How we handle personal data.
A plain-English statement of our duties as data controller. Last updated May 2026.
In short
- We collect the smallest amount of personal data we can — usually a name, an address, a phone number, an email.
- We never sell, swap or rent personal data. Ever.
- We keep donor records for seven years for HMRC Gift Aid. Most other records we keep for 24 months.
- We run no third-party analytics on this website. There is one first-party cookie and it remembers whether you’ve seen the cookie banner.
- You have a right to access, correct, delete and complain about the data we hold. The Information Commissioner’s Office is at ico.org.uk, 0303 123 1113.
- Write to the chair if you have any concern at all; we will reply in plain English within ten working days.
Who we are
THE CHARITIES OF EDWARD AP EVAN AND OTHERS (registered charity 220004) is the data controller for personal data collected through this website, by post, by email or by phone. Our registered office is c/o Llanwrthwl Village Hall, Llanwrthwl, Llandrindod Wells, Powys, LD1 6NU. We are a small charity with no staff; the chair is the responsible person for data-protection enquiries.
What personal data we collect
We collect only what we need:
- From donors: name, postal address, email, phone (optional), donation amount, frequency, Gift Aid status. We do not store card numbers; live card payments would be processed by a third-party payment processor if implemented.
- From applicants and nominees: name, postal address, phone, and the short description of the help needed. We do not require bank statements or proof of income.
- From volunteers and partners: name, email, phone (optional) and a short note about your interest.
- From all website visitors: no personal data. We do not run analytics. The web server logs an anonymised IP-address fragment and the page requested, for 14 days, for security and capacity-planning purposes only.
Why we collect it and the lawful basis
- To process and acknowledge donations (lawful basis: contract, with a legitimate interest in administering the charity).
- To consider applications and nominations for help (lawful basis: legitimate interest, with consent where the applicant directly provides their data).
- To send our quarterly dispatch (lawful basis: consent — you can unsubscribe at any time by emailing [email protected]).
- To meet our statutory duties as a charity (lawful basis: legal obligation, including filing returns with the Charity Commission and HMRC for Gift Aid).
Who we share data with
A small list. We share data only with:
- HMRC, for Gift Aid claims.
- The Charity Commission for England and Wales, for our statutory annual return.
- Our email platform (a small UK-based provider) for sending the quarterly dispatch. We send only your email address and first name.
- A payment processor, if and when we accept live card payments. The processor (such as Stripe or GoCardless) acts as a processor and is governed by its own privacy policy.
We do not share data with anyone else. We never share data with marketers, list-brokers, or other charities, regardless of how much they ask.
Retention
- Donor records: 7 years (HMRC Gift Aid requirement).
- Application and nomination records: 24 months from the date of the decision.
- Volunteer and partner correspondence: 24 months from the last contact.
- Newsletter list: until you unsubscribe.
- Server logs: 14 days.
Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you (a ‘subject access request’).
- Have inaccurate data corrected.
- Have data deleted (the ‘right to be forgotten’), subject to any legal duty we have to retain it.
- Restrict our processing of your data.
- Have your data ported to another organisation, where applicable.
- Object to our processing of your data.
- Withdraw consent at any time, where we have relied on consent.
To exercise any of these rights, write to the chair at the registered office or email [email protected]. We will reply within ten working days.
Cookies
We use a single first-party cookie to remember whether you have seen the cookie banner. We do not run third-party analytics. We do not run any marketing or advertising cookies. See our cookie policy for the detail.
Children’s data
We do not knowingly collect personal data about anyone under the age of 13. If you believe a child has provided us with personal data, please write to the chair and we will delete it. Our safeguarding policy (a one-page summary is available on the resources page) sets out how we handle concerns about children and adults at risk.
Changes to this policy
We will update this policy when our practices change or when the law changes. The ‘Last updated’ date at the top of the page is the date of the most recent change.
How to complain
Please write to us first — we read every letter and will try to put things right. If you remain unhappy, you have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection. The ICO can be contacted at ico.org.uk, by telephone on 0303 123 1113, or by post at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.