Million Minutes

Privacy Statement

Last updated: 2 October 2026
Version: 1.0

1. About this Privacy Statement

The Irish Red Cross respects your privacy and is committed to protecting your personal data. 

This statement explains how we collect and use personal data when you use the Million Minutes website, register or propose an activity, pledge time, contact the campaign team, fundraise, donate, agree to communications, submit content, take part in research or otherwise participate. It also explains who receives your data, how long we keep it and your rights. 

Read this statement with the Million Minutes Website Terms and Conditions, Cookie Notice, any activity-specific privacy information, the general Irish Red Cross Data Protection Statement, and the terms and privacy information presented by payment providers such as iDonate and iRaiser. 

2. Who we are 

The data controller for the Million Minutes website and Irish Red Cross campaign activities is: 

Irish Red Cross Society
16 Merrion Square
Dublin 2, D02 XF85
Ireland
Telephone: +353 (0) 1 642 4600
General email: info@redcross.ie
Registered Charity Number: 20005184
Revenue Charity Number: CHY3950 

For data protection questions or to exercise your rights, contact the Data Protection Officer at dpo@redcross.ie or at the address above. 

3. Who this statement applies to

• Website visitors 

• Event organisers and primary contacts 

• Fundraisers and donors 

• People who pledge time or report participation 

• People included in approved stories, images or updates 

• Research, survey or feedback participants 

• People who contact us 

• Individuals whose information is provided by an authorised organiser or representative 

4. Personal data we collect

4.1 Event and activity registration

Name, email, mobile number, organisation or school, organisational role, branch affiliation, event category and name, general location, date and time, description, expected participation, fundraising arrangements, correspondence, approval or publication status, and campaign, event, branch or CRM identifiers. 

4.2 School and youth participation

We intend to collect information about an authorised adult representative rather than individual children. Do not use core campaign forms to submit pupils’ names, children’s contact details, dates of birth, medical information, attendance lists, competency information, photographs or recordings, or information identifying a child’s routine or precise location.  

4.3 Time pledges and participation

Number of minutes pledged or completed, activity type, campaign, event or branch identifier, date or campaign period, general location, validation information and, only where clearly necessary, contact information. Public counters will use anonymous or aggregate information wherever possible. 

4.4 Donations and fundraising

iDonate may collect donor name, address, email, donation amount, payment and transaction data, fundraising-page information, identity or bank-verification information, donor messages, anonymity choices and marketing preferences. Irish Red Cross may receive necessary donor, transaction, campaign-attribution, tax-relief, refund, anonymity and preference information. The Irish Red Cross does not intend to receive or store full payment-card numbers or card verification values. 

4.5 Public event and campaign content

Approved event title, general location, date and time, description, participation instructions, organiser or organisation name, photographs, stories and campaign progress may be published. Private organiser contact information will not be published unless this has been clearly explained and specifically agreed. 

4.6 Marketing preferences

Selected channels, interests, wording and version shown, source, date and time, and withdrawal, unsubscribe or suppression information. Marketing is optional. 

4.7 Website and technical information

IP address, browser, device, operating system, access date and time, pages visited, referring website, form validation, cookie choices, security logs, anti-spam or fraud signals, referral information, and analytics or advertising data where consented. 

4.8 Correspondence, complaints and rights requests

Identity, contact information, enquiry, correspondence, verification information, complaint or incident information and response records. 

4.9 Surveys, research and feedback

Optional research may involve contact information, campaign feedback, survey or interview responses and, where clearly explained, recordings or quotations. Additional privacy information will be provided where needed. 

5. Information we ask you not to provide

Unless specifically requested through an approved secure process, do not provide health information, sensitive personal data, criminal-conviction information, identity documents, full payment-card information, bank-verification documents, children’s names or contact details, another person’s information without authority, or confidential information in public fields. 

We may restrict access, redact, return or delete unnecessary or inappropriate information. 

6. Where personal data comes from

We collect personal data directly from you; from authorised organisers, schools, branches, organisations or corporate contacts; from payment providers such as iDonate and iRaiser ; from our website and suppliers; from approved partners; from public sources where verification is necessary; and from existing Irish Red Cross systems where an appropriate relationship exists. 

If you provide another person’s information, you must be authorised to do so and should direct that person to this statement. 

7. Why we use personal data and our legal bases

7.1 Event and participation administration

Purposes: Assess registrations, communicate, coordinate participation and maintain records. 

Lawful basis: Article 6(1)(b), steps at your request or performance of an arrangement; and Article 6(1)(f), legitimate interests in administering a safe, accountable campaign. 

7.2 Donations and fundraising

Purposes: Facilitate donations, administer pages, reconcile transactions, process refunds, prevent fraud and maintain records. 

Lawful basis: Articles 6(1)(b), 6(1)(c) and 6(1)(f). 

7.3 Financial allocation and branch reporting 

Purposes: Reconcile income, apply approved allocations, investigate discrepancies and maintain audit trails. 

Lawful basis: Articles 6(1)(c) and 6(1)(f). 

7.4 Public listings and promotion 

Purposes: Publish approved events and promote participation. 

