Who we are
FJ Philanthropy Ltd (company number SC501662) is a management consulting firm that specialises in helping charitable organisations achieve their mission by growing their income through philanthropy. We are registered with the Information Commissioner’s Office (ICO), registration number ZB140127.
In addition to our consultancy services, we operate the PhilanthroTools platform at app.fjphilanthropy.uk, a suite of data-driven fundraising intelligence tools for charities, universities, and non-profit organisations.
Our registered office is: Bank Chambers, 31 The Square, Cumnock, Scotland, KA18 1AT.
Scope of this notice
This privacy notice explains how we collect, use, store, and protect personal data in connection with:
Our consultancy services — where we advise clients on fundraising strategy, conduct prospect research, and engage with donors and supporters on behalf of our clients.
The PhilanthroTools platform — where clients upload data for analysis, diagnostics, and forecasting through our online tools (PhilanthroCheck Pro, PhilanthroScan, and PhilanthroCast).
Our own business activities — where we hold contact details of clients, prospective clients, and business contacts for marketing, administration, and relationship management.
Whose data do we process?
FJ Philanthropy, from time-to-time, processes personal data which relates to our clients’ donors and other supporters and potential donors and supporters. From time-to-time we also process data about people who work with or for our clients and others with whom we have or have had a business connection.
Legal status and lawful basis for processing
When processing personal data on behalf of a client (whether through consultancy engagements or the PhilanthroTools platform), we act as a Data Processor as defined by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The client remains the Data Controller at all times. We process personal data only on the documented instructions of the client and solely for the purpose of delivering the contracted service.
The legal status of data given to us by a client is controlled by a contract between ourselves and the client. This contract defines how we use the personal data passed to us by the client. We only use the data in the way in which the client has requested. In this context we therefore act as a Data Processor as defined in the Data Protection Act 2018, and from May 25 2018 by the GDPR. Ultimate control of the data always remains with the client.
We may also collect additional data from donors and potential donors whom we may meet in the fulfilment of our contracts. In this respect, we act as both Data Processor and Data Controller.
We also act as Data Controller in respect of data on those who work with or for our clients and potential clients, as well as others with whom we have a business connection.
When we process data as a Data Controller we rely on three grounds for lawful processing:
For the purpose of administering contracts with clients, to the extent that we process personal data we do so because it is necessary for the administration of a Contract.
For our marketing and other promotional activity we process data because it is in our Legitimate Interest unless the law requires us to obtain your Consent in which case we will only process data with your Consent.
When carrying out client activity we will usually seek Consent to process data, for example, to make interview notes. In some cases, and particularly before we have met someone whom we may be seeking to interview, we will process data because it is in our Legitimate Interest to do so in order to properly advise our client.
Please see “your rights” below for details of what Legitimate Interest and Consent mean in this context, and your rights associated with these terms.
Security
PhilanthroTools platform: hosting and security
The PhilanthroTools platform is hosted on Amazon Web Services (AWS). Key infrastructure details:
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
Infrastructure is hosted within AWS’s UK region (eu-west-2, London)
All client data is processed and stored within the United Kingdom
Access to client data within the PhilanthroTools platform is restricted to authorised client users, authenticated via secure login credentials, and to FJ Philanthropy personnel who require access for service delivery and support. All FJ Philanthropy staff with data access have received data protection training and are bound by confidentiality obligations.
FJ Philanthropy is currently undertaking Cyber Essentials certification.
Consultancy services: security
For our consultancy work, we maintain extensive provisions to ensure data is kept securely. These provisions are revised on an ongoing basis as technology changes. In particular:
Portable devices (e.g. smartphones, tablets, laptops) are capable of being erased remotely should they be lost or stolen
All removable media is hardware encrypted
All written notes (e.g. interview notes) are stored in a locked filing cabinet within secure premises
What data do we process?
In carrying out our work as fundraising consultants, we may hold data, whether as a Data Processor or Controller, which helps us to understand an individual and their relationship with the organisation they support or may support. This information may include:
Basic personal details, including name and age;
Contact details;
Nature of the relationship with our client, including information about past giving to the client and hoped for future giving;
Financial, business, family and networking information since this often has a material impact on the way in which the person pursues their philanthropic interests;
Educational information and affiliations to organisations which are in the public domain;
Notes of meetings, correspondence and conversations which we may have with the data subject.
In carrying our administrative and marketing work for FJ Philanthropy, information we hold includes:
Name;
Employment and contact information;
Communications preferences.
