DONATE NOW

Privacy Policy

Purpose of this policy

 

The Sir Bobby Charlton Foundation (SBCF) relies on the generosity of its supporters to continue its charity work. We are committed to protecting the personal data we collect during the course of our activities and we promise to respect any personal information you share with us.

This Privacy Policy explains how we collect, use, store, and protect your personal information. We may update this policy from time to time, so please check this page periodically for changes.

 

1.  Who we are

 

1.1  Data Controller:

  • The Sir Bobby Charlton Foundation
  • Charity Registration Number: 1140911
  • Registered Address: Bartle House, 9 Oxford Court, Manchester, M2 3WQ

 

1.2  Contact for data protection queries:

2.  What information we collect

 

2.1. We are a grant-giving charity. We do not hold personal data on the ultimate beneficiaries of our grants – our grantee organisations are responsible as data controllers for their own beneficiaries’ personal data.

2.2. We may collect personal information directly from you when you interact with us, for example when you:

  • Make a donation
  • Request a pin badge from us
  • Subscribe to email updates
  • Register your interest in or attend Foundation events and campaigns
  • Communicate with us about our work
  • Make a complaint
  • Apply for a job or volunteer role

2.3. We may also collect personal information indirectly when you interact with third parties we work with, for example:

  • If you make a donation or create a fundraising page on Enthuse or other fundraising platforms
  • If you apply for a job with us through an agency or online job site

Note: These organisations have their own privacy policies which you should familiarise yourself with.

Types of personal data we collect:

  • Your name and contact details (postal address, email address, telephone number)
  • Taxpayer status for Gift Aid purposes
  • Education and career history (for job applicants)
  • Bank details for processing donations by direct debit
  • Emergency contact details for event participants
  • Dietary requirements and accessibility needs for events
  • Payment information for event tickets or donations

2.4. Important: We do not store credit or debit card details. When you use our secure online donation facility, you are directed to a specialist payment provider who processes the transaction securely.

3.  How we use your information

 

3.1  We collect and use your personal information for the following purposes:

  • To provide you with information, products, or services you have requested
  • To process your donations and claim Gift Aid where applicable
  • To send you information about our work, activities, and fundraising campaigns
  • To register and administer your participation in events
  • To process applications for jobs or volunteer roles
  • To respond to enquiries and complaints
  • To comply with legal and regulatory requirements

 

4.  Legal basis for processing your information

 

4.1. Under UK data protection law, we must have a lawful basis for processing your personal data. We rely on the following lawful bases:

4.2. Consent: Where you have given clear consent for us to process your personal data for a specific purpose (e.g., marketing communications, event photos, newsletter subscriptions). You can withdraw consent at any time.

4.3. Contract: Where processing is necessary to fulfil a contract with you (e.g., employment contracts, event registration).

4.4. Legal obligation: Where we must process data to comply with the law (e.g., employment law, tax law, charity law requirements, Gift Aid).

4.5. Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party, provided these interests do not override your fundamental rights and freedoms. Our legitimate interests include:

4.6. Administering and managing our charity operations

4.7. Maintaining donor records to track donations and thank donors

4.8. Fraud prevention and security

4.9. Internal administration and record-keeping

4.10. Charitable purpose soft opt-in: If you have made a donation to us, signed up to support us, or otherwise shown interest in our charitable purposes, we may contact you about similar charitable activities and fundraising appeals under the ‘charitable purpose soft opt-in’. You can opt out of these communications at any time.

 

5.  Who we share your information with

 

5.1. We do not sell, rent, or swap your personal information with other organisations for marketing purposes.

5.2. We may share your information with trusted third parties who process data on our behalf, including:

  • Bella Design: Our website, public relations, and fundraising database provider. We have a data sharing agreement in place with Bella Design which ensures they only process your data under our instruction and maintain appropriate security measures.
  • Payment processors: To process donations and event payments securely
  • IT service providers: For email services and data storage (we use Microsoft 365)
  • Professional advisors: Such as accountants and lawyers, where necessary
  • Fundraising platforms: Such as Enthuse, when you make donations through their websites

5.3. We may also share your information where required by law, to protect our rights, or to prevent fraud.

 

6. International data transfers

 

6.1. Your personal data is primarily stored and processed within the United Kingdom. Bella Design, our main data processor, is UK-based.

6.2. Some of our service providers (such as Microsoft 365) may process data outside the UK under appropriate safeguards. We only work with providers who have adequate data protection measures in place.

