Privacy Policy
Last updated: 11 September 2026
The Hibbs Lupus Trust respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, who we may share it with, and the rights you have under UK data protection law.
1. Who we are
The Hibbs Lupus Trust is a registered charity in England and Wales.
Registered charity: 1147783
Registered office:
Lakeside Point – 2nd Floor
Lakeside Business Park
Walkmill Lane
Cannock
Staffordshire
WS11 0XE
For the purposes of UK data protection law, The Hibbs Lupus Trust is the data controller of the personal information covered by this policy.
If you have any questions about how we use your personal information, please contact us at:
Email: hello@hibbslupustrust.org
2. The information we collect
The personal information we collect depends on how you interact with us.
This may include:
- your name and contact details, including your address, email address and telephone number;
- information you provide when making a donation;
- your donation history and Gift Aid information;
- information provided when registering for an event, fundraising activity or challenge;
- volunteering information;
- your communication and marketing preferences;
- correspondence, enquiries, feedback and other communications with us;
- photographs, videos, testimonials or personal stories you choose to provide;
- information submitted through forms on our website;
- technical information associated with the operation and security of our website and online services; and
- other information you choose to provide to us.
Health information
Because we are a lupus charity, information you provide when contacting us, sharing your experiences or participating in our work may include information about your health.
Health information is classed as special category personal data and receives additional protection under data protection law.
We only collect and use health information where there is a valid legal basis and an appropriate condition under data protection law. Where appropriate, this may include your explicit consent.
Please only provide health information that is relevant to your enquiry or interaction with us.
Payment information
Online payments and donations are processed through secure third-party payment providers such as Stripe.
We do not normally receive or store your full payment card details. We may receive information about your transaction, such as the amount donated, payment status and transaction reference.
3. How we collect your information
We may collect personal information directly from you when you:
- make a donation;
- complete a Gift Aid declaration;
- sign up to receive our emails or newsletters;
- contact us;
- register for an event or fundraising activity;
- volunteer with us;
- complete a form on our website;
- take part in a survey;
- share your story or experience with us; or
- otherwise interact with the Trust.
We may also receive personal information from third parties where appropriate, such as:
- fundraising platforms;
- payment providers;
- event partners or organisers;
- social media platforms where you have chosen to interact with us; and
- another person acting on your behalf.
Where required, we will tell you that we have received your information from another source.
4. How we use your information
We may use your personal information to:
- process and acknowledge donations;
- administer Gift Aid claims;
- manage event and fundraising registrations;
- communicate with you about your donation, enquiry, registration or involvement with the Trust;
- provide information and support relating to our charitable work;
- manage volunteers and fundraising activities;
- send newsletters, charity updates and fundraising communications where permitted;
- respond to enquiries and requests;
- maintain appropriate financial and administrative records;
- improve and protect our website and online services;
- prevent fraud, misuse and security threats;
- understand and improve the effectiveness of our charitable activities;
- comply with our legal, regulatory and financial obligations; and
- establish, exercise or defend legal claims where necessary.
We will only use personal information for purposes that are compatible with the reason it was originally collected unless the law allows or requires us to use it for another purpose.
5. Our lawful bases for using personal information
Under UK data protection law, we must have a lawful basis for using your personal information.
Depending on the circumstances, we may rely on:
Consent
Where you have actively agreed to us using your information for a particular purpose, such as receiving our newsletter or allowing us to publish your story.
You can withdraw your consent at any time.
Contract
Where processing your information is necessary to provide something you have requested or to take steps at your request before entering into an agreement.
Legal obligation
Where we need to use or retain information to comply with the law, including financial, accounting, Gift Aid and regulatory requirements.
Legitimate interests
Where using your information is reasonably necessary for the operation and administration of the charity and does not unfairly override your interests, rights or freedoms.
Examples may include maintaining appropriate records, responding to enquiries, protecting our systems and understanding how our charitable services are used.
Where we process special category information, such as health information, we will also identify an appropriate additional legal condition for doing so.
6. Email newsletters and fundraising communications
We may send you news, information about our work, fundraising appeals and other charity updates where you have consented to receive them or where another lawful basis allows us to do so.
You can unsubscribe from marketing emails at any time by using the unsubscribe link included in our emails or by contacting:
Unsubscribing from marketing will not prevent us from contacting you about an existing donation, event registration, enquiry or other administrative matter where necessary.
We may keep a limited record of your preference not to receive marketing so that we can respect your wishes in future.
7. Who we share information with
We do not sell, rent or trade your personal information.
We may share information with trusted organisations that help us operate the charity and provide our services.
