Privacy policy

This Privacy Policy sets out how and why MAP collects, uses, stores and protects personal data, and outlines your rights in relation to that information. This Privacy Policy applies to people who engage with MAP, including our supporters, donors, campaigners, and members of the public - including visitors to our website and premises.

If you work with us in another way - for instance apply for a job or are a member of staff or volunteer with us, there may be a separate Privacy Policy which describes how we use that data.

For details about your rights in relation to your personal data, please see the 'Your Rights' section below. If you would like to exercise any of these rights or have any questions about how we handle your information, please contact us at [email protected] or by calling +44 (0)20 7226 4114.

Medical Aid for Palestinians (MAP) is a Charitable Company Limited by Guarantee. Our registered Company Number is 3038352. Our Charity Registration Number is 1045315. Our registered address is 50 Featherstone Street, London, England, EC1Y 8RT.

As a UK-registered charity, MAP complies with UK data protection laws, including the UK GDPR and Privacy Electronic Communication Regulation (PECR). Even if you are outside the UK, we will always aim to apply the same standards and give you the same rights over your personal data.

References to “we” or “us” throughout this policy are to MAP.

MAP is regulated by the Information Commissioner’s Office (ICO), the UK’s data protection authority. You can contact the ICO at www.ico.org.uk or by calling 0303 123 1113. MAP’s appointed Data Protection Officer (DPO) is Carina Thompson. All data protection queries or complaints should be directed to [email protected] or +44 (0)20 7226 4114.

MAP works in partnership with Palestinian communities to uphold their rights to health and dignity. We do this by developing effective, sustainable and locally-led healthcare services, providing medical aid during emergencies, and campaigning to break down the barriers to Palestinian health and healthcare today and for the future.

Through our offices in the West Bank, Gaza, East Jerusalem, Lebanon and London, we work with trusted and experienced local partners to achieve this vision.

We may collect personal data when you interact with MAP, including when you:

• Donate or fundraise for us
• Sign-up to receiving updates or campaign actions
• Contact us by phone, email or post
• Interact with us through this website or social media
• Participate in campaigning or advocacy activities

We only collect personal data relevant to the type of interaction you have with MAP. Whatever your interaction with us this information will be minimal and linked to the purpose for which we need it. The information we collect may include your:

• Name
• Postal address
• Email address
• Phone number
• Donation history
• Communication preferences
• Records of correspondence or interactions with MAP

Information provided during phone calls, emails or other interactions may be recorded on our supporter database so we can respond to enquiries, maintain accurate records and manage our relationship with supporters.

When you visit our website, we may automatically collect limited technical information, such as:

• IP address
• Browser type
• Device information
• Website pages visited

This helps us understand how people use our website and allows us to improve our services and online experience.

More information about how we use cookies can be found in our Cookie policy.

As part of our fundraising activities, we may use publicly available information together with information you have already provided to us.

This may include information from sources such as:

• Publicly available company records (for example Companies House)
• Professional networking platforms such as LinkedIn
• Media or news articles
• Publicly available lists relating to philanthropy or charitable giving

We may carry out prospect research, supporter profiling or wealth screening to help us identify individuals who may have an interest in supporting our work, and to better understand our existing supporters.

This may involve working with trusted third-party data providers who analyse publicly available information to help us understand potential supporters and improve our fundraising activities. This type of research helps ensure our fundraising is relevant, proportionate and cost-effective, and reduces the likelihood of contacting people who are unlikely to have an interest in our work.

We only use information that is publicly available or already known to us, and we do not obtain private or confidential information about individuals.

This processing is carried out on the basis of legitimate interests, which we have assessed to ensure it is proportionate and respects individuals’ rights.

You have the right to object to your information being used in this way at any time by contacting us at [email protected] or calling +44 (0)20 7226 4114.

MAP uses personal information to manage relationships with supporters and to support our charitable work. This may include:

• Processing and recording donations
• Responding to enquiries, feedback or complaints
• Sending marketing information and updates about MAP’s work, campaigns, events and fundraising activities
• Supporting community fundraising and volunteering activities
• Analysing engagement with our communications and activities
• Improving our services and communications
• Claiming Gift Aid where applicable
• Maintaining records to ensure we respect communication preferences
• Complying with legal and regulatory requirements

MAP does not use any form of automated decision-making that has legal or similarly significant effects on individuals.

