Privacy policy

This Privacy Policy sets out how and why we obtain, use, store, and protect any personal information that we may hold on you. For avoidance of doubt, ‘Personal data’ means any information we hold about you that can be linked to you in any way. This Privacy Policy applies to our supporters, donors, volunteers, and members of the public - including visitors to our website and premises. For details about your rights in relation to your personal data, please see the 'Your Rights' section below. If you would like to exercise any of these rights or have any questions about how we handle your information, please contact us at [email protected] or calling +44 (0)20 7226 4114.

Medical Aid for Palestinians (MAP) is a Charitable Company Limited by Guarantee. Our registered Company Number is 3038352. Our Charity Registration Number is 1045315.

Our registered address is 50 Featherstone Street, London, England, EC1Y 8RT.

As a UK-registered charity, MAP complies with UK data protection laws, including the UK GDPR and Privacy Electronic Communication Regulation (PECR). Even if you are outside the UK, we will always aim to apply the same standards and give you the same rights over your personal data.

References to “we” or “us” throughout this policy are to MAP.

MAP is regulated by the Information Commissioner’s Office (ICO), the UK’s data protection authority. You can contact the ICO at www.ico.org.uk or by calling 0303 123 1113.

MAP works in partnership with Palestinian communities to uphold their rights to health and dignity. We do this by developing effective, sustainable and locally-led healthcare services, providing medical aid during emergencies, and campaigning to break down the barriers to Palestinian health and healthcare today and for the future.

Through our offices in the West Bank, Gaza, East Jerusalem, Lebanon and London, we work with trusted and experienced local partners to achieve this vision.

At MAP, we take your privacy seriously. The following principles guide how we handle your personal data;

1. We only collect what we need to communicate with you and support our charitable activities.
2. We use your data fairly and legally, based on consent, legal obligations, or legitimate interest.
3. You are in control. You can update your information and manage your preferences or consent decisions at any time.
4. We keep your data safe with strong security measures.
5. We are transparent about how we use your data.
6. We respect your rights and choices and never sell your personal information.
7. We only keep data for as long as it is needed to provide our services or comply with the law.
8. We take responsibility. MAP is accountable for the personal data we hold and ensuring it is handled properly.

This policy applies to the personal data we hold and use about people who support our work.  This includes:

• Donors and community fundraisers
• Campaigners
• Volunteers

We collect and store two types of information:

• Personal identifiable information:

This is information that can identify you personally, such as your name, postal address, email address and phone number. We will also hold details of any donations, campaign actions or transactional services you may make with us, together with your marketing communications preferences. Additionally, we may hold information you share with us about yourself, such as your interests or affiliations with other charities or community groups, and relevant information obtained from publicly available sources.

Non-personal information:

This is information that does not identify you personally, such as IP address and website activity. This helps us to determine how many people use our website, the frequency of visits and how popular our pages are. This information doesn’t tell us anything about who you are or your address; it simply allows us to monitor and improve our website and services.

If you use a credit or debit card to donate to us via our website, your card details are processed through third party payment providers who comply with the Payment Card Industry Security Standards. This means that your card information is never captured or stored by MAP or its card payment provider.

As a fundraising organisation, we may use publicly available information and wealth screening data, together with any information you have already provided to MAP, to help us communicate with you in a more personalised and relevant way. This can include publicly available company records, social media profiles (such as LinkedIn), electoral registers, news articles, property or political registers, and published lists of high-net-worth individuals. We may also carry out wealth screening or other research to identify people who may have an interest in supporting our work.

This processing is carried out under a legal bases (namely, legitimate interest) and is proportionate, fair, and does not override your rights. You have the right to opt out of your data being used for these purposes at any time by emailing [email protected] or calling +44 (0)20 7226 4114.

In accordance with relevant data protection legislation, there are six legitimate bases under which organisations can collect and process personal data. Of those six, we consider three of them to be applicable to the types of processing MAP carries out:

Consent

Consent means that you have clearly told us that you agree to us using your personal information for a specific purpose, such as receiving updates or marketing from MAP. For example, online donors will be asked if they want to be updated on MAP’s activities with a choice of post, email, telephone and text being offered. You can change your consent decisions at any time by emailing us at [email protected], calling +44 (0)20 7226 4114 or “opting out” of marketing emails you receive.

