Privacy and Cookie Policy
Last updated August 2026
1. Introduction
1.1 We, International Medical Corps UK, a company limited by guarantee incorporated in England (company number 04474904) and registered as a charity in England (registered charity number 1093861) with our registered office at Workspace 4, Mode, 1-4 Centric Close, Oval Road, Camden, London, NW1 7EP (‘IMC UK’, ‘we’, ‘our’ or ‘us’ being interpreted accordingly) are committed to protecting your privacy and personal information.
1.2 Personal information relating to you that either identifies you or from which you can be identified is called personal data (‘Personal Data’).
1.3 This Privacy Policy (‘Privacy Policy’) tells you about the Personal Data that IMC UK, acting as a data controller, may collect or receive; how we handle or process such Personal Data; and who we may share it with. It also provides information about the legal basis on which we process your Personal Data; how long we hold it for; and information on certain legal rights you have in relation to your Personal Data.
2. Changes to This Privacy Policy
2.1 This Privacy Policy was last updated on the date referred to above. From time to time, we may change the way we use your Personal Data. This means that we may have to amend or update this Privacy Policy. Please therefore check that you have seen the latest version.
3. What Personal Data Do We Collect and Use?
3.1 The Personal Data about you that we collect and use includes the following:
3.1.1 Your name, address, phone, email, and other contact details (for example if you sign up to receive our newsletter)
3.1.2 Information that you provide to us when you donate (including whether or not you are a UK taxpayer, for Gift Aid purposes)
3.1.3 You provide information about yourself when you submit a comment to us
3.1.4 Personal Data contained in correspondence between you and us, which we may retain on file
3.1.5 Information obtained through cookies or other tracking technology, including your IP address, when you browse this Website
3.1.6 Any other Personal Data that you may provide to us from time to time.
4. How Your Personal Data is Collected
4.1 We collect Personal Data about you in various ways, as follows:
4.1.1 When you submit a form through our website
4.1.2 If you engage with us through social media channels
4.1.3 When you browse and interact with our website
4.1.4 If you respond to a campaign or volunteer to help us
4.1.5 When you attend an event that we hold
4.1.6 Through your relationship and communication with us.
5. What We Use Your Personal Data For
5.1 Other than as stated above, we may use your Personal Data for one or more of the following purposes:
5.1.1 Contact our supporters, campaign and raise funds
5.1.2 Analyse information that you provide to us, so that we can better understand your main interests. This helps us to deliver personalised content and make suggestions to you on how you can get involved in our work. Where we have received location information about you, we may use it to tailor our communications to you
5.1.3 Deal with any comments, enquiries, or any requests that you submit
5.1.4 Provide you with newsletters and other direct marketing communications about what we are doing, as well as products, services and/or campaigns that may be of interest to you by post or phone. If required under applicable law, where we contact you by SMS, email, social media, and/or any other electronic communication channels for direct marketing purposes, this will be subject to you providing your express consent. You can object or withdraw your consent to receive direct marketing from us at any time, by contacting us using the email address below
5.1.5 Enforce and/or defend any of our legal claims or rights
5.1.6 For any other purpose required by applicable law, regulation, and the order of any court or regulatory authority.
6. The Lawful Grounds on Which We Collect and Process Your Personal Data
6.1 IMC UK will process your Personal Data for the above purposes relying on one or more of the following lawful grounds:
6.1.1 Where you have freely provided your consent for particular purposes, such as receiving e-newsletters
6.1.2 Where we agree to provide any goods or services to you, to take any pre-contract steps at your request and/or to fulfil our contractual obligations to you
6.1.3 Where we need to use your Personal Data for legitimate purposes relevant to IMC UK being able to campaign and promote our charity, as well as to efficiently and effectively fundraise, communicate with supporters, and manage our affairs. We will always seek to pursue these legitimate interests in a way that does not unduly infringe on your other legal rights and freedoms, and particularly your right of privacy. Where we need to collect, process or hold your Personal Data to comply with a legal obligation.
7. Our Legal Obligations Regarding Your Personal Data
7.1 We collect and process your Personal Data in accordance with applicable laws that regulate data protection and privacy. This includes, without limitation, the General Data Protection Regulation (EU 2016/679) as retained under UK law (‘UK GDPR’) and the UK Data Protection Act 2018 (‘DPA’) (together, ‘Data Protection Law’).
8. Disclosing Your Personal Data to Third Parties
8.1 We may need to disclose your Personal Data to certain third-party organisations that are handling that data only on our behalf and in accordance with our instructions under contract (called ‘data processors’) in the following circumstances:
8.1.1 Companies and/or organisations that act as our service providers (e.g., IT suppliers or data hosting companies); and/or
8.1.2 Companies and/or organisations that assist us in processing and/or fulfilling transactions that you have requested (e.g., payment processors) and Donorbox, which provides the software for our online donations system. In relation to these data processors, we will make sure that they act only in accordance with our instructions and that adequate safeguards are put in place by them to protect your Personal Data, in accordance with Data Protection Law.
