Vascroft Foundation Privacy Notice
Effective date: 22.06.2026
Vascroft Foundation is committed to protecting your personal data and respecting your privacy. This Privacy Notice explains how we collect, use, store and protect your personal information when you donate using our donation platform.
- Who we are
Vascroft Foundation is the data controller for the personal information we collect in connection with donations and Gift Aid administration.
If you have any questions about this Privacy Notice or how we use your personal data, please contact us at:
Email: [email protected]
Address: Vascroft Estate, Unit 1, 861 Coronation Road, Park Royal, London, NW10 7PT
- What information we collect
When you make a donation, we may collect the following personal information:
- Your name.
- Your billing and/or postal address.
- Your email address.
- Donation amount, date and payment status.
- Gift Aid declaration information, where applicable.
- Any correspondence you send to us in connection with your donation.
We do not store your full payment card details on our website or in our own database. Payment information is processed securely by our payment providers.
- How we use your information
We use your personal data for the following purposes:
- To process and record your donation.
- To administer Gift Aid declarations.
- To issue donation confirmations and automated receipts.
- To maintain accounting and fundraising records.
- To respond to any queries or issues relating to your donation.
We only use your information where we have a lawful basis to do so under UK GDPR.
- Lawful basis for processing
We rely on the following lawful bases:
- Performance of a contract: to process your donation and provide the service you request.
- Legal obligation: to comply with HMRC requirements and other legal record-keeping obligations.
- Legitimate interests: to administer donations, maintain records, and manage our operations in an efficient and secure way.
Where we need to send you marketing or fundraising communications, we will only do so where permitted by law and, where required, with your consent.
- Payment processing
All donations are processed securely through Donorbox and Stripe. Donorbox uses Stripe’s secure token mechanism, and card numbers are tokenised before being charged. Donorbox states that it does not retain donors’ card numbers in its database or logs, and Stripe is a PCI Level 1 service provider. This means that we do not receive or store your full card details on our website. Payment data is handled by our payment providers using encrypted connections and security controls designed to protect against unauthorised access.
- Gift Aid records
Where you make a Gift Aid declaration, we are required to retain the declaration and related records for HMRC compliance purposes. Gift Aid declarations and related records are generally kept for six years after the end of the relevant accounting period or tax year, depending on the circumstances.
- Sharing your information
We do not sell your personal data or share it with third parties for their marketing purposes.
We may share your information with trusted service providers who help us operate our donation process, including Donorbox and Stripe. These providers act on our behalf and are required to handle your data securely and in line with applicable data protection law.
We may also disclose personal data where required by law, regulation, or legal process.
- International transfers
Some of our service providers may process personal data outside the UK. Where this happens, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent protections, so that your personal data remains protected in line with UK GDPR requirements.
- How long we keep your data
We keep personal data only for as long as necessary for the purposes for which it was collected, and to meet legal, accounting and regulatory obligations.
In practice:
- Gift Aid declarations and related records are kept for the required HMRC retention period.
- Donation and accounting records are kept for as long as needed for financial reporting and audit purposes.
- Enquiry correspondence is kept only for as long as needed to deal with the matter.
- Your rights
Under UK data protection law, you have rights in relation to your personal data, including:
- The right to access your personal data.
- The right to request correction of inaccurate data.
- The right to request deletion, in some circumstances.
- The right to object to or restrict certain types of processing.
- The right to data portability, where applicable.
- The right to withdraw consent where consent is the basis for processing.
You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we handle your data.
- Security
We use appropriate technical and organisational measures to protect personal data from unauthorised access, loss, misuse or disclosure. Donorbox states that it uses encrypted transmission, Stripe tokenisation, and PCI-compliant payment infrastructure. No method of transmission or storage is completely secure, but we take reasonable steps to safeguard your information.
- Changes to this notice
We may update this Privacy Notice from time to time to reflect changes in our practices or legal obligations. The latest version will always be available on our website.