and Why
The data we collect and how we use it depends on your relationship with us. Please see the appendices for details:

• Appendix 1 – Enquirers and Service Users
• Appendix 2 – Grants
• Appendix 3 – Human Resources (employees, volunteers, contractors)
• Appendix 4 – Fundraising and Marketing
• Appendix 5 – Complaints Procedure

Your Rights
Under UK data protection law, you have the following rights. Some rights are subject to limitations (for example,
safeguarding or legal obligations) and may not always apply. If we cannot fulfil a request, we will explain why.

• Right to be informed – to know how your data is used.
• Right of access – to request a copy of your personal data.
• Right to rectification – to correct inaccurate or incomplete data.
• Right to erasure – to request deletion where legally permitted.
• Right to restrict processing – to limit how we use your data in certain circumstances.
• Right to data portability – to receive certain data in a structured, machine‑readable format.
• Right to object – to processing based on legitimate interests or for direct marketing.
• Rights around automated decision‑making – we do not make decisions that produce legal or similarly significant effects solely by automated means.
• Right to complain – to complain against any of our activities.

International Data Transfers
Where personal data is transferred outside the UK, we put in place appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and we perform transfer risk assessments where required.

How Long We Keep Your Data
We retain personal data only for as long as necessary to fulfil the purposes set out in this Notice and to meet legal, regulatory, contractual and funder requirements. Specific retention periods are set out in Lupus UK’s Retention Schedule and may vary by project (for example, safeguarding records or research evaluation data). We will provide further information on request.

How We Protect Your Data
We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit and at rest (where appropriate), data minimisation, secure deletion, staff training, confidentiality agreements, and vendor due diligence. We regularly review and improve these measures.

Children’s Data
We work directly with children, young people and families. Where we rely on consent or legitimate interest, we take account of the child’s age and understanding. For online services, consent from a holder of parental responsibility is usually required for children under 13. For offline, face‑to‑face services, we consider the child’s competence to consent and may also seek parental or guardian consent where appropriate. We always act in the child’s best interests and in line with safeguarding duties.

We may also rely on legitimate interest, based on the activity.

Changes to This Notice
We review this Privacy Notice regularly. Significant changes will be communicated directly or via a notice on our website.

This appendix covers how Lupus UK uses personal data to deliver its services and manage enquiries.

What and How Personal Data is Collected
When you contact Lupus UK as enquirers or service users, we collect the personal data you choose to share with us. This typically includes a name, contact details (such as email address, phone number, or your social media account), and information relevant to lupus or the reason for your enquiry. We communicate with individuals using the same method by which they contacted us, where appropriate.

We record enquiries and interactions on our secure customer relationship management (CRM) system so that our
staff can provide consistent support and ensure continuity of care. Where support is provided, we may record
relevant health-related information connected to lupus, such as where someone is on their lupus journey or the
impact of their condition on daily life. We only record information necessary to provide support, monitor service use,
and meet internal reporting requirements, such as time spent on cases.

We do not record unnecessary medical details, such as medication, and we do not contact or record information
about third parties without appropriate consent.

How We Use Your Data
• To respond to and manage enquiries, and to provide information, advice, and support about Lupus UK and our services.
• To deliver one-to-one support, including telephone calls, video calls, and online support, and to facilitate access to peer support groups.
• To record and manage interactions for consistent and appropriate support and ensure continuity of care.
• To register you for programmes, activities or services and to manage your participation.
• To understand and tailor our support to your needs.
• To safeguard children, young people, and adults at risk, including identifying and responding to safeguarding concerns and, where necessary, making referrals to statutory agencies.
• To monitor, evaluate, and improve our services and programmes, including evaluations commissioned by funders.
• To evidence the impact of our work to funders and commissioners, usually using aggregated or pseudonymised data and only identifying individuals where necessary and lawful.
• To carry out research, insight, and service-improvement activities, with appropriate ethical and data protection safeguards in place.

