- 0300 140 0028
AGHOSH UK | REGISTERED CHARITY 1178778
How Aghosh UK collects, uses, shares and protects personal information
Aghosh UK is a charity registered in England and Wales under charity number 1178778.
Our registered address is:
Aghosh UK
254A Bury New Road
Whitefield
Manchester
M45 8QN
United Kingdom
Email: [email protected]
Telephone: 0161 526 3307
For UK data-protection law, Aghosh UK is normally the data controller. This means that we decide why and how personal information is used.
Questions, rights requests and data-protection complaints can be sent to our Data Protection Lead using the contact details above.
This notice explains how we collect, use, share, retain and protect personal information relating to:
Separate or additional privacy information may be provided for employees, trustees, beneficiaries, safeguarding matters, particular events or other activities where appropriate.
Depending on your relationship with us, we may collect the following information.
Your name, postal address, email address, telephone number and other contact details.
Donation amounts, bank details, dates, frequency, campaign or appeal selected, payment method, transaction references and recurring-donation instructions.
Payments are processed by authorised payment, banking or Direct Debit providers. We do not normally receive or retain complete payment-card details. We may receive limited information such as a transaction reference, payment status, card type, last digits or bank-mandate reference.
Your Gift Aid declaration, home address, tax-status confirmation and other information required to administer Gift Aid and maintain appropriate financial records.
Your marketing choices, preferred communication channels, responses to campaigns, enquiries, complaints and records of our communications with you.
Information about events, fundraising activities, sponsorship, volunteering, interests in particular aspects of our work and your relationship with Aghosh UK.
Internet Protocol address, browser and device information, approximate location, pages visited, referring website, interaction data and cookie or similar-technology identifiers.
Non-essential analytics and advertising technologies will only be used where the applicable consent requirements have been met.
Information you make available when you interact with our social-media accounts, comment on our content, send us a message or participate in a campaign.
Certain information receives additional protection under UK data-protection law. It includes information revealing religious or philosophical beliefs, health, ethnicity and other protected matters.
For example, a donation specifically identified as Zakat, or profiling based on Islamic-giving preferences, may reveal or be used to infer religious belief. We treat such information with additional care and only process it where both an appropriate lawful basis and a separate special-category condition apply.
We do not use ordinary donor analysis intentionally to infer religion, health, ethnicity or other special-category characteristics unless we have specifically assessed and documented that processing. We normally exclude such fields from information supplied for external donor analysis.
Where an activity involves a child or a person in vulnerable circumstances, we may collect limited additional information needed to protect them, administer the activity or meet safeguarding obligations. Additional privacy information and appropriate consent arrangements will be provided where required.
We may obtain information:
10. directly from you when you donate, register, subscribe, volunteer, fundraise or contact us;
11. through our website, donation forms and event-registration systems;
12. from payment processors, banks and Direct Debit providers;
13. from fundraising platforms where you have authorised or reasonably expect the platform to provide the information to us;
14. from a person organising a sponsored activity, where lawful;
15. from social-media platforms when you interact with us;
16. from public authorities, professional advisers or other organisations where legally permitted; and
17. from publicly available sources only where the use is necessary, proportionate and transparent.
We will not carry out external wealth screening, intrusive prospect research or combine donor records with public-source information without conducting a separate assessment and providing appropriate privacy information.
We use personal information for the purposes and on the normal lawful bases shown below. The basis may vary if the facts or legal requirements of a particular activity are different.
We change this Privacy Policy from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We always indicate the date when the last changes were published and we offer access to archived versions for your review. If changes are significant, well provide a more prominent notice (including, for certain activities, email notification of Privacy Policy changes).
Legitimate interests in operating effective charitable fundraising and carrying out a donor’s instructions
Legal obligation
19. the benefit to Aghosh UK and its charitable purposes;
20. whether the processing is necessary and proportionate;
21. what donors and supporters would reasonably expect;
22. the possible effect on the individual; and
23. safeguards such as minimisation, pseudonymisation, access controls and opt-outs.