6.3. We may communicate with overseas grantees as part of our charitable work. These communications are low risk and do not involve transferring UK beneficiary data.

 

7. How long we keep your information

 

7.1. We only retain your personal data for as long as necessary for the purposes for which it was collected. Specific retention periods include:

  • Donation records: 7 years (HMRC Gift Aid requirements)
  • Payroll records: 6 years from end of tax year
  • Trustee records: Duration of trusteeship plus 7 years
  • Employment records: 6 years after employment ends
  • Job applications: 6 months after recruitment process ends
  • Volunteer records: 2 years after last activity
  • Active donor/supporter records: Until relationship ends plus 2 years
  • Newsletter subscribers: Until you unsubscribe

7.2. Some data may be retained longer if required by law, to establish or defend legal claims, or for archiving purposes in the public interest. In such cases, we document the reason for extended retention.

 

8. How we protect your information

 

8.1. We are committed to keeping your personal information secure. We have appropriate technical and organisational measures in place to protect against unauthorised or unlawful processing, accidental loss, destruction, or damage, including:

  • Physical security: Secure premises with controlled access, lockable storage for paper records
  • Technical security: Password-protected devices, encryption for portable devices, regular backups, security software
  • Organisational security: Data protection training, incident response procedures, written contracts with data processors

8.2  Only authorised staff and contractors can access your information.

8.3. Unfortunately, no transmission of information over the internet can be guaranteed to be 100% secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.

 

9. Your rights

 

9.1. Under UK data protection law, you have the following rights:

  • Right of access: You can request a copy of the personal data we hold about you
  • Right to rectification: You can ask us to correct inaccurate data
  • Right to erasure: You can request that we delete your personal data (subject to certain exceptions)
  • Right to restrict processing: You can ask us to limit how we use your data
  • Right to data portability: You can request your data in a portable format
  • Right to object: You can object to processing based on legitimate interests
  • Right to object to direct marketing: You can opt out of marketing communications at any time
  • Right to withdraw consent: Where we rely on your consent, you can withdraw it at any time

9.2. How to exercise your rights:

9.3. To exercise any of these rights, please contact us:

9.4. We will respond to your request:

  • Subject Access Requests: within one month (can be extended by two further months for complex requests)
  • Other requests: as promptly as possible and within one month where practicable

9.5. We will not charge a fee for most requests, unless they are manifestly unfounded, excessive, or repetitive. We may need to verify your identity before processing your request.

 

10. Photographs

 

10.1. We may use photographs provided by our grantee organisations showing the impact of our funding in our promotional materials and on our website. Where photographs include children, our grantee organisations are responsible for obtaining appropriate consent and permissions from parents or guardians before providing these images to us.

10.2. If we take photographs at our own events, we will inform attendees in advance and obtain appropriate consent where required, particularly for images of children. Where photographs are submitted to us, we will obtain appropriate consent for their use.”

 

11. Cookies and Website Analytics

 

11.1. What are cookies? A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a site. Cookies allow web applications to respond to you as an individual, tailoring operations to your needs, likes, and dislikes by gathering and remembering information about your preferences.

11.2. How we use cookies: We use Google Analytics 4 to analyse website traffic and understand which pages are most useful to visitors. This helps us improve our website to better serve your needs. We only use this information for statistical analysis purposes, and data is then removed from the system.

11.3. Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

11.4. How to control or delete cookies: You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. The ‘Help’ function within your browser should provide instructions on how to do this.

11.5. Alternatively, you may wish to visit aboutcookies.org, which contains comprehensive information on how to manage cookies on a wide variety of browsers, as well as how to delete cookies from your computer.

 

12.  How to Complain

 

12.1. If you are unhappy with how we have handled your personal data or how we have responded to a request to exercise your rights, you can:

  • 12.1.1. Raise a complaint with us: You can use our Complaints Policy, available on our website or by contacting us at the address above.
  • 12.1.2. Contact the Information Commissioner’s Office (ICO):
    • Website: www.ico.org.uk/make-a-complaint
    • Phone: 0303 123 1113
    • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

 

13.  Changes to this Privacy Policy

 

13.1. We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make significant changes, we will notify you by email (if we have your email address) or by posting a notice on our website.

13.2. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

13.3. This Privacy Policy was last updated: March 2026

 

14.  Automated Decision-Making

 

14.1. We do not use automated decision-making or profiling in relation to your personal data.