Legal
Privacy Policy
Convoy of Hope UK has the following privacy policy to help maintain your trust and to protect the personal information we process about you.
Scope and Overview
This Privacy Policy describes how Convoy of Hope United Kingdom of The Clubhouse St. James, 8 St. James’s Square, London, SW1Y 4JU (“Convoy of Hope UK” “we,” or “us”) collects and processes personal data about you.
This privacy notice is provided to you to ensure transparency in relation to collection, use and disclosure of your personal data by Convoy of Hope UK when you interact with us, either through the use of this website, or our fundraising and charitable activities. For the purposes described in this Privacy Policy, Convoy of Hope UK is responsible for the processing of your personal data, acting as a data controller.
This Privacy Policy describes the categories of personal data that we collect, how we use your personal data, when we may disclose your personal data to third parties, and when we may transfer your personal data outside of your home jurisdiction. This Privacy Policy also describes your rights regarding the personal data that we hold about you including how you can access, correct, and request erasure of your personal data.
We will only process your personal data in accordance with this Privacy Policy unless otherwise required by applicable law. We take steps to ensure that the personal data that we collect about you is adequate, relevant, not excessive, and processed for limited purposes.
Use of Personal Data
To carry out our activities and obligations as charitable organisation, as a current, former or potential donor, volunteer, beneficiary or supplier of Convoy of Hope UK, we may collect, store, or otherwise process your personal data. The table below sets out the nature of personal data we process for various stakeholders, the purposes for the processing and the lawful basis under Article 6 UK GDPR.
| Data Subject Category | Data Categories | Purpose of Processing | Lawful Basis |
|---|---|---|---|
| Website Visitors | IP address, device information, browser type, cookies, site usage data, preferences | To operate and improve the website, analyse site traffic, enhance user experience, and ensure site security | Legitimate interests – to maintain and improve the website and ensure security; Consent – for optional cookies/analytics. |
| Donors | Name, contact details, payment information, donation history, Gift Aid status, communication preferences, affiliated organisation | To process donations, issue receipts, manage Gift Aid claims, maintain donor records, and send updates or fundraising communications | Contract performance; Legal obligation – for Gift Aid and financial record-keeping; Legitimate interests – donor relationship management; Consent – for marketing communications. |
| Volunteers | Name, contact details, date of birth, emergency contact, skills, availability, background checks (e.g., DBS), health or accessibility information | To manage volunteer applications, allocate roles, ensure safeguarding and health & safety, and communicate effectively | Contract performance; Legal obligation – safeguarding, DBS checks; Legitimate interests – managing volunteer engagement; Special category data: Explicit consent or substantial public interest – safeguarding duties. |
| Beneficiaries | Name, contact details, demographic details, details of needs, circumstances, health or other special category data (as applicable in the circumstances of the support provided) | To assess eligibility, deliver aid and support, monitor outcomes, and ensure safeguarding | Legitimate interests – delivering charitable services; Legal obligation – safeguarding, regulatory requirements; Vital interests – in life-threatening emergencies; Special category data: Explicit consent or substantial public interest (Providing humanitarian support). |
| Newsletter Subscribers / Supporters | Name, email address, communication preferences | To send news, updates, and fundraising campaigns | Consent; Legitimate interests – for current donors, volunteers and beneficiaries. |
| Suppliers / Partners | Name, business contact details, payment details | To manage relationships, process payments, and comply with contractual or legal obligations | Contract performance; Legal obligation; Legitimate interests – maintaining business relationships. |
Automated decision-making
You will not be subject to decisions based on automated data processing without your prior consent.
Data Sharing
We will only disclose your personal data to third parties where required by law or to our employees, contractors or third-party service providers who require such information to assist us with the administration of our services.
Third-party service providers may include, but are not limited to:
- • Software vendors
- • Partners in local jurisdictions, where current initiatives take place
- • IT infrastructure suppliers
- • Payment processors
These third-party service providers may be located outside of your home jurisdiction.
We require all our third-party service providers, by written contract, to implement appropriate security measures to protect your personal data consistent with our policies and any data security obligations applicable to us. We do not permit our third-party service providers who process your personal data on our behalf to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes in accordance with our instructions.
Rights of Access, Correction, Erasure, and Objection
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
By law you may have the right to request access to, correct, and erase the personal data that we hold about you, or object to the processing of your personal data under certain circumstances. You may also have the right to request that we transfer your personal data to another party.
If you want to review, verify, correct, or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact us, using the details provided in the section below.
We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the personal data that we hold about you or make your requested changes.
Applicable law may allow or require us to refuse to provide you with access to some or all personal data that we hold about you, or we may have destroyed, erased, or made your personal data anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal data, we will inform you of the reasons why, subject to any legal or regulatory restrictions.
To Exercise Your Rights
If you would like to be exercise any of the rights set out in the section above, please use the “contact us” page on our website. Simply give us your name and address and indicate your desire to exercise one or more of your rights under the UK GDPR in the comments section of the form. You may also contact our office at [email protected] with any request to exercise your UK GDPR rights. Alternatively, to be removed from our email list, simply click on the unsubscribe link provided on each email and follow the instructions.
If you are unsatisfied with our response to any issues that you raise, you have the right to make a complaint with the Information Commissioner’s Office, by using the methods set out at https://ico.org.uk/make-a-complaint/.
Security
We use Secure Socket Layer (SSL) Protocol when collecting or transferring sensitive data such as credit card information. With the SSL technology, the credit card information you enter while making a donation or purchase will be encrypted before traveling over the internet. After we receive your credit card information, it is only used to process your donation or purchase.
Data Retention
We retain personal data for so long as it may be relevant to the purposes identified herein. To dispose of personal data, we may delete it, or take other appropriate steps. Data may persist in copies made for backup and business continuity purposes for an additional period of time. Our standard data retention period for any data for volunteers, sponsors or vendors, processed within a specific initiative, is 7 years from the conclusion of that initiative. For donors, we keep personal data for as long as you continue to be a donor, and a period of 7 years after your last donation.
Security
We take reasonable steps to protect the information provided via the Services from loss, misuse, unauthorized access, disclosure, alteration, or destruction. However, we cannot guarantee protection and recommend that you take special care in deciding what information you provide to us through nonsecure means.
International Data Transfers
During the course of our services, we may need to transfer your personal data to our partner organisation, Convoy of Hope, headquartered in the United States. We may base such transfers on the UK International Data Transfer Agreement issued by the Information Commissioner’s Office under Section 119A of the Data Protection Act 2018.
Cookie Policy
Cookies & Similar Technologies
We use cookies and similar technologies to track web interaction and to provide an enhanced user experience when accessing our Services such as modifying the information that we provide to you on subsequent visits to our Services.
We also use similar technologies such as pixels or web beacons, which allow us to understand whether our emails are opened or our web pages are viewed.
Types of Cookies We May Use
| Type | Purpose |
| Strictly necessary cookies | Required for the website to function (e.g. security, network management, accessibility, donation processing). |
| Analytics / performance cookies | Help us understand how visitors use our site (e.g. Google Analytics) so we can improve content and user experience. |
| Functionality cookies | Remember your preferences and personalise your experience. |
| Marketing / tracking cookies | Used to deliver relevant advertising or measure the effectiveness of campaigns. |
Detailed Cookie Information
| Cookie | Domain | Decription | Duration | Type |
| osano_consentmanager | .osano.com | This cookie, set by Osano, stores a user’s current consent status. | 1 Year | Necessary |
| osano_consentmanager_uuid | .osano.com | This cookie, set by Osano, stores a user’s current consent status. | 1 Year | Necessary |
| __cf_bm | .convoyofhope.org.uk | This cookie, set by Cloudflare, is used to support Cloudflare Bot Management. | 1 hour | Neccessary |
| cf_clearance | .convoyofhope.org.uk | Cloudflare sets the cookie to manage and verify CAPTCHA challenges, ensuring that legitimate users can access the website while blocking malicious traffic. | 1 year | Necessary |
| _ga_.* | .convoyofhope.org.uk | This cookie, set by Google, is used to persist session state. | 2 years | Analytics |
| ^_ga$ | .convoyofhope.org.uk | This cookie is associated with Google Universal Analytics and distinguishes unique users by assigning a randomly generated number as a client identifier. | 2 years | Analytics |
| ^_stripe_.* | .stripe.com | The Stripe cookie is used to facilitate secure online payments. It helps Stripe detect and prevent fraudulent transactions by storing information about the user’s session and device. | 1 year | Necessary |
| ^_cfuvid$ | .vimeo.com | Vimeo installs this cookie to collect tracking information by setting a unique ID to embed videos to the website. | 1 year, 1 month and 4 days | Analytics |
| vuid | .vimeo.com | Vimeo installs this cookie to collect tracking information by setting a unique ID to embed videos to the website. | 1 year, 1 month and 4 days | Analytics |
Third-party cookies
We may use third-party services such as Google Analytics or social media plug-ins that set their own cookies. These providers have their own privacy and cookie policies, which we recommend you review.
– Google Analytics Cookie Policy: https://policies.google.com/technologies/cookies
– Meta (Facebook) Cookie Policy: https://www.facebook.com/policies/cookies
You can change or withdraw your cookie preferences at any time by navigating the cookie banner on our website.
You can also control or delete cookies through your browser settings. Please note that disabling some cookies may affect the website’s functionality.
Changes to This Privacy Policy
We reserve the right to update or modify this Privacy Policy at any time, and we will provide you with a new Privacy Policy when we make any updates. If we would like to use your previously collected personal data for different purposes than those we notified you about at the time of collection, we will provide you with notice and, where required by law, seek your consent, before using your personal data for a new or unrelated purpose. We may process your personal data without your knowledge or consent where required by applicable law or regulation.
Last Modified: 30/10/25