Privacy and security

At the RNLI we are committed to treating everybody’s personal information responsibly, and being open and transparent about how we do that. On 25 May this year, the General Data Protection Regulation (GDPR) came into force, which required us to review and update our existing privacy policy. Our updated policy reflects your new rights. It explains in detail how we use the information you share with us, and what measures we take to protect it.

Who are ‘we’?

In this policy, whenever you see the words ‘We’, ‘Us’ or ‘Our’, it refers to the RNLI, RNLI Shop and RNLI College. RNLI Shop and RNLI College are separate companies, each registered as a data controller in their own right.

RNLI Shop sells a range of goods and enters into corporate partnership arrangements; all of its profits are passed to the RNLI. RNLI College owns and operates Our crew and lifeguard training centre in Poole. Its facilities (including bedrooms, conference rooms, restaurant and bar) are used by Our people who come from all over the UK and Republic of Ireland for training. It markets any spare capacity of these assets to the public and to corporate clients, and passes all its profits to the RNLI. 

RNLI Shop and RNLI College are wholly owned and controlled by the RNLI. Many of their staff – including the majority of company directors – are RNLI employees or volunteers and the companies share many of the RNLI’s head office functions such as marketing, legal, finance and HR.

The full legal information for each entity is:

RNLI is the Royal National Lifeboat Institution, a charity registered in England and Wales (209603), and Scotland (SC037736). Registered Charity number 20003326 in the Republic of Ireland.

RNLI Shop is a trading name of RNLI (Sales) Limited, a company registered in England and Wales at West Quay Road, Poole, Dorset, BH15 1HZ; Reg. Co. number 2202240.

RNLI College Limited is a company registered in England and Wales at West Quay Road, Poole, Dorset, BH15 1HZ; Reg. Co. number 7705470.

Your acceptance of this policy, and Our right to change it

By using Our websites, social media pages, entering a competition or providing your information you consent to Our collection and use of the information you provide in the way(s) set out in this policy. If you do not agree to this policy please do not use Our websites, social media pages or services.

We review our policy regularly and we may make changes to it from time to time. Any changes we make to the policy will appear on this web page and will come into effect straight away. This policy was last updated on 25 May 2018.

What is personal data?

Personal data is information that can be used to help identify an individual, such as name, address, phone number, email address and online identifiers such as IP addresses.

The policy in brief

It’s important that you read the full policy to understand what information We hold, how We may use it, and what your rights are – but if you don’t have time to read it all now, here’s a quick summary:

  • We collect information that is either personal data (as outlined above) or non-personal data (such as web pages accessed etc).

  • We may also collect special category personal data. For example, We record medical data, where appropriate, of those We assist.

  • We collect information about the people We assist or rescue, members, supporters, website visitors, survey respondents, volunteers and employees.

  • We collect information to provide services or goods, to provide information, to fundraise for Our lifesaving work, for administration, research, analysis and for the prevention/detection of crime.

  • We only collect the information that We need in Our quest to provide the best possible service.

  • We do Our very best to keep personal information secure. For example, We use a secure internet connection whenever We collect personal data online.

  • We never sell your data and We will never share it with another company or charity for their own marketing purposes.

  • We only share data where We are required by law or with carefully selected partners who do work for us. All Our partners are required by their contract or terms of service to treat your data as carefully as We would, to only use it as instructed, and to allow Us to check that they do this.

  • Our websites use cookies – for more information check Our cookies policy.

They are the basics, but don't forget to come back later and read the full policy (below), so you've got all the details you need.

the full policy

This policy has been designed to meet the requirements of the Data Protection Act (DPA), the General Data Protection Regulation (GDPR) and successive legislation. It applies to all the websites We operate, Our use of emails and text messages for marketing purposes, and any other methods We use for collecting information. It covers what We collect and why, what We do with the information, what We won’t do with the information, and what rights you have.

What information do We collect and why?

This policy has been designed to meet the requirements of the Data Protection Act (DPA), the General Data Protection Regulation (GDPR) and successive legislation. It applies to all the websites We operate, Our use of emails and text messages for marketing purposes, and any other methods We use for collecting information. It covers what We collect and why, what We do with the information, what We won’t do with the information, and what rights you have.

  • Non-personal information such as web pages accessed and files downloaded. This helps Us to determine how many people use Our websites, how many people visit on a regular basis, and how popular Our pages are. This information doesn't tell Us anything about who you are or where you live. It simply allows Us to monitor and improve Our service. Please see Our cookies policy for further information.

