Data Protection & GDPR

1. Our data protection commitment

Hands of Mercy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We process personal data lawfully, fairly, and transparently, and we are accountable for the decisions we make. “Personal data” means any information that can identify you, such as your name, contact details, or donation history.

2. Your rights under UK GDPR

You have the right to:

• Be informed about how we use your data (explained in our Privacy Policy and this notice).
• Request access to the personal data we hold about you.
• Ask us to correct inaccurate or incomplete information.
• Request deletion of your data where we have no lawful reason to continue processing it.
• Ask us to restrict processing while we resolve an enquiry or dispute.
• Receive your data in a portable format or ask us to transfer it to another organisation.
• Object to processing based on legitimate interests or to receiving direct marketing.
• Not be subject to automated decisions that have legal or similarly significant effects.

3. Making a data subject access request (DSAR)

To request access to your personal data, please email [email protected] or write to the Data Protection Officer at Hands of Mercy, Unit 12, Jubilee House, 45 Riverbank Way, London SE1 7QL, United Kingdom. Include your full name, contact details, and a description of the information you require. If you are seeking information on behalf of someone else, please provide evidence of your authority to act for them.

4. Verifying your identity

We may request copies of identification documents (such as a passport or driving licence) and proof of address to verify your identity before releasing information. This protects you from unauthorised access to your data. Once verification is complete, copies are destroyed securely.

5. Our response times

We acknowledge requests within two working days. We normally provide a full response within one month of receiving a verified request. For complex or multiple requests we may extend the deadline by up to two months; if so, we will notify you within the first month and explain why the extension is necessary.

6. Fees and repeated requests

DSARs are normally free of charge. We may charge a reasonable fee or refuse a request that is manifestly unfounded, excessive, or repetitive. If a fee is necessary, we will let you know before taking further action.

7. When we may refuse a request

We may decline to comply with a request where disclosure would adversely affect the rights and freedoms of others, conflict with legal obligations, or hinder ongoing safeguarding investigations. In such cases we will explain our decision and outline how you can escalate your concerns.

8. Data Protection Officer

Our Data Protection Officer (DPO) is responsible for overseeing compliance and handling queries:

Emma Clarke, Data Protection Officer
Hands of Mercy, Unit 12, Jubilee House, 45 Riverbank Way, London SE1 7QL, United Kingdom
Email: [email protected]
Telephone: +44 (0)20 3773 2195

9. Complaints to the ICO

If you are dissatisfied with our response or believe we are not handling your personal data lawfully, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk

10. Contact us

To exercise your data protection rights or ask a question about this notice, please contact our Data Protection Officer using the details above. We are grateful to supporters who help us uphold the highest standards of privacy and transparency.