Privacy notice
How Rosedale Foundation collects, uses and protects your personal information.
Who we are
Rosedale Foundation is a start-up charity based in London.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller for the personal information described in this notice. You can contact us about anything on this page at office@rosedalefoundation.co.uk.
If we are required to register with the Information Commissioner’s Office, our registration number will be added here.
What information we collect
We only collect what we actually need. Depending on how you interact with us, that may include:
- Contact details — your name, email address, telephone number and postal address.
- Donation records — the amount and date of a gift, whether it is one-off or regular, and your Gift Aid declaration if you make one. We do not see or store your full card number.
- Volunteer information — your availability, emergency contact, references and, for roles that require it, the outcome of a DBS check.
- Correspondence — the content of emails, messages and letters you send us, and our replies.
- Website usage — basic technical information such as your IP address and browser type, recorded in server logs. See our cookie policy.
We do not buy personal data from list brokers, and we do not build profiles of donors using wealth screening.
Why we use it, and our lawful basis
UK data protection law requires us to have a lawful basis for each use of your information. Ours are set out below.
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry | Legitimate interests — responding to someone who has contacted us |
| Process a donation and issue a receipt | Contract, and legal obligation for financial records |
| Claim Gift Aid on your donation | Legal obligation — HMRC requires us to keep the declaration |
| Send email updates about our work | Consent — you opt in, and can opt out at any time |
| Manage volunteers, including DBS checks | Legitimate interests, and legal obligation for safeguarding |
| Keep accounts and file returns | Legal obligation — Charities Act 2011 and HMRC rules |
| Keep the website secure and available | Legitimate interests — protecting our systems |
Who we share it with
We do not sell, rent or trade your personal information. We share it only where we have to:
- Service providers who act on our instructions, such as our payment processor, email platform and website host. They may only use your data to provide their service to us.
- HMRC, where we claim Gift Aid.
- Statutory agencies, where we are legally required to share information, or where there is a serious safeguarding concern and sharing is necessary to protect someone from harm.
Online donations are made through GoFundMe, and event tickets are sold through Eventbrite. Those platforms collect and handle your payment details under their own privacy policies, not ours. We receive your name, contact details and the amount, so we can thank you.
How long we keep it
- General enquiries: up to two years after our last contact.
- Donation and Gift Aid records: at least six years after the end of the relevant tax year, as HMRC requires.
- Volunteer records: for the duration of your involvement and up to [ number ] years afterwards.
- Safeguarding records: retained in line with statutory guidance, which can be considerably longer.
- Marketing consent: until you withdraw it, plus a record of the withdrawal so we do not contact you again by mistake.
Where your information is stored
We aim to keep personal data within the UK or the European Economic Area. Where a supplier stores data elsewhere, we make sure an appropriate safeguard is in place, such as UK adequacy regulations or the International Data Transfer Addendum.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate information corrected;
- ask us to erase your data, where there is no overriding legal reason to keep it;
- ask us to restrict how we use it while a concern is resolved;
- object to processing based on our legitimate interests;
- receive your data in a portable format, where it was provided by consent or under a contract;
- withdraw consent at any time, without affecting anything done beforehand.
To exercise any of these, email office@rosedalefoundation.co.uk. We will respond within one month. There is no charge.
Photographs and filming
We sometimes take photographs at events and during outreach. We ask for informed, freely given consent before photographing anyone we support, and consent can be withdrawn at any time without affecting the help they receive. We never photograph children without the consent of a parent or guardian.
If you appear in a photograph on this site and would like it removed, email us and we will take it down.
Email updates and your choices
We will only email you about our work if you have asked us to. Every email includes an unsubscribe link, and you can also email us to be removed. We do not pass your details to other organisations for their own marketing.
Changes to this notice
We review this notice at least annually and whenever our practices change. The version number and date at the top of this page will tell you when it was last revised.
How to complain
If you are unhappy with how we have handled your personal information, please tell us first so we have a chance to put it right. If you are still not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. You can complain to the ICO without contacting us first.