Ready TogetherWhat this means for you
This policy explains how the National Emergencies Trust uses your personal data when you use our website or support us. Personal data means any information that identifies you.
- We collect your data when you donate, sign up for news, ask us something, or make a complaint.
- We use it to take your donation, keep you updated, answer you, and run our website safely.
- We keep it only as long as we need it, then we delete it.
- We share it with organisations that help us run, and with others where the law requires.
- You have rights over your data. You can ask to see it, correct it, or have it deleted.
- You can complain to us at any time. If you are still unhappy, you can complain to the data protection regulator.
Your full rights and our contact details are below.
Who we are
The National Emergencies Trust is the controller for the personal data in this policy. A controller is the organisation that decides how and why your data is used.
You can contact us at London Scottish House, 95 Horseferry Road, London, SW1P 2DX. You can email us at data.protection@nationalemergenciestrust.org.uk (opens in a new tab). Responsibility for data protection sits with our Chief Executive. Our registration with the Information Commission is ZA559495.
The National Emergencies Trust is a registered charity in England and Wales (charity number 1182809) and a registered Scottish charity (charity number SC050062). Registered office: London Scottish House, 95 Horseferry Road, London, SW1P 2DX.
What this policy covers
This policy covers the personal data we collect through our website and from people who support us. It does not cover staff, volunteer or job applicant data, which we explain in a separate internal privacy notice.
The data we collect and why
The table shows what we collect, why we use it, and our legal reason for using it. A lawful basis is the legal reason an organisation is allowed to use your data.
| Data we collect | Why we use it | Lawful basis |
|---|---|---|
| Name, contact details, donation amount, payment reference | To process and administer your donation | Contract for the donation; legal obligation for financial and tax records |
| Name, address, Gift Aid declaration | To claim Gift Aid | Legal obligation (HMRC rules) |
| Name, email, phone | To send you marketing by email, text or phone | Your consent, and consent under the cookies and electronic marketing rules |
| Name, postal address | To send you fundraising by post | Legitimate interests, with a clear right to object |
| Email and name | To send you our newsletter | Your consent |
| Name, contact details, content of your message | To respond to your enquiry | Legitimate interests |
| Name, contact details, complaint detail | To handle your complaint | Legitimate interests; legal obligation for a data protection complaint |
| Usage data, device and analytics identifiers | To run, secure and improve the website | Legitimate interests for security and core function; consent for non-essential analytics |
| Supporter data combined with public sources, and wealth and major donor screening | To build supporter insight and target our work | Legitimate interests, with a right to object |
| Donor identity and source of funds detail | To carry out due diligence and ethical checks | Legitimate interests; legal obligation where money laundering rules apply |
| Any personal data | Where there is a risk of serious harm to someone | Vital interests, meaning to protect someone's life or safety |
| Health data, and lived experience and case study content | For events, volunteering, case studies and lived experience work | Explicit consent as the default; safeguarding may rely on substantial public interest |
Two of these need extra care. Supporter profiling and wealth screening can affect you, so we weigh our reasons against your rights before we rely on them, and you can object. Health data and lived experience content is special category data, which the law gives extra protection, so we apply a further legal condition on top of the basis in the table.
Where we research or screen supporters, we use only public and open sources. These include internet searches, LinkedIn, Companies House, the Charity Commission register, and published news. We do not buy supporter data, and we do not use paid screening providers or data brokers. Your data comes either from you or from these public sources.
Some data you must give us, and some is your choice.
- To make a donation, we need your name, contact details and payment information. Without these we cannot take your donation.
- A Gift Aid declaration is your choice. Without it we cannot claim Gift Aid, though you can still donate.
- Marketing and our newsletter are your choice. If you do not give consent we will not send them, and you can still use the rest of our website.
If you want to understand any row above, ask us using the contact details in ‘Who we are’.
How long we keep your data
We keep your data only as long as we need it.
- Donation and financial records: the current financial year plus six years, to meet HMRC and accounting rules.
- Gift Aid declarations and supporting records: for as long as they are relevant, and six years after the last donation they support.
- Marketing consent: until you withdraw it. After that we keep only the minimum needed to honour your opt-out.
- Newsletter: until you unsubscribe.
- Enquiries: two years after the matter is closed.
- Complaints: six years, in line with our complaints policy.
- Website analytics: no more than fourteen months at the analytics tool.
- Supporter insight and profiling data: only while you have an active relationship with us, reviewed regularly.
Sending data outside the UK
Some companies that help us are based outside the UK. Netlify, Cloudflare, Stripe, Microsoft, Google and Meta are based in the United States. monday.com is based in Israel and also uses its US company, monday.com, Inc. When your data goes to them outside the UK, we keep it protected.
- Where the UK has decided that a country's law protects personal data well enough, as it has for Israel, we rely on that decision.
- Where a company is certified under the UK-US data bridge, an approved route for sending data to certified US organisations, we rely on that certification.
- Where a company is not certified, we use the International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses, backed by a transfer risk assessment, which is a check of the risks before the data moves.
