Privacy Notice

We want you to know that when you use our organisation you can trust us with your information. We are determined to do nothing that would infringe your rights or undermine your trust. This Privacy Notice describes the information we collect about you, how it is used and shared, and your rights regarding it.

This is a general notice about how the Injured Jockeys Fund (IJF) processes personal data in ways that might apply to anyone we’ve interacted with, and it has information specifically for:

• Website Visitors – you’re visiting the Injured Jockeys Fund website or online shop.
• Event Attendees – you have attended an event we have organised.
• Suppliers or Potential Suppliers – you provide services or products to us or might do in the future.
• Solicitor, Executor or Next of Kin – you’re handling the legacy wishes or are the next of kin of someone who has died.
• Job Applicants – you’ve applied for a job with us.
• Work Experience – you’re doing a work experience placement with us.

 

Please note we have these other privacy notices which might also apply to you if you interact with the IJF in other ways:

• Beneficiaries and Clinical Service Users – for IJF beneficiaries (people who receive benefits funded by us, such as help with medical treatment, wellbeing or money matters) and people who use our clinical services.
• On-site Visitors – for people who visit our centres, for example to visit someone or to use our gym and exercise class facilities.
• Customers, Supporters, Donors and Subscribers – for people who opt to receive our communications, or who make donations or buy Supporter Club membership or something else through our online shop.
• Trustees, Patrons and Industry Experts – for the IJF’s Trustees and Patrons, and industry experts we have interacted with.

Who we are

Injured Jockeys Fund and Injured Jockeys Company Ltd are both registered with the Information Commissioner’s Office (ICO) as a Data Controller for the personal data that we hold and process. Our registered address is Peter O’Sullevan House, 7a Newmarket Road, Newmarket, Suffolk, CB8 7NU, our ICO registration numbers are Z4929460 and Z7969977 respectively. Our Data Protection Officer (DPO) can be contacted by emailing dpo@ijf.org.uk

Our role

We act as a Data Controller. A Data Controller decides what personal data needs to be collected and how it is used, and is responsible for processing it in line with the law. We can use your information in the ways we tell you about in this notice. More information is given below to explain what types of data are used in different situations. If you have questions about anything in this notice, you can contact us by emailing us on DPO@ijf.org.uk

Your rights

You have rights in respect of our processing of your personal data. The relevant rights are:

• Right to be informed: You have the right to be informed about the collection and use of your personal data;
• Right of access: You can request a copy of the personal data which we hold about you, as well as details about why and how we use it;
• Right to rectification: You can ask us to change or complete any personal data we hold about you which is inaccurate or incomplete;
• Right to be forgotten/erasure: You have a right, under certain circumstances, to ask us to delete any personal data we hold about you. Please note that there may be situations where we must retain your personal data after a request for erasure where we have a lawful basis for doing so;
• Right of restriction: You can ask us to restrict (prevent) the processing of your personal data where you have objected to our use of it and we have no lawful basis to continue processing your personal data;
• Right to data portability: In certain circumstances, you can ask us to transfer the data we hold about you to another service. This would be sent in a structured, commonly used, electronic form;
• Right to object: You can object to us using your personal data for particular purposes; and
• Automated decision making: You have a right not to be subjected to automated decision making and profiling in certain circumstances.
   

If you want to exercise any of these rights or raise a data protection complaint, please email us on DPO@ijf.org.uk.

You also have the right to lodge a complaint about our processing with a supervisory authority — in the UK that is the Information Commissioner’s Office (ICO) whose details are here: https://ico.org.uk/make-a-complaint/

Data that we hold and how we use it

Please see the information below for any activities that apply to you.

