The privacy and security of your personal information is extremely important to us. This privacy policy explains how and why we use your personal data, so you can be confident about giving us your information. We have robust and effective processes in place which comply with existing law and regulations to ensure we meet the standards required under UK GDPR, PECR, the DUA Bill and the UK’s Data Protection Act 2018
This policy applies if you’re a supporter of Epilepsy Research Institute in any capacity (fundraiser, donor, volunteer, customer, employee) or use any of our services, visit our website, email, call or write to us.
We’ll never sell your personal data and never share your information with companies for their own purposes. We will only share it with organisations we work with when it’s necessary and the privacy and security of your data is assured.
In this policy, whenever you see the words ‘Institute’, ‘we’, ‘us’, ‘our’, ‘ERIUK’, it refers to the Epilepsy Research Institute UK (Institute). Epilepsy Research Institute UK (registered charity number 1100394) is a company limited by guarantee registered in England, registered company number 4873718.
Any information which identifies you, or which can be identified as relating to you personally for example, name, address, phone number, email address counts as personal data. We’ll only collect and use the personal data that we need under a lawful basis. We collect personal data in connection with specific activities such as donations, entering an event, placing an order, volunteering, conducting research, employment etc.
Personal data you provide
You may give us your personal data by corresponding with us via letter, phone or email, filling in forms on our website, registering for an event, placing an order or subscribing to social media functions. Your activities and involvement with us will result in personal data being created. This could include details of how you’ve helped us by fundraising, volunteering or being involved with our other activities. If you decide to donate to us then we’ll keep records of when and how much you give.
Volunteers and Shape Network
If you’re a volunteer then we may collect extra information about you (e.g. references, criminal records checks, details of emergency contacts, medical conditions etc.). This information will be retained for legal or contractual reasons, to protect both yourself, and us (including in the event of an insurance or legal claim) and for safeguarding purposes. This data is only kept for as long as it is necessary to fulfil its purpose as per the Institute’s Data Retention Policy.
Information we generate
We may conduct research and analysis on the information we hold, which can in turn generate personal data. For example, by analysing your interests and involvement with our work we may be able to build a profile which helps us decide which of our communications are likely to interest you.
We’ll only use your personal data on fair, transparent and lawful grounds as permitted by the UK General Data Protection Regulation; UK Data Protection Act; Privacy of Electronic Communication Regulation & DUAA Bill.
Personal data provided to us will be used to help us deliver our charitable activities, help us raise funds, or complete your order or request. It will be used for the purpose or purposes outlined in any fair processing notice in a transparent manner at the time of collection or registration where appropriate. If asked by the police, or any other regulatory or government authority investigating suspected illegal activities, we may need to provide your personal data under lawful grounds.
We will only use and store your information for as long as it is required for the purposes it was collected for. How long it will be stored for depends on the information in question, what it is being used for and, sometimes, statutory legal requirements as per our Data Retention policy.
Marketing Communications
We will use your details to keep in touch about things that may matter to you on lawful relevant grounds.
We may send you mail which includes updates about the research we’re funding, events or ways you can support us. As a charity, each of these activities is fundamental to how we work, so we use legitimate interest as our lawful basis to contact you. We may also from time to time make phone calls, if you have not previously objected to hearing from us and are not registered with the Telephone Preference Service (TPS).
You always have the option to opt-out of receiving marketing communications by post or phone.
We will send marketing communications by email only if you have consented to receive these. You can unsubscribe and opt out of receiving emails at any time by clicking on the link in the email received.
There are some essential communications that we need to send to fulfil our promises to you as a fundraiser, donor or buyer of goods or services from the Institute. Examples are:
• Transaction messaging, such as payment receipts, shop purchase confirmations.
• Key messaging such as keeping you up-to-date with an event for which you have registered, this could be a fundraising challenge or an event you have purchased a ticket for.
Our email service allows us to track who has opened our e-newsletter and what links have been clicked on. This allows us to monitor what information is most useful to improve our content and information in future.
Fundraising, donations and legacy pledges
We may invite you to support our research by making a donation, getting involved in fundraising activities leaving a gift in your will or inviting you to an event. We may also send you updates on the impact that you make by supporting us in this way, unless you tell us not to.
