Privacy Policy

Introduction

Whether it’s joining the Anthony Nolan donor register (“the register”) to potentially donate your stem cells for transplant or donating your cells for use in research and development through our cell and gene therapy service, donating your baby’s cord blood, generously giving financial donations, getting behind our campaigns, volunteering your time, or being bold advocates of our work - your support means everything. The information you provide helps us to carry out our lifesaving work and allows us to let you know about the difference you’re making.

Anthony Nolan promises to protect and respect your privacy. This is our* Privacy Policy, relating to all our websites, use of emails and texts for marketing purposes, and any other ways we collect information. It details how we process any personal information you provide to us, as well as how we’re committed to keeping it safe and managing it in line with data protection laws**.

Please read this Privacy Policy carefully. We know it’s long, but it contains important information about how we protect, use and process any personal information you give to us, or we obtain about you from other sources. We aim to be clear when we collect your data and not do anything with the data you wouldn’t reasonably expect.

Some of the terms can be confusing, so we have added a brief glossary at the end of this Policy to explain some phrases in more detail.

What information we collect?

First things first, we want to let you know what personal information we collect, and how we collect it when you help us in our work by joining the register, being a potential donor for research and product development in cell and gene therapies or raising funds. The main pieces of information we collect are:

Donors (including potential donors on the register, donors donating for transplant or for research and development through our cell and gene therapy service and cord blood donors, and babies whose umbilical cord blood has been donated)

• Full Name

• Date of Birth
• Gender assigned at birth
• Gender identity
• Contact Information (address, phone, email)
• Medical History
• Ethnicity
• DNA

Patients - We collect the data listed below as well as diagnosis and treatment information.

• Full Name
• Date of Birth
• Gender
• Medical History
• Ethnicity
• DNA

You can read more about how we process your sensitive personal data (e.g., information about your health, ethnicity, gender, and tissue type) in the How we use and process your information section below.

Financial Supporters

• Full Name

• Date of Birth
• Gender
• Contact Information (Address, Phone, Email)
• Bank account details
• Taxpayer status – so that we can claim Gift Aid if you give your consent.
• Credit/debit card details

Potential Supporters

We collect various types of information from potential supporters to aid us in our marketing activities, including website usage data, IP addresses, cookies, and tracking information. Additionally, we may gather data concerning your interaction and engagement with us.

In some cases, where appropriate, we may also collect some information about your interests and preferences to make sure we’re sending you the most relevant communications.

Children’s information

For the purposes of this policy, “children” are those individuals under the age of 16.

We will always seek consent from a parent or guardian before collecting information about children. Some of the reasons we collect and process information about children are for the purposes of running patient appeals, developing patient case studies, organising photo shoots, and judging entries related to children who have been nominated for an Anthony Nolan Supporter Award. Every time we work with a child, we seek the parent or guardian's consent for the specific activity we are carrying out.

Our website is not intended for use by individuals under the age of 16 without the agreement and involvement of a parent or guardian. In the context of our web services and social media data processing activities, we do not knowingly collect or process personal data from children. If we discover that we have inadvertently obtained personal information from a child without appropriate consent, we will take steps to delete that information as soon as possible. If you believe that your child may have provided personal data to us without your consent, please contact us immediately so that we can address the situation.

Vulnerable adults:

At Anthony Nolan, we are committed to safeguarding the privacy and security of all individuals, especially vulnerable adults. In situations where a vulnerable adult inadvertently provides their data and there is a need for erasure, we adhere to the UK GDPR and strictly follow the RTE (Right to Erasure) procedure. This includes scenarios where individuals may not fully comprehend the implications or lack the capacity to consent to data sharing. Our commitment to safeguarding of vulnerable adults not only protects the individual but also ensures, in relation to their personal data, that we respect their privacy rights and maintain the highest standards of confidentiality and security.

Legal basis for processing

The personal data we process will depend on your relationship with us and the reason for which we are processing it. The table below explains the legal basis upon which Anthony Nolan relies when processing your personal data.