  • Personal information such as name, postal address, phone number, email address, date of birth (where appropriate), information about your interests and hobbies etc.

You don't have to disclose any of this information to browse the websites. However, if you do choose to withhold requested information, We may not be able to provide you with certain services, such as ordering goods from RNLI Shop or receiving notifications of lifeboat launches.

We will use the information you provide to:

  • fulfil your requests – such as applications for membership, donations, competition entries, participation in campaigns and research, and provision of information

  • process sales transactions, donations, or other payments and verify financial transactions

  • comply with charity law and other regulations

  • identify visitors and contributors

  • handle orders, deliver products and communicate with you about orders

  • record any contact We have with you

  • provide tailored stewardship of major donors

  • prevent or detect fraud or abuses of Our websites and enable third parties to carry out technical, logistical or other functions on Our behalf

  • communicate with Our supporters and customers

  • if you have agreed to it, provide you with information that We think may be of interest to you

  • carry out research and analysis on the demographics, interests, behaviour, responses and feedback of Our users and supporters to help Us gain a better understanding of them and to enable Us to improve Our service. This research may be carried out internally by Our employees or We may ask another company to do this work for Us

  • provide a personalised service to you when you visit Our websites – this could include customising the content and/or layout of Our pages for individual users.

Information created by your interactions with the RNLI

Your interactions with the RNLI may also result in personal data being created. For example, if you make a donation, the date and amount, along with the campaign that you responded to will be recorded. If you engage with one of Our campaigns or activities or volunteer to help at an event, details of your involvement may be added to your record.

What information We generate

We conduct analysis on the information We hold which can produce further personal data. For example, We may analyse how you interact with Our services such as Our websites and social media activity to ensure they’re personalised and relevant to you. This may lead Us to record against your details an entry such as ‘interested in water safety’ that We may use in deciding what content to share with you in future communications.

Information from third parties

We may combine your personal data with publicly available information, such as the Electoral Roll or the Royal Mail Change of Address List to minimise the risk and cost of sending communications that do not reach or would not be appropriate to you and to personalise our interaction with you.

Information from social media

We will only ever use social media platforms (like Twitter, for example) in accordance with their own terms and conditions. If you have an account on one of these platforms, you will have agreed to these terms and conditions yourself. All social media platforms must comply with the Data Protection Act, General Data Protection Regulation and successive legislation when processing or storing the personal data of individuals in the UK and Ireland. This means organisations like Facebook have a responsibility, under law, to store and process data in a fair and transparent way.

Occasionally, if you have given Us permission to use your email address, We may try to match it with your social media accounts so We can share relevant information with you, for example, on Facebook. We also do this to exclude some of Our supporters from social media advertising to make sure we’re not wasting RNLI funds on communications which aren’t relevant to you. For example, if you’re already an RNLI member, We don’t want to send you adverts inviting you to sign up for membership. To do this, We upload email addresses that have already been encrypted to a secure portal within Facebook – this means Facebook doesn’t receive the original email addresses. This is very common marketing practice but We feel it’s important to make it clear to you that We sometimes use data in this way.

On some RNLI websites, We have a social media tracking code in place. This allows Our social media accounts and websites to share data with one another. This is entirely anonymised data so We can’t see information about any individuals but it will tell us, for example, what percentage of Our Facebook page fans have recently visited Our website. You can find out more about how We use social media tracking code in Our cookies policy.

Using your information for marketing

In 2016, We were the first major charity to announce that We were moving to an 'opt-in only' communication policy. This means that We only send marketing information to people who have specifically said that they agree to Us doing this, and We will only do so in the way(s) they have agreed to. Marketing information covers information from RNLI Shop and RNLI College about the goods and services sold, fundraising appeals by the RNLI, and information about Our rescues and the other work We do such as drowning prevention.

Since January 2017, only those people who opted in have been receiving these communications. If you want to receive this information but haven’t opted in, you can do so by emailing optin@rnli.org.uk or by calling Our Supporter Care team on weekdays, 8am–6pm on 0300 300 9918 (UK) or +44(0)1202 663234 (non-UK).

If We contact you by email, We will include a link to opt out of receiving future messages if you change your mind. If We contact you by other means and you want to change how, or if, you receive Our communications, please call Supporter Care on weekdays, 8am–6pm on 0300 300 9918 (UK) or +44(0)1202 663234 (non-UK).