Lawful basis: Article 6(1)(f), where proportionate; or Article 6(1)(a) for genuinely optional stories, close-up images or media. 

7.5 Counter and campaign reporting 

Purposes: Validate submissions, operate the counter, measure performance and produce aggregate reports.

Lawful basis: Article 6(1)(f). 

7.6 Security and fraud prevention 

Purposes: Protect systems and funds, detect misuse, investigate incidents and defend legal rights. 

Lawful basis: Articles 6(1)(f) and, where applicable, 6(1)(c). 

7.7 Legal and governance requirements 

Purposes: Satisfy tax, charity, audit and regulatory duties, deal with complaints and manage incidents. 

Lawful basis: Articles 6(1)(c) or 6(1)(f). 

7.8 Optional marketing

Purposes: Send campaign updates, fundraising appeals, events and ways to support our work. 

Lawful basis: Article 6(1)(a), consent, together with applicable electronic-marketing rules. 

7.9 Optional cookies and tracking

Purposes: Analytics, advertising, social-media and conversion tracking. 

Lawful basis: Consent. Strictly necessary technologies may operate where required to provide a requested service. 

8. Our legitimate interests

Relevant interests include administering the campaign, communicating with organisers, maintaining accurate records, moderating content, protecting children and supporters, securing systems and funds, preventing fraud, reconciling donations, measuring performance and maintaining governance records. 

You may object to processing based on legitimate interests. 

9. When providing information is necessary

Certain information is required to process registrations, create or link fundraising pages, process donations, issue receipts, handle refunds, investigate security matters, comply with law or respond to rights requests. If required information is not provided, we may be unable to provide the requested service. 

Optional marketing, public stories, photography, research and non-essential cookies are voluntary.  

10. Registration, Fundraiser Information and Donations

Participation in the Million Minutes campaign requires the provision of certain information during the registration process. Information submitted by participants will be used by the Irish Red Cross for the purposes of administering and managing the campaign, communicating with participants, and supporting associated fundraising activities. 

Relevant participant and fundraiser information may also be shared with iDonate, the Irish Red Cross’s online fundraising platform provider, for the purpose of creating and managing fundraising pages and facilitating the processing and administration of donations. 

Participants should only submit information that they are comfortable providing for these purposes. All personal data collected and processed in connection with the Million Minutes campaign will be handled in accordance withapplicable data protection legislation and the relevant privacy notices of the Irish Red Cross and iDonate. 

Online donations made through a Million Minutes fundraising page hosted on iDonate will be processed by iDonate and transferred directly to the Irish Red Cross. Participants are not required to collect, receive, hold, or transfer such online donations themselves. 

11. Children and young people

Registrations involving schools or young participants must be managed by an authorised adult. Core campaign systems are not intended to profile children or collect pupil contact information. 

We require suitable safeguarding, age-appropriate information where children’s data is processed, generalised public locations, separate media controls and a separate assessment before collecting identifiable attendance, competency, health or training information. 

If a child submits information through a form not intended for children, we may delete it or take proportionate safeguarding action. Campaign fundraising accounts involving schools or young participants must be adult-managed. 

12. Who receives personal data

Irish Red Cross personnel: Authorised staff and volunteers in relevant functions may receive access according to role and need. 

OLIVER Agency and website suppliers: OLIVER Agency and website-development, hosting or support providers may receive data where necessary. Processors will act under written contracts. 

iDonate, Eventmaster and payment providers: iDonate may process donor, fundraiser, Cause, account, payment, verification, preference and public-content information.  

Other service providers: Providers may support hosting, CRM, email, SMS where activated, consent management, security, analytics, advertising where consented, technical support, payment reconciliation, storage, advice and audit. 

Branches and campaign partners: Authorised branches may receive limited event or allocation information. Partners will not receive donor or participant data for unrelated marketing. 

Public users: Approved event information, organisation names, aggregate totals and donor information selected for public display may be visible publicly. Anonymous donors will not intentionally be identified. 

Authorities and advisers: We may disclose data where required by law, to report suspected crime or serious harm, obtain professional advice or defend legal rights. 

13. Marketing preferences and iDonate transfers

The Irish Red Cross and iDonate may present separate marketing choices. Agreeing to one organisation’s marketing does not automatically mean agreement to the other’s. 

Where iDonate transfers a preference, we may receive the selected preference, wording and version, date and time, source platform and transaction or supporter identifier. 

• Our CRM suppression record will be authoritative for Irish Red Cross communications. 

• We will not knowingly overwrite a later Irish Red Cross opt-out with an older iDonate opt-in. 

• Direct withdrawals will be applied to Irish Red Cross communications. 

• A separate request may be needed to stop iDonate communications. 

• We will use appropriate reconciliation controls. 

14. International transfers 

We aim to keep campaign personal data within the EEA where reasonably practicable. Some suppliers or support services may process or access information outside the EEA. 

Where a restricted transfer occurs, we rely upon appropriate safeguard mechanisms such as adequacy decisions, Standard Contractual Clauses, approved Binding Corporate Rules or another Chapter V GDPR mechanism, and assess supplementary safeguards where required.

