Privacy Policy

Effective Date: 18^th September 2024

"Enough" ("we," "our," "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, and share your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable laws in the United Kingdom.

By interacting with us, whether by visiting our website, attending our events, donating, or otherwise engaging with our work, you agree to the terms of this Privacy Policy.

1. Who We Are

We are enough CIC, trades as "Enough", and is a non profit in the UK with the mission to end sexual violence by providing support, education, and resources to survivors and the public, particularly university students and young adults.

2. Data We Collect

We may collect and process the following personal data:

• Personal Information: Name, contact information (email address, phone number, postal address), and date of birth.
• Financial Information: Payment details when buying kits or making a donation.
• If you submit a DNA sample the testing laboratory will store limited data about the test results (including the date of the test, the number of DNA profiles detected, and unique reference numbers for those DNA profiles) on its own systems. They will also store the DNA samples. They will not have your personal information
• Fundraising Preferences: Your interests in our fundraising activities, including donation history.
• Communication Preferences: How you prefer to hear from us (e.g., email, post, or phone).
• Website Data: Cookies, IP address, browser type, and browsing behaviour on our website.
• Event Participation: Information when you sign up for or attend events (e.g., webinars, charity walks).

3. Your Report and DNA sample

• Our forensic kit meets the requirements to be labelled as Forensic DNA Grade. Specifically our swab is produced by Sarstedt and is ISO 18385 accredited.
• Our kits will be self-swabbed, sent via Royal Mail special delivery to an accredited laboratory.
• The laboratory will not be able to compare results to those held on the UK National DNA Database
• If you send a completed test, the online reporting form asks you for your consent to the use of the DNA test results. The reporting form asks you to provide your name and contact information and the barcode number of the test kit to allow you to access your test results. The laboratory does not receive your personal information
• You must be over the age of 16 to submit a sample for a DNA test.
• With your consent, the testing laboratory will store limited data about the test results (including the date of the test, the number of DNA profiles detected, and unique reference numbers for those DNA profiles) on its own systems.
• There is no possibility or desire for either Enough or the laboratory to attribute the samples to an individual person. If you choose to name the alleged perpetrator, that will only exist in your encrypted private account.
• In parallel, we will set up an account for you on our secure, encrypted platform using the data you provide in the reporting form, from which you will be able to access your DNA test results. We and the laboratory will have access to the barcode number so that we can share your results with you, but neither we nor the laboratory will receive anything else you write on the reporting form unless you share it with us through another channel.
• The results will be shared via your online account. You will be informed the number and gender of DNA profiles
• The encryption technology we use prevents access or decryption of the data. Only you are able to access the data so that if you choose to name other individuals in your encrypted account, you are the only one who can see that information.
• We do not receive any DNA samples collected via the DNA self-test kit from the laboratory.
• If, at a later time, you decide to make a report to the police, you can download your report from your account and give this information to the police.
• We are not testing for criminal purposes. Nevertheless, our laboratory partner is accredited, with significant overlap with the FSP CoP.
• The laboratory will retain an untested portion of the sample, which can be handed over to the police so that they can run their own forensic analysis. The portion of the sample that the laboratory analyses to give confirmation of the number of profiles would not be used by the police.
• We recommend that individuals who want to report to the police or a SARC should go there first because:
  • The results from a self-taken swab will have an impact on results from a subsequent forensic medical examination and will affect interpretation by a forensic scientist.
  • The testing will not be as extensive as at the Police/SARC
• With advice from the leading forensic and legal experts, we have created a self-testing process that is as reliable as possible, including a time-stamped testimony and a frozen portion of the untested sample, with the shortest chain of custody, and the highest chance of being deemed ‘fair’ by a court
• Courts decide whether evidence will have an adverse effect on the fairness of proceedings, and may omit evidence under the Police and Criminal Evidence Act, 1984.
• The laboratory will keep half of the sample (untested) to allow the police to be able to run their own analysis. The laboratory will not share your results any further unless compelled to do so by law.
• The lab will retain the untested half of your DNA sample for 20 years, or until you ask us to destroy them.
• Your test results will be held indefinitely in your Enough account, or until you ask us delete them.

4. How We Use Your Data

We use your data for the following purposes:

• Fundraising and Donations: Processing donations and managing donor relations.
• Event Management: Registering attendees and providing event-related communications.
• Marketing and Communications: Sending updates about our work, fundraising campaigns, and events based on your preferences (e.g., email, social media, postal mail).
• Website Improvement: Analysing website use to improve user experience.
• Compliance and Legal Obligations: Ensuring we comply with charity regulations, tax laws, and the GDPR.

5. Legal Basis for Processing Your Data

Under GDPR, we must have a lawful basis for processing your personal data. The lawful bases include:

• Consent: When you give clear consent to receive marketing materials or fundraising communications.
• Contractual Necessity: To process donations or sign you up for events.
• Legal Obligation: To comply with legal obligations, such as financial reporting and auditing.
• Legitimate Interests: To promote our mission and improve our services, provided your rights do not override these interests.

6. Fundraising and Communications

Some of our work is funded by donations, including pilot programs and events aimed at ending sexual violence. You may receive fundraising appeals if you have opted in or where we have a legitimate interest to contact you, such as prior engagement with "Enough" or attending one of our events.

You can opt out of fundraising communications at any time by contacting us at hello@myenough.com or using the unsubscribe options in our emails.

7. Sharing Your Data

We may share your data with:

• Service Providers: Third-party services for payment processing, email distribution, and event management.
• Regulatory Authorities: To comply with legal obligations, such as the Charity Commission or HMRC.
• Trusted Partners: For joint fundraising activities or event co-hosting, where you have consented to such collaboration.

We will never sell or rent your personal data to third parties for marketing purposes.

8. Data Retention

We retain personal data for as long as is necessary for the purposes set out in this Privacy Policy. Donation records are kept as required by law and for auditing purposes. We periodically review the personal data we hold to ensure it is accurate and up to date.

9. Your Data Protection Rights

You have the following rights under GDPR:

• Access: Request a copy of your personal data.
• You can ask us to instruct the laboratory to delete the data from your DNA test kit that they hold, and can withdraw the consent you have given at any time.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your data when it is no longer necessary for the purposes collected.
• Restriction: Request restricted processing of your data under certain conditions.
• Portability: Request transfer of your data to another organization.
• Objection: Object to data processing based on legitimate interests or direct marketing.

To exercise any of these rights, please contact us at hello@myenough.com

10. Cookies and Website Analytics

We use cookies and similar technologies to improve your experience on our website. Cookies help us to understand how visitors interact with our site, allowing us to make improvements. You can control cookies through your browser settings.

For more information, please see our Cookie Policy

11. Data Security

We take the security of your data seriously. We have implemented appropriate physical, technical, and organizational measures to safeguard your personal data from unauthorised access, alteration, disclosure, or destruction.

12. Third-Party Links

Our website or communications may contain links to third-party websites. Please note that these websites are not governed by this Privacy Policy, and we are not responsible for their content or privacy practices.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our operations or legal requirements. The latest version will always be available on our website, and where appropriate, we will notify you of significant changes.

14. Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us at: hello@myenough.com

If you are not satisfied with our response, you may contact the UK Information Commissioner’s Office (ICO) for further assistance.