This Privacy Policy explains how personal information is handled when you visit https://thesheffield1000.org, make a donation, establish a recurring donation, create an account or communicate with The Sheffield 1000.

1. Personal information we collect

We may collect your name, email address, postal or billing address, account details, donation amount and frequency, transaction identifiers, payment status, donation history, correspondence, marketing preferences and Gift Aid declarations. Stripe handles payment information and may provide us with limited payment details such as card brand, last four digits, expiry information and payment status. We do not normally store full payment card numbers. When you use the website, technical information such as IP address, device/browser information, security logs and cookie preferences may also be collected.

2. Why we use information and our legal bases

We use information to process donations, administer donor accounts and recurring payments, send receipts and service messages, respond to enquiries, prevent fraud, maintain security, keep financial records and administer eligible Gift Aid claims. Depending on the activity, our UK GDPR legal bases may include performance of a contract (where applicable), compliance with legal obligations, our legitimate interests in operating and protecting the fundraising service, and consent where required. The precise basis depends on the processing activity. Marketing newsletters, fundraising appeals and promotional messages are sent only where permitted by applicable electronic marketing rules, including where consent is required. You can withdraw marketing consent at any time.

3. Recurring donations and donor accounts

When you donate, an account is created to support your donor record and, where available, management of recurring donations. We use your information to identify you, maintain payment history, communicate about failed payments and process cancellations or refunds.

4. Gift Aid and HMRC

If you make a Gift Aid declaration, we may collect your full name, home address, donation details and declaration information. This is used to check, administer and evidence claims and may be shared with HMRC or an authorised Gift Aid administrator where necessary. You should notify us if your eligibility changes.

5. Who we share data with

We may share relevant information with Stripe for payment processing; our website hosting, IT and security suppliers; email/newsletter providers; professional advisers; HMRC and other public bodies where legally required; and organisations that assist with lawful donation administration. We do not sell personal information. Service providers are expected to handle personal data securely and under appropriate contractual arrangements where required.

6. International donations and transfers

Supporters can donate from outside the UK. Some service providers may process personal information outside the UK. Where UK data protection law requires safeguards for international transfers, we use an appropriate legal mechanism, such as UK adequacy regulations or approved contractual protections.

7. Marketing and email preferences

We may send monthly newsletters, campaign updates and fundraising promotions where lawful. You can unsubscribe using the link in marketing emails or contact us directly. We may still send essential messages concerning payments, receipts, security and your account.

8. Cookies and analytics

The website may use strictly necessary cookies for essential functions, including account access, payment security and remembering privacy choices. Any non-essential analytics or marketing cookies should only be used in accordance with applicable consent requirements. Please refer to the live cookie preference tool for details of the cookies actually used, their purposes, providers and retention periods.

9. How long we keep information

We retain information only for as long as necessary for the purposes described, including ongoing donor accounts, donation administration, legal and accounting obligations, and Gift Aid records. HMRC recordkeeping rules can require charity Gift Aid records to be retained for several years. Marketing contact details are kept until you unsubscribe or they are no longer needed, subject to retaining minimal suppression records to respect your opt-out.

10. Security

We use appropriate technical and organisational measures intended to protect personal information, including access controls and reputable payment processing. No internet service can guarantee absolute security. If you believe your account has been compromised, contact us promptly.

11. Your data protection rights

Depending on the circumstances and applicable law, you may have rights to access, correct, erase or restrict use of your information, object to certain processing, receive portable data and withdraw consent. Some rights have exceptions, including where records must be kept by law. To make a request, contact iinfo@thesheffield1000.org. You can also complain to the UK Information Commissioner’s Office (ICO) at https://ico.org.uk. We would welcome the opportunity to address your concern first.

12. Children

The Sheffield 1000 accepts donations only from individuals aged 18 or over. If we discover that personal data was collected from a child in connection with an ineligible donation, we will review and address it appropriately.

13. Updates and contact

We may update this Privacy Policy to reflect changes in law, our services or how we process information. The current version will be published on our website with its revision date.