8.2 We may also disclose your Personal Data to and/or obtain certain Personal Data about you from third-party service providers or professional advisers that we inform you about from time to time. These third parties will make their own determination as to how they process your Personal Data and for what purpose(s) (and are therefore called ‘data controllers’). Please see the following examples. It is important that you give us accurate information, if asked. We will check your details and if you give us false or inaccurate information or we suspect crime or fraud, we will record this and may (if legally required) pass this to law enforcement or other organisations involved in crime and fraud prevention.
8.3 The third-party data controllers we use will handle your Personal Data in accordance with their own chosen procedures. You should check the relevant privacy policies of these companies or organisations to understand how they may use your Personal Data. Because these controller organisations are acting outside of our control, we have no responsibility for their data processing practices.
8.4 Other than as described above, we will treat your Personal Data as private and will not disclose your Personal Data to third parties without you knowing about it. The exceptions are in relation to legal proceedings or where we are legally required to do so and cannot tell you.
8.5 In all cases we aim to ensure that your Personal Data is only used by third parties for lawful purposes and in compliance with applicable Data Protection Law.
9. International Transfers
9.1 We are based in the United Kingdom and primarily collect and process data in the UK. However, we do use third-party processors that process data on our behalf and are based in the United States. The US is one of the territories outside the UK and European Union whose laws are currently not considered to meet the same legal standards of protection for Personal Data as set out under Data Protection Law in the UK or Europe.
9.2 We use the following US-based third parties:
9.2.1 Mailchimp, which handles supporter emails, is part of the Intuit group of companies. For more information regarding Mailchimp’s current privacy practices and how it protects personal data that is transferred to the US, see https://mailchimp.com/legal/privacy
9.2.2 Donorbox, which handles donations on our behalf, has servers based in the United States. You may provide your information directly to Donorbox if you donate. For more information about Donorbox’s privacy practices and how it handles your data, see https://donorbox.org/privacy.
9.2.3 Typeform, which is a service we use to create interactive quizzes, has servers based in the US. For more information about Typeform’s privacy practices and how it handles your data, see https://admin.typeform.com/to/dwk6gt
9.2.4 We may also sometimes transfer Personal Data to our affiliates, including our independent affiliate International Medical Corps, based in the US
9.2.5 To safeguard your Personal Data, we only allow transfers such as those referred to above under an applicable derogation or appropriate mechanism that is authorised under Data Protection Law. This is to make sure that your Personal Data is safeguarded in accordance with the same legal standards that apply to IMC UK in the United Kingdom.
10. Cookies
10.1 We use cookies on this Website, which are primarily session-based cookies. A cookie is a small file that asks permission to be placed on your computer’s hard drive. If your browser settings are not set to block cookies, the file is added and the cookie helps analyse web traffic or performs other functions that improve the smooth running of the Website. Cookies enable web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
10.2 We use traffic-log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website to tailor it to visitor needs. We use this information only for statistical-analysis purposes.
10.3 Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
10.4 When you donate, we use cookies to track how you come to our website. For example, we use approach codes in our internet addresses (URLs) to show us whether a donation came from a particular online campaign, a social media link or a partner. If you click a link we’re tracking, a session cookie will be dropped on your machine. This lets us know whether you subsequently donate.
10.5 When we send you an email, we may use technology to measure the success of the emails we send so we know what stories and titles people like the most. Though we can identify who opened an email and the stories viewed, we don’t sell or share this information with anyone else.
10.6 To remember that you have accepted our use of cookies, we place a temporary cookie to remember this setting for three months.
10.7 Third-party cookies are also used as follows:
10.7.1 We sometimes embed photos and video content from websites such as YouTube, Facebook, and Instagram. As a result, when you visit a page with content embedded from such services, you may be presented with cookies from these websites. Our website does not control the dissemination of these cookies. You should check the relevant third-party website for more information about these.
10.7.2 We use Google Analytics to track traffic to our website. Cookies used by Google provide different Google services for the user and collect anonymous data about the user. For more information about Google Analytics and related privacy practices, see https://support.google.com/analytics/answer/6004245
10.7.3 Any site with social sharing buttons, such as our website, may set a cookie when you are also logged in to their service. We do not control the dissemination of these cookies, and you should check the relevant third-party website for more information about these
10.7.4 We use Facebook Pixels to collect information about how users interact with our websites. We use this for analytics and retargeting adverts. For more information on Facebook’s cookie policy, see https://www.facebook.com/privacy/policies/cookies
10.7.5 We use TikTok Pixels to collect information about how users interact with our websites. We use this for analytics and retargeting adverts. For more information on TikTok’s cookie policy, see https://www.tiktok.com/legal/page/eea/privacy-policy/en
10.7.6 We use cookies from AB Tasty to optimise the elements of our website to improve user experience over time. For more information on AB Tasty’s cookie policy, see https://www.abtasty.com/security.
10.8 You can choose to accept or decline our cookies. Most web browsers automatically accept cookies, but you can modify your own browser settings to decline cookies, if you prefer. The Help menu on the menu bar of most browsers will tell you how to prevent your browser from accepting new cookies, how to have the browser notify you when you receive a new cookie and how to disable cookies altogether. Please note that declining cookies may prevent you from taking full advantage of this Website.
