Legal · privacy

Privacy notice.

Last updated: May 2026. We have written this in plain English, and we have kept it short. If anything is unclear, write to [email protected] and we will rephrase it.

In short

  • We are the data controller. Our charity number is 219925.
  • We only ask you for the information we genuinely need.
  • We never sell or share your details with anyone outside the charity, except where we are legally required to.
  • We hold donor records for 7 years (Gift Aid), enquiries for 24 months, analytics for 14 months.
  • You have the right to ask us what we hold, to correct it, to delete it, or to complain to the ICO.
  • Write to us at [email protected] with any question.

1. Who we are

The data controller for the purposes of UK GDPR and the Data Protection Act 2018 is George Ognell’s Charity, registered charity in England and Wales number 219925, registered office Ognell’s Row, Knockhundred Row, Midhurst, West Sussex GU29 9DQ. We do not have a Data Protection Officer; the chair of trustees holds the equivalent responsibility.

2. What personal data we collect

We collect:

  • Your name and contact details if you write to us, fill in a form on this site, or attend an event.
  • Your donation amount, date and Gift Aid declaration if you give to the charity.
  • The IP address and basic analytics from your visit to this website (which pages you read and for how long), through Cloudflare Web Analytics.
  • For volunteers: a DBS check reference number and a record that safeguarding training has been completed.
  • For residents: tenancy records, including emergency-contact details and any disclosed care needs.
  • For Wassail Fund applicants: a copy of the application letter and a summary record of the decision.

We do not collect special-category data (e.g. health information, ethnicity, sexual orientation) unless you choose to tell us, in which case we keep it confidentially in the relevant file.

3. Why we collect it, and the lawful basis

  • To run the almshouses and the Wassail Fund — lawful basis: legitimate interest (the charitable purposes of the trust) and, in resident tenancies, contract.
  • To process donations and claim Gift Aid — lawful basis: contract (your gift) and legal obligation (HMRC Gift Aid rules).
  • To send the quarterly dispatches — lawful basis: consent (you opted in).
  • To meet our safeguarding obligations — lawful basis: legal obligation and legitimate interest.
  • To analyse how the website is used — lawful basis: legitimate interest (we use a cookieless analytics tool that does not identify individuals).

4. Who we share it with

Our list of data processors is short:

  • HMRC — for Gift Aid claims (donor name, address, donation amount, date).
  • The Charity Commission for England and Wales — for our statutory annual return (trustee names, accounts).
  • Mailchimp Limited (UK) — for the quarterly newsletter (email address only). Mailchimp operates under a UK GDPR-compliant data processing agreement.
  • Cloudflare, Inc. — for our website hosting and cookieless analytics.
  • Age UK Horsham District — for safeguarding referrals only, with the affected person’s consent.

We do not sell personal data. We do not share donor lists with other charities. We do not pass details to commercial third parties.

5. How long we keep it

  • Donor records: 7 years from the date of the last donation (required for Gift Aid).
  • General enquiries and contact form messages: 24 months.
  • Volunteer enquiries: 24 months, or for as long as the volunteer continues to volunteer.
  • Volunteer files (active volunteers): for the duration of volunteering, plus 6 years.
  • Resident tenancy records: for the duration of tenancy, plus 12 years.
  • Wassail Fund applications: 7 years (matches the accounts retention period).
  • Cloudflare Web Analytics: 14 months, aggregated.

6. Your rights under UK GDPR

You have the right to:

  • Access the data we hold about you;
  • Rectify any inaccurate or incomplete data;
  • Erasure (“the right to be forgotten”), subject to our retention obligations under Gift Aid and safeguarding law;
  • Restrict our processing;
  • Portability: receive your data in a portable format;
  • Object to our processing (in particular, you can unsubscribe from the newsletter at any time);
  • Withdraw consent at any time for any processing based on consent.

To exercise any of these rights, write to [email protected]. We will respond within one calendar month.

7. Cookies and tracking

This site uses two cookies and one analytics service. Full details are in our cookie policy. In summary: we use a strictly-necessary cookie to remember you have dismissed the cookie banner, and Cloudflare Web Analytics, which is cookieless and privacy-preserving.

8. Children’s data

Our work is with older adults. We do not market to children, and we do not knowingly collect personal data from under-13s. The Spring Supper booking form is the one form on the site that may include details of under-12s who are attending with a guardian; those details are held only until the event is over, then deleted.

9. Changes to this policy

We will update this notice when our practices change, when the law changes, or when an external partner changes their terms. The “last updated” date at the top of this page will be amended. Material changes will be flagged in the quarterly dispatch.

10. How to complain

If you are unhappy with how we have handled your personal data, please write to the chair at [email protected]. We will reply within one calendar month and we will do our best to put the matter right.

If you remain unhappy, you have the right to complain directly to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We hope you will write to us first, but we will not regard a complaint to the ICO as adversarial; the ICO exists for exactly this purpose.