Introduction

OMF International (UK) (known as “OMF UK”) attaches great significance to both protecting and using appropriately the personal data you give to us in order that together we may serve the Church and share the Good News of Jesus Christ in all its fullness amongst East Asians.
OMF UK is committed to keeping your personal data safe and treating it confidentially as required by UK legislation including the General Data Protection Regulations and the Data Protection Act (2018). You can exercise your rights including requesting that OMF UK changes or remove your details at any time.

Who are we?

OMF UK is the working name for OMF International (UK). OMF International (UK) is a charitable company registered in England and Wales with registered number 6541911. It is registered as a charity in England and Wales with charity number 1123973, in Scotland with number SCO39645 and the Republic of Ireland with number 20200671
OMF UK is a sovereign legal body and locally constituted member of the worldwide OMF Fellowship, one of many centres in other countries under the international leadership of OMF International (IHQ) Ltd in Singapore, to carry out activities in line with the mission to share the good news of Jesus Christ in all its fullness with East Asia’s peoples to the glory of God.
OMF UK is registered with the Information Commissioner’s Office (ICO) as a data controller, registration number ZA239818. You can find out more about our registration  here, including a list of all data related activities that we have registered with the ICO.
OMF UK’s registered address is Unit 6, Station Approach, Borough Green, Kent, TN15 8BG.
For further information about our privacy notice and data protection, or to exercise one of your rights, please contact us by:

• Telephone on 01732 887299
• Emailing  uk.dataprotection@omfmail.com
• Writing to our data protection team at OMF International (UK), Unit 6, Station Approach, Borough Green, Kent, TN15 8BG

What personal data do we collect and where do we collect it from?

Personal data is any information that can be used to identify you. For example, it can include your name, email address, postal address, telephone number, mobile telephone number, bank account details, credit/debit card details, and whether you are a taxpayer so that we can claim Gift Aid on any donations you may make. It also includes Internet Protocol (IP) addresses (the location of the computer on the internet), details of pages visited on our websites and files downloaded.
We ask for your personal data whenever you engage with us. This may be as a supporter (in prayer, financially or in other ways), OMF UK member, staff, volunteer, Serve Asia Worker, subscriber to news and information, attendee at an OMF UK organised event, supplier or contractor, or someone else with a stated interest in our work.
Collecting personal data helps us to keep in touch, based on your stated preferences, and to provide you with relevant and timely information. We never share your details with third parties outside of OMF UK’s contractual relationships, which includes our processors and other OMF centres.
We collect personal data in the following ways:

Information you give us directly:
From using our websites:
OMF UK website  – the website for OMF UK at  https://omf.org/uk/ is controlled by OMF International based in Singapore; their privacy notice is available at  https://omf.org/privacy and their cookie policy is available at  https://omf.org/cookies/. OMF International is also responsible for the ‘Pray for the Task Unfinished’ and ‘My OMF’ micro sites, and any non-OMF UK email addresses at the domain of omfmail.com.
When you sign up to receive the Billions newsletter at https://billions.omf.org/ the data you provide is sent by email to OMF UK, and OMF UK is the data controller for every OMF UK email address at the domain of omfmail.com.
Under the Get Involved section of our website, you can make gifts/pledges, sign up as a prayer partner or to mailing lists, and register for events.
Depending on your browser settings, we will collect technical data, which may include your Internet Protocol (IP) address, browser type, type of device or operating system, general location and date stamps.
There are security measures in place to protect against the loss, misuse and/or alteration of the data under our control. We utilise industry-standard HTTPS certificated secure server connections across the website and provide additional encryption during the product ordering and donation process.
OMF UK uses log files in its website to track trends, views of content and user activity. This data helps OMF UK to develop its website to better suit visitor experience and to match your areas of interest. Log files only identify you by your IP address, and contain information about what search engine domains (e.g. Google.com) are used, what browser software and system software is used, and what pages are visited on our site. This data may be archived for analysis in the future.
Cookies and local storage are industry-standard technologies that allows a website or app to store and retrieve data more efficiently on a person’s computer, mobile phone or other device. While cookies are a short string-based file, local storage can hold larger amounts of data for storage, caching and offline purposes. Like most websites, we use cookies and local storage to provide you with a better, faster or safer experience. Most web browsers offer settings to control whether to allow cookies or local storage. We recommend that cookies and local storage remain turned on to take full advantage of our website. Our cookie policy can be found at  https://ukhub.omf.org/public/terms/terms.aspx#cookies
OMF UK Hub’s website contains links to other relevant sites including OMF UK main website as mentioned above. We try to exercise caution in such cases, however, the privacy and data collection practices on linked websites are entirely separate from OMF UK and are not covered by this privacy notice. The links to other sites on this website are provided as an additional resource only and should not be seen as an endorsement, approval or agreement with any information or resources offered at sites accessed through our site.
When you sign-up:
The data that we collect when you sign-up online, by telephone, at an event or enter a contract with OMF UK may include:

• Your title, name and email address and / or postal address
• The name of any organisation/church/group you are associated with
• Your telephone numbe
• Your communication preferences
• Your areas of interest in the work of OMF UK

Information you give us indirectly:
Your data may be shared with us by other OMF centres around the world if you give permission, or by entering your personal data into OMF International controlled websites sites (such as  ‘Pray for the Task Unfinished’ and  ‘My OMF’ micro sites) and fundraising sites such as JustGiving. In each case, you should check their privacy notices when you provide your personal data, to understand how they will process your data and how you can exercise your rights.