10.9 You can find more information about cookies at www.allaboutcookies.org and www.youronlinechoices.eu.
11. How Long We Retain Your Personal Data
11.1 IMC UK retains Personal Data identifying you only for as long as you have a relationship with us, or as necessary to perform our obligations to you (or to enforce or defend contract claims) or as is required by applicable law.
11.2 Our data retention policy sets out the different periods that we retain data for in respect of relevant purposes in accordance with our duties under Data Protection Law. The criteria we use for determining these retention periods are based on:
11.2.1 Various legislative requirements, such as requirements to hold transaction records and Gift Aid information under tax law
11.2.2 The potential need to refer to that data if there is a future claim or legal dispute
11.2.3 Guidance issued by relevant regulatory authorities, including but not limited to the UK Information Commissioner’s Office (ICO). Personal Data that we no longer need is securely disposed of and/or anonymised so you can no longer be identified from it.
12. Security
12.1 We employ appropriate technical and organisational security measures to protect your Personal Data from being accessed by unauthorised persons, and against unlawful processing, accidental loss, destruction and damage. Some examples include the following.
12.1.1 Our server is located in a locked, secure environment, with a guard posted 24 hours a day
12.1.2 Any payment-card details, such as credit or debit cards that we receive through our donation websites, are passed securely to our payment-processing provider according to the Payment Card Industry Security Standards. We do not store your credit or debit card details on our website
12.1.3 All online financial transactions are encrypted using SSL (Secure Sockets Layer)
12.1.4 We also endeavour to take all reasonable steps to protect Personal Data from external threats such as malicious software or hacking. However, please be aware that there are always inherent risks in sending information by public networks or using public computers, and we cannot fully guarantee the security of all data sent to us (including Personal Data). You should not send any financial information to us by email.
13. Your Personal Data Rights
13.1 In accordance with your legal rights under applicable law, you have a ‘subject-access request’ right under which you can request information about the Personal Data that we hold about you, what we use that Personal Data for and whom it may be disclosed to, as well as certain other information. Usually, we have a month to respond to such subject access requests. We reserve the right to verify your identity if you make such a subject- access request and we may, in case of complex requests, require a further two months to respond.
13.2 We may also reject any manifestly unreasonable or excessive requests for access.
13.3 We may also require further information to locate the specific information you seek before we can respond in full and apply certain legal exemptions when responding to your request.
13.4 Under Data Protection Law you also have the following rights, which are exercisable by making a request to us in writing (including email) or through any of our usual communication channels:
13.4.1 That we correct Personal Data that we hold about you which is inaccurate or incomplete
13.4.2 That we erase your Personal Data without undue delay if we no longer need to hold or process it
13.4.3 To object to any automated processing (if applicable) that we carry out in relation to your Personal Data (for example if we conduct any automated credit scoring)
13.4.4 To object to our use of your Personal Data for direct marketing
13.4.5 To object to and/or restrict the use of your Personal Data for purposes other than those set out above, unless we have a legitimate reason for continuing to use it
13.4.6 To request that we transfer Personal Data to another party where the Personal Data has been collected with your consent or is being used to perform a contract with you and is being carried out by automated means.
13.5 All these requests may be forwarded on to a third-party provider that is involved in the processing of your Personal Data on our behalf.
13.6 Where we rely on consent as a lawful basis for processing your Personal Data, you have the right to withdraw such consent by contacting us using our contact details below. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn. If you withdraw such consent, we may no longer be able to provide certain services to you where the relevant processing is necessary for the provision of those services. In those circumstances, we will cease the relevant processing of your Personal Data and retain or dispose of it in accordance with our data-retention policy described above.
13.7 If you would like to exercise any of the rights set out above, please contact us using the contact details below.
13.8 We hope that we can resolve any query or concern you raise about our use of your Personal Data. If you make a request and are not satisfied with our response or believe that we are illegally processing your Personal Data, you have the right to complain to the Information Commissioner’s Office (ICO) at https://ico.org.uk. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance. We may provide you with a complaint form so that you can provide details about the circumstances of your complaint. This will also enable us to investigate as efficiently as possible. When we receive your complaint, we will:
13.8.1 Acknowledge receipt within 30 days of receiving it
13.8.2 Without undue delay, take appropriate steps to investigate your complaint, including making appropriate enquiries with you or any other person involved to properly understand the issue
13.8.3 Keep you informed of the progress of your complaint
13.8.4 Without undue delay, tell you the outcome of your complaint once we have considered it. If we respond to your complaint and you are still not satisfied with the outcome, you may still complain to the ICO or exercise any right you have to take legal action.
14. Contact
If you have any queries regarding this Privacy Policy or wish to make a further request
relating to how we use your Personal Data as described above, please contact:
Martin Mongalla
International Medical Corps UK, Workspace 4, Mode, 1-4 Centric Close, Oval Road,
Camden, London, NW1 7EP
Telephone: +44 (0)20 7253 0001
Email: mmongalla@InternationalMedicalCorps.org.uk