If you make a donation, we’ll use any personal information you give us to record the nature and amount of your gift, claim gift aid where you’ve told us you’re eligible and thank you for your gift. If you interact or have a conversation with us, we’ll note anything relevant and store this securely on our systems.
If you tell us you want to fundraise to support our cause, we’ll use the personal information you give us to record your plans and contact you to support your fundraising efforts.
If you’ve told us that you’re planning to, or thinking about, leaving us a gift in your Will, we’ll use the information you give us to keep a record of this – including the purpose of your gift, if you let us know this.
If we have a conversation or interaction with you (or with someone who contacts us in relation to your Will, for example your solicitor), we’ll note these interactions throughout your relationship with us, as this helps to ensure your gift is directed as you wanted.
Charity Commission rules require us to be assured of the provenance of funds and any conditions attached to them. We follow a due diligence process which involves researching the financial soundness, credibility, reputation and ethical principles of donors who’ve made, or are likely to make, a significant donation to the Institute.
As part of this process, we’ll carry out research using publicly available information and professional resources. If this applies to you, we’ll remind you about the process when you make your donation.
Profiling
It’s important to use our resources in a responsible and cost-effective way, so we may use automated profiling and targeting to help us understand our supporters and make sure that we use our resources responsibly and keep our costs down.
We will analyse how you interact with us (e.g. on our website) and may use both geographic and demographic information to let you know what’s happening in your local area and understand your interests. See our Cookies Policy for more information.
We may also gather additional information about you from external sources, for example: updates to address and contact information, or publicly available information regarding your wealth, earnings and employment at an aggregate level. We may use this information to assess your capacity to support us and invite you to do so. This analysis may be carried out by us or by third-party organisations working for us.
We may also host encrypted personal data on third-party websites (e.g. social media platforms) to ensure that you only see relevant, personalised and interesting content from those organisations.
Management of volunteers
We need to use your personal data to manage your volunteering for the entirety of its time. This could include contacting you about a role you’ve applied for or one we think you might be interested in, expense claims you’ve made, shifts you’ve booked and to recognise your contribution. We may also share this with funders to help them monitor how their funding is making a difference.
Trading
We process customer data in order to fulfil retail activities. Your data will be used to communicate with you throughout the process, including to confirm we’ve received your order and payment, to clarify where we might need more detail to fulfil an order or booking, or to resolve issues that might arise with your order or booking.
Research
We may from time to time carry out a survey with our supporters, staff and volunteers to get feedback on their experience with us. We use this feedback to ensure we know what is relevant and interesting to you.
If you choose to take part in a survey, we’ll tell you when you start what data we will collect, why and how we’ll use it. All our surveys are optional and you can choose not to take part. We may ask you to provide sensitive personal data (e.g. ethnicity). You don’t have to provide this data and we also provide a ‘prefer not to say’ option. We only use it at an aggregate level for reporting (e.g. equal opportunities monitoring) and it is only kept for as long as it is necessary.
We may give some of your personal data (e.g. contact information) to a research agency who will carry out research on our behalf.
Media
The Institute uses public and social media channels to promote the work that we do. If you take part in an Institute activity, planned or unplanned, we may seek your permission to use your personal data in media activity.
Recruitment and employment
In order to comply with our contractual, statutory, and management obligations and responsibilities, we process personal data, including ‘sensitive’ personal data, from job applicants and employees.
Such data can include, but isn’t limited to, information relating to health, racial or ethnic origin, and criminal convictions. In certain circumstances, we may process personal data or sensitive personal data, without explicit consent.
Contractual responsibilities arising from the contract of employment – includes, but is not limited to, data relating to: payroll, bank account, postal address, sick pay, leave, maternity pay, pension and emergency contacts.
Statutory responsibilities are those imposed through law on the organisation as an employer. The data processed includes, but is not limited to, data relating to: tax, national insurance, statutory sick pay, statutory maternity pay, family leave, work permits, equal opportunities monitoring.
Management responsibilities are those necessary for the organisational functioning of the organisation. The data processed includes, but is not limited to, data relating to: recruitment and employment, training and development, absence, disciplinary matters, email address and telephone number.
Researcher Grant Applicants
If you have submitted a research grant application to us, you have given consent for us to process your application. We keep unsuccessful applications for 3 years after submission, and we hold successful applications indefinitely.
Funded researchers
If you are currently in receipt of funding from the Institute we have a legitimate interest in you. We will keep your contact details on record so that we may carry out grant administration, keep updated on the progress of your research and on your obligations to the charity.
