Privacy policy.
This Policy explains how and why we collect and use your personal information and explains your related rights and options.
Who we are and how to contact us:
The Clewer Initiative is a charity whose main objective is to challenge, combat and reduce modern slavery and human trafficking. We exist to raise awareness and mobilise interested communities to take action, promote victim identification and provide victim care and support.
For the purposes of applicable data protection law (mainly the UK General Data Protection Regulation and the Data Protection Act 2018), The Clewer Initiative is the “controller” of your personal information. That means that we determine the purposes (the why) and the means (the how) of using your personal information, and that we take on legal obligations to you.
The Clewer Initiative is registered with charity number 1186900.
If you have any questions about this Policy or our use of your personal information, you can contact us at: info@clewer.org.uk
How do we collect your personal information?
We collect your personal information in a number of different ways:
From you directly (for example when you make an enquiry via a website, make a report using our Safe Car Wash app or website or when you use our services)
From you indirectly (for example information collected about your use of our website via cookies used on our website, or information which you post on our social media account)
When you give permission for third parties to share it with us (for example where someone has identified you as a potential victim and we want to offer care and support, or if you are working with another charity or service provider)
What personal information do we collect and use?
The personal information we collect and use depends on what you, or others, provide. Typically – but not exhaustively – this includes:
Your full name
Your contact details (phone number and email address)
Any information you choose to provide to us as part of your enquiry, report or other use of our services
Your gender
Next of kin / emergency / support contact details
Details of your experience as a victim of modern slavery or human trafficking
Your current employment and accommodation situation (to the extent relevant to our services)
Details of your relationship with us (for example as a beneficiary or supporter) or how you learned about us
Information about how you use your website
Information on your social media profiles / accounts (to the extent you interact with our social media pages / accounts)
Some bank account information (only to process donations)
Whether you are a UK taxpayer (for Gift Aid purposes, if relevant)
Your job title (where we interact professionally, for example when giving training)
Why do we use your personal information?
Typically – but not exhaustively – we use personal information for the following reasons:
Responding to your enquiry, report or request for support
Providing you with the advice and support you have requested
Keeping you up to date with our work, such as how we are campaigning to help victims, raising awareness and expanding understanding. This might include letting you know about services we offer and hope to offer in the future, or keeping you informed of ongoing activities, news, campaigns and funding appeals, or to invite you to events we think may be of interest
To raise funds and process donations and Gift Aid declarations
Providing you with our services and ongoing support in line with our charitable objectives
To monitor the quality of, and develop and improve, our services
To improve our communications and make our website better suited to your needs
Considering your circumstances in order to recommend the most appropriate of our services
Maintaining and updating internal records we are required to keep under applicable law
To train our staff and people working on our behalf, or others in the same line work, to provide our services or similar services
To provide corporate or organisational training
To comply with legal obligations which apply to us (for example if we are obliged to disclose personal information via a court order to law enforcement bodies)
Using your story as a victim, on an anonymous basis, to draw attention to the problem, promote our activities and services and campaign to achieve our charitable objectives
To carry out statistical analysis to assess trends in modern slavery and human trafficking
To prevent or detect crime
To carry our market research
Our lawful basis for using your personal information
UK data protection law requires us to have a “lawful basis” to collect and use your personal information. A lawful basis is a justification for collecting and using your personal information which is recognised and permitted by applicable data protection law.
Depending on the purposes for which we use your personal information, we may rely on one of the following lawful bases:
Consent: where you give us clear consent to collect and use your personal information for a specific purpose. For example, if you agree to act as a case study, where you want to receive email updates about our work and fundraising and where we need to work with medical professionals.
Performance of a contact: where we need to use personal information to perform a contractual obligation, for example to process a donation or to provide our services.
Legal obligation: when we need to use personal information to comply with applicable law (not including contractual obligations).
Vital interests: in rare circumstances it may be necessary for us to use your personal information to protect the vital interests of you or another individual (for example to provide your details to a medical professional in the case of a medical emergency).
Performing a task carried out in the public interest: using your personal information is necessary to perform a task in the public interest. For example, where we provide you with support, assistance or care in order.