How we protect your data
We keep your data safe by:
- limiting access to staff who need it
- holding it in secure systems
- encrypting it as it travels, including across our website and forms
- encrypting it where it is stored, including in our CRM
- training our staff in data protection.
Your data rights
You have these rights over your data:
- To be informed. This policy tells you how we use your data.
- To see your data. You can ask for a copy of the data we hold about you. We respond within one month. If we need more detail to find your data, that time can pause until you give it.
- To correct your data if it is wrong or incomplete.
- To have your data deleted in some cases.
- To limit how we use your data while we look into a concern.
- To object to how we use your data, including profiling and postal fundraising.
- To move your data to another organisation, where this right applies.
- To withdraw consent at any time, where we rely on your consent.
We do not make decisions about you by automated means alone. A person always makes the decision, and a committee or our board signs off where needed. We do not use automated systems on their own to accept a donation or award a grant.
How to complain
If you want to complain about how we use your data, or how we have handled your personal information, you can do this in two ways:
- Fill in our complaint form.
- Email us at complaints@nationalemergenciestrust.org.uk (opens in a new tab).
We will acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome.
If you are not happy with our response, you can raise your concern with the Information Commission, the UK data protection regulator:
Information Commission4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL
You can also visit ico.org.uk (opens in a new tab) or call the ICO helpline. We are registered with the ICO as a data controller under number ZA559495. You can go to the ICO at any time, though we ask you to come to us first.
Other formats
We will provide this policy in other formats on request, including large print, easy-read and audio, and in other languages where we reasonably can. Email data.protection@nationalemergenciestrust.org.uk (opens in a new tab) to ask.
Changes to this policy
We review this policy every year, and sooner if the law or our use of data changes. The version and date at the top show when we last updated it.
Detailed legal information
This section holds the legal detail behind the plain wording above.
Transparency. We provide this privacy information under Articles 12, 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, in line with the ICO's right to be informed guidance.
Lawful bases (Article 6). The bases above are: contract, Article 6(1)(b); legal obligation, Article 6(1)(c); consent, Article 6(1)(a); legitimate interests, Article 6(1)(f); and vital interests, Article 6(1)(d). Where we rely on legitimate interests, we carry out a balancing test that weighs our interest against your rights, and you have the right to object.
Sources. Where we obtain supporter data from sources other than you, we use publicly available and open sources, in line with Article 14 UK GDPR.
Special category data (Article 9). For health, lived experience and case study data we rely on explicit consent, Article 9(2)(a), as the default condition. Safeguarding work may rely on the substantial public interest condition, Article 9(2)(g). Each use needs an Article 9 condition in addition to an Article 6 basis.
Marketing. Electronic marketing by email and text relies on your consent under the Privacy and Electronic Communications Regulations (PECR), alongside the UK GDPR consent basis.
Complaints duty. We handle data protection complaints under section 164A of the Data Protection Act 2018, added by the Data (Use and Access) Act 2025, in force from 19 June 2026. This includes acknowledging your complaint within 30 days and telling you of your right to complain to the ICO.
Access requests. We handle access requests under Article 15 UK GDPR, as amended by the Data (Use and Access) Act 2025, including the rule that allows the response time to pause where we reasonably need more information to find your data.
Automated decisions. We do not carry out solely automated decision-making with legal or similarly significant effect. Our position reflects Articles 22A to 22D UK GDPR, as amended by the Data (Use and Access) Act 2025.
International transfers. Transfers outside the UK rely on UK adequacy regulations where they apply, including for Israel; on the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge, in force since October 2023) where the recipient is certified; or on the International Data Transfer Agreement or the UK Addendum to the standard contractual clauses, with a transfer risk assessment, where it is not.
Security. We apply technical and organisational measures under Article 5(1)(f) and Article 32 UK GDPR, including access controls, secure systems, encryption in transit and at rest, and staff training.
Cookies. We set cookies under regulation 6 of PECR, which requires consent for non-essential cookies before they are set.
Due diligence. Donor due diligence and source of funds checks rely on legitimate interests, and on legal obligation where the money laundering rules apply.
Key terms
- Controller: the organisation that decides how and why your data is used.
- Processor: an organisation that handles data on the controller's instructions.
- Personal data: any information that identifies you.
- Special category data: data the law gives extra protection, including health data.
- Lawful basis: the legal reason an organisation is allowed to use your data.
- Legitimate interests: a lawful basis where an organisation uses data for a clear reason that does not override your rights.
- Consent: a clear, freely given agreement to a specific use of your data.
- Vital interests: a lawful basis used to protect someone's life or safety.
- Profiling: using data to assess or predict things about a person.
- Gift Aid: a scheme that lets a charity reclaim tax on a UK taxpayer's donation.
- UK-US data bridge: an approved route for sending data to certified US organisations.
- International Data Transfer Agreement: a contract that protects data sent outside the UK.
- PECR: the Privacy and Electronic Communications Regulations, the rules on cookies and electronic marketing.
- UK GDPR and Data Protection Act 2018: the main UK data protection laws.
- Data (Use and Access) Act 2025: the 2025 law that updated UK data protection rules.
- ICO: the Information Commission, the UK data protection regulator.