Our opt in statement outlines that We will send news, activities and appeals within Our marketing activities. These are defined as follows

Item Definition
News

Noteworthy information that is published about recent events that would be of interest to individuals who follow the work of the organisation.

Such information would include: rescue stories, education and prevention initiatives and programmes, announcements/reports on fundraising activities (but not promotional asks), publishing offers available through partnerships, publishing services We are promoting (for example, Free Wills)

Activities This would include activities the RNLI initiates covering: prevention, education, rescue, fundraising, volunteering or other engagement activities (now or in the future)
Appeals This covers requests to individuals for a donation, to become volunteers, share content on social media or become advocates.

Major gifts

We steward highly influential supporters who act as our advocates sharing their networks to promote the RNLI or donate large gifts or who may wish to do so in the future. 

We prepare for one to one meetings and bespoke events with this small group of supporters to make our contact as impactful as possible. We research an individual's professional and charitable interests and their likely capacity to support us. We use this to help us identify what part of the RNLI’s activities are the best match to an individual's public ambitions to make a difference. 

We use publicly available data, from reputable sources, where someone would expect their information may be read by the public. This includes data from Companies House, corporate and charity websites, media coverage, and business due diligence websites. 

Sharing your information

We will only share your information if:

  • We are legally required to do so, for example by a law enforcement agency legitimately exercising a power or if compelled by an order of the Court

  • We believe it is necessary to protect or defend Our rights, property or the personal safety of Our people or visitors to Our premises or websites

  • We are working with carefully selected partners that are carrying out work on our behalf, such as mailing houses, marketing agencies, IT specialists and research firms. The kind of work We may ask them to do includes processing, packaging, mailing and delivering purchases, answering questions about products or services, sending postal mail, emails and text messages, carrying out research or analysis and processing card payments. We only choose partners We can trust. We will only pass personal data to them if they have signed a contract or agreed to terms of service that require them to:

    • abide by the requirements of the Data Protection Act, General Data Protection Regulation and successive legislation
    • treat your information as carefully as We would
    • only use the information for the purposes for which it was supplied (and not for their own purposes or the purposes of any other organisation)
    • allow Us to carry out checks to ensure they are doing all these things.

Storing your information

Information is stored by Us on computers located in the UK and Republic of Ireland. We may transfer the information to other offices and to other reputable third party organisations as explained above – they may be situated inside or outside the European Economic Area. We may also store information in paper files.

We place great importance on the security of all personal information associated with Our supporters, customers and users. We have security measures in place to attempt to protect against the loss, misuse and alteration of personal data under Our control. For example, only authorised personnel are able to access supporter information, and the financial and personal information you enter on Our website is encrypted before it is sent to Us.

Unfortunately, the transmission of data across the internet is not completely secure. While We do Our best to try to protect the security of your information.

We cannot ensure or guarantee that loss, misuse or alteration of data will not occur while data is being transferred.

Where you or We have provided a password enabling you to access parts of Our websites or use Our services, it is your responsibility to keep this password confidential. Please don't share your password with anyone.

How long We keep your personal information

We will keep your information only for as long as We need it to provide you with the goods, services or information you have required, to administer your relationship with us, to inform Our research into the causes and prevention of drowning or the preferences of Our supporters or to comply with the law. When We no longer need information We will always dispose of it securely, using specialist companies if necessary to do this work for us. We have an information and data retention policy, which we review regularly. 

Some personal information We hold is retained to fulfil statutory obligations, for example there is an HMRC requirement to retain of Gift Aid declarations for a set period. You can withdraw your consent to any particular usage of your data at any time.

The below summarizes how long We will keep information about different groups of people:

Supporters

If you support Us financially (via donations, memberships or regular gifts) We will hold data for up to 6 years after your last transaction or donation to comply with Our statutory obligations, unless there is evidence that you continue to actively engage with Us in which case We will continue to hold your data as long as We have your opt in consent.

If you support Us via non-financial means We will continue to hold your data, so that We can communicate with you as long as there is evidence that you are continuing to have active engagements with Us and We have your opt in consent.

If you notify Us that you are intending to leave a gift in your will We will retain your data to ensure We can acknowledge your generosity at the appropriate time in the future. This may be more than 6 years after your last active engagement with us.

