We're committed to going above and beyond the legal requirements in order to do the right thing by our supporters. The following guidance has been taken from advice we gave to our staff across the charity. We'll add questions you ask to this list, to better explain what we're doing, and why.
What does ‘opt-in’ mean?
From the summer of 2016, we only call, email, SMS or write to people who have given us explicit permission to do so. The building block of this is the concept of ‘freely given, specific, informed and unambiguous consent’, as defined in the regulations of 2018 (GDPR).
Consent is only one of the ways we can legally use personal data - the other main ones are where there's a legal need, or where there are 'legitimate interests'. We will use opt-in consent to the fullest extent we can, wherever a genuine choice can be given. Read more about these differences on this page.
Legally, all charities must have opt-in permissions for marketing phone calls, email and SMS. (‘Administration’ calls are permitted, eg relating to a person’s membership details, Direct Debits, thanking, or sorting a problem with a payment). The new regulations coming in 2018 strengthen this, but don’t go as far as making all-channel opt-in mandatory, as we have done.
We're going further than the legal requirement by applying opt-in to include postal communication, because we feel it's the right thing to do. It will result in a smaller group of more committed and trusting supporters of our work.
Who is a 'supporter'?
In 2016 we decided that a supporter is any individual who had taken some form of recorded positive action with us within the last 2 years. Examples would be giving a donation, signing up for our newsletter, signing a petition on one of our campaigns, or renewing your membership.
What types of communication count as marketing?
The law states that marketing includes any form of communication that asks for money or promotes the aims of the charity. This includes but is not limited to fundraising appeals.
You would need to 'opt in' to receive:
- Our E-newsletter (currently every 6 weeks)
- Your Voice membership magazine
- Response magazine (for donors and those who've raised money for us locally or online)
- Invitations to any local event
- Emails asking you to take part in our latest campaign, sign a petition or share facts our messages
- Welcome pack (with free camomile seeds) after your first gift
What counts as an 'opt-in'?
A donation doesn't count as an opt-in by itself. Nor does someone signing a petition, or becoming a member. We can't assume that you want to hear from us, and we can't give you just one tickbox for multiple actions. You have to explicitly tell us you're happy to hear from us. This can happen online on our signup forms when you take one of the actions above; or on the phone to our supporter care team; by post; or by email. It might take the form of a simple tickbox, words, or any other way we can prove your wishes at that time. We save a date that you made that choice, and we overwrite the last choice you told us, so that we always have the most up to date permissions.
Why does my permission only last 2 years?
Legally we need to justify a reasonable amount of time that your consent lasts for. For us, 2 years felt reasonable. If we haven't heard from you in the last 2 years, we assume that you no longer want to hear from us. We'll remind you just before the 2 years is up to tell us if you still want to hear from us. If you don't re-confirm, we'll leave you alone.
What about people using our services?
For service or advice relationships, these are professional records and we are likely collecting sensitive information from a GP or other NHS contact, a local authority, or from the person directly. This information is not for use by any other part of the charity - it's confidential and other teams in the charity cannot see it. There's no need for 'opt-ins' because no marketing will happen to that person unless they ask for it.
What about other work-related communications? (Rethink Mental Illness to another organisation) Do we have to have an opt-in?
No. An organisation which advertises that we can apply for a grant or make a service application does NOT need an opt-in. These rules are in place to protect individuals only.
If we are speaking to a contact at an organisation, then we'll have a record of that organisation and a named contact there. Our permission to speak to this individual is on behalf of the company or Trust they work for. No opt-in is needed - we can call this 'legitimate interest'.
If this organisation is a regular work contact of ours, they might need their own record on our database so that teams can collaborate and see where common contact might help.
If this person later leaves that organisation for a new one, or becomes a person of interest separate from their relationship with us through their workplace, then they should have an individual record on our database, and will need an opt-in when we next speak to them. Otherwise we are using their personal details for marketing, without their expressed permission, and this is not allowed.
Here's an example:
We applied for a grant to Trust ABC, and our contact there is Mrs Smith. We email, talk and write to Mrs Smith regularly over the months and years of this relationship with Trust ABC - always about the grant, its service implementation, its reporting, or the wider work relationship.
