search Donate

931e7818-a082-b073-440c-abdf5f7363fb flex-box container between col-100 0

239d3af2-c4d1-58d5-e71e-fd01ff510876 flex-box col-100 0

3dd74f8b-5819-9384-b320-53dfcca661a5 col-100 0

Your Privacy

fc4c2d52-9637-bbd9-3dfd-fb747e671023 flex-box container between col-100 0

b69e5b8a-64d4-5fdf-913e-3771fd017978 flex-box col-100 0

2747f241-f3eb-0e84-052a-158eeddc21b9 col-100 0

Action for Pulmonary Fibrosis takes the security of your personal data seriously and processes and stores information in accordance with the current data protection regulations. This Privacy Policy sets out your rights and freedoms, our practices and information on our commitment to keeping your data secure, so our supporters can be confident when sharing their personal information with us.

63eacaeb-4772-cc0b-e0ae-59d9e3e439ab flex-box col-100 1

d61e52b4-5918-d01b-3b92-965b29fb9937 col-100 0

1. Who are we?

d0d8a353-de60-1b4b-3ac6-f2018ba48206 col-100 0

Action for Pulmonary Fibrosis (APF) is a UK national registered Charity, registered with the Charity Commission in England and Wales (Registered Charity number: 1152399) and the Office of the Scottish Chairty Regulator (OSCR) (Registered Charity number: SCO50992).

c2ecf943-356c-7e11-319e-07c5a2a2a9b9 col-100 1

Our mission is to bring people together to drive change so that more people affected by pulmonary fibrosis (or lung scarring) can live well for longer. We provide expert support, information, education and a growing network of support groups to raise awareness of pulmonary fibrosis.

APF is the data controller for the information you provide unless it is otherwise specified. APF may enter into contracts or partnerships with third parties from time to time. In instances such as these, there may be privacy policies from the third parties which govern the processing of personal data, separate to APF’s processes.

ced4d6b7-6c6e-6444-1c5d-b21c6e22da47 col-100 2

If you have any questions relating to our Privacy Policy or how we use your personal data, please email our Data Protection Officer on: info@actionpf.org or post your query to:

Data Protection Officer
Action for Pulmonary Fibrosis
Stuart House
St John’s Street
Peterborough
PE1 5DD

4e5f7dae-6cba-7f0c-a4d9-734833508dc5 flex-box col-100 2

8f5aaa51-b481-5378-dd7d-fe05259e2a9a col-100 0

2. Data collection overview

010ff8c5-919c-b462-ec93-a4ae245ed4ad col-100 1

Personal data is defined as any information relating to an identified or identifiable natural person. This includes information that can directly or indirectly identify a person.

We use personal data to provide the best possible support for our beneficiaries who use our services. We may collect personal data as part of the following activities:

ed55e56c-c144-9c92-2527-9c50351a9cde col-100 2

In person in the community or at an event or conference;
When you use our website to request information, ask about our
When you email or call us;
As part of our ongoing relationship with you;
When you have consented to a third party to share it with us.

3ecb3212-21aa-3eef-8db3-56aaa34bca18 col-100 3

In some instances, we may collect special category data, including health related data, information about Criminal Convictions or Offences and children’s data. Prior to collecting this information, a Data Privacy Impact Assessment is undertaken to ensure that it is necessary and there is a lawful basis to do so under the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018.

We may collect and use anonymous data to provide statistics or demographical information on the beneficiaries our services are reaching, and to drive change in policy, health and care.

4b856a4f-bee7-a9de-7156-bcab378e38e7 flex-box col-100 3

58b59ace-e583-af33-2278-8121cabf317c col-100 0

3. What personal data do we collect and how?

c1fb0ec3-cec1-2403-1368-478d8ba0cfeb col-100 1

We process personal data to provide the information or services that you have requested. The data we collect may include:

your name, postal address, email address and phone number.
In some instances, we may also ask for your date of birth, gender, demographic information and your relationship to pulmonary fibrosis.
When you make a donation or purchase through our website, APF does not store your bank or card details however, you will be asked to input them into our secure third-party payment providers platform. We may collect your UK taxpayer status to maximise the impact of your donation by claiming gift aid and we record your donation and purchase history with us.
When you make a donation in the community via one of our terminals, APF does not store your bank or card details, these are kept by our third-party payment processor Blackbaud Merchant Services. We will receive your contact details to effectively administrate the payment.
Your direct marketing preferences.
We may collect special category data to help us to analyse and improve the reach of our services and anonymously provide statistical information about our beneficiaries.
Where we process personal data relating to children (under 18), we do so only where it is necessary and we take additional care to protect children’s personal data and special category data. We apply appropriate safeguarding measures to this data and ensure such data is only retained for as long as necessary. Where we rely on consent, we obtain explicit consent from a parent or legal guardian. All communications are directed to the parent or guardian and children’s data is never used for direct marketing purposes.
We may record calls received through our Support Line.
Where you have consented to share information about yourself and your personal experiences as part of a case study, we may collect and store photos, videos and audio alongside this information.

