Additional rights for individuals located in the EU/UK
If you're a resident of the European Union (EU), European Economic Area (EEA) or United Kingdom (UK), and we collect your personal information, the following additional information applies to you ("EU/UK Privacy Notice"). We may amend this EU/UK Privacy Notice from time to time and will inform you of any significant changes.
Introduction
If you're an EU, EEA or UK resident and Starlight collects your personal information, we’ll do so in accordance with applicable laws that regulate data protection and privacy. This includes, without limitation, the EU General Data Protection Regulation (2016/679) ("GDPR"), applicable EU member state laws that implement or regulate the collection, processing and privacy of your personal data as well as the UK version of the GDPR as it forms part of the laws of the United Kingdom by virtue of section 3 of the European (Withdrawal) Act 2018 ("UK GDPR") and the UK Data Protection Act 2018 (together known as "EU/UK Data Protection Laws"). In this Appendix, "personal data" has the meaning given to that term in the EU/UK Data Protection Laws).
This EU/UK Privacy Notice should be read in conjunction with Starlight's Privacy Policy, which provides further information as required under the EU/UK Data Protection Law on how we collect, use, store or disclose your personal data and with whom we may share it.
This Appendix A also provides information on your legal rights under EU/UK Data Protection Law and how you can exercise them.
How long do we keep your personal data for?
We will only use and store personal data for so long as it is required for the purposes it was collected for and as specified in our archiving guidelines, which we review regularly. How long personal data will be stored for depends on the personal data in question and what it is being used for, as well as whether there is any legal or regulatory obligation for retaining the personal data.
How do we store and transfer your data internationally?
As Starlight is a charity head quartered in Australia, we may transfer, process and store your personal data outside of your country of residence, including in Australia. We want to make sure that your personal data is stored and transferred in a way which provides appropriate protection. We will therefore only transfer personal data in a manner which is compliant with EU/UK Data Protection Laws and the means of transfer provides adequate safeguards in relation to your data.
Direct marketing
If Starlight provides direct marketing communications to individuals in the EU/EEA, this will be done in accordance with applicable EU/UK Data Protection Laws. In particular, we will only contact you for direct marketing purposes by SMS, email, social media, and/or any other electronic communication channels if you have opted in to receive such direct marketing or we are otherwise permitted to undertake direct marketing in accordance with applicable EU/UK Data Protection Laws. You’re also free to object or withdraw your consent to receive direct marketing from us at any time by contacting us at mail@starlight.org.au.
Legal bases for us processing your data
There are a number of different ways that we are lawfully able to process your personal data. We have set these out below.
Where using your data is in our legitimate interests
We are allowed to use your personal data where it is in our interests to do so, and those interests are not outweighed by any potential prejudice to you.
We believe that our use of your personal data is within a number of our legitimate interests, including but not limited to:
to help us effectively manage and operate our charity in a consistent manner across all countries and territories
Example: we may use your personal information to process your donations or other payments and verify financial transactions.
for our internal administrative purposes
Examples: we may use your personal information where necessary to keep a record of your relationship with us or to contact you with a query about a donation or where you have contacted Starlight.
We don't think that any of the activities set out in this EU/UK Privacy Notice will prejudice you in any way. However, you do have the right to object to us processing your personal data on this basis. We have set out details regarding how you can go about doing this in the section ‘Your rights’ below.
Where using your personal data is necessary for us to carry out our obligations under our contract with you
We are allowed to use your personal data when it is necessary to do so for the performance of our contractual obligations to you and/or enforce our rights.
Where processing is necessary for us to carry out our legal obligations
As well as our obligations to you under any contract, we also have other legal obligations that we need to comply with and we are allowed to use your personal data when we need to in order to comply with those other legal obligations.
Your rights
You have various rights in relation to the data which we hold about you. We have set these out below.
Right to access your data
You may ask us for a copy of the information we hold about you at any time, and request us to modify, update or delete such information. We will respond to your request within one month. That period may be extended by two further months where necessary, taking into account the complexity and number of requests. We may request proof of identification to verify your request. If we provide you with access to the information we hold about you, we will not charge you for this unless permitted by law. If you request further copies of this information from us, we may charge you a reasonable administrative cost. Where we are legally permitted to do so, we may refuse your request. If we refuse your request we will usually tell you the reasons for doing so.
Right to erasure
You have the right to request that we "erase" your personal data in certain circumstances. Normally, this right exists where:
the data are no longer necessary;
you have withdrawn your consent to us using your data, and there is no other valid reason for us to continue (where the processing is based on consent);
the data has been processed unlawfully;
it is necessary for the data to be erased in order for us to comply with our obligations under law; or
you object to the processing and we are unable to demonstrate overriding legitimate grounds for our continued processing.
We would only be entitled to refuse to comply with your request for erasure in limited circumstances and we will usually tell you our reason for doing so.
Right to restrict processing
You have the right to request that we restrict our processing of your personal data in certain circumstances, for example if you dispute the accuracy of the personal data that we hold about you or you object to our processing of your personal data for our legitimate interests. If we have shared your personal data with third parties, we will notify them about the restricted processing unless this is impracticable or unlawful. We will, of course, where lawful to do so, notify you before lifting any restriction on processing your personal data.
Right to rectification
You have the right to request that we rectify any inaccurate or incomplete personal data that we hold about you. If we have shared this personal data with third parties, we will notify them about the rectification unless this is impracticable or unlawful. You may also request that we notify the third parties that we have disclosed the inaccurate or incomplete personal data to and any correction made to the personal data. Where we think that it is reasonable for us not to comply with your request, we will usually explain our reasons for this decision.
Right of data portability
If you wish, you have the right to transfer your personal data between service providers. In effect, this means that you are able to transfer the details we hold on you to another third party, without hindrance. To allow you to do so, we will provide you with your data in a commonly used machine-readable format so that you can transfer the data. Alternatively, we may directly transfer the data for you.
Right not to be subject to automated decision making
This right enables you to not be subject to a decision based solely on automated processing including profiling which produces legal effects on you or similarly affects you.
Right to object
This right enables you to object to us processing your personal data where we do so for one of the following reasons:
because it is in our legitimate interests to do so; or,
for scientific, historical, research, or statistical purposes.
We will stop such processing unless we can demonstrate compelling legitimate grounds for the processing which overrides your interests or if the processing is necessary for the establishment, exercise or defense of legal claims.
Right to withdraw consent
Where we have obtained your consent to process your personal data for certain activities, you may withdraw this consent at any time and we will cease to use your data for that purpose unless we consider that there is an alternative legal basis to justify our continued processing of your data for this purpose, in which case we will inform you of this condition.
Right to complain
You also have the right to lodge a complaint with a supervisory authority. Our supervisory authority is the Information Commissioner's Office ("ICO") in the UK. Contact details for the ICO are set out below:
Phone: 0303 123 1113
Email: icocasework@ico.org.uk
Post: Public Advice and Data Protection Complaints Service, Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow SK95AF
The privacy regulators for other EU Member States are listed (along with contact details) here.
If you would like to exercise any of these rights, or withdraw your consent to the processing of your personal data (where consent is our legal basis for processing your personal data), please contact us using the contact details set out below. We will respond to your request within one month. Please note that we may keep a record of your communications to help us resolve any issues which you raise.
Contact Us
If you'd like to make a complaint, would like to exercise one of your data protection rights, or have any comments or suggestions concerning this EU/UK Privacy Notice please do not hesitate to contact us via email at mail@starlight.org.au.