Privacy Policy - Hands of Mercy

Hands of Mercy ("Hands of Mercy", "we", "us", "our") is a registered charity in England and Wales (Charity No. 1199084). We are committed to respecting and protecting the privacy of everyone who supports our work with orphans, widows, and vulnerable families. This Privacy Policy explains how we collect, store, and use personal data when you visit homsl.org, make a donation, become a sponsor, attend one of our events, or otherwise interact with us.

1. Who is responsible for your data?

Hands of Mercy is the "data controller" for the purposes of UK data protection legislation. We can be contacted at:

Hands of Mercy
Unit 12, Jubilee House, 45 Riverbank Way, London SE1 7QL, United Kingdom
Email: [email protected]
Phone: +44 (0)20 7123 4567

2. Personal data we collect

We collect and process the following categories of personal data:

Identity and contact data: names, titles, postal addresses, email addresses, telephone numbers, and (where relevant) your date of birth.
Donation and sponsorship data: amounts donated, frequency of gifts, Gift Aid status, communications about your sponsored child or project, and preferences for recognition.
Financial data: partial payment details required for processing contributions. All card and Direct Debit transactions are handled securely by Stripe and GoCardless; we do not store full payment card numbers on our systems.
Safeguarding data: information shared in confidence when raising concerns about children or vulnerable adults, recorded in accordance with our safeguarding procedures.
Usage data: IP address, device information, browser type, referral source, and pages viewed on our website, captured via essential and analytics cookies.
Marketing preferences: your consent and communication choices for email, SMS, phone, or post.

3. How we collect personal data

We collect data in the following ways:

When you give it to us directly by making a donation, setting up a sponsorship, or subscribing to updates.
When you complete online forms, surveys, petitions, or event registrations.
When you interact with our social media accounts or digital advertising.
When a supporter shares your details with us (for example, purchasing a gift sponsorship on your behalf).
From public records and reputable third-party providers that help us maintain accurate supporter data.

4. Why we use personal data

We will only use your personal data when the law allows us to. The primary purposes are to:

Process donations, Direct Debits, sponsorships, and Gift Aid claims.
Send you updates about the programmes you support and report on the impact of your giving.
Respond to enquiries, fulfil resource requests, and provide supporter care.
Administer events, campaigns, volunteering, and safeguarding referrals.
Improve our website, communications, and fundraising so we can reach more families in need in a cost-effective way.
Comply with our legal and regulatory obligations as a registered charity.

5. Lawful bases for processing

Our lawful bases under UK GDPR are:

Contract: processing donations, sponsorships, and event bookings requires the use of your personal data to fulfil the service you requested.
Legal obligation: we retain records for tax, fraud prevention, and charity regulation compliance, including Gift Aid declarations.
Legitimate interests: we contact supporters in reasonable ways to share impact stories, fundraising opportunities, and organisational updates. You can opt out at any time.
Consent: we will only send marketing emails or SMS messages where you have opted in.
Vital interests: on rare occasions we may process data to protect someone’s life or wellbeing as part of a safeguarding investigation.

6. How we share personal data

We never sell personal data and we will not share it with unrelated organisations for their own purposes. We may disclose information to:

Our payment processors (Stripe, GoCardless) to collect secure online contributions.
Trusted service providers who deliver email campaigns, impact reporting, printing, IT support, or data analytics on our behalf. Each provider is bound by contract to keep your data secure and only use it as instructed by Hands of Mercy.
HM Revenue & Customs, the Charity Commission, law enforcement, or safeguarding partners where required by law.
Our programme delivery partners overseas when this is necessary to administer your sponsorship (for example, sharing a sponsor’s name with a partner school). We minimise the data provided and ensure appropriate safeguards are in place.

7. International data transfers

Some of our partners operate outside the United Kingdom. Whenever we transfer personal data internationally, we ensure that an adequate level of protection is afforded by using UK approved standard contractual clauses, binding corporate rules, or by working with organisations in countries deemed to provide adequate protection by the UK government.

8. Data security

We implement appropriate technical and organisational measures to protect personal data against loss, misuse, or unauthorised access. These include encryption, access controls, staff training, secure disposal of confidential waste, and regular testing of our systems. While no transmission of data is ever completely secure, we continually review our safeguards to keep your information safe.

9. Data retention

We retain personal data only for as long as necessary for the purposes set out above. Typically this means we keep donation and Gift Aid records for seven years from your last gift, and safeguarding records for at least 75 years in line with statutory guidance. When data is no longer required, we securely delete or anonymise it.

10. Your rights

You have the following rights under UK data protection law:

To request access to the personal data we hold about you.
To correct inaccurate or incomplete information.
To request erasure in certain circumstances (for example, where data is no longer needed).
To restrict or object to processing where we rely on legitimate interests.
To request the transfer of your data to another organisation.
To withdraw consent to marketing communications at any time.

You can exercise these rights by emailing [email protected]. We will respond within one month. You are also entitled to lodge a complaint with the Information Commissioner’s Office (ICO) if you are unhappy with how we handle your data.

11. Children and young people

We do not knowingly collect personal data from children under 16 without the consent of a parent or legal guardian. Sponsors are asked not to share personal contact details with sponsored children. Any correspondence is facilitated through Hands of Mercy in accordance with our safeguarding policy.

12. Changes to this policy

We review this Privacy Policy annually, or sooner if legislation or our practices change. Updated versions will be posted on this page and, where appropriate, notified to you by email.

13. Contact and complaints

If you have any questions, concerns, or complaints about this Privacy Policy or how we process your personal data, please contact our Data Protection Officer at [email protected] or write to Hands of Mercy, Unit 12, Jubilee House, 45 Riverbank Way, London SE1 7QL, United Kingdom. If you remain dissatisfied, you may complain to the ICO at www.ico.org.uk or by calling 0303 123 1113.