Privacy statement | Fight for Sight

Introduction and general terms

Fight for Sight always endeavours to take great care with your personal data and we commit to protecting any personal information we obtain about you, whether you are a fundraising supporter, researcher, a recipient of our e-newsletters or if you follow us on social media.

This Privacy and Fair Processing Notice (“Privacy Notice”) sets out how and why we obtain, use and protect personal information if you interact with us in one of these roles.

Who we are

In this Privacy Notice, “Fight for Sight”, “we” or “our” means:

I. British Eye Research Foundation, trading as Fight for Sight, a company limited by guarantee registered in England (Company Number 05525503) and a charity registered in England by the Charity Commission for England and Wales (Charity Number 1111438) whose registered office is located at 18 Mansell Street, London, E1 8AA.

II. The Iris Fund for the Prevention of Blindness, a company limited by guarantee registered in England (Company Number 1929733) and a charity registered in England by the Charity Commission for England and Wales (Charity Number 293204) whose registered office is located at 18 Mansell Street, London, E1 8AA.

III. Eye Research UK, a company limited by guarantee registered in England (Company Number 4424695) and a charity registered in England by the Charity Commission for England and Wales (Charity Number 1091829) whose registered office is located at 18 Mansell Street, London, E1 8AA.

IV. Fight for Sight Trading Limited (Company Number 2389071) whose registered office is located at 18 Mansell Street, London, E1 8AA.

We are a Data Controller, registered with the Information Commissioner’s Office (Registration Number Z9323113).

This Privacy Policy applies to all information which is obtained and processed by Fight for Sight and for which Fight for Sight is the Data Controller.

What we do

Fight for Sight’s purpose and overall vision is to create a future everyone can see. To achieve this, we fund pioneering eye research to improve the prevention and treatment of sight loss.

Developing a better understanding of our supporters through their personal data allows us to make better decisions, fundraise more efficiently and, ultimately helps us to reach our vision. More importantly, it helps us to communicate with our supporters on a level they are comfortable with.

About this notice

Your personal information (such as your name and contact details, known as ‘personal data’) is protected by specific legislation:

General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679)
The Data Protection Act 2018
Privacy and Electronic Communications (EC Directive) 2003

The laws in this area continue to develop quickly. We take our responsibilities around personal data very seriously, and it’s essential that you understand how and why we ask for and use your details. Your privacy is important to us and we have policies to ensure that we collect only the data that we need to effectively carry out our business and that we don’t keep it any longer than we need to.

This policy explains how we collect, manage, use and protect your personal data, including how we work with third parties. We never sell or swap your details with any other organisation for their marketing purposes.

If you would like more information on anything in this Privacy Notice, please do get in touch with our Supporter Care Team.

Email: supportercare@fightforsight.org.uk
Telephone: 020 7264 3900
Post: Supporter Care, Fight for Sight, 18 Mansell Street, London, E1 8AA

Understanding your rights

It is important that you understand your legal rights around your personal data and how we may use it. If you would like to discuss or exercise any of these rights, please do get in touch with our Supporter Care Team:

Email: supportercare@fightforsight.org.uk
Telephone: 020 7264 3900
Post: Supporter Care, Fight for Sight, 18 Mansell Street, London, E1 8AA

You have the right to be informed

This Privacy Notice ensures that you are informed about how we will process your personal data. You might also see messages on some of our forms (or otherwise when we collect personal data from you) that explain why we ask for specific pieces of information from you.

You have rights of access

You have the right to access a copy of your personal data and receive certain information about what the data is and how and why we are processing it. Please note that we will require you to prove your identity before we disclose any information.

You have the right to rectify information

If you feel that any of the information that we hold about you is incorrect, do let us know so that we can look into it and amend it.

You have the right to object

You have the right to object to the processing of your data that we have outlined in this policy in certain cases. You can object in instances whereby we are processing your personal data on the basis that it is within our ‘legitimate interests’ to do so. Please see further information on this in the Our legal basis for processing your data[BR1] ’ section below.

You have the right to be forgotten

You have the right to request that we delete your information and you can discuss this with us at any time.

You should know that there are some circumstances where we may need to keep your details, for example, if it is necessary for us to comply with a legal obligation. If this situation occurs, then we will explain and discuss these circumstances with you.

