Legal
Privacy Policy
Convoy of Hope United Kingdom has the following privacy policy to help maintain your trust and to protect the personal information we process about you.
Scope and Overview
This Privacy Policy describes how Convoy of Hope United Kingdom of 107-111 Fleet Street, London EC4A 2AB (“Convoy of Hope United Kingdom,” “COH UK,” “we,” or “us”) collects and processes personal data about you.
This privacy notice is provided to you to ensure transparency in relation to collection, use and disclosure of your personal data by COH UK when you interact with us, either through the use of this website, or our fundraising and charitable activities. For the purposes described in this Privacy Policy, COH UK is responsible for the processing of your personal data, acting as a data controller.
This Privacy Policy describes the categories of personal data that we collect, how we use your personal data, when we may disclose your personal data to third parties, and when we may transfer your personal data outside of your home jurisdiction. This Privacy Policy also describes your rights regarding the personal data that we hold about you including how you can access, correct, and request erasure of your personal data.
We will only process your personal data in accordance with this Privacy Policy unless otherwise required by applicable law. We take steps to ensure that the personal data that we collect about you is adequate, relevant, not excessive, and processed for limited purposes.
Use of Personal Data
To carry out our activities and obligations as a charitable organisation, as a current, former or potential donor, volunteer, beneficiary or supplier of COH UK, we may collect, store, or otherwise process your personal data. The table below sets out the nature of personal data we process for various stakeholders, the purposes for the processing and the lawful basis under Article 6 UK GDPR.
| Data Subject Category | Data Categories | Purpose of Processing | Lawful Basis |
| Website Visitors | IP address, device information, browser type, cookies, site usage data, preferences | To operate and improve the website, analyse site traffic, enhance user experience, and ensure site security | Legitimate interests – to maintain and improve the website and ensure security; Consent – for optional cookies/analytics. |
| Donors | Name, contact details, payment information, donation history, Gift Aid status, communication preferences, affiliated organisation | To process donations, issue receipts, manage Gift Aid claims, maintain donor records, and send updates or fundraising communications | Contract performance; Legal obligation – for Gift Aid and financial record-keeping; Legitimate interests – donor relationship management; Consent – for marketing communications;Soft opt-in under DUAA 2025. |
| Volunteers | Name, contact details, date of birth, emergency contact, skills, availability, background checks (e.g., DBS), health or accessibility information | To manage volunteer applications, allocate roles, ensure safeguarding and health & safety, and communicate effectively | Contract performance; Legal obligation – safeguarding, DBS checks; Legitimate interests – managing volunteer engagement; Special category data: Explicit consent or substantial public interest – safeguarding duties;Soft opt-in under DUAA 2025. |
| Beneficiaries | Name, contact details, demographic details, details of needs, circumstances, health or other special category data (as applicable in the circumstances of the support provided) | To assess eligibility, deliver aid and support, monitor outcomes, and ensure safeguarding | Legitimate interests – delivering charitable services; Legal obligation – safeguarding, regulatory requirements; Vital interests – in life-threatening emergencies; Special category data: Explicit consent or substantial public interest (Providing humanitarian support). |
| Newsletter Subscribers / Supporters | Name, email address, communication preferences | To send news, updates, and fundraising campaigns | Consent; Legitimate interests – for donors, volunteers and beneficiaries;Soft opt-in under DUAA 2025. |
| Suppliers / Partners | Name, business contact details, payment details | To manage relationships, process payments, and comply with contractual or legal obligations | Contract performance; Legal obligation; Legitimate interests – maintaining business relationships. |
Automated decision-making
You will not be subject to decisions based on automated data processing without your prior consent.
Third-party links outside of our control
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
Social Media Users
We use social media channels (including Facebook, WhatsApp, TikTok, YouTube and Instagram, the “Social Media Companies”) to publish information about Us. If you follow or otherwise engage with our social media channels, we will collect Usage Data to analyse how users interact with those channels. If you use social media to send us messages or posts, we may use your Profile Data to communicate with you. When you interact with our channels, the Social Media Companies will also process your personal data for the purposes set out above as joint controllers. For more information, we would encourage you to review the privacy notices published by the Social Media Companies.
For more information, or to manage your social media ad preferences, please see:
Facebook Custom Audiences guides
Facebook Data Policy (also applies to Instagram)
Google Privacy Notice
Donations
Ethical screening and minimising risk
To comply with our obligations as a charity, we must also take reasonable and appropriate steps to identify our donors, particularly when significant sums are donated.
Using charity law as the legal basis for processing, we may conduct due diligence to ensure that donations and support come from appropriate sources. This is to safeguard our reputation and mitigate any associated risks. We have clearly defined principles that guide how we engage in mutually beneficial relationships with companies, foundations and individuals.
These principles ensure that we raise money legally, safely and transparently. The nature and extent of due diligence research are proportionate to the fundraising opportunity. This doesn’t mean we’ll research extensive personal details about every donor or ask about every donation.
If required, please request a copy of our Due Diligence Policy.
Any information we collect for these purposes will be limited to what is necessary to meet these requirements and will be processed in line with your rights.
Data Sharing
We will only disclose your personal data to third parties where required by law or to our employees, contractors or third-party service providers who require such information to assist us with the administration of our services.
Third-party service providers may include, but are not limited to:
- Professional advisers, including lawyers, bankers, auditors and insurers based in the UK who provide consultancy, banking, legal, insurance and accounting services.
- HM Revenue & Customs, regulators and other authorities based in the UK who require reporting of processing activities in certain circumstances.
- Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If our business changes, the new owners may use your personal data in the same way as set out in this privacy notice.
These third-party service providers may be located outside of your home jurisdiction.
We require all our third-party service providers, by written contract, to implement appropriate security measures to protect your personal data consistent with our policies and any data security obligations applicable to us. We do not permit our third-party service providers who process your personal data on our behalf to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes in accordance with our instructions.
We currently contract with:
| Third-party name | Used to | Privacy notice |
| Mailchimp | Marketing E-mails | https://www.intuit.com/privacy/statement/ |
| Salesforce | CRM | https://www.salesforce.com/company/legal/privacy/#privacy-statement |
| Document Storage | https://policies.google.com/privacy?hl=en-GB | |
| MS365 | Documentation creation and storage | https://privacy.microsoft.com/en-gb/privacystatement |
| Stripe | Online donations payment | https://stripe.com/gb/legal/privacy-center |
| Dropbox | Document Storage | Privacy Policy – Dropbox |
Rights of Access, Correction, Erasure, and Objection
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
By law you may have the right to request access to, correct, and erase the personal data that we hold about you, or object to the processing of your personal data under certain circumstances. You may also have the right to request that we transfer your personal data to another party.
If you want to review, verify, correct, or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact us, using the details provided in the section below.
We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the personal data that we hold about you or make your requested changes.
Applicable law may allow or require us to refuse to provide you with access to some or all personal data that we hold about you, or we may have destroyed, erased, or made your personal data anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal data, we will inform you of the reasons why, subject to any legal or regulatory restrictions.
To Exercise Your Rights
If you would like to exercise any of the rights set out in the section above, please use the “contact us” page on our website. Simply give us your name and address and indicate your desire to exercise one or more of your rights under the UK GDPR in the comments section of the form. You may also contact our office at [email protected] with any request to exercise your UK GDPR rights. Alternatively, to be removed from our email list, simply click on the unsubscribe link provided on each email and follow the instructions.
Security
We use Secure Socket Layer (SSL) Protocol when collecting or transferring sensitive data such as credit card information. With the SSL technology, the credit card information you enter while making a donation or purchase will be encrypted before traveling over the internet. After we receive your credit card information, it is only used to process your donation or purchase.
We take reasonable steps to protect the information provided via the Services from loss, misuse, unauthorized access, disclosure, alteration, or destruction. However, we cannot guarantee protection and recommend that you take special care in deciding what information you provide to us through nonsecure means.
Data Retention
Our standard data retention period for any data for volunteers, sponsors or vendors, processed within a specific initiative, is 7 years from the conclusion of that initiative. For donors, we keep personal data for as long as you continue to be a donor, and a period of 7 years after your last donation.
Personal data that we process for any purpose(s) shall not be kept for longer than is necessary for such purpose(s).
Please request our Retention Schedule for a detailed list of our retention periods.
International Data Transfers
During the course of our services, we may need to transfer your personal data to our partner organisation, Convoy of Hope, headquartered in the United States. We may base such transfers on the UK International Data Transfer Agreement issued by the Information Commissioner’s Office under Section 119A of the Data Protection Act 2018.
Automatic Collection, Cookies and aggregate information collected from our website.
We automatically collect some data from visitors to our websites. This includes which pages you have viewed, how long you have viewed them, and where you go on our website.
We use cookies to store information about how you use our sites. A cookie is a piece of data stored on a user’s computer that remembers information about you and creates a profile of your viewing preferences. Your profile is used to tailor your experience on our website, make navigation easier, and direct you to information that best matches your interests. We require your consent to place non-essential cookies on your device. You can change your cookie preferences by selecting the button in the bottom left corner of any page on our website. View our cookies policy: convoyofhope.org.uk/cookie-policy
Information is also collected about how you arrived at our websites. This includes what links or adverts of ours you have viewed or clicked on to reach us, or any search terms you have used. Where you see an advert outside of our website, we may place a cookie on your browser. This is so that, when you access our website, we recognise that you have seen an advert of Ours elsewhere. If you have logged in, your login details are included.
Aggregate information is collected from users using our own web tracker. This information includes users’ Anonymised Internet Protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, platform type, date/time of visit, number of clicks, error pages, and number of unique visits. This information is not linked to personal profiles or personally identifiable information provided by users. We use the information to analyse visitor trends and website usage, administer the website, and gather broad demographic information about our website users.
How to Contact Us
If you have any questions about Our Site or this Privacy Notice, please get in touch with us by email at [email protected]
or by post to Data Protection,
Convoy of Hope United Kingdom
107-111 Fleet Street,
London
EC4A 2AB
Please ensure that your query is clear, particularly if it is a request for information about the data that we hold about you.
How to complain
If you have any complaints about how we handle your data, please contact us by email at [email protected].
If this does not resolve your complaint to your satisfaction, you have the right to complain to the Information Commissioner’s Office (ICO). The ICO is the supervisory body authorised by the Data Protection Act 2018 to regulate the handling of personal data within the United Kingdom. The contact details for the Information Commissioner’s Office are:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: 0303 123 1113 Website: https://ico.org.uk/concerns/
Changes to This Privacy Policy
We reserve the right to update or modify this Privacy Policy at any time, and we will provide you with a new Privacy Policy when we make any updates. If we would like to use your previously collected personal data for different purposes than those we notified you about at the time of collection, we will provide you with notice and, where required by law, seek your consent, before using your personal data for a new or unrelated purpose. We may process your personal data without your knowledge or consent where required by applicable law or regulation.
Last Modified: 6/7/26