WHO YOU ARE	THE REASON WE CAN PROCESS YOUR DATA
Potential stem cell donors and cord blood donors on the register	Consent or legitimate interests (scientific research)
Donors who donate their cells for transplant or for research and development through our cell and gene therapy service	Consent
Patients	Consent, or Contractual necessity
Financial Supporters	Consent, Legitimate interests or legal obligation
Potential Supporters	Consent or legitimate interests (direct marketing)
Website Visitors	Consent (cookies and webforms)
Customers, Suppliers and Partners	Contractual necessity and legitimate interests

Legitimate Interests

In certain instances, we may collect and use personal information where this is necessary for our own (or a third party’s) legitimate interest such as:

• processing in relation to your status as a potential stem cell donor on the register (potential donors may be contacted as a match for a patient for transplant or as a potential donor for research and product development in our cell and gene therapy service), including email, social media and postal communications with you (see How We Will Communicate With You section below).
• sending direct marketing material to you by post or contacting you by telephone for fundraising and marketing purposes and to keep in touch during your time on the register (subject to checking against any existing marketing preferences);
• conducting research to better understand who our supporters are and better target our fundraising activity.
• conducting scientific research to improve Anthony Nolan’s transplant activities, including advancing the understanding of blood cancer, stem cell transplants, donor health and educating healthcare professionals and the general public, as well as promoting scientific and medical research into the causes, prevention and cure of blood cancer, and publishing the results of such research on an anonymous basis.
• monitoring who we deal with to protect our charity against fraud, money laundering and other risks.
• to comply with our obligations as a charity we must take reasonable and appropriate steps to know who our financial donors are, particularly when significant sums are donated. We may conduct due diligence to provide assurances that donations and support are from appropriate sources.
• maintaining and administering our register, supporter database and systems.
• processing in relation to keeping the transplant community informed, including e-mail newsletters.
• conducting research to identify potential new supporters of our life-saving work.

In all cases, we balance our legitimate interests against your rights as an individual and make sure we only use personal information in a way or for a purpose that you would reasonably expect in accordance with this Privacy Policy and that does not intrude on your privacy or previously expressed marketing preferences.

When we collect your information

There are a number of instances when we might collect information from you. These include when:

• you access, or let us know you’re interested in, an Anthony Nolan product or service (for example, registering for an event or joining the stem cell register).

• you give us any information on our website, in writing, face-to-face, by chatting to us on social media or over the phone (including if your call is recorded).
• you register an interest in, or apply for, a job vacancy or volunteering opportunity.
• you ask for information or assistance from us, you provide some feedback about an area of our work, or you make a complaint.
• you give us your details when you make a financial donation.
• we are provided with information from a third party where we need to find more up to date contact information for you, or when we are conducting statistical analysis or research.
• you use any other new and exciting features on our website that might sometimes require you to provide more information.

How we collect your information

We collect information in the following ways:

• When you give it to us DIRECTLY:
  You may give us your information in order to sign up to the stem cell register, as a potential donor for research and product development in cell and gene therapies, for one of our events, to tell us your story, make a donation or communicate with us.  Sometimes when you support us, your information is collected by an organisation working for us (e.g. a professional fundraising agency), but we are responsible for your data at all times.

• When you give it to us INDIRECTLY:
  Your information may be shared with us by independent event organisers, such as the London Marathon or fundraising sites like Just Giving or Enthuse, as well as social media platforms. These independent third parties will only do so when you have indicated that you wish to support Anthony Nolan and with your consent. You should check their Privacy Policy when you provide your information to understand fully how they will process your data. If you are a patient in need of a lifesaving stem cell transplant, your transplant centre will obtain your consent to share your details with us when they are searching for matching donors or cord blood units.

When you give permission to OTHER ORGANISATIONS to share, or it is publicly available, we may combine information you provide to us with information available from external sources to gain a better understanding of our supporters and to improve our fundraising methods, products, and services. This information comes from the following sources:

• Social Media
  Depending on your settings or the privacy policies for social media and messaging services such as Facebook, WhatsApp, or Instagram, you might grant us permission to access information from those accounts or services.

• Information which is publicly available
  This may include information from public sources such as: Companies House, the Charity Commission, newspapers, and online media, as well as company or charity websites and accounts.