Legitimate interests: where using personal information is necessary to achieve our, your or society’s “legitimate interests”. As a general comment, “legitimate interests” means any valid and genuine operational, charitable, legal or medical reason to collect and use personal information. We will only rely on this lawful basis where, on balance, the impact of our doing so does not pose an undue risk of adverse impact for you.
Special category personal data
Where we need to collect and use special category persona data (please see above), for example information concerning health, in addition to a lawful basis we also need to satisfy an appropriate legal “condition”. In essence, this is an additional lawful basis (i.e. recognised and permitted justification for using your special category personal data).
Depending on the relevant use of your special category personal data, we rely on the following conditions:
You have provided your explicit consent in advance
We need to use your special category personal data to provide or connect you with health or social care services
We need to use your special category personal data to protect your or another person’s vital interests where that person is physically or legally incapable of giving consent (for example, providing your details to a medical professional in a medical emergency)
You have knowingly and willingly made the information generally available to the public
Use of personal information is necessary for the establishment, exercise or defence of legal claims (for example, providing information to a court where a claim has been made)
Collection and use is necessary for strong public interest reasons, such as:
the provision of confidential counselling, advice or support;
support for individuals with a particular disability or medical condition;
safeguarding of an individual at risk;
safeguarding of the economic or emotional well-being of an individual;
Children’s personal information
Depending on the victim or the nature of the crime, we sometimes need to collect and use personal information about children (whether children of victims or child victims themselves).
More broadly, personal information about children may be collected when they e.g. attend our events or participate in fundraising activities. This will always be based on parental / guardian consent if the child is under the age of 13.
Where we collect and use children’s personal information, we apply enhanced information security measures and access controls, and apply greater scrutiny than usual to our usage.
Sharing your personal information with third parties:
We will not share your personal information with third parties without your consent unless the law allows us to. We may disclose your personal information to the following third parties, to enable us to provide our services, fulfil our charitable objectives or comply with our legal obligations:
Third parties who help us provide care, advice and support
Medical professionals where this is appropriate in the circumstances
Analytics and search engine providers that help us improve the functionality and experience of our website and how you use it
third parties in connection with or as a result of restructuring or reorganisation of our operations, for example if we merge with another charity. In such event we will undertake due diligence to ensure that the relevant third party can comply with applicable data protection law
third parties to whom we are required to disclose personal information under a legal obligation (for example for the purposes of fraud prevention or tax compliance)
we also need to disclose personal information to third parties that provide services for us, for example our legal advisors, accountants, IT service providers (such as our website host or Safe Car Wash app platform provider) and parties providing mailing and marketing services. We select all our service providers with care and only share with them the minimum amount of personal information required to provide their service. We put appropriate agreements in place that require third parties to comply with data protection law and protect your personal information with the same care as we do
Public authorities, government departments, statutory agencies and regulators, such as the police, HMRC, HMCTS, the Charity Commission or the ICO.
The Church of England and local churches (given our continued ties and work in conjunction with the Church)
Partnerships and collaborations with other charities or social enterprises to raise awareness and develop practical tools
Where necessary to establish, exercise or defend legal rights
Security
We are committed to ensuring that your personal information is secure when in our care.
We implement technical (i.e. IT / technological) and organisational (i.e. physical / documentary) measures to ensure a level of security appropriate to the potential risks which may arise from our use of your personal information. For example:
Where we use cloud storage services, our records are kept encrypted at rest and cannot be accessed without providing a complex password.
All persons authorised to access and use personal information as part of their role with the Clewer Initiative are required to undergo appropriate training and must understand and comply with organisational and technical measures that we have put in place.
We have put in place procedures to deal with any information security incidents (such as a malware attack or unexpected system failure) and will notify you and any applicable regulator of any such incident where we are legally required to do so.
We always ensure that access to your personal information is restricted on ‘need to know basis’, i.e. to those members of our staff, volunteers and contractors who need to access personal information to fulfil their roles. For example, to offer you counselling services, we need to know about the background of your experience and trauma and your current state of mental health and wellbeing. All authorised persons are appropriately trained and commit to ensuring confidentiality and security of your personal information.
Please note, we interact via the internet and email, and no external data transmission over the internet can be guaranteed to be 100% secure. While we strive to safeguard your personal information and mitigate any risks as far as possible, we cannot guarantee the security of the information you provide online and you do this at your own risk.