These may include:
- payment processors such as Stripe;
- fundraising platforms;
- website hosting and technical service providers;
- email, newsletter and customer relationship management providers;
- Microsoft 365 and other secure business technology providers;
- professional advisers where necessary;
- HM Revenue & Customs in connection with Gift Aid;
- banks and financial service providers;
- regulators, public authorities or law enforcement agencies where required by law; and
- organisations involved in delivering an event or activity where this is necessary and appropriate.
Where another organisation processes personal information on our behalf, we require it to protect that information and only use it for the agreed purpose.
Some organisations, such as payment providers, may act as independent data controllers for some of the information they process. Their own privacy policies will apply to that processing.
8. International transfers
Some of the organisations and technology providers we use may process or store personal information outside the United Kingdom.
Where personal information is transferred internationally, we take appropriate steps to ensure that it receives a level of protection consistent with UK data protection law.
Depending on the destination and provider, these safeguards may include UK adequacy regulations or approved contractual protections for international data transfers.
9. How long we keep your information
We keep personal information only for as long as it is reasonably necessary for the purpose for which it was collected, including satisfying legal, accounting, regulatory and reporting requirements.
The period will depend on the type of information involved.
For example:
- donation and financial records are normally retained in accordance with applicable accounting and tax requirements;
- Gift Aid declarations and supporting records are retained for the periods required by HM Revenue & Customs;
- event and fundraising records are retained for as long as reasonably necessary for administration, safeguarding, insurance or legal purposes;
- volunteer records are retained for as long as reasonably necessary following the end of the volunteering relationship;
- newsletter and marketing information is retained while you remain subscribed, together with any information necessary to record an unsubscribe request;
- general enquiries and correspondence are retained for as long as reasonably necessary to deal with the enquiry and maintain an appropriate record; and
- personal stories, photographs, videos or health information are retained only for as long as we have an appropriate reason and lawful basis to use them.
Gift Aid records will normally need to be retained for at least six years in accordance with HMRC requirements. Certain ongoing Gift Aid declarations may need to be retained for longer.
When personal information is no longer required, we will securely delete, destroy or anonymise it where appropriate.
10. Children and young people
Some of our charitable activities, fundraising events or communications may involve children or young people.
Where we collect personal information about someone under 18, we take additional care over how that information is collected, used and protected.
Where appropriate, we may ask for information or consent from a parent, guardian or other responsible adult.
We will only collect information that is reasonably necessary for the activity concerned and will take particular care with photographs, health information and other sensitive information relating to children and young people.
11. Keeping your information secure
We take appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.
These measures include, where appropriate:
- secure website hosting;
- encryption;
- SSL/TLS protection;
- password and account security;
- access controls;
- multi-factor authentication;
- secure cloud services;
- regular software and security updates; and
- backups and other appropriate technical safeguards.
However, no internet-based service or method of electronic storage can be guaranteed to be completely secure.
If you believe personal information you have provided to us may have been compromised, please contact us at hello@hibbslupustrust.org.
12. Your data protection rights
Depending on the circumstances, UK data protection law gives you rights over your personal information.
These can include the right to:
- be informed about how your information is used;
- access personal information we hold about you;
- correct inaccurate or incomplete information;
- request deletion of your information in certain circumstances;
- restrict how your information is used in certain circumstances;
- object to certain types of processing;
- receive certain information in a portable format where the right to data portability applies; and
- withdraw consent at any time where we rely on consent.
These rights are not absolute and may not apply in every situation.
To exercise any of these rights, contact:
We may need to ask you for information to confirm your identity before acting on your request.
We will normally respond without undue delay and within one month. Where permitted by law, this period may be extended if a request is particularly complex or if you make a number of requests. We will tell you if an extension is necessary.
There is normally no charge for exercising your data protection rights.
13. Automated decision-making
We do not use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals.
14. Complaints
If you have concerns about how we have handled your personal information, we would appreciate the opportunity to resolve them.
Please contact us at:
You also have the right to complain to the UK data protection regulator:
Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our activities, technology or legal requirements.
The latest version will always be published on our website and the date at the top of this page will show when it was last updated.
If we make a significant change that materially affects how we use personal information, we will take reasonable steps to bring it to the attention of people affected where appropriate.
16. Contact us
If you have any questions about this Privacy Policy or the way we handle your personal information, please contact:
The Hibbs Lupus Trust
Lakeside Point – 2nd Floor
Lakeside Business Park
Walkmill Lane
Cannock
Staffordshire
WS11 0XE
Email: hello@hibbslupustrust.org
Registered charity: 1147783