Privacy policy

Money Ready is committed to protecting your personal information and being transparent about what information we hold, whether you are a donor, volunteer, or young person who we support.

Developing a better understanding of our supporters through their personal information allows us to fundraise more efficiently, which ultimately helps us support more young people. Information from service users helps us to improve the programmes and tailor the service to the need of the individual.

This Privacy Policy applies to visitors of our website (https://moneyready.org/) and to other individuals we interact with in the course of providing our charitable activities, including service users of Money Ready projects, programmes and events, as well as other donors, fundraisers, supporters, and volunteers (together the “Activities“). The purpose of this policy is to give you a clear explanation about how Money Ready collects and uses the personal information you provide to us.

For the purposes of this policy, “personal information” is any information that relates to you and/or information from which you can be identified, directly or indirectly which is processed by Money Ready. Please see the section titled “What personal information do we collect about you?” for further details about the types of information we collect.

Who are we?

Money Ready (formerly MyBnk) is a registered charity in England and Wales (No. 1123791) and Scotland (SC050175) and a company limited by guarantee (No. 6215005). Our registered address is 40 Gracechurch Street, London EC3V 0BT, UK. All references in this policy to “our”, “us” or “we” refer to Money Ready.

How can I contact Money Ready?

We are a data controller, which means that we are responsible for, and control the processing of, your personal information. If you have any questions about this policy or want to exercise your rights as a data subject set out in this policy, you can send us an email at [email protected] or write to us at The Data Protection Officer, Money Ready, 40 Gracechurch Street, London EC3V 0BT, UK.

What personal information do we collect about you?

In the course of our Activities, we may collect and process different types of personal information about you for different processing purposes. The types of personal information we collect depends on who you are and how you interact with us. We have grouped the types of personal information which we may collect, store, transfer and about you in the table below, as follows:

Identity Data includes: legal first name and last name, title, date of birth and gender.
Contact Data includes: email address, postal address, telephone numbers, billing address (if making a donation), and communication preferences.
Health Data includes: information about your health and any medical conditions or disabilities you may have.
Criminal Convictions Data includes: DBS certificates (where required to volunteer with us)
Financial Data includes if you are a taxpayer to help us claim gift aid.
Technical Data includes: your IP address and general processing or monitoring data for performance and technical purposes.
Usage Data includes: information about how you use our website and services.
Marketing and Communications Data includes: your preferences in receiving marketing from us and our third parties and your communication preferences.

We do not collect special categories of personal data about our supporters or service users unless there is a clear reason for doing so, for example, relating to your health if you are visiting The Money House or another workshop or taking part in a challenge event to raise funds for us. We will only collect and use that sensitive personal data with consent or where we have a legal obligation, and clear notices will be provided on applications for events and other relevant forms and communications, so you know what information we need and why we need it. You can withdraw your consent at any time. Please see the section titled “Your Rights” for further details.

How do we collect your personal information?

We collect personal information about you:

a. When you give it to us directly. This could be when you:

Ask about our activities, resources or training;
Register with us for information;
Use our services or attend our programmes, workshops or other activities;
Sign up for publications or newsletters;
Volunteer or fundraise for us;
Pledge or make a donation or sign up for an event;
Sign up to become a member of our Youth Advisory Panel;
Give us feedback or complete a survey;
Telephone, write, contact us online or text us or otherwise provide us with your personal information;

b. When you visit our website. We and our third-party partners use cookies, web beacons, pixel tags, other similar technologies, and other types of tracking technologies (all of which we generically refer to as “Cookies”) to collect data from the devices that you use to access our website and any emails that you receive from us. We use cookies to monitor how well our website is performing, this might include analysing which pages you visit most often and which services, events or information is of most interest to you. We may also track which pages you visit when you click on links in emails from us. We also use ‘cookies’ to help our site run effectively. See our Cookies Policy for more details.

c. When you interact with us through third parties: This could be if you provide a donation through a third party or one of the other third parties that we work with. This is only if you consent for your personal information to be shared with us.

d. When we collect it through publicly available sources: From time to time, we may collect personal information about you that is contained in publicly available sources (including open source data sets or media reports) or that you or a third party may otherwise make publicly available (for example through publishing articles or other news stories or posts on social media platforms). This information is used to help us identify those who may be able to help us with a larger gift.

How do we use your personal information?