Our Lawful Bases (Article 6 UK GDPR)
• Legitimate Interests (Art 6(1)(f)) – our primary basis for delivery of our services and support.
• Vital Interests (Art 6(1)(d)) – for safeguarding, where processing is necessary to protect someone’s life or prevent serious harm.
• Consent (Art 6(1)(a)) – for optional activities such as certain participation opportunities, recordings/photography, case studies, surveys or where required by law for specific communications. We also rely on your consent to share your information with other organisations (Patient and Public Involvement and Engagement) if you wish to contribute to their research.

Special Category Data (Article 9 UK GDPR)
Where we process special category data (e.g., health, ethnicity, beliefs, sexuality) or criminal offence data, we do
so only where strictly necessary and with additional safeguards. Our typical conditions include:
• Substantial Public Interest – safeguarding of children and individuals at risk (Art 9(2)(g) and Data Protection Act 2018, Sch. 1, para 18), and where applicable, supporting individuals with a medical condition or providing counselling and support.
• Vital Interests (Art 9(2)(c)) – where the individual is incapable of giving consent and processing is necessary to protect life.
• Not‑for‑profit bodies with appropriate safeguards (Art 9(2)(d)) – for members/participants in our activities, where data is not disclosed outside without consent.
• Scientific or historical research or statistical purposes (Art 9(2)(j)) – for research/evaluation with suitable safeguards and, where required, ethical review.
• Explicit Consent (Art 9 (2)(a)- for processing dietary requirements or any other optional EDI information.

Who We Share Data With
• Independent evaluators and research partners – under contracts and approved protocols.
• With organisations under our patient and public involvement and engagement work, if we have your consent.
• In instances of safeguarding, we will share your information with Authorities on the basis of legitimate interest.

Research and Evaluation Ethics
We apply proportionate ethical review and safeguarding measures for research and evaluation. We only use anonymised data for research.

Lupus UK processes personal data in connection with its grant-making activities. This includes data about grant applicants, individuals on our grants mailing list, members of our expert medical panel and people with lived experience who support our grants programme.

What Personal Data We Collect
Depending on your involvement, we may collect:
• Grant applicants: Names, contact details, organisational details, role or position, application information, supporting documents, and communication about the application.
• Mailing list subscribers (grants updates): Name, email address, and preferences relating to grants communications.
• Expert medical panel members: Name, professional role, qualifications, area of expertise, contact details,
declarations of interest, and feedback or assessments provided as part of the grants review process.
• Lived experience members: Name, contact details, and information about lived experience of lupus that
is shared to support grant assessment or engagement activities.

How We Use Your Personal Data
We use personal data to:
• Administer and manage our grants programme.
• Receive, assess and make decisions on grant applications.
• Communicate with applicants about their application and outcomes.
• Maintain a mailing list for grants-related updates and opportunities.
• Seek expert advice and input from medical professionals and people with lived experience to inform funding decisions.
• Meet legal, regulatory, and good-governance requirements including record keeping and reporting.

Our Lawful Bases
Under UK GDPR, we rely on the following lawful bases:
• Legitimate interests – for administering and managing the grants programme, assessing applications and involving appropriate experts and lived experience members in decision-making.
• Consent – where you sign up to receive grants related communications.
• Legal obligation – where processing is necessary to meet charity law, accounting, or regulatory requirements.

Who We Share Your Data With
We may share personal data with:
• Members of our expert medical panel and lived experience contributors, for the purpose of reviewing and advising on grant applications.
• Trusted contractors or professional advisers who support the administration of our grants programme, under appropriate data protection agreements.
• Regulators, auditors, or funders, where required or appropriate usually using anonymised or aggregated information.

This appendix explains how we process personal data for job applicants, employees, workers, contractors,
consultants and volunteers or trustees.

How We Collect Your Information
• Directly from you during recruitment and onboarding, and during your engagement with us.
• From agencies and referees (with your knowledge).
• From pre‑employment screening such as right‑to‑work, risk assessments and DBS where applicable.
• From internal systems (e.g., HR, payroll, learning and development).