How we protect your information

We go to great lengths to keep all your information safe, whether you are a donor, patient, supporter, volunteer, or employee. We invest in the appropriate resources to protect your personal information from loss, misuse, unauthorised access, modification, or disclosure. We make sure we manage it in accordance with our legal responsibilities under applicable data protection laws. However, no internet-based site, including email, is 100% secure, so we cannot be held responsible for unauthorised or unintended access that is beyond our control.

Patient data (processed on behalf of a Transplant Centre or Hospital).

The security and confidentiality of patient data, including samples used for matching purposes is of great importance to us. Our well-trained professionals strictly adhere to data protection regulations, ensuring that all information is securely stored and accessed only by authorised personnel. We employ encryption and secure storage protocols to safeguard data, and whenever possible, we anonymise or pseudonymise information to protect patient identities.

How we use and process information

After we have received your information, there are a variety of ways in which we might use it to ensure we give you the best possible service. They include:

Providing services and processing information internally

• Entering and managing your details if you choose to join the Anthony Nolan register as a potential donor.
• If you come up as a potential match, contacting you or tracing you through your GP, other medical practitioners, or data tracing services (where some of those companies, for example, GBG Plc, will then become a controller of your data). Only a minimum amount of contact details is shared with our tracing service companies.
• Providing the product or service you wish to use, or any information about it.
• Confirming, updating and improving our records to make sure we have the correct information, or if we require additional information in relation to you being a potential stem cell donor (by contacting you or by using a carefully selected external company, for example, GBG Plc).
• Processing sales transactions, donations, or other payments and verifying financial transactions.
• Troubleshooting and fixing problems with the website, including instances when we want to improve your user experience.
• As part of our due diligence process which covers organisations we are working with in any capacity and/or key individuals directly involved with us. This may include, for example, suppliers, customers and partners.
  

Managing and improving our relationships with supporters

• Informing you of any new products or services, news about Anthony Nolan, and other ways you can help us with our lifesaving work. We will use your data to tailor and improve our communications so that they are relevant to you.
• Contacting you about any Anthony Nolan fundraising events you have signed up for, so we can provide you with information and support.
• Ensuring our communications are timely and relevant, so you only receive the information you want. We will analyse data from our database to better understand our supporters. For example, we use third parties to create supporter categories within our database based on postcodes, and we will include this information with the rest of the personal data we hold on you. We will also use broad demographic information, such as statistics and analysis from third parties, to better understand how our supporter base compares to the general population. This helps us decide who to send our communications to and ensures the communications you receive are relevant to you.
• Creating statistical aggregates (anonymous data) about the success of a campaign.
• We may use your personal data to create profiles and conduct analysis based on specific characteristics for the purpose of targeted marketing. This analysis enables us to tailor marketing communications to you that align with your demographics, preferences, interests, behaviour, and interactions with Anthony Nolan. We undertake this profiling in compliance with applicable laws and regulations, applying the principle of data minimisation and ensuring the protection and security of your data throughout the process. You have the right to object to such profiling activities, and you can exercise this right by contacting us through the provided channels in this privacy policy.

• Asking you about supporting our lifesaving work through a fundraising request, provided we have the legal basis for doing so.
• Inviting you to get involved with voluntary surveys, campaigns, or research (either internally or by another company) to find out more about the demographics, interests, and behaviours of our supporters.
• We may request your permission to use your photos and video footage for marketing and promotion purposes.
• Where you have agreed to receive email or SMS marketing communications from us, we may provide your email address or mobile phone number in an encrypted format to social media companies, such as Facebook, Instagram, X (formerly Twitter), TikTok or YouTube, or to digital advertising networks that are providing services to us by displaying our advertising to you on those social media platforms and other websites, as well as identifying audiences with interests similar to yours. You can opt-out of your data being used to display advertising to you by contacting us on 020 7424 6626 or emailing support@anthonynolan.org. However, this will not prevent our advertisements from being shown to you on a randomised basis or based on cookie data and may mean that you stop receiving marketing communications from us more generally.