Data protection law requires organisations to have a lawful basis for processing personal data. MAP mainly relies on the following:

Consent: We rely on consent where you have clearly agreed for us to use your personal information for a specific purpose, such as receiving email marketing updates.

You can withdraw consent at any time by contacting us at [email protected] or +44 (0)20 7226 4114 or by using the unsubscribe option in all our marketing communications (email, SMS etc.).

Legitimate interests: We may process your personal data where it is necessary for MAP’s legitimate interests as a charity and where this does not override your rights.

For example, for sending direct marketing information by post. We will only apply legitimate interest where we have reason to believe you would be interested to hear about our projects, fundraising activities and appeals. We will always provide a clear way to opt out of such marketing if you do not wish to receive it.

Legal requirements: In some circumstances we are required to process personal data to comply with legal obligations. For example, where Gift Aid is claimed we must retain certain information to meet HRMC requirements.

MAP does not sell or exchange personal data with other organisations. We may share information with trusted third parties where necessary to support our work. These may include:

• Mailing and fulfilment services
• Payment processors
• IT service providers
• Marketing or communications agencies
• Data analysis providers

Where third parties process personal data on our behalf, this is done under contract and in accordance with strict data protection requirements. We may also share information where required by law or where necessary to protect MAP, our staff, or the public.

Where personal data is transferred outside the UK or European Economic Area, we ensure appropriate safeguards are in place to protect that information, such as approved contractual clauses or transfers to countries with recognised data protection standards.

We only retain personal data for as long as necessary for the purposes for which it was collected or to comply with legal requirements.

Typical retention periods include:

• Supporter contact details retained for up to four years after the last recorded interaction
• Gift Aid records retained for seven years to meet HMRC requirements
• Limited information retained on suppression lists to ensure we respect requests not to be contacted

MAP uses appropriate technical and organisational measures to protect personal data. These include access controls, secure systems and regular reviews of our data security practices.

Staff are trained to handle personal information securely and in accordance with data protection requirements.

If a serious data breach occurs that affects personal data, we will report it to the Information Commissioner’s Office where required and inform affected individuals if there is a significant risk to their rights.

Under data protection law, you have several rights regarding your personal data. These include the right to:

• Request access to the personal data we hold about you
• Ask us to correct inaccurate or incomplete information
• Request deletion of your personal data in certain circumstances
• Ask us to restrict how we use your information
• Object to certain types of processing, including direct marketing
• Withdraw consent where we rely on consent to process your data

You can exercise these rights by contacting [email protected].

We will normally respond within one month. In some cases, we may need to verify your identity before responding to a request.

If your complaint is not dealt with to your satisfaction, you can raise this with the UK regulator, the Information Commissioner's Office (ICO), via their website at www.ico.org.uk or on 0303 123 1113.

Alternatively, if you are located in the European Union, you can raise this with your nation’s data protection authority. You can find their contact details here: https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm

We do not knowingly collect personal information from children under 13 (or in the EU, under the age of 16 years of age) without the direct involvement of the minor's parents or guardians. If we learn that we have collected or received Personal Information from a child under 13 or Personal Data from a child in the EU under the age of 16 without parent or guardian consent without legally-valid consent or other legal basis, we will take reasonable steps to delete that information.

If you believe that we might have any Personal Information from or about a child under 13 or Personal Data from a child in the EU under the age of 16, please contact us at [email protected]

We want our communications to be relevant and respectful. We may contact supporters by post, phone, email or text, depending on the preferences you have provided and where permitted by law.

You can change your communication preferences or opt out of marketing communications at any time by contacting [email protected].

Meta (Facebook & Instagram) marketing: MAP uses social media platforms such as Facebook, Instagram, X and YouTube to share updates and promote our work.

We may use tools provided by platforms such as Meta, including the Meta Pixel and Conversion API (CAPI), to understand how people interact with our website and improve our advertising. This may involve sharing limited information such as your device information, or actions taken on our website.

If you use these social media platforms, your personal information will also be governed by the platform provider’s own privacy policy.

Cookies: Cookies are small text files on your device. They are made by your web-browser when you visit a website. Every time you go back to that website, your browser will send the cookie file back to the website's server. Cookies are useful because they allow a website to recognise a user's device.

You can find more information about how MAP uses cookies in our Cookies policy.

This privacy policy may change from time to time. For example, we will continue to update it to reflect new legal requirements.

If we make any significant changes in the way we treat your personal information, we will make this clear on our website or by contacting you directly.