PhilanthroTools platform
When clients use the PhilanthroTools platform, they may upload the following categories of personal data for analysis:
Donor and alumni names, contact details, and biographical information
Giving history, pledge records, and gift amounts
Prospect research data including wealth indicators and capacity markers
Engagement and stewardship records
Pipeline and solicitation status information
Business contacts
In carrying out our administrative and marketing work, information we hold about business contacts includes name, employment and contact information, and communications preferences.
Sub-processors
FJ Philanthropy uses the following sub-processors in the delivery of its services:
Amazon Web Services (AWS) — cloud infrastructure and hosting for the PhilanthroTools platform
In our capacity as a Data Processor, we never disclose any personal data to a third party unless the client to whom the data belongs requests or permits us to do so in writing, or where disclosure to a sub-processor listed above is necessary for the delivery of the contracted service. FJ Philanthropy will not engage additional sub-processors without prior notification to the client.
In our capacity as a Data Controller, we do not pass control of personal data to any other organisation except with the consent of the individual data subject, unless required to do so by law.
Data retention and deletion
PhilanthroTools platform
Client data uploaded to the PhilanthroTools platform is retained for the duration of the license period (12 months) or until the end of the annual period, whichever comes sooner. Upon expiry or termination of the license:
All client personal data will be securely deleted within 30 days
FJ Philanthropy will provide written confirmation of deletion on request
No copies or backups of client data are retained beyond the deletion period
Consultancy services
In our capacity as a Data Processor, we keep information for so long as the contract with our client requires.
In our capacity as a Data Controller, we keep information for as long as is necessary for us to carry out our work as fundraising consultants. In respect of interview notes, we and the data subjects often find it helpful to have a record of discussions that took place, even some years earlier. If a donor or data subject wishes us to remove this information, we will comply with that request.
For administering our own business, we retain personal data while clients are working with us and for a reasonable time beyond, until such a time as repeat business seems unlikely. A data subject may ask us to remove them from our database or from the receipt of communications at any time.
International data transfers
All data is processed and stored within the United Kingdom. FJ Philanthropy does not transfer personal data outside the UK.
Where any future change to our infrastructure or sub-processors would require data to be transferred outside the UK, we will ensure appropriate safeguards are in place in accordance with UK GDPR, and will update this notice and notify affected clients accordingly.
Data breach notification
In the event of a personal data breach affecting client data, FJ Philanthropy will:
Notify the affected client without undue delay and within 72 hours of becoming aware of the breach
Provide all available details including the nature of the breach, categories of data affected, likely consequences, and remedial measures taken or proposed
Cooperate fully with the client’s own breach reporting obligations to the ICO
FJ Philanthropy maintains incident response procedures to ensure that any breach is identified, contained, and reported promptly.
How we use personal data
In general terms, we use data to help us inform our advice to clients on the planning and implementation of fundraising and supporter relations activities. This may include statistical analysis of data provided to or obtained by us.
If we are carrying out interviews with donors and potential donors and supporters, we seek a person’s permission to take and to keep notes of our conversation(s) and correspondence. We ask the person to tell us what we may disclose to the client and what we may not. We may securely retain our notes following the close of a particular contract, since we have found that these are useful to the client should they choose to work with us again.
Through the PhilanthroTools platform, client data is processed solely for the purpose of delivering the contracted diagnostic, analytical, or forecasting service. We do not use client data uploaded to the platform for any other purpose, including marketing, benchmarking, or product development.
In pursuit of our own business interests, we use personal data to manage our contractual relationship with clients and to communicate with you for marketing, promotional, and administration purposes. We may do this by post, telephone, or email.
Your rights
Under UK GDPR and the Data Protection Act 2018, you have the following rights in respect of your personal data:
If we are processing data with your consent, you have the right to withdraw that consent at any time without prejudice
If we are processing data because it is in our legitimate interest to do so, you have the right to object to such processing
You have the right to request a copy of any personal data we hold about you (a subject access request)
You have the right to request rectification of inaccurate data or erasure of data that is no longer necessary
You have the right to request restriction of processing in certain circumstances
You have the right to data portability where processing is based on consent or contract and carried out by automated means
You have the right to complain about the way in which we process your data
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO). Contact details can be found at ico.org.uk.
Data Processing Agreements
FJ Philanthropy will enter into a formal Data Processing Agreement (DPA) with each client prior to any personal data being shared, whether for consultancy services or through the PhilanthroTools platform. This DPA will comply with the requirements of Article 28 UK GDPR and can be based on the client’s standard template or FJ Philanthropy’s own terms.
Changes to this notice
We may update this privacy notice from time to time. The date of the most recent update is shown at the top of this notice.
How to contact us
FJ Philanthropy Ltd, Bank Chambers, 31 The Square, Cumnock, Scotland, KA18 1AT
T: +44 7775644895
E: hello@FJPhilanthropy.com