The Multiple Sclerosis Trust’s privacy policy

At The MS Trust, we're committed to protecting and respecting your privacy.

This policy explains when and why we collect personal information about you, how we use it, the conditions under which we may disclose it to others, how we keep it safe and secure and your rights and choices in relation to your information.

In this policy ‘the Multiple Sclerosis Trust’, 'MS Trust', ‘we’, ‘us’ or ‘our’ means: the Multiple Sclerosis Trust and our education and trading companies (MS Trust (Education) Limited and MS Trust (Trading) Limited). The MS Trust is registered with the Information Commissioner's Office under the Act as a Data Controller (Z5773463B).

Usually, the MS Trust will be the 'controller' of your personal information. This means that we are responsible for deciding how your personal information is used and ensuring that it is used in compliance with applicable data protection law (in conjunction with other parties, where applicable).

If one of our subsidiaries (or another entity) is the relevant controller, this will be explained where appropriate. In this regard: MS Trust (Education) Limited MS Trust (Trading) Limited.

This Privacy Policy applies to our supporters, our customers and those individuals who call our helpline as well as the public who may have reason to contact us.

We obtain information about you in the following ways:

• independent event organisers, for example the London Marathon and fundraising sites like JustGiving or Charities Aid Foundation
• professional fundraisers
• subcontractors acting on our behalf who provide us with technical, payment or delivery services, our business partners, advertising networks analytics providers and search information providers
• Referrals made to us from another organisation or individual, such as your GP

You should always check any privacy policy provided by a third party if you plan to share your data with them.

We may supplement information on our supporters with information from publicly available sources such as annual reviews, corporate websites, public social media accounts, the electoral register, Mint UK, Google and Companies House in order to create a fuller understanding of someone’s interests and support. For more information, please see the section on ‘Building Profiles’ below.

We may obtain information about you when you order products and services from us (such as publications and newsletters), use our services, (e.g. by contacting our helpline), make a donation to us, fundraise on our behalf, attend one of our events, purchase or download products from our online shop, volunteer with us, provide personal stories, quotes and images or otherwise give us personal information.

We, like many organisations, collect the following information: 

• technical information, including the type of device you’re using, the IP address, browser and operating system being used to connect your computer to the internet. This information may be used to improve the services we offer
• information about your visit to this website. For example, we collect information about pages you visit and how you navigate the website i.e. the length of your visit to certain pages, products and services you viewed and searched for referral sources (e.g. how you arrived at our website)
• we collect and use your personal information by using cookies on our website. Some of these cookies can be enabled/disabled by selecting your preferences in the preference centre when first interacting with this site. You can read our Cookie Policy.

The purposes for which we use your information may depend on the relationship you have with the MS Trust and/or our trading subsidiaries. We may use your information for a number of different purposes, which may include:

• providing you with the services, products or information you asked for
• processing orders that you have submitted
• carrying out our obligations under any contracts entered into between you and us
• keeping a record of your relationship with us
• to administer your donation or support your fundraising, including processing Gift Aid
• responding to or fulfilling any requests, complaints or queries you make to us
• conducting analysis and market research to better understand how we can improve our services, products or information
• to help us understand the demographic of the people who use our services and apply for funding
• monitoring the interactions we have with our customers, donors and beneficiaries for quality control and compliance purposes to ensure we are delivering the service we and our regulators expect 
• checking information we have collected, online and offline, about you against third party sources, so we can ensure that the information we hold about you is up to date and accurate 
• to monitor website-use to identify visitor location, guard against disruptive use, monitor website traffic, personalise information which is presented to you and/or to provide you with targeted advertisements
• seeking your views or comments on the services we provide or your views on issues affecting people living with MS
• notifying you of changes to our services
• sending you communications which you have requested and that may be of interest to you. These may include information about campaigns, fundraising appeals and activities and promotions of goods and services
• using personal stories, images and personal information you have supplied across our media channels to support, promote or advertise the MS Trust’s aims
• communicating with you about the fundraising events you have signed-up for to help us raise important funds for our charitable work
• administering a legacy. Where the charity is potentially the beneficiary of a legacy, we will obtain the names and contact details of executors, a copy of the will, and a grant of probate
• checking donation payments for the purposes of prevention of fraud or other crime
• processing grant or job and volunteer applications

We may analyse your personal information to create a profile of your interests and preferences so that we can tailor and target our communications in a way that is timely and relevant to you. We may make use of additional information about you when it is available from external sources to help us do this effectively. This allows us to be more focused, efficient, and cost effective with our resources and also reduces the risk of someone receiving information they may find inappropriate or irrelevant.

We're committed to putting you in control of your data so you’re free to opt out of your information being used in this way at any time by contacting privacy@mstrust.org.uk.