71ac8659-eb58-18a0-65fb-aaf38013966d col-100 2

The main ways that we receive and collect personal information are:

When you fundraise or donate to APF.
When you ask us to provide you with support or information.
When you ask us to provide you with a call back from our Support Line.
When you ask us to keep you up to date with Support Groups.
When you sign up to our mailing list to receive direct marketing from us.
When you consent to be part of our Involvement Network.
When you agree to provide your personal data for research purposes.
When you complete a survey.
When you use an online tool to email your elected representative.
When you attend one of our webinars.
When you sign up to our befriending service.
When you purchase something from our website.
When you register your interest to become a volunteer.
When you enter a prize draw or take part in a lottery organised by us.
If you make a complaint directly to us.
When you visit our website, we use essential cookies to maintain a good user experience. In addition, we may collect some information on how frequently pages are visited and other website performance related data.
We also use Meta Pixel to provide targeted advertising based on geographical data, social media and website interactions and individual interests.
When your data is publicly available. In some instances, APF has a legal requirement to complete due diligence on individuals prior to accepting donations. Additionally, we may also undertake prospect research to better understand our beneficiaries and how they may be able to support APF in the future.
When you interact with us on social media, for example, if you tag APF in a post.
When you consent for a third party to share your data with us. This could be a through a donation platform, when you sign up to our lottery, social media, as part of gift in Will administration via a solicitors, when you have provided explicit consent as part of your healthcare journey or as part of a complaint or feedback made about us.

057380ee-cff1-f4a3-a1a8-bf16152eb7ce flex-box col-100 4

f878cabb-ef36-8411-807b-2bdc14da8e94 col-100 0

4. How we use your data and our legal justification for doing so.

8f89bef4-0d89-3dd3-95ce-f09f100f7420 col-100 1

APF only processes personal data in accordance with the current laws. We will use the below legal bases to process your personal data:

Consent: We gain clear consent from you before processing your data.
Contractual necessity: We process your data to fulfil our contractual obligations to you.
Legal Obligations: Processing is necessary for compliance with a legal obligation.
Vital interest: Where we need to protect your vital interests (or someone else’s).
Legitimate interest: Where we have a legitimate interest to process your data, and your rights and freedoms are not overwritten by those interests.

6c69d27c-2787-a992-02a6-6028883284b6 col-100 2

Please see below for more information on how we process the different types of personal data and which legal basis we rely on. If we are relying on the legitimate interest as our legal basis for processing, we have noted what that interest is and a legitimate interest assessment has been completed in advance of this processing activity.