These activities assist us in understanding the background of the people who support us and help us make appropriate requests to supporters who may have the means and the desire to give more. You can opt out of your data being used in this way by contacting us on 020 7424 6626 or emailing support@anthonynolan.org.

Responding to any queries or issues

• Responding to any feedback, queries or complaints that you raise.

Conducting training and reviews of our service (including via call recording)

• Enhancing or reviewing the service we provide to you, and meeting training needs.
• Conducting statistical analysis and research using, where possible, anonymised data.

Meeting our legal obligations

• Using information for auditing purposes.
• If we have a legal obligation to use or disclose information about you for instance, where we are ordered by a court or regulatory authority or we are legally required to hold donor transaction details for Gift Aid or accounting/tax purposes.

Other

• When we consider you for potential job or volunteering opportunities where you complete an application
• If we sell or buy a business or its assets, we might need to share your personal information with the potential buyer or seller of that business or asset. Additionally, if our assets are substantially bought by a third party, your personal information might be passed on as part of those assets.
• For any other purpose to which you agree.

Processing your sensitive personal data

We process some of the sensitive personal data you might provide (e.g., information about your health, gender assigned at birth, gender identity, ethnicity, tissue type (HLA), and DNA information) where you have given your consent to do so, as set out on applicable forms, or where you have made that information manifestly public, or where there are public interest reasons in the area of public health, archiving purposes, or scientific and medical research purposes. We use predictive statistical techniques (using your data, including personal sensitive data) to decide how to communicate with you in relation to your status as a potential stem cell donor. Where we process your sensitive personal data for scientific research purposes, we will implement appropriate safeguarding measures such as pseudonymising or anonymising information (where applicable).

In the medical field, particularly in scientific research and healthcare, the increasingly prevalent use of algorithms plays a vital role in matching donors with patients, particularly in scenarios like stem cell, bone marrow, or organ transplantation. These algorithms facilitate the analysis of extensive medical data from potential donors and patients, evaluating compatibility based on factors such their tissue type, blood type, and other essential medical markers. By using algorithms, the objective is to accurately identify the most suitably matched donors, thereby enhancing the likelihood of successful transplantation and ensuring optimal matches between donors and recipients. The application of this technology significantly enhances the efficiency and precision of the matching process, which is crucial in life-saving medical procedures.

International Transfers (third countries):

When you join the register or donate your cord blood, Anthony Nolan will transfer personal information collected from you to third-party data processors, such as international registries, transplant centres, and hospitals located outside the UK and the European Economic Area. This information is crucial for us to facilitate the matching of potential stem cell donors (including cord blood units) with patients in need of a transplant. To identify suitable donor matches for patients residing outside the United Kingdom, it is necessary for us to share your data (in a pseudonymised format) with international registries and transplant centres located outside the UK. This is typically done through the World Marrow Donor Association (WMDA), with whom Anthony Nolan has established specific data protection agreements.

Please be aware that some countries may not offer the same level of data protection as the United Kingdom. However, if we transfer your information to one of these locations, we will take steps to ensure that your data, rights, and freedoms are protected through appropriate technical and organisational measures, including mechanisms for international data transfers approved within the relevant Data Protection laws. If you would like further information about how we protect your transferred information, please contact dataprotection@anthonynolan.org.

How we keep your information safe and who has access to it

We want you to know that we will never sell or pass on your personal information to third parties for their own marketing purposes. However, there may be some third parties with whom we need to share personal information in order to provide services and products to you and to run our website, including the following:

• Related Anthony Nolan entities**, if you ask us to do so, so we can manage our supporter relationships, administer our business, and let you know about Anthony Nolan news, products, and services which might be of interest to you.
• If we sell or buy a business or its assets, we might need to share your personal information with the potential buyer or seller of that business or asset. Additionally, if our assets are substantially bought by a third party, your personal information might be passed on as part of those assets.
• Our advisors, to help us better manage, support, or develop our organization and comply with legal and regulatory obligations.
• Any service providers who need to know certain information to provide you (or us) with a product or service – such as sending out your donor welcome pack if you join the register.
• Our partners, including event organizers we work with.
• Law enforcement bodies and/or regulatory entities, to comply with any legal obligation or court order.
• We may share information with third-party vendors and other service providers who work on our behalf or our customers' behalf, and require access to such information to carry out their work, for example, to provide data storage and processing services.