Under the UK Data (Use and Access) Act 2025, MAP may also rely on the “soft opt-in” rule for new supporters who have shared their details while supporting our work. This means we can send emails or texts about our projects and appeals without asking for consent each time, as long as the messages relate to our charitable aims and you can easily opt out. For more information, please refer to the ‘Marketing and Communication Preferences’ section of this policy.

Legitimate interest

Personal data may be legally collected and used if it's necessary for a legitimate interest of the organisation using the data, as long as its use is fair and doesn't adversely impact the rights of the individual concerned.

In MAP’s case, this includes research to understand supporters better, personalise communications, and make fundraising and volunteering activities more relevant and effective.

This research may involve using publicly available information or engaging trusted third-party partners, including for wealth screening and due diligence. You will always have the right to opt out of this processing by contacting [email protected] or calling +44 (0)20 7226 4114.

Legal obligation

If the law requires us to, we may need to collect and process your data.

For example, if you have added Gift Aid to a donation we must process some information for HMRC and hold this for seven years.

MAP uses personal information of supporters to:

• Deal with enquires and requests, including responding to feedback or complaints
• Administer and keep a record of donations made, and actions taken by our supporters and our communications with them
• Send supporters relevant updates about our projects, fundraising activities, events, campaigns and appeals
• Support community-based fundraising
• Analyse our fundraising and campaigning activities
• Understand how we can better improve our services and information
• Claim Gift Aid on donations
• Comply with legal and regulatory obligations that require the use of personal data, including Gift Aid, safeguarding, and donor reporting.
• Ensure we do not send unwanted information to supporters or members of the public who do not want to be contacted

MAP does not use any form of profiling or automated decision-making that has legal or similarly significant effects on individuals.

MAP never sells or exchanges our supporters' information with other organisations.

We will only share your information if:

• We are legally required to do so, for example by a law enforcement agency legitimately exercising a power or if compelled by an order of the Court
• We are working with a trusted service provider that is carrying out certain activities on our behalf. These  providers may include mailing houses, marketing agencies, IT specialists and research firms. When these organisations process personal data on behalf of MAP, this is done under a formal contract, in compliance with strict data protection requirements, and with appropriate security measures in place.
• We believe it is necessary to protect or defend our rights, property or the personal safety of our people, visitors to our premises or websites.

Information about supporters is stored by MAP in the UK whenever possible. If we do transfer personal data outside the UK or European Economic Area (for example, when we make use of services provided by international IT or cloud service providers ) we will ensure that such transfers are made under appropriate safeguards. This may include adequacy decisions or appropriate data transfer agreements that ensure your personal data remains properly protected. Further details are available on request at [email protected].

We only keep your information for as long as we need to to be able to use it for the reasons given in this privacy policy.

• Basic contact details will kept for four years after your last donation or be retained on a suppression list if you request no further contact from us.
• Where someone has left MAP a gift in their will, we will maintain our records of that pledge to carry out legacy administration and communicate effectively with the families of people leaving us a legacy.
• If you have kindly added Gift Aid to a donation, we must record the fact that you are a UK taxpayer. HMRC requires that we maintain a record of that Gift Aid for seven years after your last donation to us.

At MAP, we are committed to protecting your personal information. To do so, we use appropriate technical and organisational measures, including encryption, access controls and other IT security safeguards to manage and protect your personal information and privacy, and we review them regularly in line with industry best practices.

Our staff are trained to handle personal information securely and in line with data protection requirements. Our procedures mean that, in some cases, we may ask for proof of identity – for example, when responding to requests to access, update, or delete personal information.

In the unlikely event of a security breach that compromises our protection of personal information, we will notify the Information Commissioner’s Office within 72 hours where required by law, and we will also contact affected individuals if there is a high risk to their rights and freedoms.

You have a number of rights in relation to your personal information. You should note that these rights are not absolute, so we do not always need to comply with your requests, but we will make sure we explain our reasons to you if this is the case.

