3. What personal data we collect

Depending on how you use the website and interact with us, we may collect:

• Contact details such as name, email address, postal address and telephone number when you complete a contact form, sign up to our updates, make an enquiry or register for an event.home.
  

• Donation and support information, including amounts donated, Gift Aid declarations and communication preferences, when you make a donation or support us in other ways. (Payment card details should be handled by our payment processor and are not stored by us.)
  

• Volunteering or participation information, including applications, references and any relevant background details, where you apply to volunteer or take part in programmes.
  

• Technical data such as IP address, device type, browser type, pages visited, time and date of visits and other usage information collected through cookies and similar technologies, to help us understand how the website is used and to improve it.
  

• Any other personal information you choose to provide in correspondence with us.

4. How we collect your personal data

We collect personal data:

• Directly from you when you fill in forms on the website, contact us by email, phone or post, make a donation, register for an event, sign up to newsletters or otherwise interact with us.

• Indirectly through your use of the website via cookies and similar technologies (see our Cookies Policy for further detail).

• From third parties where necessary, for example event partners, fundraising platforms, payment processors or referrers, and only where it is lawful and appropriate to do so for our charitable purposes.

5. Why we use your personal data (purposes) and lawful bases

We will only process your personal data where we have a lawful basis under UK GDPR. Typical purposes and lawful bases for a charity website include:

• Responding to enquiries and providing information

  • Purpose: To answer your questions, handle requests and provide information about our work.

  • Lawful basis: Our legitimate interests in running and promoting our organisation and responding to enquiries; in some cases, performance of a contract if you ask us to provide specific services.

• Managing donations, Gift Aid and supporter relationships

  • Purpose: To process donations, claim Gift Aid, thank supporters, manage preferences and keep appropriate financial records.

  • Lawful bases: Performance of a contract; legal obligation (e.g. Gift Aid and accounting); legitimate interests in fundraising and supporter stewardship; consent for certain marketing communications.

• Volunteer and participant management

  • Purpose: To assess applications, manage volunteering or participation, provide support and keep necessary records.

  • Lawful bases: Performance of a contract or taking steps at your request prior to entering into one; legitimate interests in delivering our programmes; legal obligations where applicable.

• Running events and activities

  • Purpose: To administer registrations, attendance, follow-up and related logistics.

  • Lawful bases: Performance of a contract; legitimate interests in delivering events and services.

• Sending you updates and fundraising communications

  • Purpose: To send you newsletters, updates, invitations and fundraising appeals, in line with your preferences.

  • Lawful bases: Consent (where required under PECR for email/SMS marketing) or legitimate interests (e.g. postal fundraising), always with an option to opt out.

• Running and improving our website and digital services

  • Purpose: To analyse usage, fix bugs, protect security, and improve content and user experience.

  • Lawful basis: Our legitimate interests in maintaining an effective, secure website and understanding how it is used.beingacharitytrustee.

• Compliance, governance and risk management

  • Purpose: To comply with legal, regulatory and safeguarding obligations, respond to complaints, and manage risk.

  • Lawful bases: Legal obligation; legitimate interests in proper governance and safeguarding; in some cases, establishment, exercise or defence of legal claims.

Where we rely on consent, you can withdraw it at any time using the unsubscribe link in emails or by contacting us; withdrawal will not affect the lawfulness of processing before consent was withdrawn.

6. Cookies and similar technologies

Our website uses cookies and similar technologies to:

• Make the site work (for example, session and security cookies).

• Remember your preferences.

• Help us understand how people use the site (for example, analytics cookies).

Non-essential cookies (such as analytics and advertising cookies) will only be set with your consent, in line with the UK Privacy and Electronic Communications Regulations (“PECR”) and ICO guidance.

For more information, including the types of cookies we use and how to manage your preferences, please see our Cookies Policy.

7. Who we share your personal data with

We may share personal data with:

• Trusted service providers and data processors who support our operations (for example, website hosting, email delivery, event platforms, payment processors, CRM or mailing services), under contracts that require them to keep your data secure and use it only on our instructions.

• Professional advisers (such as auditors, legal advisers) where necessary for advice, audit or legal purposes.

• HM Revenue & Customs and other regulators where required (for example to claim Gift Aid or meet regulatory obligations).

• Law enforcement or other authorities where we are legally required to do so or where it is necessary to protect individuals or our organisation (for example, safeguarding concerns).

We do not sell your personal data and we do not share it with other organisations for their own direct marketing purposes.

If we transfer personal data outside the UK or EEA, we will ensure that appropriate safeguards are in place in line with UK data protection law.

8. How long we keep your personal data

We keep personal data only for as long as necessary for the purposes described above and to meet legal, accounting and reporting requirements.

Retention periods vary depending on the type of data, for example:

• Donation and Gift Aid records are typically kept for at least six years (and Gift Aid records for longer, often up to twelve years) to comply with tax and accounting requirements.

• Volunteer, event and programme records are kept for the duration of involvement and for a period afterwards, where needed for safeguarding, legal or reporting purposes.

• Email subscription data is kept while you remain subscribed and for a short period afterwards to manage suppression lists.

• Technical and analytics data is kept for a period appropriate to monitoring and improving the website.

We maintain internal retention schedules and will securely delete or anonymise data when it is no longer needed.

9. How we protect your personal data

We take appropriate technical and organisational measures to protect your personal data from unauthorised access, use, disclosure, alteration or loss. These measures may include:

• Access controls, role-based permissions and “need-to-know” access.

• Secure systems, passwords and, where appropriate, encryption.

• Staff and volunteer training on data protection and confidentiality.

• Policies and procedures governing data handling, security and breach response.

We also expect our service providers and partners to put in place suitable security measures and data protection controls.

10. Your rights

Under UK data protection law you have rights in relation to your personal data, including:gov+2

• The right to be informed about how your data is used.

• The right of access to a copy of the personal data we hold about you.

• The right to rectification of inaccurate or incomplete data.

• The right to erasure in certain circumstances (“the right to be forgotten”).

• The right to restrict processing in certain circumstances.

• The right to object to certain types of processing, including direct marketing and processing based on legitimate interests.

• The right to data portability in certain circumstances.

To exercise these rights, please contact us using the details in section 2. We may need to verify your identity before responding.

If you are unhappy with how we have handled your personal data, you can contact our data protection lead or make a complaint to the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk | Telephone: 0303 123 1113

11. Links to other websites

Our website may contain links to other websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policies of any websites you visit.

12. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in law or our practices. The version published on this page will always show the date of the latest update.