We use external companies to collect or process personal data on our behalf. However, we always carry out comprehensive checks on these companies before we work with them and put a contract in place to set out our requirements, especially regarding how they manage the personal data they collect or have access to.

Some of our suppliers operate outside the UK or the European Economic Area ("EEA"), where different privacy laws apply, and this may include lower security requirements and fewer rights for individuals. Where your personal information is transferred, stored, and/or otherwise processed outside the UK or the EEA, we will take all reasonable steps to ensure that appropriate safeguards are in place to protect your personal information (such as entering into an International Data Transfer Agreement (IDTA)).

We may share anonymised or pseudonymised data about you with organisations engaged in related research activities to help improve transplant outcomes for our patients or better understand donor health and experience. However, as this information is anonymised or pseudonymised, these organisations will be unable to identify the information as relating to you.

How we will communicate with you

Potential Stem Cell Donor Communications

When you register as a potential stem cell donor, it could be quite some time before you are called upon to donate. We understand that life can get busy, and it's easy to forget about your commitment. That's why we like to stay in touch with you, keeping you informed and updated. Our goal is to ensure that if you are a match for a patient in need, you are ready, available, and reachable. Time is critical when it comes to stem cell donation for patients in need. Being available when the opportunity arises is of utmost importance. Our minimum level of contact helps increase the chances of giving someone a second chance at life. Together, we can make a significant impact and save lives.

For this reason, unless you choose to hear more from us, our communications with potential stem cell donors tend to be limited to monthly updates. We may contact stem cell donors to provide information related to your registration status, facts about stem cell donation, and to request updates on your details to stay active on the register. Rest assured, we won't send you appeals or fundraising requests as part of the above communications, unless you've separately informed us that you want to receive them.

You can always opt out of receiving the marketing and fundraising communications (see below), but we will always contact you in relation to your status as a potential stem cell donor, including in relation to updates to the donor process, if you are identified as a potential match for a patient in need, and with opportunities as a potential donor for scientific or medical research and product development through our cell and gene therapy service. Once on the register, you will stay on it until your 61st birthday (unless you ask to be removed before that date by contacting us on 020 7424 6567 or emailing register.support@anthonynolan.org).

Marketing and Fundraising Communications

Separate from potential stem cell donor communications, we will contact you to update you on news about the stem cell register, information about campaigns to get involved with, ways to financially support our lifesaving work, stories from patients, and other news we think you'd be interested in. It is always your choice whether you want to receive information about our work, how we raise funds, and the ways you can get involved.

Please note that for postal and telephone communications, we may rely on legitimate interests as the legal basis. This means we may send you relevant information via post, or by calling you, that aligns with our legitimate interests. However, we always respect your preferences, and you can update your communication preferences or unsubscribe from these communications at any time (including telling us that you don't want us to contact you for marketing purposes by telephone or by post) by clicking the link provided in every email message we send you or by contacting us (see the Contacting Us section below). We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted by us for such purposes. However, we will retain your details on a suppression list to help ensure that we do not continue to contact you.

We will never pass on your information to other companies or charities for their own marketing purposes. We may use third-party data tracing services, such as GBG Plc, and publicly available sources to make sure your information is up to date so we can keep in touch.

How we retain your information

The information you provide will be retained by us in accordance with applicable laws. We will take reasonable steps to destroy or de-identify personal information we hold if it’s no longer needed in connection with the purpose(s) for which it was collected and/or processed.

However, if you do choose to share your information with us publicly (for example, photos or footage on social media), then it’s possible that other people may have copied this information during the time that it was live, and therefore use of it is beyond our control.

If you decide to sign up to the Anthony Nolan stem cell register, you will stay on the register until you are 61 years old, unless you decide to close your record on the register before that time. You can request copies of your personal information that we hold at any time (see What your rights are section below).