You have the right to restrict processing of your data

You can request that we restrict the processing of your data, as an alternative to deleting it – this means that we will keep the data but stop processing it for most purposes. You may want to exercise this right if you feel that the data is inaccurate, you there is disagreement over its legitimate use, or you feel that we have no further use of your data.

You have the right to object to automated decision making

You have rights to avoid being subjected to decisions based solely on automated processing (e.g. using computerised models and algorithms) which may have legal or other significant effects on a person.

You have the right to data portability

You have the right to request a copy of certain personal data to have it transferred to another organisation in certain circumstances.

You should know that there are some circumstances where these rights may not apply, but where this is the case we will always explain this to you. Please do contact us if you have any questions or concerns on how we collect and use your personal data, or on your rights, as we are always happy to speak to you.

You also have the right to make a complaint direct to the UK’s data protection authority, the Information Commissioner’s Office (ICO). The ICO can be contacted at: https://ico.org.uk/global/contact-us/ and concerns can be also logged via the ICO website.

The information that we collect

The personal data that we collect about you will be based on how you interact with us, but we collect the following information from many of our supporters:

Your name
Your postal and email addresses
Your telephone number or numbers
Details of any correspondence that we have had with you. For example, if you call our Supporter Contact team, they will make a note of the conversation, in case you need anything else on that matter
How you would like to hear from us, and when you told us this
Details of any donations that you have made to us
Whether or not you have signed up to the Gift Aid Scheme, and when you did so
Your date of birth
Any fundraising appeals that you may have responded to
Events that you have taken part in or enquired about.

There is also other information that we may collect and hold in specific circumstances. For example:

Your bank account details if you set up a direct debit with us
Health information that you give us if you are participating in an event, to help us to ensure your safety
Details of your connection to the charity, including your experience with sight loss or eye conditions, if you choose to provide us with this information.
Our telephone system lists the numbers that have recently called or been dialled, but we do not link these to any supporter records
Information to support our work with high net worth individuals, to understand their philanthropic interests, and complete any necessary due diligence.

When we collect information about you

We collect information in the following ways:

When you give it to us DIRECTLY

You may give us your information in order to sign up for one of our events, tell us your story, sign up to our e-newsletter, fundraise on our behalf, make a donation, pledge a legacy, play our lottery, purchase Christmas cards or to simply communicate with us. Sometimes when you support us, your information is collected by an organisation working for us (e.g. a professional fundraising agency), but we are responsible for your data at all times.

• When you give it to us INDIRECTLY

Your information may be shared with us by independent event organisers, for example the London Marathon or fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so when you have indicated that you wish to support Fight for Sight and with your consent. You should check their Privacy Policy when you provide your information to understand fully how they will process your data.

• When you give permission to OTHER ORGANISATIONS TO SHARE or it is AVAILABLE PUBLICLY

We may combine information you provide to us with information available from external sources in order to gain a better understanding of our supporters and to improve our fundraising methods, products and services. You can find out more information on how we use your personal data.

The information we get from other organisations may depend on your privacy settings or the responses you give, so you should regularly check them. This information comes from the following sources:

Third party organisations

You may have provided permission for a company or other organisation to share your data with third parties, including charities. This could be when you buy a product or service, register for an online competition or sign up with a comparison site. The data we receive depends on your agreement with the third party organisation.

Social Media

Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp or Twitter, you might give us permission to access information from those accounts or services.

• When we collect it as you use our WEBSITE

We assign web browser cookies to enhance each visitor's use of our website. Cookies are used for saving small amounts of information such as user settings.

We may also work with third parties to help us measure visits to our website in order to improve its usability. The data we measure may contain personal information (an IP address and/or cookies).

We do not link IP addresses to individuals. IP addresses are used for internal research and promotion purposes and are not provided to third parties. Cookies issued by us only contain a unique number and therefore contain no personal data. We do not link cookies to individuals other than to recognize repeat visits.

If you do not wish to have cookies stored on your computer you can change your web browser to refuse cookies or to let you know when you get a new cookie. Find out more on our cookies page.

Why we collect and use your personal data

We collect personal data to help us to process your requests, keep in touch with you and to help us to interact with you in the most effective way.