We cannot ask Mrs Smith to be a member. We cannot send Mrs Smith the charity newsletter to her email address, even if it's her work address, unless she asks us to. We can discuss opt-ins if it comes up, but she has to make the choice herself.
Here's a second example:
If someone asks one of our staff about what Rethink Mental Illness does, and whilst we're telling them, we recommend a particular service or an asset that might be useful to that person - no opt-in is needed.
Were this person to come back to us a second time to ask another question – still no opt-in would be needed. However, if we wanted to continue the conversation as a charity with this person - we would need to get an opt-in.
If for any marketing reason (except service user relationships - see above) we need your personal data - we need to get an opt-in.
What about our support groups?
Do our local support groups have to do this for new group members and group fundraising activity?
Whenever we (or any representatives of ours, like our volunteers) are collecting contact details for someone, we have to clearly state what they'll be used for. Support group activities come under these regulations and we must make sure we comply across the whole organisation for us to be effective, and to comply with the law.
If data is going to be used to recruit new group members, send newsletters, invite people to events in their area, for collecting donations (even if it's for the local cause only), these rules still apply and we will need to prove what permissions we have. We're currently testing a pilot system (2017-18) with a couple of our groups to find out what can be done with what they have.
Some group coordinators currently lock paper records away, password lock their phones and password protect spreadsheets where they have details collected solely for the purpose of letting group members know about meetings. Other groups do not collect contact details, they just rely on regular group meetings to pass on information. Many group members don’t want to give personal information out, and if they do, they don’t want it saved on a database. In these cases, we just ask our support groups to follow our Information Governance Guidance, to keep data safe and secure.
We can never swap data with other organisations or individuals without that person’s expressed permission, and as an organisation we already state that we do not do this.
How will we collect these opt-in permissions?
In 2016, we changed all the pages on our website where we'd previously asked people to give us their contact details - these all now link directly to our database (and have the additional benefit of protecting your data from online fraudulent activity) and have the new opt-in statement.
For mail contact, we ran down existing stock of leaflets with the old-style forms on, and all new forms where we collect personal details are being produced with the new opt-in statements.
If you're speaking to us by phone or email, then we will check the last time we have had any recorded preferences from you and ask you if this is still what you'd like. Where possible, we'll direct you to where you can make your own choices online. If that's not possible or convenient for you, we can do it for you and record the date you told us.
How will we ensure these permissions are always up to date?
We must give you - our supporters - every opportunity to tell us your contact preferences. We'll always overwrite these with the latest preferences you give us, even if they are only a day apart. We can see all the dates your preferences were changed, in case you were to ask us.
There's a ‘Change my preferences’ button on every marketing email we send you, and it links to a simple contact form - you don't have to log in, it takes seconds to complete.
- Brand new supporters are always asked for their contact preferences.
- All donation thank-you letters, appeals, and newsletters have a line about how to change your contact preferences.
- Reminders will appear in our e-newsletter and on social media.
- As you approach the end of your 2-year permissions, we'll send you an email, letter or call you to ask you to update your preferences if you haven't already.
- On SMS, you are given an opportunity to stop future texts in every message, just by replying with one keyword.
- We also record if you are registered with the Fundraising Preference Service, or if you told us you don't want thank-you letters or you don't want to hear about raffle or lottery activity.
What if I call up and say ‘take me off your mailing lists’?
We have a duty to let you know that the best way for us to be sure we don’t contact you again is to minimise the data we hold on you and ‘block’ these details from being contacted, rather than delete them completely. It’s best practice (as advised by the Information Commissioner’s Office) to hold ‘suppressed’ records, rather than to delete them, so that we can make sure that we’re never able to accidentally contact you again should we acquire your details from somewhere else in future.
If you have a special reason for asking for us to delete all record of you - just let us know, and of course we can do that.
I have more questions!
Please have a look at the other pages in the MY DATA section, such as:
If you have any other questions, call 0121 522 7007, email firstname.lastname@example.org or write to us at FREEPOST Rethink Mental Illness and we'll do our best to help.