25e3bdd0-b5bd-c1d4-b8fb-7aefdfdbe382 col-100 3

Purpose and / or activity being undertaken	Lawful basis for processing	Legitimate Interest (where relevant)	Maximum data retention period
Processing activities relating to our support line, support groups and webinars
To provide you with a phone call that you have requested through our web forms. To provide emotional and informative support based on the health and demographic data you have shared with us.	Consent Explicit consent		7 years after the last interaction 7 years after the last interaction
To capture photographs, videos or audio recordings and information about individuals’ journey with APF from supporters who have benefitted from APF’s services, to be included as a case study in our electronic and printed newsletter, on social media, in a press release and on our website	Explicit consent		5 years
To capture and share content facilitated by us, such as recording our webinars and making them publicly available.	Consent		2 years
To work with and facilitate the creation of support groups. Support groups are a place for beneficiaries to gain peer-to-peer support and share experiences.	Consent Legitimate Interest	We have a legitimate interest to promote and grow the number of support groups and their members.	7 years from the last interaction.
To provide you with information about your support group membership or webinar attendance	Legitimate Interest	We have a legitimate interest to provide you with information about upcoming support group or webinar events.	7 years from the last interaction.
To send you marketing communications based on your interests.	Consent Legitimate interest	We have a legitimate interest to share APF’s work with our engaged supporter base.	7 years from the last interaction.
To understand the profiles of the individuals accessing our services by collecting demographic and health data.	Explicit consent		2 years from last interaction.
Processing activities related to fundraising for and donating to APF
To enable you to make a donation to us.	Legal Obligation Legitimate Interest	We have a legitimate interest to talk to you about our fundraising campaigns, a gift in Will or regular giving pledge that you have made or are thinking about making.	7 years after the last interaction
To claim gift aid on qualifying donations	Legal Obligation		7 years after the last interaction
To invite beneficiaries to events and challenge events that may be of interest.	Consent Legitimate Interest	We have a legitimate interest to keep you informed of upcoming events that may be of interest, based on our ongoing relationship with our supporters.	7 years from the last interaction.
To talk to you about how your donations are making a difference.	Consent Legitimate Interest	We have a legitimate interest to keep you informed of how donations received by Action for Pulmonary Fibrosis are being used.	7 years from the last interaction.
To enable us to administrate a gift left to APF in an individuals Will.	Legal Obligation Legitimate interest	We have a legitimate interest to maintain the relationship and provide support to the family of an individual who has left a gift in their Will.	7 years from the last interaction.
To enable us to complete prospect and due diligence research to ensure that donations are made without a risk to the Charity's reputation, in line with our ethical principles and for anti-money laundering purposes.	Legal Obligation		7 years from the last interaction.
To conduct research, including wealth screening, to help us to understand which areas of work you might be interested in supporting. Examples of the information we may use include: Companies House registration, Charity Commission, professional or corporate profiles, social media and third-party publications.	Legitimate interest	We have a legitimate interest to identify individuals who may be interested and have the capacity to make a high value gifts.	7 years from the last interaction.
To gather statistical data on email and website engagement using pixel technology.	Legitimate interest	We have a legitimate interest to monitor the effectiveness of our communications with our supporters	2 years
To provide content and advertisements that are personalised to you that may be based on your engagement and geographical location.	Cookie consent*		1 year
To administrate individuals who play our lottery.	Consent		7 years from the last interaction.
To enable you to take part in a competition or prize draw and to administrate those opportunities.	Contractual obligations		7 years from the last interaction.
To fulfil an order of merchandise through our website.	Contractual obligation		7 years from the last interaction.
Processing activities relating to Research, Involvement, Education and Policy
To enable business to business partnerships and contracts	Contractual obligation		7 years from the last interaction.
To administrate the application and review of our conference and research grant reviews	Consent		7 years from the last interaction.
To administrate an agreement with our research panellists	Contractual obligation		7 years from the last interaction.
To administrate the survey responses provided, including any special category data	Explicit consent		7 years from the last interaction.
To provide you information as part of our involvement network	Consent		7 years from the last interaction.
To provide you with news and updates via direct marketing	Consent		7 years from the last interaction.
To provide you with opportunities to attend focus groups	Consent		7 years from the last interaction.
To fulfil an order of educational materials through our website	Contractual Legitimate interest	We have a legitimate interest to follow up on bulk orders to understand how these resources are being used to serve our community.	7 years from the last interaction.
Other reasons we may process your data
To respond to feedback or a complaint	Legal obligation		7 years from the last interaction.
To understand the profiles of the individuals accessing our services by collecting demographic and health data.	Explicit consent		2 years from last interaction.
To maintain our relationship with you by notifying you of any changes to our privacy policy.	Legal obligation		7 years from last interaction.

cdd09d2d-e7d1-408b-5e01-0f3e86c58e9f col-100 4

We will only keep your personal data for as long as is reasonably necessary to fulfil the purposes for which we collected it. The data retention periods stated above have been calculated based on the type of data we are collecting, the amount of data and the sensitivity and potential risk of harm from unauthorised disclosure of that data.

dff75f4d-7714-6c12-2de6-beb4e7a05d6c col-100 5

*APF provides its website users with the opportunity to ‘accept all’, ‘customise’ and ‘reject all’ cookies when visiting the APF website. These preferences can be changed at any time by accessing the ‘Cookie preferences’ option on the APF website.

We regularly review the purposes for why we process your data and are committed to the data minimisation principle. We will always take the lowest risk approach to ensure we are not holding any unnecessary information, and take all reasonable steps to ensure the accuracy of that information.

7a5d604c-5623-9c03-834f-922e38df5ceb flex-box col-100 5

66393f08-8187-0693-570d-ab614db20614 col-100 0

5. Who do we share your data with?.

14115a61-511b-6c43-4632-c1935abb101c col-100 1

Action for Pulmonary Fibrosis will never sell your data to a third party for marketing purposes.

APF will need to share your data from time to time in order to provide you with the service you have requested. We ensure that all organisations that are processing your personal data on APF’s behalf are carefully selected and have a high standard of security. In some instances, our suppliers may host data outside of the UK. Where data is being transferred outside of the UK, APF has appropriate safeguards (such as the UK International Data Transfer Agreement (IDTA) or UK Addendum, and a transfer risk assessment where required), using UK GDPR compliant contracts, strict data transfer agreements and security measures which provide an equivalent level of protection to that within the UK.