We advertise on Facebook and Google as well as some other online platforms such as Instagram. We also place adverts on other websites to promote general awareness of the MS Trust, our fundraising and products and services that we offer. We do this by:

1. Advertising on particular types of websites - for example newspapers and magazines' websites
2. Advertising to people signed up with an online platform (such as Facebook or Google) based on what the platform knows about them

We may use the following re-marketing processes on some or all of specific online platforms:

1. 'Look-alike' / 'similar' audiences: we send a list of 'hashed' email addresses to an online platform such as Facebook or Google (hashing is a security measure whereby the personal information is turned into a code)
2. 'Custom audiences'/ 'customer matches': we use a similar method as above to send information and support about our fundraising campaigns/ marketing campaigns to people who have supported us in the past
3. 'Saved' audiences to remember which supporters on Facebook are most likely to respond to our fundraising, campaigning, and marketing requests
4. Tracking people's interactions with our adverts so that we know when an individual has clicked on an advert. This allows us to measure the effectiveness of our campaigns

In some of the above instances, this means that if you have already visited our website, we can direct you back to it through ads shown on sites you visit across the internet by third party vendors. These third-party vendors include Google and Facebook. All parties may use cookies to serve these ads based on your past visits to our website.

You can object to your information being used by choosing not to opt into marketing cookies on our preference centre that you will see when you visit the website. You can read our Cookie Policy.

You can read our full Data Protection Policy. To request a copy, please email privacy@mstrust.org.uk.

We will never sell or rent your information to third parties for marketing purposes. 

We may disclose your information to third parties in connection with the other purposes set out in this policy. These third parties may include:

• business partners, suppliers and sub-contractors who may process information on our behalf
• if you are a legacy giver, we may share information with co-beneficiaries
• advertisers, social media platforms and advertising networks
• analytics and search engine providers
• IT service providers

We may also share information with our financial and legal advisers for the purposes of obtaining advice and protecting our legal rights.

Where we are under a legal or regulatory duty to do so, we may disclose your details to the police and regulatory bodies for example if we are following our safeguarding policy and are concerned that you are at risk of immediate harm. 

We reserve the right to disclose your personal information to third parties:

• if we sell or buy any business or assets, in which case we may disclose your personal information to the prospective seller or buyer of such business or assets
• if substantially all our assets are acquired by a third party, personal information held by us may be one of the transferred assets

Under UK data protection law, you have rights over personal information that we hold about you. These are summarised these below:

• Right to access your personal information
  • You have a right to request access to the personal data that we hold about you. You also have the right to request a copy of the information we hold about you, and we will provide you with this unless legal exceptions apply.
• Right to have your inaccurate personal information corrected
  • You have the right to have inaccurate or incomplete information we hold about you corrected. If you believe the information we hold about you is inaccurate or incomplete, please provide us with details and we will investigate and, where applicable, correct any inaccuracies.
• Right to restrict use of your personal information
  • You have a right to ask us to restrict the processing of some or all of your personal information in the following situations: if some information we hold on you isn't right, if we're not lawfully allowed to use it, if you need us to retain your information in order for you to establish, exercise or defend a legal claim, or if you believe your privacy rights outweigh our legitimate interests to use your information for a particular purpose and you have objected to us doing so.
• Right to erasure of your personal information
  • You may ask us to delete some or all of your personal information and in certain cases, and subject to certain exceptions, you have the right for this to be done. If we are unable to delete your information, we will explain why this is the case. 
• Right for your personal information to be portable
  • If we are processing your personal information (1) based on your consent, or in order to enter into or carry out a contract with you, and (2) the processing is being done by automated means, then you may ask us to provide it to you or another service provider in a machine-readable format.
• Right to object to the use of your personal information
  • If we are processing your personal information for direct marketing purposes, and you wish to object, we will stop processing your information for these purposes as soon as reasonably possible
  • If you want to exercise any of the above rights, please contact us. You can request access to any information we hold about you by contacting the Data Protection lead at MS Trust, Spirella Building, Bridge Road, Letchworth Garden City SG6 4ET, by emailing privacy@mstrust.org.uk, or by phoning 01462 476700
  • We may be required to ask for further information and/or evidence of identity. We will endeavour to respond fully to all requests within one month of receipt of your request, however if we are unable to do so we will contact you with reasons for the delay
  • Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances 
  • For more details we recommend you consult the guidance published by the UK's Information Commissioner's Office (ICO).

We want to communicate with you, in a way that suits you. Our forms have clear marketing preference questions with options to opt in and we include information on how to opt out when we send you marketing. If you don’t want to hear from us, that’s fine, and you can change your preferences at any time. Just let us know when you provide your data or contact us at MS Trust, Spirella Building, Bridge Road, Letchworth Garden City SG6 4ET, email hello@mstrust.org.uk, or alternatively, you can telephone 01462 476700.

As a charity which supports people with MS, we will ensure that we use any sensitive information you provide to us in an appropriate way. We will:

• ensure that access to sensitive personal data disclosed through using a service (such as our helpline) or through providing insight or personal stories is limited to staff involved in the service or activity provision.
• keep information that is recorded by our helpline for a period of 6 years (or 6 months in the case of recordings of phone calls to the helpline) unless you let us know you do not want us to keep this data. This may include special category data such as health information 
• record information regarding the nature of your enquiry for statistical purposes, such as whether it related to diagnosis, drugs, symptoms, care etc.
• not record identifiable information that relates to a third party, given during any conversation. In other words, if you talk to us about a specific person who has MS, but we do not have their permission, we will not record detailed information about them if you choose to disclose your link to MS eg that you live with MS or that you have a family member with MS we may use this information to tailor our communications to you and we will record this information alongside other personal data that we hold.