Please note that we may ask you to provide additional information to prove your identity, for example, to provide a copy of an identification document, before we allow you to exercise a right. This is for your security: we consider that we have a legitimate interest in ensuring that we only allow the correct individuals to exercise the rights to which they are entitled.

To exercise any of your rights, please contact us at [email protected] or call us on 020 7226 4114. You can do this if you would like to request a copy of any personal information we hold on you. This is known as a Data Subject Access Request. You can make this request verbally or in writing, but if possible, please email us at [email protected] to request this this. We'll supply any information you ask for as soon as possible, but this may take up to 30 days.

• Ask us to stop using or to restrict the processing of your personal data in certain cases, for example, if you believe it's no longer needed for the purpose we collected it, or if you dispute its accuracy or legitimate use.
• Withdraw your consent for us to process your data at any time, but only where such processing relies on consent as a legal basis e.g. to send you electronic direct marketing.
• Ask us to correct or complete any inaccurate or incomplete personal information we hold on you.. We may seek to verify the accuracy of the personal information before rectifying it, and in some circumstances we may need to keep a copy of the inaccurate data (for example, if we need to keep an audit trail).To update your records, please get in touch with us using the details above.
• Ask for your data to be deleted (“the right to be forgotten”) i.e. to have your personal data deleted from our database) or transferred to another organisation (“data portability”). Where you have requested that we don't send you marketing materials, we'll need to keep some limited information on you in order to ensure that you're not contacted in the future.

We will respond to any such request within 1 month. If we refuse a request, we will explain our reasons and let you know how you can challenge our decision. If you have any concerns about the way your data is being used or if you’d like to make a complaint, please contact us at [email protected] or on 020 7226 4114.

If your complaint is not dealt with to your satisfaction, you can raise this with the Information Commissioner's Office via their website at www.ico.org.uk or on 0303 123 1113.

We only want to contact you in ways that are useful, relevant and respectful of your choices. To help ensure our communications with you are relevant, we may analyse geographic, demographic and other key characteristics and behaviours relating to you; as well as your previous responses to our marketing communications. This helps us to personalise and improve your supporter experience with MAP and minimise wastage. Some of this analysis is based on data provided by you and some of this is provided by external organisations. You are in control of how we use your personal information for marketing and fundraising purposes.

When you share your contact details with us, we’ll ask how you’d like to hear from MAP - by post, email, phone or text. You can change your preferences anytime by emailing [email protected] or calling 020 7226 4114.

Under the Data (Use and Access) Act 2025, charities like MAP can send emails or texts to new supporters who have shared their details with us while supporting our work – so long as the messages relate to our charitable aims and you can easily opt out at any time.

You’ll always see an unsubscribe link or opt-out option in every message we send.

Facebook marketing

You may come across MAP naturally on Facebook through your own networks, or you might be presented with a promoted advert from us. We use targeted advertising on Facebook which allows people who are interested in our work to connect with us and become a supporter. We do this to inform, educate and engage new potential supporters. We may provide your email address, mobile number and address to Facebook, so they can determine whether you are a registered account holder with them. Our adverts may then appear when you access Facebook. Facebook deletes the data that we provide them in an encrypted format if it does not match with an account, however we want to remind our supporters and users that information shared by you or your contacts on timelines, on our page, or in private messages may be used and sold by Facebook for commercial purposes.

Other social media sites

We operate a number of social media pages (including Facebook, Twitter, YouTube and Instagram). Although this policy covers how we will use any data collected from those pages, it does not cover how the providers of social media websites will use your information. Please ensure you read the privacy policy of the social media website before sharing data and make use of the privacy setting and reporting mechanisms to control how your data is used.

Cookies

Cookies are small text files on your device. They are made by your web-browser when you visit a website.  Every time you go back to that website, your browser will send the cookie file back to the website's server. Cookies are useful because they allow a website to recognise a user's device.

You can find more information about how MAP uses cookies in our Cookies policy.

This privacy policy may change from time to time. For example, we will continue to update it to reflect new legal requirements.

If we make any significant changes in the way we treat your personal information, we will make this clear on our website or by contacting you directly.