4755051d-5aa1-a740-b64e-9a6676e6821d col-100 2

We will only ever share your personal data for these reasons set out in this policy. The organisations we work with may be acting as data processors or joint or independent controllers in their own right. Where permissible and consistent with the activities detailed in section four, data may be shared with:

80874fb5-8f4d-6fa3-2021-5195e2f0b383 col-100 3

Suppliers in order to fulfil a contract that we have entered into with you for example, if you order an APF Rose;
On our Charity database, hosted by Blackbaud;
Event organisers, where you sign up to a fundraising event;
Social media platforms, with your consent;
Our website host and database provider;
Mailing companies, both postal and electronic;
HMRC, where we can claim gift aid on your behalf;
Our Trustees, to allow them to fulfil their Trustee duties;
Analytics and advertising providers to improve our services and track the most visited content;
Individuals or organisations who are involved in the administration of a gift in Will;
Specialists who analyse anonymous data collected as part of our surveys;
The Police or regulatory bodies where we have a legal obligation;
Where it is necessary to fulfil our duty of care and safeguarding of a vulnerable individual.

0feced88-bbe2-6694-bdb8-ebb3adc3e546 flex-box col-100 6

e2b82824-d8a5-ade4-a016-bb458e5c1819 col-100 0

6. Your individual rights.

ddc3a3e7-5f9a-c58f-dd3b-f33ad7bdc7ff col-100 1

Every individual has rights under the UK data protection law. Your rights in relation to APF processing your personal data are:

b78241fc-62dc-36e5-36e1-43b6227dc43d col-100 2

Right of access: you can ask for a copy of the data we hold on you, also known as a subject access request (SAR). There is a one-month time limit on SARs.
Right to object: you can object to specific processing of the data we hold about you.
Right to be informed: you can ask what data is held and what we are using it for.
Right to rectification: you can ask us to correct your data if it is inaccurate.
Right to erasure: you can ask us to delete the data. (This is not an absolute right, for example, if we need to hold the data for a regulatory requirement, then we must)
Right to restrict: you can ask us to stop processing your data.
Right to portability: you can ask for your data to be made easily accessible and transferable to another organisation. You can request that it is moved to another data controller.
Right in relation to automated decision making and profiling: you can request that human involvement is required in the processing of data for activities that are entirely automatic where it may have a legal or similarly significant effect. (APF does not currently use automated decision making.)

3b679d99-f24e-ffb4-ce83-abb566a2a1fa col-100 3

If you would like to exercise any of the rights that are detailed above, please contact our data protection officer via email: info@actionpf.org or via the post:

Data Protection Officer
Action for Pulmonary Fibrosis
Stuart House
St John’s Street
Peterborough
PE1 5DD

13643663-89d0-43de-bac9-a6c0b72cf5e1 col-100 4

To submit a subject access request, please follow this link and complete the form.

Upon confirmation of identity, APF will respond within one month as required under UK GDPR.

bc69ca04-9d89-b2ef-edc0-a9ddb1e4f918 col-100 5

In the event that you would like to make a complaint about the way we process your personal data, you have the right to lodge a complaint with the supervisory authority for the UK which is the Information Commissioner’s Office (ICO) at any time. You can make a complaint through the ICO’s website: www.ico.org.uk or via the phone: 0303 123 1113

445d8848-8f08-757b-ce05-a06d6f7eedb7 col-100 6

In the event that a data breach is discovered, APF will promptly investigate, take steps to contain and mitigate its impact and notify the affected individual and the ICO within 72 hours where required and feasible. All incidents are thoroughly reviewed to implement additional measures and prevent any recurrence.

dec96159-866f-d876-7bc4-c3883af0e88c flex-box col-100 7

0d359439-7191-11d5-89a8-77b712f8c342 col-100 0

7. Links on our literature and website

a0ea8237-4f3d-1d25-bd3c-4480659f6b43 col-100 1

In some instances, we will provide links to external sources that are not within the control of APF. Where an individual navigates away from APF’s website or literature, we are no longer responsible for the third-party processing of your data and we encourage you to read the privacy policies for those third parties.

e756461d-5b3e-0b94-7924-57bdc41c9c45 flex-box col-100 8

8eefdc1d-2d44-3549-3aad-8e4d710e4078 col-100 0

8. Updates to the way we process data

53d9c1d9-22d9-14a9-6ae8-734971066f31 col-100 1

Action for Pulmonary Fibrosis regularly reviews its data activities to ensure that it accurately reflects how we are processing your personal data and why. The most recent version of our Policy will always be available on our website.

This policy is available in alternative formats upon request.

This Policy was last reviewed: March 2026

Tab ID:291