We have set out in the table below, a description of all the ways we plan to use your personal information, and which legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Purpose or activity	Type of Data	Lawful basis for processing
To register you as interested in information regarding Money Ready.	Identity Contact	Performance of a contract with you Legitimate interests – to grow our charity by offering services to more individuals.
To send you relevant marketing and fundraising communications	Identity Contact Marketing and Communications	It is in our legitimate interest to use your personal information for marketing purposes, for example to decide what marketing content we think may appeal to you. It is in our legitimate interest to use your personal data to send our marketing to you by post. However, we will only send marketing communications to you by email where you have consented to receive such content by email, or where we have another lawful right to send marketing to you using email. For example, in certain circumstances we may rely on our legitimate interest to send marketing by email to individuals who we have an existing relationship with. We may also rely on our legitimate interest to send marketing by email to certain business users we interact with through our Activities. You can opt out of our marketing and fundraising communications at any time and you can opt out of your data being used for profiling and wealth screening techniques by contacting using the details set out at the start of this Privacy Policy.
To register you as a service user and to operate and administrate the services which we provide to you, including our programmes, workshops or other events	Identity Contact	Performance of a contract with you Legitimate interests – to grow our charity by offering services to individuals
To provide appropriate facilities or support during programmes, workshops or other events	Health	Consent Compliance with our legal obligations
To register you as a new volunteer or fundraiser and to administer the volunteering or fundraising arrangement	Identity Contact Criminal Convictions Data	Performance of a contract with you Legitimate interests – to grow our charity by increasing the number of volunteers who can assist with our projects and fundraisers to enable us to fundraise effectively We will not process any Criminal Convictions Data except where we are able to do so under applicable legislation or with your explicit consent.
To process your donations or other payments and to claim Gift Aid on your donations and verify any financial transactions	Identity Contact Financial Marketing and Communications	Performance of a contract with you Legitimate interests – to grow our charity by enabling us to fundraise effectively
To update you with important administrative messages about your donation, an event or services you have requested	Identity Contact	Legitimate interests – to grow our charity by assisting and communicating effectively with our service users
To improve our marketing and fundraising and measure or understand the effectiveness of our marketing we send to you, including by profiling and wealth screening techniques	Identity Contact Marketing and Communications	Legitimate interests – to grow our charity by enabling us to fundraise effectively
To manage our relationship with you including: Notifying you about changes to our Privacy Policy Surveys or providing feedback on your experience	Identity Contact Marketing and Communications	Performance of a contract with you Legitimate interests – to keep our records updated and to study how service users use our services
To operate and administer the Youth Advisory Panel	Identity Contact	Legitimate interests – to understand how young people use and need our services
To administer and protect our charity and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	Identity Contact Technical	Legitimate interests – for running our charity, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise Legal obligation
To use data analytics to improve our services, relationships and experiences	Technical Usage	Legitimate interests – to understand our user demographic, preferences and behaviours so we can improve the relevance and grow Money Ready
To comply with the Fundraising Regulator’s Code of Fundraising Practice and the Charities (Protection and Social Investment) Act 2016 (as amended from time to time) and follow the recommendations of the official regulator of charities, the Charity Commission, which requires us to identify and verify the identity of supporters who make major gifts so we can assess any risks associated with accepting their donations.	Identity Contact	Legal obligation
(i)To comply with our legal obligations; (ii) to enforce our legal rights; (iii) to protect the rights of third parties; and (iv) in connection with a business transition such as a merger, reorganisation, acquisition by another charity or company, or sale of any of our assets.	Any personal information we hold about you	Where we use your personal information in connection with a business transition, to enforce our legal rights or to protect the rights of third parties, it is in our legitimate interest to do so. For all other purposes described in this section, we have a legal obligation to use your personal information to comply with any legal obligations imposed upon us, such as a court order.

Your debit and credit card information

If you use your credit or debit card to donate to us, buy something or pay for a registration online or over the phone, we will ensure that this is done securely and in accordance with the Payment Card Industry Data Security Standard. You can find out more information about PCI DSS here – www.pcisecuritystandards.org/security_standards/index.php.

All donations we receive are currently processed by secure third-party partners such as Donorbox, Enthuse.com and JustGiving.

In each case we do not receive your credit or debit card details at all, following the completion of your transaction. Please review the Privacy Policies of these third parties should you wish to know how they manage your personal information.

If we receive an email containing any credit or debit card details, it will be immediately deleted, no payment will be taken and you will be notified about this.

Links to other websites

Money Ready’s website contains some links to other websites that we think you might find interesting. However, please bear in mind that once you leave our website we cannot be responsible for the protection and privacy of any information that you might provide elsewhere, and that other websites are not governed by this privacy notice. Always be careful and make sure you read the privacy notice or statement of the website in question before giving out any information.

Children and vulnerable persons

We place great importance on the safety of vulnerable persons. See a copy of our Safeguarding Children and Vulnerable Adults policy here.

We are committed to protecting the privacy of young people who want to fundraise for us or who are supported by Money Ready.

