Privacy Policy

Last updated: September 2026

1. About us

This website is provided and managed by IAPWA, registered charity number 1137532, with its registered address at: 1B Rudds Lane, Haddenham, Aylesbury, Bucks, HP17 8JP, United Kingdom. Our ICO registration reference is Z2208647.

You can contact us about data protection matters at any time by emailing enquiries@iapwa.org.

This Privacy Policy explains how we collect, use, store and share your personal information, and what your rights are. By using our website or providing us with your personal information, you are acknowledging that you have read this policy.

We may update this policy from time to time to reflect changes in the law or in how we work. When we make significant changes, we will take reasonable steps to let you know - for example by updating the date at the top of this page. We encourage you to check back periodically.

2. What personal information do we collect?

The personal information we collect may include, but is not limited to:

  • Your name, address, telephone number, and email address

  • Date of birth

  • Gift Aid declarations

  • A record of communications we have had with you, and your communication preferences

  • Your donation history

  • Photos and videos where you have consented to these being taken

  • Next of kin details, where you participate in an event with us

  • Payment information (see section 8 for how this is handled)

3. How do we collect your personal information?

Where possible, we collect personal information directly from you. This may happen when you:

  • Make a donation online or offline

  • Purchase merchandise

  • Sign up for or take part in an event or campaign

  • Contact us by phone, email or post

  • Follow or interact with us on social media

We also collect information through third-party platforms, such as JustGiving, where you choose to support us that way.

We may also cross-reference our records against public registers such as the Telephone Preference Service (TPS) or Fundraising Preference Service (FPS) to make sure we are not contacting people who have opted out of marketing communications.

If you are under 18, please make sure you have a parent or guardian's permission before providing us with any personal information.

4. Our lawful basis for using your information

UK data protection law requires us to have a lawful basis for every way we use your personal information. We rely on the following bases:

Consent

We ask for your consent before sending you electronic marketing communications (emails, text messages, or direct messages on social media). You can withdraw your consent at any time - see section 10 for how to do this.

Legitimate interests

We sometimes use your information where we have a legitimate interest in doing so and where this does not outweigh your rights and interests. We carry out a Legitimate Interests Assessment (LIA) before relying on this basis. We use legitimate interests to:

  • Send you information about our work and how to support us (you can opt out at any time)

  • Analyse and profile our supporter base to make sure we are communicating with you in a relevant and proportionate way

  • Conduct prospect research to identify people who may have the capacity or inclination to support us more significantly

You have the right to object to any processing based on legitimate interests. See section 9 for your full rights.

Charitable soft opt-in (electronic marketing to existing supporters)

Since 5 February 2026, charities in the UK have been able to send electronic marketing - including emails, texts and social media direct messages - to people who have previously expressed an interest in, or offered support to, our charitable purposes, without needing to obtain consent first. This is known as the charitable soft opt-in.

This means that if you have donated to, volunteered with, or otherwise shown an interest in IAPWA's work, we may contact you by email or text to share information about our work, campaigns and fundraising - even if you have not explicitly opted in to marketing, unless you have told us you do not wish to hear from us.

You can opt out of receiving these communications at any time by using the unsubscribe link in any email or by contacting us directly (see section 10)

Contract

Where you purchase merchandise or register for an event, we process your information as necessary to fulfil that agreement.

Legal obligation

We may be required to retain certain information by law - for example, financial records must be kept for six years.


5. How do we use your personal information?

Volunteering and community support

To enable you to assist us with volunteering, fundraising and other activities, and to keep you informed about our work and how others can get involved.

Marketing and fundraising communications

To send you information about our work, campaigns, events and fundraising - including how to Gift Aid your donations. We may also use your information to administer events and to produce fundraising materials, including photographs and videos where consent has been given.

Where we contact you by post, we do so on the basis of legitimate interests. You can ask us to stop at any time.

Where we contact you by email or text, we do so either on the basis of your consent or (from February 2026) through the charitable soft opt-in - see section 4.

Supporter research, profiling and segmentation

To help us communicate with you in a relevant and proportionate way, we may use your information to build a profile of our supporter base. This may include:

  • Analysing your donation history, preferences and interests

  • Using publicly available information - such as addresses, Companies House or Charity Commission records, newspaper articles, social media posts, or typical earnings in an industry - to build a fuller picture of who our supporters are

  • Assessing whether it may be appropriate to ask someone to consider increasing their giving, or leaving us a legacy

  • Using geo-demographic data and measures of affluence to tailor our approaches

  • Tracking whether our emails are opened and links clicked, to help us improve our communications

We rely on legitimate interests as our lawful basis for this processing. We always carry out a Legitimate Interests Assessment before doing so. You have the right to object to this use of your data at any time - see section 9.

We may use third-party suppliers to assist with profiling. These suppliers act as data processors on our behalf and are only provided with the personal information necessary to complete that task. They are not permitted to use your information for any other purpose.