Data Retention

As we strive to uphold the highest standards of data privacy and protection, we may need to adjust our retention periods from time to time. Potential reasons for modifying retention periods include, but are not limited to, legal and regulatory requirements, industry standards, evolving business needs, and technological advancements.

Be assured that any changes made to the retention periods will be implemented in accordance with applicable laws and regulations. We will make reasonable efforts to notify you of any significant modifications that may affect the storage duration of your personal information.

If you have any questions or concerns regarding our data retention and deletion practices, please feel free to contact us at dataprotection@anthonynolan.org.

VISITING THIRD PARTY WEBSITES

This website contains links to other websites that we believe may be of interest to you. This Privacy Policy only applies to our website, so if you link to another website, we recommend you read the privacy policy of that website before sharing any personal or financial data.

Cookies

Like most websites, we use ‘cookies’ to help us improve how we create, and how you use, our site. Cookies mean that a website will remember you and can obtain an overall view of visitor habits and volumes to our website. They can make interacting with a website faster and easier, for example filling in your name and address in text fields. View our Cookie Policy to find out what cookies we use and how we use them.

What your rights are

We want to make sure you’re in control of how we use and keep your information.

You have the right to:

• be told how your personal information will be used;
• request a copy of the information we hold about you;
• update or amend the information we hold about you if it is wrong;
• change your communication preferences at any time;
• ask us to restrict the processing of your personal information if there is a disagreement about its accuracy or legitimate use;
• ask us to remove your personal information from our records;
• request an electronic copy of your personal information be sent to you, or another organisation;
• object to the processing of your information for marketing purposes on the basis of a legitimate interest or for statistical purposes;
• ask us for human intervention or to challenge any such decision where we take automated decisions in relation to your personal information; or
• raise a concern or complaint about the way in which your information is being used.

To request a copy of the information we hold about you, or to exercise any other of your rights, you can use our online form, which can be accessed here.

Alternatively, please contact the Data Protection Team at:

Data Protection Team
2-3 Heathgate Place,
75-87 Agincourt Road,
London NW3 2NU

Email: dataprotection@anthonynolan.org

Or you can find out more on the Information Commissioner’s Office website

How you can contact us and find updates to this policy

Questions

If you have any questions about this Privacy Policy, anything you’d like to correct or if you’d like to request a copy of the information we hold about you, you can contact The Data Protection Officer at the ‘Head Office’ address below, or email dataprotection@anthonynolan.org

Complaints

If you have any concerns or complaints as to how we have handled your personal information, please don’t hesitate to get in touch (you can find the details above) and we will endeavour to investigate. You may also lodge a complaint with the UK’s data protection regulator, the ICO, who can be contacted at: www.ico.org.uk/global/contact-us/ or by writing to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

EU Representative

To comply with the General Data protection Regulation (2016/679) we have appointed a European representative. If you wish to contact them, their details are as follows:
Bird & Bird GDPR Representative Services SRL
Avenue Louise 235
1050 Bruxelles
Belgium
EUrepresentative.AnthonyNolan@twobirds.com

Updating this policy

This Privacy Policy was updated in February 2024. We will keep it under review and make updates from time to time. If we make any significant changes to the way we treat your personal information, we will make this clear on the Anthony Nolan website or by contacting you directly.

*’Us’, ‘we’ or ‘our’ refers to the registered charity Anthony Nolan (no. 803716 in England and Wales/ no. SC038827 in Scotland) and a company limited by guarantee (company no. 02379280) and Anthony Nolan Trading Limited, a limited company (company no. 02511952).

Registered address:

The Royal Free Hospital, Pond Street, Hampstead, London, NW3 2QG

Head Office:

2-3 Heathgate Place, 75-87 Agincourt Road, Hampstead, London NW3 2NU

**We are registered with the UK Information Commissioner’s Office (ICO) as a data controller under registration number Z3022117 (Anthony Nolan) and Z4877402 (Anthony Nolan Trading Limited). To comply with the General Data protection Regulation (2016/679) we have appointed a European representative. If you wish to contact them, their details are as follows: Bird & Bird GDPR Representative Services SRL Avenue Louise 235 1050 Bruxelles Belgium EUrepresentative.AnthonyNolan@twobirds.com