Transfers of personal data to other countries
While the Clewer Initiative is a UK-based charity which carries out most of its work in the UK and in conjunction with UK-based organisations, modern slavery and human trafficking are intentional problems.
Over the last few years, the Clewer Initiative has developed an international body of work in Italy, Ghana and Tanzania, and has worked with a variety of partners and networks to help build community resilience, raise awareness and support victims (for example working with similar organisations or police in other jurisdictions).
Carrying out such international work, or where necessary due to financial (e.g. payment processing) or technical (e.g. website hosting or cloud storage) reasons, we may need to transfer your personal information to, or allow it to be accessed form, countries outside the UK which are subject to different data protection laws (i.e. which offer you varying levels of protection). Some countries – for example countries in the European Economic Area – have data protection law which offers the same standard of protection. However, some jurisdictions offer a lower standard of protection.
Where this happens, we will ensure you’re your personal information is protected as if it were being held in the UK. This will usually be because we have entered into a contract with the third party which contains contractual clauses which put the recipient under obligations when using your personal data similar to obligations under UK data protection law.
Keeping your personal information up to date
We take care to ensure that your personal information we hold is up to date and we would really appreciate it if you could let us know when your contact details or other relevant information change.
How long will we keep your personal information?
As a general comment, we will only hold your personal information for as long as we need it to fulfil the purposes of collecting and using it, or a related purpose. For example, we normally keep your information from the last point of your contact with us for a further seven years, broadly because this is the amount of time you have to commence legal proceedings if you are unsatisfied with the standard of our services.
Where we rely on your consent to contact you for direct marketing or fundraising purposes, we will treat your consent as lasting only for as long as it is reasonable to believe that you remain interested in hearing from us. If you ask us to stop contacting you with marketing or fundraising materials, we will keep a record of your contact details on our marketing suppression list to ensure we comply with your request.
Automated decision making
Automated decision-making is when a computer or similar electronic system uses personal information to make decisions about people without any human involvement. Profiling involves collecting various pieces of information about a person in order to analyse or evaluate certain aspects relating to that person or to make predictions about them (for example, how that person may behave or what their preferences are). Automated decision-making does not have to involve profiling, though it often will.
We do not use your personal information in automated decision-making, including profiling (i.e. we do not create profiles or make decisions about you based solely on automated decision-making without human involvement). If that changes, we will tell you.
Your rights and how to exercise them
You have a number of specific rights with regards to your personal information:
Right of access – You can contact us to find out what personal information we hold about you, and ask for copies of the records which contain that personal information.
Right of rectification – If you believe that any of your personal information that we hold is incorrect or incomplete, please contact us as soon as possible. We will correct any information found to be incorrect.
Right of erasure – If you want to remove your personal information from our records, you can contact us to ask us to do so. We will remove the information as far as it is practical within our power, and where we are not legally obliged or entitled to retain it.
Right to object – contact us if you want to formally object how we are using your personal information. This right only applies in certain circumstances.
Right of restricting processing – you might be able to restrict how we use your information if you have made a valid objection. You can ask us to suspend a particular use of your personal information, for example if you want us to establish its accuracy or you’re questioning our lawful basis for processing it. This right only applies in certain circumstances.
Right of portability – you may have the right to have the personal information we hold transferred to another organisation.
Right to complain – if unhappy with how we are using your personal information, you can lodge a complaint with the ICO (the UK data protection regulator: https//ico.org.uk). If you have any concerns about how we have used your personal information, we would appreciate it if you contacted us in the first instance so that we can consider your concerns and see if we can address them.
To exercise your rights, please contact info@clewer.org.uk. Please note that some of these rights only apply in specific circumstances (such as the right to erasure or right to restrict).
Links to other websites
Our website may contain links to other websites, for example social media websites or websites of organisations we work with to provide our services. We are not responsible for those websites or their data protection compliance practices. Please note that we do not have any control or influence over the relevant website or controller of your personal information. You should view the privacy policies of the relevant website to learn more about how those controllers collect and use your personal information (which may be different from how we use it).
Changes to this Privacy Policy
This Privacy Policy will be revised and updated from time to time to reflect any changes to the way we handle your personal information or new legal requirements. We will advertise any changes on our website or, if the changes are material, we will bring them to your attention directly.
This Policy was last updated on 31st January 2025.