{
  "id": "POL-079",
  "slug": "pol-079",
  "title": "A charity policy must bar anyone but the charity from using subscriber data",
  "statement": "A charity or donation programme's policy must state that no entity other than the charity itself may use the subscriber data.",
  "rationale": "T-Mobile requires this because donor lists are traded more freely than almost any other consumer data, and the donor who gave a number to one cause did not agree to hear from every cause its fundraising agency serves. Charities work through agencies and platforms as a matter of course, so the clause has to say the agency may deliver the messages and nothing else.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "privacy policy body",
  "severity": "BLOCKING",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "TERMINAL_POLICY",
  "artifact": "privacy_policy",
  "authorities": [
    "T-Mobile"
  ],
  "codes": [
    {
      "provider": "Bandwidth",
      "code": "7103",
      "remediable": true
    }
  ],
  "applicability": {
    "useCases": [
      "CHARITY"
    ]
  },
  "applicabilityText": "Applies when the use case is CHARITY.",
  "universal": false,
  "remediation": "State in the policy that subscriber data is used only by the named charity, and that agencies and platforms handle it solely to deliver the charity's own messages. Done when no other organisation is permitted to use it for anything.",
  "example": "Numbers given to Riverside Shelter are used only by Riverside Shelter. Our messaging vendor sends the texts on our behalf and uses the numbers for nothing else; no other organisation receives them.",
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-079/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-079.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}