Penny Appeal is committed to safeguarding your privacy online.

AnchorPrivacy Policy – Donors

1.           Introduction

At Penny Appeal, we are committed to respecting your data privacy. The Data Protection Act 2018 (“DPA”) and Regulation (EU) 2016/679 of the European Parliament (the General Data Protection Regulation (“GDPR”)) require that we provide you with information about how and why we use personal data. We aim to process information about you fairly, lawfully, and in a transparent manner and the aim of this document is to provide you with sufficient information for you to understand what we are doing with your personal data. This policy also explains our commitment to protecting your personal data and your rights towards those data. Please read it carefully to understand our views and practices regarding your personal data and how we will use it.

The controller of your data is Penny Appeal of Penny Appeal Campus, Wakefield WF2 8QZ. References to we, our or us in this policy are to the controller, Penny Appeal.

Our Data Protection Advisor oversees our compliance with this policy. They can be contacted using the contact details below.

2.           Personal Information we may collect about you

We collect information about you in the following ways:

Personal data you provide to Penny Appeal directly

You may provide us with information about you when you submit an enquiry form on our website, write to us, call us, or when you make or enquire about making a donation, fostering or adoption.  This may include your name, address, email address, telephone number, payment details, appeal you wish to support, gift aid status etc. and information you provide in any correspondence with us.  You may also provide us with marketing and communications preferences and in some cases an indication of your consent for us to perform certain processing activities on your personal data. 

Information collected by your involvement with Penny Appeal

Your activities and involvement with Penny Appeal will result in personal data being collected. This could include details of how you’ve helped us by being involved with our campaigns activities. If you decide to donate to us or get involved in our fostering and adoption campaign, then we will keep records of when and how much you give to a particular cause and information you provide for the adoption process. When you use our website we will collect personal information about you using cookies and other digital media technologies details of which are contained in our Cookies Policy. We will receive and store information about the type of device you use to access our website, what operating system you have, some of your device settings and your IP address. 

Information from other sources 

We may receive information from our sub-contractors providing services to us such as payment services in order to process any donation you may make.  We will collect information about you from other sources such as professional fundraising agencies, data cleansing companies, event organisers, data brokers and sources such as Companies House and the Electoral Register who are able to provide us with information about you such as your forwarding address if you move house, your charity affiliations to help us to understand you more as an individual. 

Social Media 

Depending on your settings or the privacy policies of the social media platforms and messaging services you use (e.g. Facebook, YouTube, Twitter, Instagram, WhatsApp etc.) you may allow us to access information from those services for example if you publicly “like” or “follow” us we may be able to collect information from your social media profile.  We strongly advise you to check the privacy settings on your social media accounts to ensure that you know what information is shared with us and others.


Some of our premises have CCTV and you may be recorded when you visit them. CCTV is there to help provide security and to protect both you and Penny Appeal. CCTV will only be viewed when necessary (e.g. to detect or prevent crime). Unless it is flagged for review, CCTV footage will be recorded over. Penny Appeal complies with the ICO’s CCTV Code of Practice, and we put up notices so you know when CCTV is in use.

3.           Lawful basis for processing

Data Protection laws require that a controller that processes personal data must do so based on one of the following lawful legal basis:

  1. Contractual obligation: the processing is necessary for the performance of a contract or taking steps to enter into a contract between the controller and the data subject.
  2. Legal Obligation: the processing is necessary for the controller to comply with the law or a legal requirement (not including contractual obligations).
  3. Vital Interests: the processing is necessary to protect someone’s life
  4. Legitimate interests: the processing is necessary for the controller’s legitimate interests, or the legitimate interests of a third party however, such interests are overridden by the interests or fundamental rights and freedoms of the data subject which requires protection of the personal data
  5. Consent: the data subject has given consent for the processing for one or more specific reasons
  6. Public task: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

4.           How we use your personal information

The table below describes the main purposes for which we process your personal information, the categories of your information involved and our lawful basis for doing so.

Personal data

Our Purpose

Our Lawful basis

Name; address; cheques, card, bank or other payment details

Necessary to fulfil the wishes of our donors making a donation and to enable the use of the funds for the purpose it was donated for 

Legitimate interest of Penny Appeal and the donor

Personal contact information collected from donors

Our donor information is used to creating and maintaining a database of donors and potential donors, their relationship with us, respond to complaints, queries, etc.

Legitimate interest of Penny Appeal and the donor

Name, address, email, phone number and other contact details

To contact you as a follow-up on your enquiry regarding fostering/adoption; send you marketing correspondence where you have given your consent

Legitimate interest;


Name and house address

We use our donor database to contact our former, current and prospective donors from time to time, through direct postal mail, to ask if they would like to make a donation to an appeal.

Legitimate interest of Penny Appeal and the donor

Name, email, phone number and other electronic contact details

We use our donor database to contact our former, current and prospective donors from time to time, through a range of digital methods such as email, SMS or social media to ask if they would like to make a donation to an appeal.