Information from public sources:
We may combine information you provide to us with information available from public sources or records in order to gain a better understanding of our supporters and those who engage with us. Such information may be found in places such as Companies House and information that has been published online and in print. We do not use tele-appending and tracking services.

Sensitive/special categories of data
Data Protection law recognises that certain categories of personal data are more sensitive. This is known as sensitive personal data or special categories of data and covers health information, race and ethnicity, religious or philosophical beliefs and political opinions amongst other things.
We do not collect sensitive personal data about you unless there is a clear reason for doing so, and we will make it clear to you what we are collecting and why, and gain consent where necessary.
Instances, where we may process sensitive personal data, include:

• Involvement in an event to help the organisers and leaders have the relevant information to care for event attendees
• Medical information to care for members and Serve Asia Workers and occupational health checks for some roles.
• Information on self-identified religious beliefs (with reference to GDPR article 9-2 (a) and 9-2(b))

Under 15s
OMF UK does not engage directly with children below the age of 15 years. We may process information of children under 15 years where they are a part of a family unit, provided that we have the consent of an adult with parental responsibility.

How do we use personal data?

OMF UK is extremely careful with the collection, storage and processing of personal data you provide. We use it for the following purposes:

• To keep you informed about our work and the work of the OMF International centres around the world
• To inform you of relevant events that we organise or that we feel you may be interested in
• To process your requests for resources
• To provide you with a receipt and acknowledgement of donations
• To track your engagement with us as an OMF UK member, staff, volunteer, Serve Asia Worker, subscriber to news and information, attendee at an OMF UK organised event, supplier or contractor, or someone else with a stated interest in our work.
• To keep a record for any lawful purpose

What is our lawful basis for processing data?

We rely on a variety of lawful bases for processing data depending on the purpose of the processing being undertaken.
We use a  contractual basis  for processing data relating to

• Staff and volunteers employment applications and engagement
• Members and Serve Asia Workers applications and engagement
• Event attendees
• Purchases and free issue of resources
• Payments of invoices, expenses and other authorised amounts

We rely on  legitimate interests  for a variety of purposes. Legitimate interest is about balancing the interests of OMF UK against your rights and freedoms and having due regard to your reasonable expectations about the use of your data. These purposes include:

• Mailing you information related to your subscription to prayer bulletins and newsletters, and about related resources and events that you might be interested in, given your previous communications and attendance
• Thanking those of you who have made a financial gift
• Recording details of the Lammermuir Fellowship

We rely on  consent  for all email marketing communications such as prayer bulletins, newsletters and conference/event invitations; every email you receive provides a clear opportunity for you to opt out or alter your communication preferences.
We use  compliance with a legal obligation  as the basis for processing any legally required activities such as:

• Financial records
• Contracts and agreements with suppliers, tenants and other professional advisers
• Companies House information and returns
• Gift Aid returns to HMRC
• Health and safety records

Who has access to your personal data and how do we keep it safe?

OMF UK is committed to keeping your personal data safe. All members, staff and volunteers are fully briefed on OMF UK’s data protection policies and procedures relevant to their role, and regular training is given. OMF UK workers only have access to data that they need to be able to carry out their duties.
Passwords
Where you or we have provided a password enabling you to access the OMF UK Hub, it is your responsibility to keep this password confidential. Please don’t share your password with anyone, and if you think anyone else has gained access to your password, please change it or let us know as soon as possible.
Transferring your information outside of Europe
Although most of the data we store and process stays within the UK, some data may be transferred to countries outside the European Economic Area (EEA).
This may occur if, for example, information relating to gifts given by you is stored on OMF International servers in Singapore or if we use a cloud IT platform where data is dispersed outside of the EEA between a number of different servers. These countries may not have similar data protection laws to the UK. However, we will ensure that your privacy continues to be protected as outlined in this privacy notice and in accordance with our legal obligations under applicable data protection legislation.
By submitting your personal data to us you agree to this transfer, storing or processing at a location outside the EEA.
Payment by credit or debit card
If you use your credit or debit card to donate to us, buy something or pay online or over the phone, we will ensure that this is done securely and in accordance with the Payment Card Industry Data Security Standard. Find out more information about PCI DSS standards by visiting their website at  www.pcisecuritystandards.org.
Only those workers authorised to process payments will be able to see your card details. Once your transaction is completed, we will not store your full credit or debit card details. All transactions online are processed through SagePay, which is PCI DSS compliant
We hold bank account details for the purpose of administering standing order and direct debit transactions.
Sharing your information
OMF UK never sells, rents or leases personal data. Nor do we exchange any personal data with other organisations outside of other OMF centres, for their own use.
OMF UK may disclose your personal data to third parties who provide a service to us as data processors. These include:

• Professional services – Anthony Collins (solicitor), BDO (auditor), BWB (solicitor), MB Law (solicitor), Wellers (solicitor), Mark Mason Employment Law, Croner (health and safety training), Finastra (direct debit processing), OMF International (IHQ) Ltd (hosting of email, website, IT systems, accounting and payment services), Yeomans (mail fulfilment), School of Oriental and Asian Studies (archives)
• IT services – Constant Contact (email marketing), MailChimp (email marketing), Montala (image library), Rackspace (hosting of UK Hub), SagePay (payment processing), ThankQ (CRM and donation handling), Yahoo (online forum)
• Venues and conference centres – BMS conference centre in Birmingham, The Hayes in Swanwick, Chinese Overseas Christian Mission, Otford Manor
• Individual specialists under contract to provide medical and other personal support services

These data processors have access to personal data needed to perform their functions but may not use it for other purposes. We require these third parties to comply strictly with our instructions and data protection laws and will make sure that appropriate controls are in place.
We may also disclose your personal data where we are under a duty to comply with any legal obligation (for example to government bodies and law enforcement agencies), or in order to enforce or apply our rights (including in relation to our website or other applicable terms and conditions) or to protect OMF UK (for example in cases of suspected fraud or defamation).

How long do we keep your personal data for?

Locally Managed and Stored Data
We have a retention policy for every personal data set. We will retain your personal data on our digital systems or in paper form for as long as is needed to fulfil the purpose for which we hold the data, or as long as is required by law for the relevant activity:

• 1 yr from termination of process where not continued to completion – member enquiries and applications, Serve Asia Worker enquiries and applications, volunteer enquiries and applications, staff applications
• 2 yrs after last engagement – supporter records (non-financial), area representative contact lists and requests for speakers, event signup cards, prayer and partnership leaflet signup, faith & finance leaflet signup
• 3 yrs after incident – accident books and reports
• 6 yrs from retirement/resignation – former staff, Serve Asia Workers, volunteers, interns  1
• 7 yrs from document date – financial records including Gift Aid declarations and donations, data relating to tenants, staff and event attendees
• 12 yrs from document date – leases
• Indefinitely but with annual review – current staff, members (current and former), volunteers, Serve Asia Workers, supporters  2 3

Where your data is no longer required we will ensure that it is disposed of in a secure manner.
If you request that we stop sending you information (your right to object), we will keep the minimum amount of personal data needed to enable us to comply with your request not to be contacted by us. If you exercise your right to erasure, we will delete all your personal data that we are not obliged to keep by law.
Data Managed and Stored by Other OMF International Centres
As already detailed in this privacy notice, some personal data sets are necessarily transferred to systems which are controlled by OMF International based in Singapore, protected in accordance with the terms of this privacy notice. However, since the retention requirements for personal data on those systems also need to conform to those of other jurisdictions, the retention policy for those systems differs from OMF UK’s retention policy detailed in the section above. The retention policy for the OMF International systems in Singapore is detailed in the privacy notice available at  https://omf.org/privacy.
  1  Allegations made about the conduct of any adult, unless proven malicious, will be retained until the adult is 65 or for 10 years, whichever comes later.
2  Sensitive information is deleted from member files 6 years after resignation/retirement. Adult Third Culture Kids (TCK) records will have such information removed on their 26th birthday. Any child protection related concerns will be kept until 7 years after the organisation’s last contact with the TCK and their family or until the TCK is age 50, whichever comes later.
3  Allegations made about the conduct of any adult, unless proven malicious, will be retained until the adult is 65 or for 10 years, whichever comes later.

What are your rights and how can you exercise them?

Under GDPR and the Data Protection Act (2018) you have a number of rights over your personal data and how we use it. You have the following rights:

• Informed – this privacy notice
• Access – you may request a copy of the data we hold about you and details of the purposes for which we process your data (known as a data subject access request)
• Rectification – update or amend the data we hold about you if it is wrong, change your communication preferences at any time or withdraw your consent to use of your personal data where we are relying on consent as the legal ground for processing it
• Erasure – ask us to remove your personal data from our records
• Restrict processing – ask us to restrict the processing of your personal data
• Data portability – obtain a portable copy of certain personal data where this is processed automatically
• Object – object to the processing of your data for marketing purposes
• Related to automated decision-making including profiling – ask us to explain any automated processing we carry out and the impact of this on you

If you wish to exercise any of these rights, please contact us in any way listed in the ‘Who are we’ section at the start of this privacy notice. We may ask for reasonable proof of your identity before providing you with data or carrying out any of the above actions.
To change your communications preferences, you may find it easier to use the link where these exist in the emails we send, or update your details using the OMF UK Hub.
Changes to this Privacy Notice
OMF UK reserves the right to make changes to this privacy notice and its associated policies at any time and we recommend that you review this notice periodically for updates.
Last revised on 1 August 2019