We may analyse donor information to:
25. understand overall donation patterns;
26. assess how people move through our donation and supporter journeys;
27. identify where our website, communications or donor services can be improved;
28. understand engagement with campaigns and appeals;
29. measure the effectiveness of fundraising channels;
30. group supporters according to non-sensitive factors such as donation history, campaign engagement or communication preferences; and
31. reduce irrelevant or excessive communications.
This analysis may involve donation dates, values, frequency, campaign categories, communication history, engagement information and donor preferences. Where possible, we use aggregated or pseudonymised information.
Analysis may result in a supporter profile or segment, but we do not use it to make decisions that have legal or similarly significant effects without meaningful human involvement and appropriate safeguards. We will respect objections to direct-marketing profiling.
We may appoint a specialist fundraising, social-media and donor-experience audit agency to support our social-media audit, donor-journey review and donor analysis. The identity of a current agency can be obtained from our Data Protection Lead.
For these activities, the agency will normally act as a data processor under Aghosh UK’s documented instructions. It must:
32. use the information only for the agreed Aghosh UK project;
33. keep it confidential and secure;
34.limit access to authorised personnel;
35. not sell the data or use it for its own marketing;
36. not use it to train general-purpose artificial-intelligence models;
37. not combine it with unrelated client or third-party data;
38. obtain approval before appointing subprocessors;
39. assist us with rights requests and data incidents; and
40. return or securely delete the information when the work ends.
The agency will receive only the information reasonably necessary for the project. Full payment-card details will not be provided. Working datasets must be returned or securely deleted within the period set in the written contract and no later than is reasonably necessary for the project and documented backup deletion.
If an agency or supplier determines its own purpose for using the information, it may instead be an independent or joint controller. Where that happens, we will assess the arrangement and provide additional information where required.
If donor information reveals or is deliberately used to infer religious belief or another special-category characteristic, we must identify both:
42. a lawful basis under Article 6 of the UK GDPR; and
43. a condition under Article 9 of the UK GDPR.
The not-for-profit condition in Article 9 contains restrictions on disclosing special-category information outside the organisation without consent. We will not disclose information externally in reliance only on that condition where the disclosure is not permitted.
Where possible, information such as Zakat selections or other fields revealing religious practice will be removed or aggregated before external donor analysis. If identifiable special-category information must be disclosed, we will establish another valid condition or obtain explicit consent where required.
We may contact you about our charitable work, appeals, campaigns, volunteering and events by email, text, telephone, post or direct social-media message.
For electronic communications, we will rely on:
45. your consent; or
46. the charitable-purposes soft opt-in where all its legal requirements are satisfied.
We will only use the charitable-purposes soft opt-in where, among other requirements:
47. we obtained your contact details directly from you;
48. you expressed an interest in or offered support for our charitable purposes;
49. we gave you a clear opportunity to opt out when collecting your details; and
50. every subsequent message contains a simple opt-out.
Telephone and postal fundraising will only be undertaken where legally permitted. We will respect your preferences and applicable preference services.
You may stop marketing at any time by:
51. using the unsubscribe link in an email;
52. following the opt-out instruction in a text message;
53. telling a caller that you do not wish to receive further calls; or
54. contacting [email protected].
We may retain limited suppression information so that we can honour your request.
Where you interact with us through a social-media platform, that platform may process information under its own privacy terms.
We will only upload contact information to a social-media platform for audience matching or similar targeted advertising where we have established an appropriate lawful basis and satisfied applicable marketing rules. Where consent is required, we will obtain it.
Social-media platforms may act as independent or joint controllers for parts of their processing. We will not state that a platform retains no information unless that has been contractually and technically verified.
You can manage advertising preferences through the relevant platform as well as contacting us.