Consent of the donor

Name, address, email, phone number, other contact details, financial information (income and expenses), household details, employment details

To assess your suitability for the fostering/adoption application

Legitimate interest; Consent

Name, address, email, phone number and other contact details

Where you have donated towards a particular project/appeal, we may contact you from time to time to update you on how your donations was/is being used, the success of our appeals, our activities on the field, developments of new products and services, and new  campaigns

Legitimate interest;

Name, address, email, phone number and other contact details

To respond to queries, questions or questions we may receive from our donors, in a time and professional manner.

Legitimate interest of Penny Appeal

Personal identification numbers, IP addresses, user names and other IT system identifying information

We use cookies and other digital technologies on our website, in our emails, and in other digital interactions with you to allow us to understand traffic to our website, and how well our website and outbound digital communications perform. 

Legitimate interest of Penny Appeal

If for any reason we would like to process your personal data for any other purpose different from the purposes listed above, we will provide you with appropriate additional privacy information at the point where you come across those additional purposes. 

5.           Withdrawing consent

Where you have given consent to use your data in a particular manner, you have the right to withdraw that consent at any time. You may do this by contacting us using the contact details below. Please note however that the withdrawal of your consent will not affect the lawfulness of any processing that had commenced before the consent was withdrawn. When we contact you by electronic means, we will always provide you with the option to opt out of receiving further communication of that nature from us.

6.           Sharing your data

Penny appeal uses third parties to help us keep you informed with whom we may need to share your data for these specific purposes only. Services used including mailing houses, email and text marketing services. We will share your personal data with other organisations to enable us process your donation, send you communication materials, and to undertake other activities in line with the information provided in the above table.

Please note that we may need to disclose your personal information where we:

  • are under a legal duty to comply with any legal obligation or in order to enforce or apply our terms and conditions; or
  • need to disclose it to protect our rights, property or safety of our customers or others, including the exchange of information with other companies, organisation and/or governmental bodies for the purposes of fraud protection and credit risk reduction
  • Companies in the same group of companies as us: for the purpose of providing a service to you.
  • for adoption and fostering: with local authorities in the region where you live, social workers and other independent adoption providers
  • HMRC (for Gift Aid processing), our regulators and other government agencies where we are required to do so by law or to assist with any investigation or enquiry
  • Police, law enforcement and security services: to assist with the investigation and prevention of crime and the protection of national security.
  • Other organisations as we may determine from time to time such as payment processors (Worldpay, KeyIVR, SmartDebit, PayPal), email and text messaging providers (Text Marketer, MailChimp, Mailing House) and for publicity (media channels carrying appeals).

If you provide us with any personal information other than your own you, are responsible for ensuring they know that you have done this and for providing them with access to this privacy policy.  We reserve the right to contact any such individual and inform them when, where and how we obtained their personal data including citing you as the source.

7.           Transferring your data internationally

  • Where we transfer your personal data or use service providers that are located outside the EEA, we will ensure that the country where the organisation operates from is one where the European Commission has issued an opinion which approves the adequacy of the data protection laws of that country. We will also ensure that under GDPR and DPA 2018 requirements, that we have a signed data processing agreement and service contract with them, which contains the “model clauses” approved by the European Commission for an agreement of this nature. Additionally, we will also ensure that the third-party is signed up to an approved transfer mechanism such as the EU-US Privacy Shield where the organisation is based in the United States of America.

7.2        MailChimp

We use MailChimp to send emails and newsletter.  MailChimp is based in the U.S.A. and subscribes to the EU-US Privacy Shield meaning that MailChimp has adopted work practices that are approved by the EU in relation to data protection practices.  The MailChimp registration on the Privacy Shield is available to review on the Privacy Shield website

7.3        SurveyMonkey

We also use SurveyMonkey to facilitate the sending of surveys from time to time.  SurveyMonkey subscribes to the EU-US Privacy Shield and their registration can also be reviewed on the Privacy Shield website above.

  • Hotjar

We use Hotjar in order to better understand our users’ needs and to optimize their experience, e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc. This enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices (in particular device's IP address: captured and stored only in anonymized form, device screen size, device type, browser information, geographic location: country only, preferred language used to display our website). Hotjar stores this information in a pseudonymized user profile. Neither Hotjar nor Penny Appeal will use this information to identify individual users or to match it with further data on an individual user. For more details, please see Hotjar’s privacy policy by clicking this link.

7.4       Adroll Smart Pixel

We use AdRoll’s smart pixel. AdRoll may serve you with targeted Ad's by occasionally placing a cookie on your browser. No information about the visitor will be stored by the Adroll smart pixel. The data that is collected includes:

  • Website Activity - what pages you visited while on the website. This helps us understand what pages you were interested in during your visit. 
  • Device and Browser - This includes browser or device you used to access the website, e.g. device type and IP address. 
  • Ad Data - This is data about the on line adverts AdRoll served (or attempted to serve) you. It includes information such as what page an advert appeared on, the number of times the advert was served to you and if you engaged with the advert.  

