Information about Bupa Foundation

In this privacy notice, ‘we’, 'us’ and ‘our’ mean Bupa Foundation.

We are registered with the UK data protection Regulator, Information Commissioner’s Office, under registration number ZA131459.

For our contact details, click here.

Scope of our privacy notice

This privacy notice applies to anyone who interacts with us (‘you’, ‘your’) in any way (for example by email, through our website, by phone or as a participant in our programmes). This privacy notice also applies to you if you ask us about our programmes or apply for updates from the Bupa Foundation. 

It describes how we handle your information, regardless of the way you contact us. We will provide you with further information or notices if necessary, depending on the way we interact with each other in the future.

If you have any questions about this, please contact us at dataprotection@bupa.com.

How we collect personal information

We collect personal information from you and from third parties. Please see below for more information.

Where you provide us with information about other people, you must make sure that they have seen a copy of this privacy notice and are comfortable with you giving us their information.

We collect personal information from you through your contact with us, including by phone (we may record or monitor phone calls to make sure we are keeping to legal rules, codes of practice and internal policies, and for quality assurance purposes), by email, through our websites, by correspondence you send us in the post, by your filling in applications, registration or other forms, through social media or face-to-face.

We may collect information from:

• your parent or guardian, if you are under 18 years old;
• a family member, teacher or someone else acting on your behalf;
• any service providers who work with us in relation to your product or service, if we don’t provide it to you direct, such as providing you with apps, training and education, funding grants;
• organisations who carry out customer-satisfaction surveys or market research on our behalf, or who provide us with statistics and other information (for example, about your interests) to help us to improve our products and services;
• fraud-detection and credit-reference agencies; and
• sources which are available to the public, such as the edited electoral register or social media.

We also collect information relating to individuals and organisations who have made grant funding applications from other sources as part of our due diligence process. This includes publicly available information from:

• Companies House;
• the Charity Commission;
• applicant websites;
• news articles or press coverage, and
• social media accounts.

Categories of personal information

For all of our services, we process one category of personal information about you which is standard personal information (for example, information we use to contact you, identify you or manage our relationship with you).

Standard personal information includes:

• contact information, such as your name, address, email address and phone numbers;
• details of any contact we have had with you, such as correspondence, emails and call notes;
• financial details, such as bank details for grant payments; and
• information about how you use our website, including IP addresses or other device information (please see our Cookies Policy below for more details).

For some programmes or activities, special categories of information (for example, health information that we may get from application forms you fill in) may be collected. Further information will be provided to you as part of that programme or activity about that data.

What we use your personal information for

We process your personal information for the purposes set out in this privacy notice.

We have also set out some legal reasons why we may process your personal information (these depend on what category of personal information we are processing). We normally process standard personal information if this is necessary to provide the services set out in our terms and conditions (the contract), it is in our or a third party’s legitimate interests or it is required or allowed by any law that applies. Please see below for more information about this and the reasons why we may need to process special category information.

By law, we must have a lawful reason for processing your personal information. We process standard personal information about you if this is:

• necessary to provide funding under the terms and conditions set out in our grant agreement  − if we have an agreement  with you, we will process your personal information in order to fulfil that contract (that is, to provide you and your dependants with our funding);
• in our or a third party’s legitimate interests − details of those legitimate interests are set out in more detail below;
• required or allowed by law.

Legitimate Interest

We process your personal information for a number of legitimate interests, including managing all aspects of our relationship with you, to enable us to provide programme updates and to keep you informed of, and to help us improve, our programmes and the Foundation’s activities.  More detailed information about our legitimate interests is set out below.

Taking into account your interests, rights and freedoms, legitimate interests which allow us to process your personal information include:

• to manage our relationship with you, our business and third parties who provide services for us (for example our partnered charities who help provide programmes);
• to review and process funding applications;
• to administer our programmes;
• to produce, host and distribute our podcast;
• to keep our records up to date and to provide you with marketing as allowed by law;
• to contact you about new upcoming programmes;
• to develop and carry out marketing activities and to show you information that is of interest to you, based on our understanding of your preferences (we combine information you give us with information we receive about you from third parties to help us understand you better);
• for statistical research and analysis so that we can monitor and improve products, services, websites and apps, or develop new ones;
• to contact you about market research we are carrying out;
• to enforce or apply our website terms of use, our policy terms and conditions or other contracts, or to protect our (or our grant recipients or other people’s) rights, property or safety; and
• to exercise our rights, to defend ourselves from claims and to keep to laws and regulations that apply to us and the third parties we work with.

Marketing and preferences 

We may use your personal information to send you marketing by post, by phone, through social media, by email and by text.

We can only use your personal information to send you marketing material if we have your permission or a legitimate interest as described above.

