Privacy Notice (UK GDPR)
The Hands Up Project
Effective date: 1/01/2018
Last updated: 13/05/26
1. Who We Are
The Hands up Project (“we”, “us”, “our”) is a charitable organisation registered in England and Wales under charity number 1170272., with its principal address at Flat 8, Apple Court, South Street, Totnes, TQ9 5DZ
We are committed to protecting and respecting your privacy. This Privacy Notice explains how we collect, use, store, and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and related legislation.
For the purposes of data protection law, The Hands up Project is the data controller.
2. Contact Details
If you have any questions about this Privacy Notice or how we use your personal data, please contact:
Data Protection Lead
The Hands up Project
Flat 8, Apple Court, South Street, Totnes, TQ9 5DZ
Email: info@handsupproject.org
Telephone: 00 44 7944506493
You also have the right to lodge a complaint with the UK regulator, the Information Commissioner's Office.
ICO website
3. Personal Data We Collect
We may collect and process the following categories of personal data:
a) Identity Data
Full name
Date of birth
Nationality
Identification documents (where required for safeguarding, legal compliance, or travel support)
b) Contact Data
Postal address
Email address
Telephone number
Emergency contact details
c) Supporter / Donor Data
Donation history
Gift Aid declarations
Communication preferences
Event attendance records
d) Volunteer / Staff Data
Employment history
References
DBS or safeguarding checks (where applicable)
Training records
Right-to-work documents
e) Beneficiary Data
Support needs
Case notes
Program participation records
Immigration or legal support documents
Language preferences
f) Special Category Data
In some cases, we may process special category personal data, including:
Health information
Ethnic origin
Religious beliefs
Biometric or identity documents
Information relating to vulnerability or safeguarding
This is only processed where lawful and necessary for our charitable purposes.
4. How We Collect Data
We collect personal data when you:
Contact us directly
Complete forms on our website
Apply for services or assistance
Donate to us
Volunteer or work with us
Participate in our projects
Communicate by email, telephone, or social media
Are referred to us by partner organisations, NGOs, schools, or public bodies
5. How We Use Personal Data
We process personal data for the following purposes:
Delivering charitable services and humanitarian assistance
Managing volunteer recruitment and training
Communicating with beneficiaries and supporters
Processing donations and Gift Aid
Administering events and educational programmes
Safeguarding children and vulnerable adults
Monitoring programme effectiveness
Legal and regulatory compliance
Managing funding applications and reporting to grant-makers
Maintaining organisational records
Protecting our staff, volunteers, and beneficiaries
6. Lawful Bases for Processing
Under UK GDPR, we rely on one or more of the following lawful bases:
Article 6 UK GDPR
Consent
Performance of a contract
Legal obligation
Vital interests
Public task
Legitimate interests
Article 9 UK GDPR (Special Category Data)
Where special category data is processed, we rely on:
Explicit consent
Employment/social protection obligations
Vital interests
Substantial public interest
Provision of health or social care
Safeguarding of children and vulnerable individuals
7. Sharing Personal Data
We will not share your personal data outside of the HUP.
We do not sell personal data to third parties.
8. International Transfers
Where our work involves international humanitarian support, personal data may be transferred outside the UK.
Where this occurs, we ensure appropriate safeguards are in place, including:
Adequacy regulations
International Data Transfer Agreements
Standard contractual clauses
Additional security protections where required
9. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, including legal, safeguarding, funding, and regulatory obligations.
Typical retention periods:
Data Type. Retention
Donor records 6 years
Gift Aid records 6 years
Volunteer records 6 years after leaving
Safeguarding records Up to 25 years
Beneficiary case files 7 years after support ends
Recruitment records 12 months
Retention periods may be extended where legally required.
10. Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
Access controls
Password protection
Encrypted cloud storage
Secure file transfer
Confidentiality agreements
Staff training
Safeguarding procedures
Incident response protocols
11. Your Rights
Under UK GDPR, you have the right to:
Access your personal data
Rectify inaccurate data
Erase data
Restrict processing
Object to processing
Data portability
Withdraw consent at any time
Complain to the ICO
Requests should be made in writing to the contact details above.
12. Safeguarding
As part of our charitable work, particularly where we support displaced persons, refugees, children, or vulnerable adults, personal data may be processed for safeguarding purposes.
This processing is necessary to:
Protect individuals from harm
Assess support needs
Coordinate with statutory services
Comply with legal safeguarding obligations
13. Website and Cookies
Our website may collect limited technical data including:
IP address
Browser type
Device information
Cookies
Usage analytics
A separate Cookie Policy applies.
14. Changes to This Notice
We may update this Privacy Notice from time to time.