Responding to requests and complaints

• We sometimes need to provide personal data for legal reasons, e.g. to a regulatory authority or to auditors as part of preparing our statutory accounts. The data involved will vary depending on the case. The lawful basis for the processing is our Legal Obligation. If special category data (e.g. health information) is involved, the additional lawful basis for processing that will vary depending on the case. How long we keep this information will depend on the nature of the data involved.
• If we need to respond to a Data Subject Request, the data involved will vary depending on the case. For Data Subject Request responses, if you were not the requester we will redact (remove) information about you from our response, unless you agree to provide it. The lawful basis is our Legal Obligation. If special category data (e.g. health information) is involved, the additional lawful basis for processing that will vary depending on the case. We keep Data Subject Request information for 6 months after the processing.
• If we need to process personal data in order to respond to a complaint, we will use: name, nature of the complaint, and any correspondence generated while handling the complaint. The lawful basis is Legitimate Interest, to respond to complaints in the way that you would expect of us. If special category data (e.g. health information) is involved, the additional lawful basis for processing that will vary depending on the case. We keep complaint information for 7 years.
• If we need to handle a safeguarding concern, we will use: the name of the person making the report, and the contents of the report. The lawful basis is our Legal obligation. If special category data (e.g. health information) is involved, the additional lawful basis for processing that is: UK GDPR Art 9(2)(g) Public Interest | DPA 2018, Schedule 1 condition 18 – Safeguarding of children and individuals at risk. We will keep safeguarding information for as long as we are legally required to.
   

Website visitors

• When you visit one of our websites, we process the following data about you: IP address, pages visited, length of time spent on pages, your preferences and settings. This data would have come directly from you, using cookies. Cookies are small text files that are stored on your browser or device by websites, apps, online media, and advertisements. We use cookies to:
  • Validate users
  • Remember user preferences and settings
  • Determine frequency of accessing our content
  • Measure the effectiveness of advertising campaigns; and
  • Analyse site visits and trends.

Our lawful basis for processing your data for essential cookies is Legitimate Interest to make the website work properly, and for non-essential cookies it is Consent. Further information about the purpose and storage duration of the specific cookies that we use can be found in the Cookie Settings tool available on the website.

E-card recipients

• If you receive a charity e-card sent from our webshop, we process: the sender’s name and recipient’s name, the recipient’s email address. This information will have been provided by the sender. The lawful basis for processing the sender’s data is Contract; for the recipient it is Legitimate interest, to enable you to receive the e-card that was purchased to support the fund. We keep this information for 7 years after the last activity.
   

Event attendees

• If you attend our charity-related events, we will process the information necessary for your attendance (your contact details, role etc), as well as any dietary preferences and considerations we may need to take to ensure your attendance goes as smoothly as possible. The lawful basis for processing is Legitimate interest, to support beneficiaries and keep you up to date with our activities. The information is kept for 7 years after processing.
  If we process any other data at the time of the event, or need to share data with a third party (for example a co-hosted event), then we will let you know at the time.

• If you are included in a general crowd shot, when promoting the IJF on social media, we process your photo/image/footage, and the lawful basis is Legitimate interest, to promote the work of the fund. This data is stored for as long as is determined by the social media platform.
   

Suppliers or potential suppliers

• If you are a supplier of goods or services to us, we hold the following details to manage the relationship, pay your invoices or expenses, and fulfil our contract with you: name, contact details, vendor company information, address and bank details, type of grant or expense. The lawful basis for processing is Contract. We keep the data for as long as we have a relationship with you plus 7 years.
• If as a supplier you are authorised to use our hosted telephone system, for this we use your name and contact details. The lawful basis is Legitimate Interest, to enable us to route calls to our authorised suppliers. We keep this information until there is no longer a business need.
• If you are a potential supplier to us, we store your name, contact details and type of service, in case we need your services in the future. The lawful basis is Legitimate Interest, to store recommended suppliers’ contact details so we can contact you if needed. We hold your data for the length of time that we are considering a relationship with you.
   