If your research has been funded by Epilepsy Research UK in the past, we keep some of your personal information on record indefinitely, such as your name alongside the grant information. We have a legitimate interest to keep track of the impact of our research. We also use Researchfish to measure the impact of our research including leveraged funding, research publications, conference presentations, etc.
Scientific Advisory Committee (SAC) members
If you are currently a member of our SAC, we have a legitimate interest in working with you. We keep your details on record so that we may carry out the duties of the SAC, including the grant round process and other research activities of the Institute.
If you have been a member of our SAC in the past, we keep your details so that we can keep a record of SAC membership terms, and so that we do not invite you to become a member of the SAC again.
Expert Peer reviewers
If you are a researcher and have reviewed grant applications, we have a legitimate interest in working with you and therefore keep your details on record for future peer reviews in your specialist area. If you would like to be removed from this list, please email Annee Amjad, our Head of Research.
Special Category Data
Special Category Data is sensitive personal information about racial or ethnic origin, political opinions, religious beliefs or other similar beliefs, trade union membership, physical or mental health, sexual life, and criminal allegations, proceedings or convictions. This data requires an additional special category condition for processing in compliance with Article 9 of the UK GDPR.
Employees and Special Category Data
We will process data about an employee’s health where it is necessary, for example, to record absence from work due to sickness, to pay statutory sick pay, and to make any necessary arrangements or adjustments to the workplace in the case of disability. This processing will not normally happen without the employee’s knowledge and, where necessary, consent.
We will process data about, but not limited to, an employee’s racial and ethnic origin, their sexual orientation or their religious beliefs only where they have volunteered such data and only for the purpose of monitoring and upholding our equal opportunities policies and related provisions.
Data about an employee’s criminal convictions will be held as necessary.
In certain limited circumstances, we may legally collect and process sensitive personal data without requiring the explicit consent of an employee.
Shape Network and Special Category Data
Special Category Data is freely given by Shape Network members, so we process this using the lawful basis of Consent. We hold information relating to racial or ethnic origin, health data and data concerning sexual orientation. This information is optional at the time of sign up and is not a condition of being part of the Shape Network. Shape Network members can request that this information be removed at any time from their record.
This information is only used in order to analyse the demographic of the shape network. Data will be held securely on the Institute’s CRM system with restricted access for as long as it is necessary.
Information system and data security is imperative to us to ensure that we are keeping our supporters, volunteers, employees and contractors safe.
We regularly review new and existing systems to ensure that they are up to date and secure against ever-changing cyber threats.
We will always keep your information secure to maintain your confidentiality. By utilising strong encryption when your information is stored or in transit we minimise the risk of unauthorised access or disclosure; when entering information on our website, you can check this by right clicking on the padlock icon in the address bar.
Payment card security
The Institute has an active PCI-DSS compliance programme in place. This is the international standard for safe card payment processes. As part of our compliance to this very stringent standard, we ensure that our IT systems do not directly collect or store payment card information; for example the full 16 digit number on the front of the card or the security code on the back.
Our online payment solutions are carried out using a ‘payment gateway’ (e.g. PayPal, Stripe) which is a direct connection to a secure payment processing service provided by a company. This means that when you input card data into the payment page, you are communicating directly with the payment processing company, which passes your payment to us. Your payment card information is handled by the payment processing company and not processed or held by us.
Third Parties
We may sometimes use third parties to process some of our data on our behalf, but only where we are confident that the third party will treat your data securely, in accordance with our terms and in line with all the lawful requirements set out in the GDPR.
Disclosing and sharing information When we allow third parties acting on behalf of the Institute to access to your information, we will always have complete control of what they see, how long they see it for and what they are allowed to do with it. We do not sell or share your personal information for other organisations to use for their own purposes.
Personal data collected and processed by us may be shared with the following groups where necessary:
• Institute employees
• Third-party cloud hosting and IT infrastructure providers who host the website and provide IT support in respect of the website;
Also, under strictly controlled conditions:
• Contractors
• Service Providers providing services to us
• Advisors
• Agents
We may also disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use or cookie policy and other agreements; or to protect the rights, property, or safety of the Institute and our supporters. This includes exchanging information with other companies and organisations for the purposes of fraud protection.