We will use your personal information to:

To provide you with the services, products or information you have asked for
To process your donation including the processing of gift aid
To support your fundraising efforts
To ask you to help us raise money or to donate through our appeals
To administer our lottery
To provide you with information about our work and activities or to send you materials that you have requested
To invite you to participate in market research
To invite you to events
To manage and administer any legacies that have been pledged or left to us
To keep a record of our relationship with us
To ensure we know how you prefer to be contacted
For internal record keeping, such as the management of feedback or complaints.
To administer our grants programme
Where it is required or authorised by law.

Direct Marketing

From time to time, we will contact you to let you know about the progress we are making and to ask for donations or other support. We make it easy for you to tell us how you want us to communicate, in a way that suits you. Our forms have clear marketing preference questions and we include information on how to opt out when we send you marketing. If you don't want to hear from us, that's fine. Just let us know when you provide your data or contact us on 020 7264 3900 or at supportercare@fightforsight.org.uk

Sharing your story

Some of our supporters may choose to tell us about their experiences with eye conditions and diseases to help further our work. This may include them sharing sensitive information related to their health and family life in addition to their biographical and contact information. Should supporters choose to tell us if they have any eye conditions/diseases, and where we have permission to do so, we will endeavour to use the information provided to tailor our communications with them. If we have the explicit and informed consent of the individuals, or their parent or guardian if they are under 18, this information may be made public by us at events, in materials promoting our campaigning and fundraising work, or in documents such as our annual report.

Building profiles of supporters and targeting communications

As part of our major donor fundraising activities we undertake research and profiling of supporters and prospective supporters who may have an interest in, and financial ability to, support Fight for Sight and particular aspects of our work. This research helps us to target our communications in a more focused, personalised and cost effective way by giving us greater insight into what donors and prospective donors may find interesting and the level of support they may be able to provide.

When undertaking research or gathering information in order to build a picture about a supporter or prospective supporter, we consider geographic, demographic and other publicly available information such as location, listed Directorships or trusteeships, donations to other organisations and measures of affluence such as typical earnings in a given profession and house values.

Our profiling methods and analysis activities can be categorised in the following four ways:

Data Matching

We may use the personal information an individual has given us in conjunction with data that has been obtained from external sources in order to obtain a greater understanding of their likely social, demographic and financial characteristics. This allows us to tailor communications with a greater degree of relevancy to better meet the expectations and desires of the individual and other individuals in similar circumstances. We will not use this data in any way that might intrude upon an individual’s rights or be considered inappropriate.

Segmenting

We analyse supporters by group, post code or geodemographic area where supporters may be located. This enables us to better tailor relevant campaigns and mailings for those most likely to be interested and get involved. This is not designed to identify any specific individuals, but rather many individuals who may lie in a particular segment of supporters.

Event Planning

We sometimes create short biographies of individuals who are attending our events or meetings for the purpose of understanding more about the people we are engaging with. This includes reviewing publicly available sources such as public registers, broadcast media and online publications and stories.

Major Donor Analysis

We analyse our database and use information on how supporters have engaged with us in the past to see if we believe that they would be interested in building a relationship with our fundraisers. We then use publicly available sources of information to understand their philanthropic interests and capacity to give greater support (which includes estimated levels of wealth where available). We may also identify other potential new supporters this way. We may from time to time engage a specialist third party prospect research company to analyse our database against their demographic database for this purpose.

These external data sources are gathered entirely from publicly accessible sources and include examples such as:

Public Registers: Companies House (directorships, shareholdings and company accounts), The Electoral Commission (Political Donations), The Electoral Roll (Open Register), The FCA (Financial Services Register), The Law Society, The Land Registry.
Trade and Industry References, Professional directories, Charity Commission.
UK Reference volumes: Who’s Who, Debrett’s People of Today, Debrett’s Peerage and Baronetage, City of London Livery Company information, Trustfunding.org.uk, Sunday Times Rich List.
Reliable print and broadcast media: newspapers (The Telegraph, Financial Times, The Times and Sunday Times, City AM), magazines.
Information that individuals put into the public domain such as on company websites or biographies on professional networking sites
Geographic and demographic information based on postcode

The information that we then review from these sources includes things such as whether a person is a company director or trustee of a charity, their business profession, and estimated property values.