Our activities and fundraising events may request specific information about the age of participants. Where appropriate we will seek the consent from a parent, guardian or carer before collecting information about young people under 16.

How long we keep your personal information for

We keep your personal information only for as long as required for us to operate the relevant service or carry out our Activities in accordance with legal requirements and tax and accounting rules. Where your information is no longer required, we will ensure it is disposed of in a secure manner. If you have any questions or need more information regarding data retention, please contact us using the details set out at the start of this Privacy Policy. If any personal information is only useful for a short period (e.g. for a specific activity, promotion or marketing campaign), we will not retain it for longer than the period for which it is used by us.

If you have opted out of receiving marketing communications from us, we will need to retain certain personal data on a suppression list indefinitely so that we know not to send you further marketing communications in the future. However, we will not use this personal information to send you further marketing unless you subsequently opt back in to receive such marketing.

Your Rights

You can help us keep our records up to date by telling us when your contact details and other personal information change.

You have the following rights under data protection laws in relation to your personal information:

Right of access. You have a right of access to any personal information we hold about you. You can ask us for a copy of your personal information; confirmation as to whether your personal information is being used by us; details about how and why it is being used.
Right to update your information. You have a right to request an update to any of your personal information which is out of date or incorrect.
Right to delete your information. You have a right to ask us to delete any personal information which we are holding about you in certain specific circumstances. You can ask us for further information on these specific circumstances by contacting us using the details below.
Right to restrict use of your information. You have a right to ask us to restrict the way that we process your personal information in certain specific circumstances. You can ask us for further information on these specific circumstances by contacting us using the details below.
Right to data portability. You have a right to ask us to provide your personal information to a third party provider of services.
Right to object. You have a right to ask us to consider any valid objections which you have to our use of your personal information where we process your personal information on the basis of our or another person’s legitimate interest. You also have the right to object where we are processing your personal information for direct marketing purposes.
Right to withdraw consent. If you have given us your consent (or explicit consent) to use personal information (for example, for marketing or for the collection of health data), you can withdraw your consent at any time by contacting using the details below.
Should you wish to exercise these rights we may require you to prove your identity with a copy of a valid means of identification in order for us to comply with our security obligations and to prevent unauthorized disclosure of data. Please address requests using the contact details set out at the start of this privacy policy.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. Please provide as much information as possible about the nature of your contact with us to help us locate your records.

Complaints

If you have any concerns about our use of your personal information, you can make a complaint to us in writing using the contact details at the start of this Privacy Policy. You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues. The ICO can be contacted at its address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or by telephone at: 0303 123 1113. You can read more about your rights on the ICO website here: https://ico.org.uk/.

Sharing your personal information

We promise to make all reasonable efforts to keep your details secure and will only share them with:

third parties where we have a duty or are permitted to disclose your personal information by law (for example, to comply with applicable laws, regulations and codes of practice or in response to a valid request from a competent authority);
third party fulfilment partners with whom we have a data sharing agreement with to help deliver our services (for example, fulfilment partners who help to create and send information to you regarding platforms that we use to process donations and claim Gift Aid);
payment processing platforms such as Donorbox, Enthuse and JustGiving;
third party service providers (for example, legal advisors, accountants, and information security advisors);
any person you have asked us to share information with; or
third-party service providers that are assisting us with the operation and administration of events that we are running. If we are running an event in partnership with other organisations, we will share your personal data with such organisations for use in relation to the event.

Where we may transfer your personal information

Your personal information may be used, stored and/or accessed by staff operating outside the UK or the EEA working for our suppliers. Further details about who your personal information may be disclosed to are set out above.

If we provide any personal information about you to any such non-UK and non-EEA or suppliers, we will take appropriate measures to ensure that the recipient protects your personal information adequately in accordance with this privacy policy. These measures may include the following:

ensuring that there is an adequacy decision by the UK Government in the case of transfers out of the UK, or by the European Commission in the case of transfers out of the EEA, which means that the recipient country is deemed to provide adequate protection for such personal data. For further details see: https://www.gov.uk/government/publications/uk-approach-to-international-data-transfers/international-data-transfers-building-trust-delivering-growth-and-firing-up-innovation; or
where we have in place standard contractual arrangements with the recipient which have been approved by the UK Government for transfers out of the UK or the European Commission for transfers out of the EEA. These model contractual clauses include certain safeguards to protect the personal data. For further details see: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-data-transfer-agreement-and-guidance/.

If you have any questions or need more information regarding international transfers of your personal data, please contact us using the contact details set out at the start of this Privacy Policy.

Changes to this privacy policy

We may update the terms of this policy at any time, so please do check it from time to time. We will notify you about significant changes in the way we treat personal information by sending a notice to the primary email address you have provided to us or by placing a prominent notice on our website.