Disclosure of employee personal data to other bodies
In order to carry out our contractual and management responsibilities, we may, from time to time, need to share an employee’s personal data with one or more third party supplier.
To meet the employment contract, we are required to transfer an employee’s personal data to third parties, for example, to our payroll company, pension providers and HM Revenue & Customs.
In order to fulfil our statutory responsibilities, we’re required to give some of an employee’s personal data to government departments or agencies e.g. provision of salary and tax data to HM Revenue & Customs.
The Institute’s operations are based in the UK and we store most of our data within the European Union (EU). Some organisations which provide services to us may transfer data outside the European Economic Area but we’ll only allow this if your data is adequately protected. Some of our systems are provided by US companies and whilst it is our policy that we prefer data hosting and processing to remain on EU-based solutions, it may be that using their products results in data transfer to the USA. However, we only allow this when we certain it will be adequately protected. (e.g. US Privacy Shield or Standard EU contractual clauses).
The UK General Data Protection Regulation (UKGDPR) gives you certain rights over your data and how we use it, including Subject Access Requests, the right to rectify your personal data if you believe it to be incorrect or to object to your information being used for marketing purposes. We want you to remain in control of your personal data.
Where the Institute is using your personal data on the basis of consent, you have the right to withdraw that consent at any time. You also have the right to ask the Institute to stop using your personal data for direct marketing purposes where we are using your personal data on the basis of legitimate interest.
If, at any time, you want to update or amend your personal data or marketing preferences please email us at [email protected] or write to: the Senior Information Risk Owner (SIRO), Epilepsy Research Institute, 82 Tanner Street, London, SE1 3GN.
For full details on your rights under data legislation, see here: https://ico.org.uk/for-the-public/ and you can contact us to let us know if you wish to opt out.
If you have a general complaint about us please do talk to us directly in the first instance so we can resolve any problems. General complaints will be acknowledged within 3 days and a full response will be received within 20 days.
If you are not happy with the way we have handled your personal data, please do talk to us directly in the first instance so we can resolve any problems. All data protection complaints will be acknowledged as soon as possible, and within 30 days.
You can get in touch with us using this online form: email us at [email protected] or write to: the Senior Information Risk Owner (SIRO), Epilepsy Research Institute, 82 Tanner Street, London, SE1 3GN.
The Institute will take appropriate steps to respond to complaints, including making appropriate enquiries, and keep you informed of the outcome without undue delay. We may also need you to provide further information that will help us confirm your identity or are authorised to act on someone’s behalf.
If you are unsatisfied with our reply, you also have the right to contact the Information Commissioner’s Office (ICO) . You can contact them using their help line 0303 123 113 or at www.ico.org.uk.
You can write to us at: Epilepsy Research Institute, 82 Tanner Street London or email here. Please provide the following details:
• Your contact details
• The personal information you want to access
• Where it is likely to be held
• The date range of the information you wish to access
We will also need you to provide information that will help us confirm your identity or that you are authorised to act on someone’s behalf. If we hold personal information about you, we will give you a copy of the information in an understandable format together with an explanation of why we hold and use it. We will make all reasonable and proportionate searches to find this information.
Once we have all the information necessary to respond to your request we’ll provide your information to you within one month. This timeframe may be extended by up to two months if your request is particularly complex.
We want you to remain in control of your personal data. If, at any time, you want to update or amend your personal data or marketing preferences please:
Email [email protected] with your full name and full address including postcode.
Call us: 020 3882 9438 (local call rates apply). Open 9.00am – 5.00pm, Monday to Friday
Write to:
Epilepsy Research Institute
82 Tanner Street
London
SE1 3GN
Cookies & Website
Cookies are small text files stored on your computer when you visit certain websites. We use first-party cookies (cookies that we have set, that can only be read by our website) to personalise your online experience. We also use third-party cookies (cookies that are set by an organisation other than the owner of the website) for the purposes of website measurement and targeted advertising. You can control the use of cookies via your browser.
See our Cookies Policy for full details.
Links to other websites
Our website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we don’t accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites. This privacy policy applies solely to the personal data collected by the Institute.
We’ll amend this privacy policy from time to time to ensure it remains up to date and reflects how and why we use your personal data and new legal requirements. Please visit our website to keep up to date with any changes. The current version will always be posted on our website.
This Privacy Policy was signed off on 11 June 2026