Using this information means that we can tailor communications to areas of our work that we believe will be of interest to you, as we know that donors want information relevant to their motivations. It enables us to spend less money than we otherwise would to raise more funds. It also allows us to ensure that we do not contact people inappropriately.

If you would like any further information on our profiling and major donor analysis, or do not wish us to use your details in any of the ways described above, please contact our Supporter Contact Team

Email: supportercare@fightforsight.org.uk
Telephone: 020 7264 3900
Post: Supporter Care, Fight for Sight, 18 Mansell Street, London, E1 8AA.

Ethical Screening and Minimising Risk

We are subject to many legal and regulatory obligations and standards. We employ appropriate due diligence of donors and donations as well as implementing robust financial controls that help protect Fight for Sight from abuse, fraud and money laundering. We may screen supporters to minimise the risk of associating ourselves with an individual or organisation that conflicts with the high standards we have set ourselves in our ethical policy.

Our legal basis for processing your data

Data protection laws mean that each use we make of personal information must have a “legal basis”. The relevant legal bases are set out in the General Data Protection Regulation (EU Regulation 2016/679).

Consent

Consent is where we ask you if we can use your information in a certain way, and you agree to this (for example when we send you marketing material via, text or e-mail). Where we use your information for a purpose based on consent, you have the right to withdraw consent for any future use of your information for this purpose at any time.

Legal obligation

We are able to use your personal information where we need to do so to comply with one of our legal or regulatory obligations. For example, in some cases we may need to share your information with our various regulators such as the Charity Commission, Fundraising Regulator, Information Commissioner or Gambling Commission, or to use information we collect about you for due diligence or ethical screening purposes.

Performance of a contract / take steps at your request to prepare for entry into a contract

We are able to use your personal information where we are entering into a contract with you or performing our obligations under that contract. Examples of this would be if you are buying something from us (for instance Fight for Sight Christmas cards or, in some cases, an event place) or applying to work with us.

Vital interests

We have a basis to use your personal information where it is necessary for us to protect life or health. For instance if there were to be an emergency impacting individuals at one of our events, or a safeguarding issue which required us to contact people unexpectedly or share their information with emergency services.

Legitimate Interests

We may also process your data where we are furthering our legitimate aims and have assessed that the processing is not likely to be too intrusive, or to unduly infringe on your rights and freedoms. In legal terms, this is called the “legitimate interests” basis.

We have a duty to fund pioneering eye research and to eradicate sight loss: to promote ourselves and our work, to responsibly raise as much money as possible to further our charitable aims, to update our supporters and the general public on our progress, and to operate in an effective way. We always pursue these interests in a respectful manner and with the needs of our supporters as our top priority. We might further our legitimate interests in the following ways:

To communicate with you about marketing and fundraising materials or products:

To send you mail by post relating to activities that we think you may be interested in (unless you have told us you do not want this). We will always consider how much mail you receive from us, and what the topic is, to ensure that it is appropriate.
To contact you by telephone for fundraising or marketing purposes where you have provided us with your number. (If you have already told us that you prefer not to receive telephone calls from us, or are registered with the Telephone Preference Service then we will not call you.)

To ensure that we understand our supporters and so can contact them in a way that is relevant for them, and to make sure that we are using our marketing budgets effectively:

To segment and analyse our data that we hold so that we can understand who our supporters are and contact them about specific activities. For example, to identify which supporters have previously participated in running events and to send them details of future running activities.
To undertake research on potential high value supporters (as detailed in the “Building profiles of supporters and targeting communications” section above), to understand their philanthropic interests and ensure that we only contact people whose interests align with our aims and charitable activities.

To manage our everyday business needs

To work with third party suppliers, where we can make use of their expertise in a specialist field, or where they can provide services at a more cost-effective rate than we could manage internally.
To update our database records to keep them accurate, for example, to amend an address where we receive returned mail.
To process donations, gift aid declarations and applications for funding.
To communicate with you in relation to administrative matters (see more below).

You have the right to object to us processing your data on the grounds of our legitimate interests in certain cases. If you would like us to stop using your data on this basis, please do get in touch with our Supporter Care Team. You will also see a ‘please do not contact me by post’ box on our communications where we are using the legitimate interest basis and you can also tick this to ask us to stop sending communications through this channel.