Legacies

If you tell us you intend to leave IAPWA a legacy, we will record this and administer it accordingly.

Retail

To fulfil orders for merchandise, whether purchased online or in person.

Research

To conduct or fund research into IAPWA's projects or into supporter attitudes and experiences.

Operations and legal compliance

To communicate with you about our activities and objectives, to verify your identity, to evaluate and improve our programmes and services, and to comply with any legal obligations.

6. How long do we keep your information?

We do not keep your personal information for longer than is necessary. These are our general retention periods:

  • Financial, accounting and Gift Aid records (including donation records and Gift Aid declarations)

    6 years, or for as long as required to meet applicable legal, accounting, tax or regulatory requirements

  • Active supporter contact and engagement records

    For as long as you maintain an active relationship with us, subject to regular review

  • Lapsed supporter contact and engagement records

    Generally up to 3 years after your last meaningful engagement with us, after which information we no longer need will be securely deleted or anonymised

Where information is no longer required in an identifiable form, we may anonymise it so that it can no longer be linked to an individual. We may retain anonymised information for longer for purposes such as analysing our impact, reporting and statistical analysis.

7. Who do we share your information with?

We will never sell, trade or rent your personal information to any third party.

We may share your personal information with:

  • Service providers who carry out functions on our behalf - for example, mailing houses, event platforms, payment processors, IT support, or profiling and research suppliers. These organisations act as data processors, meaning they can only use your information for the specific purpose we have engaged them for, and are contractually bound to handle it securely.

  • Third-party fundraising platforms such as JustGiving, where you choose to donate via those services.

  • Regulatory bodies or law enforcement agencies, where we are legally required to disclose information.

8. How do we keep your payment information secure?

Online donations are processed securely through our payment provider. We do not store your full card details on our own systems.

Offline donations made by cheque, direct debit or card are processed securely, either by IAPWA directly or by our trusted payment processors. Any card details provided over the phone are held only for as long as it takes to process your payment, and are then securely deleted.

9. Your rights

Under UK data protection law, you have a number of rights in relation to your personal information. These are:

  • Right of access

    You can request a copy of the personal information we hold about you (known as a Subject Access Request).

  • Right to rectification

    If any of the information we hold about you is inaccurate or incomplete, you can ask us to correct it.

  • Right to erasure

    You can ask us to delete your personal information. Where we agree to do so, we will remove your identifiable data but retain a suppression record to ensure we do not contact you again. In some cases, we may be legally required to keep certain information - for example, financial records.

  • Right to restrict processing

    You can ask us to pause processing of your information in certain circumstances - for example, while you contest its accuracy.

  • Right to data portability

    Where we are processing your information on the basis of consent or a contract, and processing is carried out by automated means, you may ask us to provide your data in a structured, machine-readable format.

  • Right to object

    You have the right to object to us processing your personal information where we rely on legitimate interests as our lawful basis - including for profiling, prospect research, and postal marketing. If you object, we will stop processing your information for that purpose unless we can demonstrate compelling legitimate grounds that override your interests.

  • Rights related to automated decision-making

    You have the right not to be subject to a decision made solely by automated means that has a legal or similarly significant effect on you. We do not currently make any such decisions about our supporters.


To exercise any of these rights, please contact us at enquiries@iapwa.org or write to us at 1B Rudds Lane, Haddenham, Aylesbury, Bucks, HP17 8JP, UK. We may ask you to verify your identity before we can action your request.

10. How to stop hearing from us

You can opt out of any marketing communications at any time by using the unsubscribe link in any email we send you, or by emailing enquiries@iapwa.org.

We will action your request as soon as possible. Once you opt out, we will retain a suppression record to make sure we do not contact you again by that channel.

11. How we keep your information secure

We take the security of your personal information seriously. We take reasonable and appropriate steps to protect it from unauthorised access, loss, misuse or disclosure, including:

  • Restricting access to personal information to those within IAPWA who have a genuine need to see it

  • Storing records containing personal information securely, whether in physical or electronic form

  • Using secure, reputable systems and service providers

No transmission of data over the internet can be guaranteed to be completely secure. While we take all reasonable precautions, you send information to us online at your own risk. Once we receive your data, we make every effort to keep it secure.

Where we no longer need personal information and are not required by law to keep it, we will securely destroy or anonymise it.

12. Cookies and website tracking


Our website uses cookies - small text files placed on your device - to help the site function and to understand how it is used. This site is also protected by reCAPTCHA; Google's Privacy Policy and Terms of Service apply.

13. Complaints and how to contact the ICO

If you have a concern about how we handle your personal information, please contact us first at enquiries@iapwa.org and we will do our best to resolve it.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), which is the UK's independent data protection regulator.

You can contact the ICO at:

  • Website: ico.org.uk

  • Helpline: 0303 123 1113

  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF