How we look after the small amount of personal data we hold.

1 · Who we are (the data controller)

The data controller for this policy is Lady Clementina I Tottenham’s Bequest, a charity registered in England and Wales (registered charity number 220026), with its registered office at 6 Holly Gardens, Burton, Christchurch, Dorset, BH23 7JD. You can contact the trustees at [email protected] or on +44 (0)1202 483 219.

2 · What personal data we collect

We collect only what we need. In practice, that is:

• Donor records — name, postal address, email address, donation amount, donation date and (if you have signed a Gift Aid declaration) a confirmation that you are a UK taxpayer.
• Volunteer records — name, contact details (email, phone, postcode), and notes about your availability and the roles you are interested in.
• Enquiries — name, contact details, and the text of any message you send us through the contact form or by email.
• Analytics — anonymised information about pages visited, browser type, country (approximate, not IP-level), and referrer. We use a self-hosted analytics tool with IP addresses truncated at source.

3 · Why we collect it, and the lawful basis

Under Article 6 of the UK GDPR, our processing is justified as follows:

• Donations — necessary for the performance of a contract (the gift) and, where you have signed a Gift Aid declaration, for compliance with our legal obligations to HMRC.
• Volunteering — necessary for the performance of a contract (the volunteering arrangement) and our legitimate interest in running a safe rota.
• Enquiries — our legitimate interest in answering you, balanced against your privacy.
• Analytics — your consent, given via the cookie banner. You may withdraw it at any time.

4 · Who we share data with

We share data only with the following named processors and authorities, and only as necessary:

• HMRC — for Gift Aid claims, where you have signed a declaration.
• The Charity Commission — for statutory reporting (aggregate figures only; no donor names).
• Our independent examiner — Lyndsey Whittaker FCCA of Christchurch, who reviews our annual accounts.
• Our email platform — we use a UK-hosted email tool for the quarterly dispatch. We do not run targeted marketing.
• Our payment processor — if we offer online card payments through this website, the processor (a UK-regulated provider) receives card details directly; we never see them.

We do not transfer personal data outside the UK or the EEA. We do not sell data to anyone, ever.

5 · How long we keep it (retention)

• Donor records (Gift Aid) — seven years from the end of the relevant tax year, in line with HMRC requirements.
• Other donor records — seven years from the date of the most recent gift.
• Volunteer records — for the duration of your involvement, then 24 months afterwards.
• Enquiries — 24 months from the date of the last reply.
• Analytics — 14 months, aggregated.

6 · Your rights under UK GDPR

You have the right to:

• be informed about how we use your data (this policy);
• access the data we hold about you;
• have inaccurate data corrected;
• have your data erased (where possible — Gift Aid records are subject to HMRC retention);
• restrict the processing of your data;
• data portability (a copy in a structured, machine-readable format);
• object to processing based on legitimate interest;
• not be subject to automated decision-making (we do none).

To exercise any of these rights, email [email protected] or write to the trustees at our office. We will reply within one month, and usually much sooner.

7 · Cookies

We use a small number of cookies. They are listed in detail in our cookie policy. None of them is used for advertising.

8 · Children’s data

We do not knowingly collect personal data from anyone under 13. We do not market to under-13s. If a child wishes to volunteer at a working morning, a parent or guardian must register them and accompany them on the day. Our safeguarding policy is on the resources page.

9 · Security

The bequest is a small charity and our security measures match our scale: a password-protected office laptop, a paper file kept in a locked cabinet at 6 Holly Gardens, and a UK-hosted email account with two-factor authentication. We do not store card numbers. We will tell you, and the ICO, within 72 hours of becoming aware of any data breach that puts your rights or freedoms at risk.

10 · Changes to this policy

We update this policy when our practices change. The date at the top of the page tells you when it was last revised. Material changes are also flagged in the next quarterly dispatch.

11 · How to complain

If something has gone wrong, please write to the chair of trustees at our office address, or email [email protected]. We will reply within ten working days. If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):