Administrative communications

There are some administrative communications that we are required to send to you, which are not affected by how you have told us you would like us to contact you for marketing purposes.

Examples of these include (but are not limited to):

Confirming the details of any direct debit that you set up with us, including your bank account and payment details
Confirming where you have made a Gift Aid Declaration orally, so that we can give you the information on the tax implications of this
Letting you know if you have won in a Fight for Sight Lottery draw.

How to control the marketing that we send you

We want to make sure that we keep in touch with you when and how you want. Every marketing communication that we send will outline how you can update us on your preferences and all of our emails have an Unsubscribe link.

You are also always welcome to get in touch with our Supporter Contact Team in any of the following ways:

Email: supportercare@fightforsight.org.uk
Telephone: 020 7264 3900

Post: Supporter Care, Fight for Sight, 18 Mansell Street, London, E1 8AA.

We will ensure that our records are updated as soon as possible once we receive your instructions. For our postal communications, it can take up to 21 days for any change to take full effect because of the production times for our campaigns, but in most cases we would expect the change to be effective much more quickly. If you do receive any mail within this 21-day window, please accept our apologies and recycle it.

Administrative communications

Please note that there are some administrative messages that we legally must share with you, which are not affected by how you have told us you would like us to contact you.

Examples of these are:

Confirming the details of any direct debit that you set up with us, including your bank account and payment details
Confirming where you have made a Gift Aid Declaration orally, so that we can give you the information on the tax implications of this

If we send you one of these messages, we will only use it to share the detail that we have to legally provide you with and will not use it for marketing purposes.

How we work with third parties in processing personal data

At Fight for Sight, we sometimes work with third parties. It’s important that you understand the circumstances where this might happen and who we work with.

We never sell or swap your details with any other organisation for their marketing purposes.

These are some examples of how we work with third parties:

Where we sign a contract with a third party supplier to carry out services for us. These contracts will always hold a supplier to our own high standards of data protection to ensure that they treat your information with the same care as we do.
Where you register to take part in an event (such as a marathon) and we have to provide your details to the event organiser to secure your place.
Where a company sends us data because you have given permission for them to share it, for example, where you set up an online giving fundraising page, sign up for an event via a third party or register with the Telephone or Fundraising Preference Services.
Where we use companies who can help us to enhance the information that we hold about you, for example, to help us to understand which parliamentary constituency you fall into, the size and composition of your household, or the demographic of people living in your postcode area.
Where we legally have to share information. For example, if you make a Gift Aid declaration to enable us to claim Gift Aid on donations that you make, we have to share your name and address with HMRC so that they can audit our claim.

Third party suppliers

We may use companies to provide services and process your personal data on our behalf, where they have a specific expertise or can offer the most cost-effective solution for us. Some of the activities that third-party companies carry out for us are:

Packing and delivering postal mail

Making telephone calls to our supporters
Signing up new supporters for us over the phone, through door to door, street or private site campaigns
Sending emails
Processing credit card payments

Whenever we work with a company in this way, we will always have a contract with them, to be certain that they treat your data with the same level of care and respect as we do. We will only send them the data that they need to carry out their specific service and they are required to delete it or return it to us once they have completed this. Your data will only ever be passed to them for the services that they carry out on our behalf, it is never shared for their marketing purposes.

Event organisers

Some events require us to pass your personal information to the event organisers to secure your place.

Companies we currently work with in this way are:

Virgin London Marathon: Marathon Events Limited
Royal Parks Limited
The Great Run Company
London Landmarks Half Marathon Limited

Third Parties who send us data

Some third party organisations collect data on our behalf and share it with us in accordance with their policies and procedures for data protection compliance. Some of these organisations are Data Management companies, which we use to ensure that data you have provided us with is up to date. We do not use this to add new contact data; so if we already have your address, we may update this, but if we do not have your telephone number we will not use one of these companies to find and record it. Whenever you give your data to any organisation, you should always make yourself aware of their Data Protection and Privacy Policies.