What Personal Data We Collect
• Personal details and contact information.
• Application, CV and interview information; references; employment history and qualifications, due diligence checks
• Contract terms, job role, pay/fees, benefits, working time, leave and absence, performance and supervision records, disciplinary and grievance records, training records.
• Next of kin and emergency contacts.
• Right to work, risk assessments, DBS where applicable, and other compliance records.
• Special category data (where necessary) – health/occupational health information (e.g., reasonable adjustments), and equality, diversity and inclusion data provided voluntarily.

How We Use HR Data (Purposes and Lawful Bases)
• To recruit and onboard staff, volunteers and trustees – Contract (Art 6(1)(b)) and Legitimate Interests (Art 6(1)(f)).
• To administer employment/engagement – Contract (Art 6(1)(b)).
• To meet legal obligations – Legal Obligation (Art 6(1)(c)) (e.g., HMRC, right‑to‑work, health & safety).
• To manage performance, supervision, learning and development, security and IT systems – Legitimate Interests(Art 6(1)(f)).
• Special category data – Art 9(2)(b) employment and social protection law; Art 9(2)(g) substantial public interest (e.g., equality monitoring under Schedule 1 conditions); occupational health; and where appropriate, explicit consent.
• To use photographs on the organizational website or platforms – Consent.
• Criminal offence data – Art 9(2)(g) Substantial Public Interest, handled in line with law and safeguarding or prevention of crime (e.g., DBS).

Who We Share Your Data With
• Payroll, pension, HR and benefits providers (processors).
• Regulators and statutory bodies (e.g., HMRC, Home Office).
• Occupational health and wellbeing providers.
• IT service providers.
• Professional advisers and insurers where necessary.

This appendix explains how we process personal data for fundraising and marketing, including individual giving, major donors, corporate partnerships, trusts and foundations, events, and supporter communications as well people who sign up for a membership with our organization or to receive our newsletter.

What We Collect
• Identity and contact data; communication preferences.
• On donors: Donation history, Gift Aid status, event registrations and attendance.
• Marketing subjects: Engagement information (e.g., email opens/clicks), where permitted.
• Donors and Members: Payment information processed securely by our payment service providers; we do not store full card details.
• Event Attendees: Dietary information.

How We Use Supporter Data
• To process and acknowledge donations and manage Gift Aid.
• To manage events and volunteering opportunities.
• To share our resources if you have signed up to receive them.
• To send you marketing about our work, newsletter and ways to support us, in line with your preferences and PECR.
• To comply with legal and regulatory requirements and prevent fraud.

Lawful Bases (Fundraising & Marketing)
• Consent (Art 6(1)(a)) – for email marketing or text messages to individuals where required by PECR.
• Legitimate Interests (Art 6(1)(f)) – for postal or telephone marketing, or soft opt-in related email communications when you have expressed an interest.
• Contract (Art 6(1)(b)) – to administer membership or event bookings.
• Legal Obligation (Art 6(1)(c)) – for Gift Aid and financial record‑keeping.

Who We Share Supporter Data With
• Payment processors and fundraising platforms (as independent controllers).
• Regulators (e.g., HMRC for Gift Aid) and auditors where required by law.
• Event partners and venues where necessary for attendance and safety.

If you are unhappy with how we handle your personal data, you have the right to raise a complaint with us.
You can contact us by:

• Email: [email protected]
• Telephone: 02081 830 651
• Post: LUPUS UK, The Finsbury Business Centre, 40 Bowling Green Lane, Clerkenwell, London, EC1R 0NE

Please provide:
• Your name and contact details
• A clear description of your concern
• Any relevant dates or reference numbers

What Happens Next?
1. We will acknowledge your complaint within 30 days of receiving it.
2. We will investigate your concerns.
3. We may contact you if we need further information.
4. We will respond as soon as possible and without undue delay.

Our response will explain:
• What we have found
• Whether any action has been taken
• What happens next

If You Are Not Satisfied
If you remain unhappy with our response, you have the right to complain to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk

Accessibility
If you require this information in an alternative format, please contact us and we will be happy to assist