Where necessary and lawful, we may share information with:
57. payment processors, banks and Direct Debit providers;
58. website, database, customer-relationship-management and cloud-hosting suppliers;
59. email, text and communication providers;
60. fundraising, donor-support, research and data-analysis agencies;
61. event, printing, fulfilment and postal providers;
62. accountants, auditors, insurers, solicitors and other professional advisers;
63. HM Revenue & Customs for Gift Aid and tax administration;
64. the Charity Commission, Information Commissioner’s Office, Fundraising Regulator, law-enforcement bodies, courts or other authorities where required;
65. social-media platforms where appropriate consent or another applicable legal permission exists; and
66. successor organisations if Aghosh UK undergoes a lawful merger or restructuring.
Processors may only act under our instructions and must be bound by an appropriate written agreement.
We do not sell personal information. We do not allow suppliers to use donor information for their own marketing.
We retain information only for as long as it is required for its purpose, legal obligations, dispute management and the protection of our charitable interests. Typical periods include:
73. donation and accounting records: normally six years after the relevant accounting period, or longer where legally required;
74. Gift Aid declarations: for the applicable HMRC period; enduring declarations may be retained while active and for the required period after the final relevant donation;
75. marketing records: while the relationship remains active or until you object, subject to periodic review;
76. suppression records: for as long as reasonably required to honour an opt-out;
77. event and volunteer records: for the duration of the activity and an appropriate period afterwards based on safeguarding, insurance and legal requirements;
78. complaints and legal claims: for the period needed to investigate and resolve the matter and manage potential claims;
79. website analytics: according to the periods shown in our cookie settings; and
80. agency donor-analysis datasets: only for the agreed project period and contractual deletion period.
At the end of the applicable period, information is securely deleted, destroyed or anonymised.
We use proportionate technical and organisational measures designed to protect personal information. These include, where appropriate:
82. access controls and least-privilege permissions;
83. confidentiality requirements;
84. encryption in transit and at rest;
85. multifactor authentication;
86. secure transfer methods;
87. staff and volunteer training;
88. supplier due diligence and contracts;
89. logging, backup and incident-response procedures; and
90. periodic review of processing activities.
No system can be guaranteed completely secure. If a personal-data breach occurs, we will investigate it and notify the ICO and affected individuals where legally required.
Essential cookies may be used to operate the website, remember donation-basket information, maintain security and provide requested functions.
Analytics, advertising and social-media cookies will only be placed or accessed where legally permitted, including obtaining consent where required.
You can manage non-essential cookies through the cookie settings control displayed on our website. A separate Cookie Notice should identify the cookies and technologies actually used, their providers, purposes and durations.
Depending on the circumstances, you may have the right to:
93. receive information about our processing;
94. access your personal information;
95. correct inaccurate or incomplete information;
96. request deletion;
97. restrict processing;
98. object to processing based on legitimate interests;
99. object at any time to direct marketing, including related profiling;
100. receive certain information in a portable format;
101. withdraw consent without affecting earlier lawful processing; and
102. receive safeguards relating to qualifying automated decisions.
These rights are not absolute and exemptions may apply. To exercise a right, contact [email protected]. We may request proportionate information to confirm your identity.
You can complain to us if you believe we have not handled your information properly. Complaints may be submitted:
104. by email to [email protected] with the subject “Data Protection Complaint”; or
105. by post to our Data Protection Lead at the registered address.
We will acknowledge a data-protection complaint within 30 days. We will investigate appropriately, keep you informed where necessary and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/
Our public fundraising website is not directed specifically at children. Where we knowingly collect information relating to a child, we use age-appropriate language and apply additional safeguards. A parent or guardian may be asked to provide information or permission where appropriate.
We will review this notice regularly.
If a change materially affects how we use existing personal information, we will update this notice and proactively bring the change to the attention of affected people before the new processing begins, where required.
The date at the beginning identifies the latest version.
Questions, rights requests and privacy complaints may be sent to:
Aghosh UK
254A Bury New Road
Whitefield
Manchester
M45 8QN
United Kingdom
Email: [email protected]
Telephone: 0161 526 3307