Volunteers

If you volunteer with the RNLI then We will keep information about you for the duration of your time as a volunteer, plus 7 years after you finish, in order to ensure We provide you with the best volunteer experience We can. In addition, if you are one of Our volunteer crew members, We will keep basic information about you (such as your name, service history and date of birth) on an indefinite basis so that We can verify your eligibility for the RNLI Benevolent Fund, should you make a claim. 

Shop customers

If you make a purchase from the RNLI Shop, We will retain information about you for a period of 90 days, in case there are any problems with your order.
If you choose to opt in to RNLI communications when you make your order, then you will become an RNLI Supporter and your contact information will then be retained as per the ‘Supporters’ section above. 

Job applicants

If you have applied for an employed or voluntary role with the RNLI, We will retain the personal data you provide as part of the application process, along with the CV and application form documents you submit, for a period of 12 months from the point at which you last access your application. 

People We rescue 

When Our RNLI lifeboat crews and lifeguards carry out their lifesaving work, it will sometimes be necessary for them to collect medical information about the people they rescue in order to ensure that appropriate care is provided. This will be retained for an indefinite period of time as it forms an historical record. We may also collect further information from the people We rescue, such as name, age, address and contact information. This is used to identify those who make queries to the organisation, or who may require the information for legal purposes. This information will also be retained indefinitely as it goes on to form an historical record. 

Heritage information

The RNLI was founded in 1824 and We hold many historic records, which enable Us to learn about the work of the RNLI over the decades and improve how We make decisions in the future. 

In order to ensure that We have an ongoing record of the RNLI’s lifesaving activities, which may be of interest and importance in years to come, We keep certain information indefinitely. This includes information about shouts carried out by Our crews and rescues carried out by Our lifeguards. If this information contains personal data, a confidential ‘closure period’ will be applied so that it cannot be accessed or viewed by those who do not have a clear purpose to do so. 

What We don’t do with your information

We never sell or share your information to other organisations to use for their own purposes.

Your rights

The General Data Protection Regulation gives you certain rights over your data and how We use it. These include the right to:

  • access to the personal information We hold about you, known as a subject access request

  • object to Our processing (automated or otherwise) of your personal information

  • object to your information being used for marketing purposes

  • restrict the processing of your personal information

  • obtain a copy of your personal data in a portable format so that you can reuse it

  • rectify your personal information if you believe it is incorrect. We want to ensure that all information We hold about you is accurate and up to date so please do let Us know if anything changes, and 

  • request the erasure of your personal information. Please note that in certain circumstances We may need to retain your data for a specified period to comply with Our legal obligations.

If you make a request relating to any of the rights listed above, We will consider each request in accordance with all applicable data protection laws and regulations. No administration fee will be charged for considering and/or complying with such a request unless the request is deemed to be excessive in nature.

If you wish to exercise any of these rights please contact our Data Protection Officer in writing at RNLI, West Quay Road, Poole, BH15 1HZ or by emailing data_protection@rnli.org.uk.

You can find more information about your rights under data protection legislation from the Information Commissioner’s Office at ico.org.uk.

The RNLI is not a ‘public authority’ as defined under the Freedom of Information Act and We will not therefore respond to requests for information made under this Act; using the funds generously donated to Us by Our supporters for such activities is not in accordance with Our charitable purposes.

other important information

Children’s data

Some of the services We offer are aimed specifically at children (for example Our Storm Force membership club and Swim Safe programme). To deliver these services safely it is necessary for Us to collect data and store it on Our database. Before We collect data from anyone under 18, We will always ask them to:

  • obtain the permission of a parent or guardian before registering with Us, and

  • let an adult know before they use Our sites to obtain information about fundraising, campaigning or supporting Our work.

It is Our policy not to request donations or subscriptions, or accept product orders, from children under 18.

Links to third party websites

Our websites contain links to third-party websites that We believe may be of interest to Our website visitors. This privacy policy only governs Our websites and We are not responsible for the privacy policies that govern third party websites even where We have provided links to them. If you use any link on Our website We recommend you read the privacy policy of that website before sharing any personal or financial data.

Other people’s data

Some of the services We offer allow you to provide the personal data of other people (for example tagging people on photos on social media, or using Our ‘Tell a Friend’ service). Before providing anyone else’s data please ensure they are happy for you to do so. Under no circumstances must you make public another person’s home address, email address, or phone number.

Any questions?

If you have any questions about this policy or how We use your data please contact our Data Protection Officer at the address given above or by emailing data_protection@rnli.org.uk.