• At the MS Trust we produce a wide range of materials to support people affected by MS, to tell them about our services, to promote events and for fundraising purposes. To make these materials interesting, we use photographic images (moving and still) personal stories and insight from people with lived experience of the issues covered.
• We only use one to one interview images and videos with the explicit consent of the people involved (or their parents / guardians if they are under 16).
• Photographs and video taken at MS Trust events will be held and used by the MS Trust without seeking individual permissions. Clear signage will be used at all MS Trust events to ensure that participants are aware of this and are able to tell us if they do not want to be included.
• When we are filming and taking photographs in public spaces, we will try to make it clear that we are doing so as a matter of courtesy. You can ask us not to use or to remove any images that we take that have you in.
• Please tell us if we use your image and you no longer want us to do so. We will stop all future use of the image and remove it from our website. If it has been used in a publication, we will not be able to remove it from existing print copies but will ensure it is removed from future versions
• The copyright of any material which is generated because of a photographic session with the MS Trust shall be the property of MS Trust.

Data protection laws mean we must have a “legal basis” every time that we make use of your personal information. The relevant legal bases are set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK data protection legislation.

Consent is where we ask you if we can use your information in a certain way, and you agree to this (for example when we send you marketing material via post or e-mail). Where we use your information for a purpose based on consent, you have the right to withdraw consent for any future use of your information for this purpose at any time.

We have a basis to use your personal information where we need to do so to comply with one of our legal or regulatory obligations. For example, in some cases we may need to share your information with our various regulators such as the Charity Commission, Fundraising Regulator, Information Commissioner.

We have a basis to use your personal information where we are entering into a contract with you or performing our obligations under that contract. Examples of this would include if you are buying something from us (for instance some branded merchandise or an event place), applying to work/volunteer with us.

We have a basis to use your personal information where it is necessary for us to protect life or health. For instance, if there were to be an emergency impacting individuals at one of our events, or a safeguarding issue which required us to contact people unexpectedly or share their information with emergency services.

We have a basis to use your personal information if it is reasonably necessary for us (or others) to do so and in our/their “legitimate interests” (if what the information is used for is fair and does not unduly impact your rights).

We consider our legitimate interests to include all day-to-day activities MS Trust carries out with personal information. Some examples not mentioned under the other bases above where we are relying on legitimate interests are:

• analysis and profiling of our supporters or potential supporters
• updating your address using third party sources if you have moved house
• use of personal information to administer, review and keep an internal record of the people we work with, including supporters, volunteers, and researchers

When we rely on legitimate interests we always consider our (or others’) interests alongside any potential impact that processing your information may have on you (both positive or negative), your rights under data protection laws, and how intrusive the processing of your information in this way may be.

We consider various criteria when determining the appropriate retention period for personal data including: 

• the purposes for which we process your personal data and how long we need to keep the data to achieve these purposes
• how long personal data is likely to remain accurate and up to date
• for how long the personal data might be relevant to possible future legal claims
• any applicable legal, accounting, reporting or regulatory requirements which specify how long certain records must be kept

• MS Trust ensures that there are appropriate technical and organisational controls (including physical, electronic, and managerial measures) in place to protect your personal details
• Some of our suppliers run their operations outside the United Kingdom, including within the European Economic Area (EEA). This includes countries which do not have the same data protection laws as in the UK. In these circumstances, we will make sure they provide an adequate level of protection in accordance with UK data protection law and confirm that appropriate safeguards are in place

This covers the MS Trust Facebook page (and other social media), our Facebook Group, our health professional community, our discord community and comments and contributions on pages of the MS Trust website.

When you post personal information on any of our social media platforms or other messaging boards on our website, your information is publicly accessible. Such information can be viewed online and collected by third parties. We are not responsible for the use of information by such third parties.

When contributing to a discussion we strongly recommend you avoid sharing any personal information that can be used to identify you (such as your name, age, address or name of employer). We are not responsible for the privacy of any identifiable information that you post in our online community.

We will follow our Safeguarding Policy if we are concerned that you are at risk of harm including contacting external site moderators or the emergency services.

If you're under 16, you must get your parent/guardian’s permission before you provide any personal information to the MS Trust including images and personal stories. If we have permission to hold your data from your parent / guardian we will confirm that you are still happy for us to hold this data when you reach 16. If you're a young person living with or affected by MS, we have a section on our website with MS information you may be interested in.

We keep this policy under regular review, and we update it to reflect changes in the data protection law. This policy was last updated in February 2022.

If you have any questions about how we capture, store and use your personal information, please contact our Data Protection lead at MS Trust, Spirella Building, Bridge Road, Letchworth Garden City SG6 4ET, by emailing privacy@mstrust.org.uk, or alternatively, you can  telephone 01462 476700.

If you think we may have made a mistake in our work relating to your personal details or indeed any other aspect of our work and want to complain to us, please read our complaints procedure.

You also have the right to lodge a complaint about any use of your information with the Information Commissioners Office, the UK data protection regulator.