Here are some examples of organisations we currently receive this information from:

Online Giving Providers: BT MyDonate, JustGiving, Virgin Money Giving
Events Companies: Action Challenge, Charity Challenge, Discover Adventure, Eventbrite, Real Buzz, Skyline, Active Networks
Payroll Giving Agencies: CAF payroll, Charities Trust payroll, Charitable Giving payroll
Data Management Services: Telephone Preference Service, Fundraising Preference Service, National Change of Address Register (managed by Royal Mail), Mortascreen.
External Lottery Agency: Sterling Lotteries

Companies who provide us with additional information

Understanding our supporters helps us to provide them with a really personalised experience and makes sure that we use our marketing budgets in the most efficient way. We may collect the following additional information about our supporters:

Information on the size and composition of your household
Information on your financial ability to support us
Your parliamentary constituency
Information about your interests and hobbies
The age band that you fall into

If you don’t want us to use your data in this way, please get in touch with our Supporter Contact team and we will make sure your details are not included.

Email: supportercare@fightforsight.org.uk
Telephone: 020 7264 3916
Post: Supporter Care, Fight for Sight, 18 Mansell Street, London, E1 8AA.

Where we have a legal requirement

We will always share data where we have a legal requirement to do so. Examples of this include providing audit information to HMRC for our Gift Aid claims or if we are required to do so by law enforcement officials. If we were to merge with another charity or restructure, we may also share your personal details with other entities involved in the merger/restructure for that purpose.

How long we keep your information for

We will hold your personal information on our systems for as long as is necessary for the relevant activity, for example we will keep a record of donations subject to gift aid for at least seven years to comply with HMRC rules. Our general data retention policy stipulates seven years which allows us to comply with any legal obligations.

If you request that we stop sending you marketing materials we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.

Legacy income is vital to the running of the charity. We may keep data you provide to us indefinitely, to carry out legacy administration and communicate effectively with the families of people leaving us legacies. This also enables us to identify and analyse the source of legacy income we receive.

How we keep your information secure

Fight for Sight takes the care of your data very seriously and we use a combination of organisational and technological security measures to protect your personal information to the highest possible standards. This includes the use of secure servers, firewalls, virus & malware protection, secure socket layer (SSL) encryption and secure file transfer protocol for our work with third parties. We follow payment card industry (PCI) security compliance guidelines when processing credit card payments.

Access to all Fight for Sight data is protected by complex passwords, including letters, numbers and characters: in some cases more than one method of authentication is used. We make sure that only staff who need to access your personal data can do so. Any member of our staff who has access to your personal data is given training to make sure that they understand the importance of keeping your information safe and secure at all times.

Whilst we take all of the measures that we’ve outlined above, unfortunately, the transmission of information using the internet is not completely secure. Although we will do our best to protect your personal data sent to us this way, we cannot guarantee the security of data transmitted to our site.

In the extremely unlikely event that we experience a data breach, our Data Protection Lead would immediately work with our Senior Management Team and liaise the Information Commissioner’s Office if necessary.

Keeping your information up to date

We may use information from external sources such as the post office national change of address database and/or the public electoral roll to identify when we think you have changed address so that we can update our records and stay in touch.

[We do this so we can continue to contact you where you have chosen to receive marketing messages from us and contact you if we need to make you aware of changes to our terms or assist you with problems with donations.]

This activity also prevents us from having duplicate records and out of date preferences, so that we don’t contact you when you’ve asked us not to.

We’re committed to putting you in control of your data and you can opt out from this activity at any time. To find out more, please get in touch with our Supporter Care Team:

Email: supportercare@fightforsight.org.uk
Telephone: 020 7264 3900
Post: Supporter Care, Fight for Sight, 18 Mansell Street, London, E1 8AA

We really appreciate it if you let us know if your contact details change.

Changes to this policy

From time to time, we may make changes to this Policy and you will always be able to see here when it was last updated. If we make significant changes, such as in how or why we process your personal data, we will also publicise these changes on our website or may contact you directly with more information.

Please do revisit this policy each time you consider giving your personal data to Fight for Sight.

The last significant changes to this policy were in July 2019.

Contact us

If you have any questions, comments or suggestions, please let us know by contacting our Supporter Care Team at supportercare@fightforsight.org.uk or by phone on 020 7264 3900.

Fight for Sight also has a Data Protection Lead, who can be contacted at:

The Data Protection Lead
Fight for Sight
18 Mansell Street
London
E1 8AA

Email: supportercare@fightforsight.org.uk

Telephone: 0207 264 3900

Privacy Notice