Solicitor, Executor or Next of Kin

• If you are a solicitor or executor of an estate, handling the legacy wishes of someone who has died, we may hold the following data about you: your name, contact details, the value donated, any notes or requests you make in correspondence to us about the donation or legacy wishes. We will have received this data from you directly. We use the data to record the details of donations and legacy payments for the charity, and to collect those payments. Our lawful basis for processing your data in this way is Legitimate Interest, to keep a record and be able to contact you. It’s necessary for the purpose and you would reasonably expect us to use the data in this way. We store your data for 7 years from your last activity (donation made, payment received, event attended, legacy wishes completed).
• If you are a Next of Kin, we may hold the following data about you: your name, contact details, the value donated, any notes or requests you make in correspondence to us about the donation or legacy wishes, the details of any donation you make in memory of a deceased person. We will have received this data from you directly, or from a Donor who identified you as their Next of Kin. We use the data to record the details of donations and legacy payments for the charity, to collect those payments, and to send letters of acknowledgement. Our lawful basis for processing your data in this way is Legitimate Interest, to keep a record and be able to contact you. It’s necessary for the purpose and you would reasonably expect us to use the data in this way. We store your data for 7 years from your last activity (donation made, payment received, event attended, legacy wishes completed).
   

Job applicants and work placements

• If you apply for a job with IJF, we will hold the following data on you: name, contact details, CV, interview notes, and any correspondence relating to a potential contract. The data we hold will have come directly from you. Our lawful basis for processing your data is Contract; when you applied for a job it was with a view to entering into an employment contract with us. If you are not successful on this occasion, then the lawful basis for keeping your details is Legitimate Interest, to enable us to contact you in the short term in case the role becomes available again or another suitable role opens up.
  If you are successful in gaining employment with us then you will fall under IJF’s Employee Privacy Notice going forward; please refer to the employee handbook. If you are not successful in securing a role, then we will keep your details on our database for a period of 6 months.
• If you do a work experience placement with IJF, we hold the following data about you: name, address, email address, telephone number, qualifications, any background information and personal biography you provide, and emergency contact details. We use your details to be able to provide you with information and support as part of your work experience. Our lawful basis for processing your data is Legitimate Interest, in order to provide your work experience. We store your information only for the duration of your work experience.

 

How we receive the data

We will have received the data from you directly unless stated otherwise in the processes above, or unless the information is received in a safeguarding report or complaint.

Data sharing and transfers

We have a number of processors (such as cloud service providers) who act on our behalf. We have Data Processing Agreements in place with all of these processors to ensure that your data is processed in compliance with the law and only upon our instruction.

Some contracted suppliers of services to the Injured Jockeys Fund are authorised to have access to some specified data. We ensure these accesses are only given as far as they are needed for the role, and we use data sharing or joint controller agreements to agree roles and responsibilities for data protection.

We share some limited data with our payment processing partners in order to process payments.

We may need to share some limited personal data with our audit partners when they audit us to prepare our statutory accounts.

To handle a safeguarding issue, we may need to share details with the relevant social care service, police or local authority designated officer.

We never sell your data.

Transfers of your data outside the UK or EEA

We only transfer data outside of the UK or EEA if it is to a country or organisation that is deemed by the UK or EU to have adequate protection of data, or if appropriate safeguards have been put in place, for example EU Standard Contractual Clauses or the UK IDTA. When we rely on Standard Contractual Clauses/IDTA, we also carry out due diligence and transfer impact assessments to ensure they provide enough protection within the local legal framework.

Automated decision making

We do not use your personal data in any automated processes to make decisions about you.

Technical and operational security

We will take all reasonable steps to protect your personal information in order to prevent unauthorised access to or alteration or destruction of personal information in our possession. All the personal information we collect is stored securely. All areas of our premises that hold personal data are protected by secure physical access controls and covered by CCTV. Data stored in electronic form is secured using industry-standard cloud service providers and security configurations are reviewed regularly. Computing devices used to access personal information are centrally managed to ensure access controls, encryption, antivirus and system security are maintained

Changes to our Privacy Notice

We may change this Privacy Notice from time to time (for example, if the law changes). We recommend that you check this page regularly to keep up to date. If we make any significant changes to the manner in which we process and use your personal data, we will contact you to let you know about the change.

This version was created: July 2025