If you don’t want to receive emails from us, you can click on the ‘unsubscribe’ link that appears in all emails we send. If you don’t want to receive texts from us you can tell us by contacting us at any time. Otherwise, you can contact us at bupafoundation@bupa.com to update your contact preferences.

You have the right to object to direct marketing. Please see the section about your rights for more details.

Sharing your information

We sometimes need to share your information with other people or organisations for the purposes set out in this privacy notice.

For all our contacts, we share your information with:

• people or organisations we have to, or are allowed to, share your personal information with by law (for example, for fraud prevention or safeguarding purposes including with the Charity Commission or auditors);
• suppliers who help deliver products or services on our behalf.
• the police and other law enforcement agencies to help them perform their duties, or with others if we have to do this by law or under a court order;
• organisations that carry out surveys on our behalf;
• if we (or any member of the Bupa group of companies) sell or buy any business or assets, the potential buyer or seller of that business or those assets; and
• a third party who takes over any or all of the Bupa group of companies' assets (in which case personal information we hold about our customers or visitors to the website may be one of the assets the third party takes over).

Transferring information outside the European Economic Area

We work with companies that we partner with, or that provide services to us (such as health-care providers, other Bupa companies and IT providers) that are located in, or run their services from, countries across the world. As a result, we transfer your personal information to different countries including transfers from within the UK to outside the UK, and from within the EEA (the EU member states plus Norway, Liechtenstein and Iceland) to outside the EEA, for the purposes set out in this privacy notice.

We take steps to make sure that when we transfer your personal information to another country, appropriate protection is in place, in line with global data-protection laws.

For more information about this protection, please contact us at dataprotection@bupa.com.

How long we keep your personal information

We keep your personal information in line with set periods calculated using the following criteria.

• How long you have been a grant applicant or recipient with us;
• How long you have been participating on one or more of our programmes;
• How long it is reasonable to keep records to show we have met the obligations we have to you and by law;
• Any periods for keeping information which are set by law or recommended by regulators, professional bodies or associations;
• Any relevant proceedings that apply.

If you would like more information about how long we will keep your information for, please contact us at dataprotection@bupa.com.

Your rights

You have the right to access your information and to ask us to correct any mistakes and delete and restrict the use of your information. You also have the right to object to us using your information, to ask us to transfer information you have provided, to withdraw permission you have given us to use your information and to ask us not to use automated decision-making which will affect you. For more information, see below.

You have the following rights (certain exceptions apply).

• Right of access: you have the right to make a request for details of your personal information and a copy of that personal information
• Right to rectification: you have the right to have inaccurate information about you corrected or removed
• Right to erasure ('right to be forgotten'): you have the right to have certain personal information about you deleted from our records
• Right to restriction of processing: you have the right to ask us to use your personal information for restricted purposes only
• Right to object: you have the right to object to us processing your personal information in cases where our processing is based on a task carried out in the public interest or where we have let you know it is necessary to process your information for our or a third party’s legitimate interests. You can object to us using your information for direct marketing and profiling purposes in relation to direct marketing.
• Right to data portability: you have the right to ask us to transfer the personal information you have given us to you or to someone else in a format that can be read by computer.
• Right to withdraw consent: you have the right to withdraw any permission you have given us to handle your personal information. If you withdraw your permission, this will not affect the lawfulness of how we used your personal information before you withdrew permission, and we will let you know if we will no longer be able to provide you with your chosen product or service.
• Right in relation to automated decisions: you have the right not to have a decision which produces legal effects which concern you or which have a significant effect on you based only on automated processing, unless this is necessary for entering into a contract with you, it is authorised by law or you have given your permission for this. We will let you know if we make automated decisions, our legal reasons for doing this and the rights you have.

Please note: Other than your right to object to us using your information for direct marketing, your rights are not absolute. This means they do not always apply in all cases, and we will let you know in our correspondence with you how we will be able to meet your request relating to your rights.

If you make a request, we will ask you to confirm your identity if we need to, and to provide information that helps us to understand your request better. We have 21 days to respond to requests relating to automated decisions. For all other requests we have one month from receiving your request to tell you what action we have taken.

In order to exercise your rights please contact dataprotection@bupa.com.

Data protection contacts

If you have any questions, comments, complaints or suggestions relating to this notice, or any other concerns about the way in which we process information about you, please contact our Privacy Team at dataprotection@bupa.com. You can also use this address to contact our Data Protection Officer.

You also have a right to make a complaint to your local privacy supervisory authority. Our main establishment is in the UK, where the local supervisory authority is the Information Commissioner:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
United Kingdom
SK9 5AF

Phone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

You can also make a complaint with another supervisory authority which is based in the country or territory where:

• you live;
• you work; or
• the matter you are complaining about took place.