Please note, none of your personal data will be shared with Adroll. 

You can find information on how you can opt out here . Opting out could result to seeing adverts which have no relevance to your interest.

8.           How long we keep your personal information for

  • Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements and we will review this from time to time. How long information will be stored for depends on the information in question and what it is being used for. For example, we will retain information about donors and donations for no longer than 7 years from the date of donation for taxation and financial record-keeping. We retain information about queries and/or contact from individuals for as long that it is needed for us to respond to the query and/or maintain records of queries for our internal management purposes. We retain records of donors and potential donors for as long as we feel you may be interested in making donations. Records of our marketing activities are kept in accordance with our donor records as above.  If you ask us not to send you marketing emails, we will stop storing your emails for marketing purposes (though we’ll keep a record of your preference not to be emailed). We continually review what information we hold and delete what is no longer required. We never store payment card information.
  • It is important to ensure that the personal information we hold about you is accurate and up-to-date, and you should let us know if anything changes, for example if you move home, change your phone number or email address. If you want to update your personal data, please contact us at [email protected].
  • We may use information from external sources such as the post office national change of address database and/or the public electoral roll to identify when we think you have changed address so that we can update our records and stay in touch.  We do this so we can continue to contact you where you have chosen to receive marketing messages from us and contact you if we need to make you aware of changes to our terms or assist you with problems with donations.  This activity also prevents us from having duplicate records and out of date preferences, so that we don’t contact you when you’ve asked us not to. You may object to any data processing we undertake which involves direct marketing.

9             Your Rights in relation to personal information

  • You have the following rights concerning your personal data:


Brief Explanation

Right to be informed

This is known as ‘privacy information’. We are required to provide you with information regarding the purposes for processing your personal information, the retention period and who it will be shared with. This Privacy Policy serves that purpose.

Right of access

Commonly known as "subject access request"(SAR). You have the right to obtain confirmation from us as to whether we are processing your personal data, and where that is the case, access to that personal data. If you are seeking to obtain specific information (e.g. about a particular matter from a particular time period), it helps if you clarify the details of what you would like to receive in your written request.

Right to rectification

This enables you to have any incomplete or inaccurate information we hold about you to be corrected. If you feel that any data that we hold about you is inaccurate you have the right to ask us to correct or rectify it.

Right to erasure

Also known as “right to be forgotten”. You have the right (under certain circumstances, but not all) to ask us to erase personal data concerning you.

Right to restriction of processing

You have the right (under certain circumstances, but not all) to ask us to restrict processing of your personal data. For example, you may request this if you are contesting the accuracy of your personal data that we hold.

Right to data portability

You have the right (under certain circumstances, but not all) to ask us to provide you with the personal data about you which you have provided to in a structured, commonly used and machine-readable format.

You also have the right to ask us to transmit those data to another controller.

Right to withdraw consent

Where we are relying on consent as the lawful basis for our processing of your data, you have the right to withdraw that consent at any time. Please note that this will not affect the lawfulness of processing based on consent before it is withdrawn.

Right to object to direct marketing

Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for marketing, which includes profiling to the extent that it is related to such direct marketing.

Rights in relation to automated decision making and profiling

We do not perform any automated decision-making based on personal data that produces legal effects or similarly significantly affects you.

  • Please note that some of these rights are not absolute and can only apply in certain circumstances. For more information on your rights, visit the ICO website on
  • You should note that some of these rights, for example the right to require us to transfer your data to another service provider, may not apply as they have specific requirements and exemptions which apply to them and they may not apply to personal information recorded and stored by us. For example, we do not use automated decision making in relation to your personal data. To exercise any of the above rights, or if you have any questions relating to your rights, please contact us by using the details below.

10          Profiling and Automated-decision making

Penny Appeal does not currently carry out any automated profiling using the personal information we hold. We do, however, use the services of external companies, including social media companies, who may profile personal data they hold to enable them to offer us to more accurately target our promotional activity on their platforms.

11          Your right to lodge a complaint with the ICO

If you wish to complain about the way Penny Appeal is managing your personal information (including a complaint about fundraising activity), we would like you to give us the opportunity in the first instance, to address your concerns. Please contact us using the details below:

Email: [email protected]

Phone: 03000 11 11 11

Post: Data Protection Advisor, Penny Appeal, Penny Appeal Campus, Wakefield WF2 8QZ.

If you remain unhappy with the outcome of your complaint, you have the right to complain to the UK Information Commissioner’s Office (ICO). Their contact details are below:

Information Commissioner's Office

Post: Wycliffe House, Water Lane, Wilmslow. Cheshire. SK9 5AF

Phone: 0303 123 1113

Email: [email protected]


12          Changes to This policy

We may update this privacy policy from time to time. When we change this policy in a material way, we will update the version date at the bottom of this page. For significant changes to this policy we will try to give you reasonable notice unless we are prevented from doing so. Where required by law we will seek your consent to changes in the way we use your personal information.

Last updated March 2019.

We value your privacy

We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies..