Collective Aid Charitable Foundation
Registered charity in England and Wales: 1206028

Effective date: 2 September 2026
Last updated: 2 September 2026

1. Introduction

Collective Aid Charitable Foundation ("Collective Aid", "we", "us" or "our") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect personal information when you:

  • visit our website;

  • make a donation;

  • make a purchase;

  • participate in a fundraising activity;

  • attend one of our events;

  • communicate with us;

  • subscribe to our mailing lists;

  • volunteer with us;

  • apply for a role;

  • interact with our social media accounts;

  • provide us with information in connection with our programmes or activities; or

  • otherwise interact with Collective Aid.

This Privacy Policy should be read together with our Terms of Service and any specific privacy notices that we may provide in particular circumstances.

2. Who we are

The organisation responsible for your personal information is:

The Collective Aid Charitable Foundation
Registered charity in England and Wales: 1206028 [57 Preston Street, Faversham, Kent, ME13 8PG, United Kingdom]

For privacy enquiries, please reach out from our contact page.

For the purposes of applicable UK data protection legislation, Collective Aid is generally the data controller for personal information that we determine the purposes and means of processing.Where another organisation processes personal information on our behalf, that organisation may act as a data processor or independent controller depending on the circumstances.

3. The personal information we collect

Depending on how you interact with us, we may collect:

Identity information

  • name;

  • title;

  • username or account information;

  • date of birth where genuinely necessary; and

  • other information you choose to provide.

Contact information

  • email address;

  • postal address;

  • telephone number;

  • social media handles; and

  • other contact details.

Donation and transaction information

  • donation amount;

  • donation frequency;

  • donation date;

  • campaign or programme supported;

  • Gift Aid information where applicable;

  • transaction identifiers;

  • payment method;

  • billing information;

  • refund information; and

  • limited payment information supplied by our payment providers.

We do not generally collect or store complete payment-card details ourselves. Payment information is processed through payment providers such as Stripe and fundraising platforms such as Fundraise Up.

Communications information

We may retain information about your communications with us, including emails, correspondence, enquiries, complaints and preferences.

Fundraising information

If you fundraise for us, we may collect information about your fundraising activity, fundraising targets, donations raised, event participation and related communications.

Volunteer and recruitment information

Where relevant, we may collect information necessary to assess and administer volunteer, employment, trustee, contractor or other applications and relationships.

Technical information

When you use our website or digital services, we may collect information such as:

  • IP address;

  • browser type;

  • device type;

  • operating system;

  • approximate location;

  • pages visited;

  • referring website;

  • interaction data;

  • cookies and similar technologies; and

  • information about how you interact with our website and communications.

Information you provide about others

You should only provide personal information about another person where you have a lawful basis and, where required, their permission to do so.

4. Information concerning service users

Collective Aid may process personal information in the course of delivering humanitarian, community, research, advocacy and other charitable activities. Depending on the circumstances, this may include information relating to service users, programme participants, volunteers, partners and other people involved in our work. Such information may include sensitive or special-category personal data where this is genuinely necessary for our charitable activities and permitted under applicable law.

We apply additional safeguards to such information, including access controls, minimisation, secure storage and restricted disclosure. We do not collect sensitive personal information merely because it may be interesting or useful. We seek to collect only information that is reasonably necessary for a legitimate and defined purpose.

5. How we use personal information

We may use personal information to:

  • administer donations;

  • issue donation receipts;

  • administer Gift Aid;

  • process refunds;

  • communicate with supporters;

  • provide information about our work;

  • administer fundraising activities;

  • organise events;

  • manage volunteers;

  • recruit staff, trustees and contractors;

  • administer our programmes;

  • conduct monitoring, evaluation, learning and reporting;

  • conduct research and advocacy;

  • investigate complaints or incidents;

  • protect people and property;

  • maintain safeguarding and security;

  • operate and improve our website;

  • analyse engagement and fundraising performance;

  • comply with legal and regulatory obligations;

  • maintain appropriate financial and organisational records;

  • prevent fraud and misuse;

  • enforce our terms and policies; and

  • otherwise pursue our legitimate charitable objectives.

6. Lawful bases for processing

Depending on the circumstances, we may rely on one or more of the following lawful bases under UK data protection law:

Consent

Where we ask you to consent to a particular use of your personal information, you may withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Contract

We may process information where necessary to enter into or perform a contract with you, such as where you purchase merchandise or tickets.

Legal obligation

We may process information where necessary to comply with a legal or regulatory obligation.

Legitimate interests

We may process personal information where necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

  • administering our charity;

  • communicating with supporters;

  • fundraising;

  • improving our services;

  • maintaining security;

  • preventing fraud;

  • managing relationships with donors and partners; and

  • protecting our organisation and those involved in our work.

Vital interests

In limited circumstances, we may process information where necessary to protect someone's vital interests.

Public task or other lawful basis

Where applicable, we may rely on another lawful basis recognised under applicable data protection legislation.

7. Direct marketing

We may send supporters information about Collective Aid, our work, campaigns, fundraising opportunities, events, reports and related activities where we have a lawful basis to do so. Where consent is required, we will ask for it.

You can unsubscribe from marketing communications at any time by using the unsubscribe mechanism included in our communications or by contacting us. You may continue to receive essential administrative communications, such as donation receipts, transaction confirmations or information relating to an existing relationship with us, even if you opt out of marketing.

8. Cookies and analytics

Our website may use cookies and similar technologies to:

  • enable website functionality;

  • maintain security;

  • understand how visitors use our website;

  • remember preferences;

  • measure campaigns;

  • improve performance; and

  • support fundraising and communications.

Where legally required, we will seek your consent before using non-essential cookies or similar technologies. You can manage cookie preferences through the mechanisms made available on our website and through your browser settings.

9. Donation platforms and payment processors

We may use third-party providers to process donations and payments. These may include Fundraise Up, Stripe, PayPal, CAFDonate and other providers selected from time to time. Fundraise Up's own documentation states that it processes donation-related information on behalf of organisations and that Stripe handles payment-card data for donations processed through Fundraise Up.

These providers may process information in accordance with their own privacy policies and contractual obligations. We do not generally receive or store your complete payment-card number, security code or other full payment credentials.

10. Who we share information with

We may share personal information where necessary and lawful with:

  • payment processors;

  • fundraising platforms;

  • IT and hosting providers;

  • email and communications providers;

  • event platforms;

  • accounting and financial service providers;

  • professional advisers;

  • auditors;

  • insurers;

  • regulators and public authorities;

  • law enforcement agencies where legally required;

  • partner organisations where necessary to deliver our charitable activities;

  • trustees, employees, contractors and volunteers where they require access to perform their responsibilities; and

  • other third parties where you have asked us to share information or where applicable law permits or requires us to do so.

We do not sell personal information.

11. International transfers

Some of our service providers, partners or systems may be located outside the United Kingdom. Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place, as required by applicable data protection legislation. These safeguards may include adequacy regulations, standard contractual clauses, international data transfer agreements, contractual protections or other lawful mechanisms.

12. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, taking into account:

  • legal and regulatory requirements;

  • accounting and financial obligations;

  • safeguarding requirements;

  • legitimate organisational needs;

  • donor and supporter relationship management;

  • dispute resolution;

  • fraud prevention; and

  • our charitable and reporting obligations.

Different categories of information may therefore be retained for different periods. Financial and donation records may need to be retained for longer periods to comply with legal, accounting, tax and regulatory requirements. Where information is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it.

13. Data security

We take reasonable technical and organisational measures to protect personal information against:

  • unauthorised access;

  • accidental loss;

  • destruction;

  • alteration;

  • disclosure; and

  • other unlawful or unauthorised processing.

These measures may include access controls, authentication requirements, encryption, secure systems, restricted permissions, staff training and appropriate contractual safeguards. No online system is completely secure. We therefore cannot guarantee absolute security of information transmitted over the internet.

14. Your data protection rights

Subject to applicable legal conditions and exemptions, you may have the right to:

  • request access to personal information we hold about you;

  • request correction of inaccurate information;

  • request deletion of information;

  • request restriction of processing;

  • object to certain processing;

  • request transfer of certain information to another organisation;

  • withdraw consent where processing is based on consent; and

  • object to direct marketing.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO). More information about your rights is available from the ICO.

15. Exercising your rights

To exercise a data protection right, please us our contact page. We may need to verify your identity before responding to a request. We aim to respond within the time period required by applicable law.

16. Children

Our website and general fundraising services are not ordinarily directed specifically at children. Where our charitable activities involve children or young people, we apply appropriate safeguarding and data protection measures. We do not knowingly collect children's personal information through general online fundraising activities where it is not necessary.

17. Photographs, stories and testimonials

We may collect and use photographs, videos, stories, testimonials and other material relating to our work for fundraising, communications, advocacy, research, educational and reporting purposes. We always seek appropriate permissions and rely on appropriate basis where required. We take particular care where material concerns vulnerable people, children or people whose identification could create safety, privacy or other risks and we operate a robust safeguarding policy to ensure all photos, stories and testimonials are presented in accordance with international standards.

18. Data breaches

If we become aware of a personal data breach, we will assess and respond to it in accordance with applicable legal and regulatory requirements. Where notification to affected individuals or a regulator is legally required, we will make that notification within the applicable timeframe.

19. Third-party websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to read the privacy policy of any third-party website you visit.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will be published on our website with its effective date. Where appropriate, we may notify supporters of material changes.

21. Contact

For questions about this Privacy Policy or how Collective Aid processes personal information, contact:

Collective Aid Charitable Foundation
Registered charity in England and Wales: 1206028
Contact available on our contact page.

Last updated: 2 September 2026