15. How long we keep personal data

We keep personal data only as long as necessary, taking account of legal, accounting, tax, charity, safeguarding, complaint and audit requirements. 

• Incomplete or abandoned registrations: Normally up to 90 days. 
• Rejected or withdrawn proposals: Normally six months after closure. 
• Approved event and campaign records: Normally 24 months after the relevant event or campaign cycle closes, unless longer retention is justified. 
• Public event listings: Normally unpublished promptly after completion, cancellation or expiry. 
• Pledge and participation records: Delete or anonymise after validation and reporting, subject to a final approved period of 90 days. 
• Donation and financial records: Retained for a period of 7 years as is required by applicable law and the Irish Red Cross retention schedule. 
• Marketing and consent records: Periodically reviewed; minimal suppression and evidence records may be retained. 
• Website security logs: Normally 30 to 90 days unless an incident or legal requirement justifies longer. 
• Complaints, incidents and rights requests: Retained under the applicable Irish Red Cross compliance schedule. 
• iDonate records: iDonate determines retention for data it controls; copies transferred to IRC follow IRC purposes and schedules. 

The multi-year nature of Million Minutes does not automatically justify retaining identifiable Year 1 participation information for the full programme. 

16. Security

We use appropriate technical and organisational measures that may include role-based access, least privilege, multifactor authentication, encryption, secure hosting and backups, logging, monitoring, vulnerability management, penetration testing, test and production separation, export restrictions, incident response, supplier controls, confidentiality obligations and staff training. 

No online service can be guaranteed completely secure. Report suspected loss, disclosure or unauthorised access to dpo@redcross.ie promptly. 

17. Your data-protection rights

• Access: ask whether we process your data and obtain a copy. 
• Rectification: correct incomplete or inaccurate information. 
• Erasure: request deletion where there is no continuing lawful reason to retain the data. 
• Restriction: request restricted use in specified circumstances. 
• Object: object to legitimate-interest processing. You have an absolute right to object to direct marketing. 
• Data portability: receive eligible data in a structured, commonly used and machine-readable format. 
• Withdraw consent: withdraw consent at any time where consent is our lawful basis. 
• Complain: raise a concern with us or the Data Protection Commission. 

To exercise a right, email dpo@redcross.ie with your name, the right sought, information identifying the relevant record and any information reasonably needed to verify identity. We normally respond within one month and will tell you if a lawful extension applies. 

18. Rights involving iDonate or another controller

Requests relating to an iDonate account, fundraising page, SSO, linked Eventmaster account, payment or identity verification, donor message or information held only by iDonate may need to be handled by iDonate or another controller. 

iDonate’s data-protection contact is dataprotection@idonate.ie. We will assist with routing where appropriate, but one controller cannot always delete or change information independently controlled by another. 

19. Automated decision-making and profiling

We do not currently intend to make decisions based solely on automated processing that produce legal or similarly significant effects. 

Automated tools may identify duplicates, detect spam, flag suspected fraud, validate entries, apply cookie choices, route forms and produce aggregate reports. An authorised person should review matters before a significant rejection, suspension or investigation decision. 

If profiling, CRM audience selection, lookalike advertising or materially different automated processing is introduced, we will assess the change and update this statement where required. 

20. Cookies, analytics and advertising

The website may use strictly necessary cookies, consent tools, security and anti-spam services, analytics, advertising or conversion tracking, embedded content, social-sharing tools and iDonate scripts, frames, modals or redirects. 

Optional technologies will remain disabled until valid consent is provided. You can change or withdraw choices through [insert Cookie Settings link or tool]. Read the Million Minutes Cookie Notice at [insert Cookie Notice link]. 

21. Social media

Social-media platforms may independently process account information, reactions, comments, shares, messages, advertising interactions and device or usage activity. Their own privacy information applies. 

We may receive aggregate campaign statistics and information you choose to make available. Public social-media content will not automatically be reused for marketing without considering privacy, copyright and reasonable expectations. 

22. Public information and search engines

Approved public content may be visible worldwide, shared, indexed by search engines, cached or retained in screenshots and external archives. We provide a route to request correction or removal and will take reasonable steps to remove content from systems under our control, but external removal may not be immediate. 

Do not submit information for public display unless you are comfortable with its publication. 

23. Changes to this Privacy Statement

We may update this statement when campaign activities, technology, suppliers, data fields, retention periods, legal requirements or privacy practices change. The latest version will be published with its effective date and version number. 

Each annual campaign cycle will be reviewed before launch. Material additions may require additional privacy information. 

24. Contact us

Data Protection Officer
Irish Red Cross Society
16 Merrion Square
Dublin 2, D02 XF85
Ireland
Email: dpo@redcross.ie
Telephone: +353 (0) 1 642 4600 

General campaign email: amillionminutes@redcross.ie

25. Complaints to the Data Protection Commission

We encourage you to contact us first so that we can try to resolve your concern. You also have the right to contact: 

Data Protection Commission
6 Pembroke Row
Dublin 2, D02 X963
Ireland
Email: info@dataprotection.ie
Telephone: 01 765 0100 or 1800 437 737
Website: https://www.dataprotection.ie/