STEP Foundation: Privacy Notice

STEP Foundation ("STEP Foundation," "we," "us," "our") is a registered charity in England and Wales (Charity Registration Number 1216644), registered office at 61 Bridge Street, Kington, Herefordshire, HR5 3DJ. We are the "data controller" for the personal data described in this notice.

If you have questions about this notice or how we handle your data, contact us at:
Email: info@step-foundation.org.uk
Post: 61 Bridge Street, Kington, Herefordshire, HR5 3DJ

This notice explains how STEP Foundation collects, uses, and protects personal data belonging to:

• Donors and supporters, including people who register interest in STEP Legacy
• Website visitors
• Volunteers
• Event attendees
• Job applicants and employees (see separate Employee Privacy Notice)
• Beneficiaries and partner organisations (see Section 8)

Depending on how you interact with us, we may collect:

3.1 Information You Give Us

• Your name, email address and phone number
• Your home address and confirmation that you are a UK taxpayer, if you make a Gift Aid declaration
• If you register interest in STEP Legacy: the amount you have in mind, when you would like to give, how you would like us to contact you, your organisation, and any message you send
• A record of what you agreed to and when, for example your consent for us to contact you, or the exact wording of your Gift Aid declaration
• Communication preferences
• Information provided in emails, forms, or when contacting us

When you donate by card, you enter your card details on the secure payment page of our payment provider, Stripe. They go directly to Stripe and we never see or store your full card number.

3.2 Information Collected Automatically

When you visit our website, our hosting provider automatically records technical information such as your IP address, browser type and the pages requested. This is used only to keep the website running and secure, and is kept for a short period. We do not use analytics or advertising tools to track visitors (see Section 10).

3.3 Information From Third Parties

• Stripe, our payment provider: confirmation of your payment, with your name, email address and billing details
• Publicly available sources (for example, to verify eligibility for certain grants or partnerships, where relevant)

We do not knowingly collect special category data (such as data about health, religion, or ethnicity) unless you provide it to us voluntarily, for example, if you tell us your donation is intended as Zakat or Sadaqah for religious reasons, or you disclose accessibility needs at an event. Where we hold this data, we apply additional safeguards.

We only use personal data where we have a lawful basis to do so under UK GDPR. The table below sets out our main purposes and the lawful basis for each.

Where we rely on legitimate interests, we have considered that our use of your data is proportionate, expected, and does not unreasonably impact your rights. You have the right to object to processing based on legitimate interests (see Section 9).

Where we rely on consent (for example, contacting you about STEP Legacy, or marketing emails to new supporters), you can withdraw consent at any time by unsubscribing or contacting us directly.

If you make a Gift Aid declaration, we use your name, home address, and taxpayer status to make and support the claim with HMRC. You can make a declaration when you donate, or on the thank-you page straight after donating. You can cancel a declaration at any time by emailing us. We are required to keep Gift Aid declarations and associated records for the period specified by HMRC (see Section 11). For more detail on Gift Aid, see our Donation Policy.

We do not sell your personal data. We use a small number of trusted service providers to run our website and services. They act on our instructions under data processing agreements and may not use your data for their own purposes:

We may also share your information with:

• HMRC, for Gift Aid claims
• The Charity Commission and other regulators, where legally required
• Professional advisers (accountants, auditors, legal advisers), where necessary
• Overseas delivery partners, only where necessary to deliver aid (for example, confirming beneficiary eligibility), and only in accordance with a written partnership agreement and appropriate safeguards (see Section 8)
• Law enforcement or regulators, where required by law

We do not share your data with third parties for their own marketing purposes.

Our database is stored in the UK. Some of our service providers (Stripe, Vercel, Resend and Google) are based in, or use systems in, other countries including the United States, so your data may be processed outside the UK. Where this happens, we make sure it is protected to UK standards, relying on UK adequacy regulations (including the UK–US Data Bridge for certified companies) or the UK International Data Transfer Agreement or Addendum.

Because STEP Foundation operates projects in Bangladesh, some personal data relating to project delivery and beneficiaries may also be transferred outside the UK, with appropriate safeguards such as contractual protections consistent with UK data protection law.

Where we or our delivery partners collect personal data from beneficiaries (for example, as part of water, housing, education, or emergency relief projects), we:

• Collect only what is necessary to deliver and monitor the project
• Apply additional care where special category data or data about children is involved
• Require partner organisations to handle this data securely under written agreements
• Apply our Safeguarding Policy where children or vulnerable adults are involved

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure of your data, in certain circumstances
• Restriction of processing, in certain circumstances
• Object to processing based on legitimate interests, including direct marketing
• Data portability, in certain circumstances
• Withdraw consent at any time, where processing is based on consent

These rights are not absolute and are subject to exemptions under UK data protection law. For example, we may need to retain certain financial and Gift Aid records even if you request erasure, in order to comply with our legal obligations to HMRC and the Charity Commission.

To exercise any of these rights, contact us at info@step-foundation.org.uk. We will respond within one month, as required by law.

You also have the right to complain to the Information Commissioner's Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113

We keep cookies to a minimum. We do not use analytics, advertising or tracking cookies, so you won't see a cookie banner on our website.

• Our videos are shown using YouTube's privacy-enhanced mode, which does not store cookies on your device unless you press play.
• When you pay by card, Stripe's payment page uses its own cookies to process your payment securely and prevent fraud.
• Our staff sign-in area uses essential cookies to keep authorised staff signed in. These do not apply to visitors.

See our Cookie Policy for more detail.

We keep personal data only for as long as we need it, and then securely delete it:

Records that have reached the end of their retention period are deleted automatically.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. These include:

• Encrypting data as it travels between your device and our website
• Storing our database in the UK, with access restricted to named staff
• Requiring staff to sign in with a password and a code from an authenticator app (two-factor authentication)
• Recording which staff viewed, changed, downloaded or deleted records
• Using card payment pages provided by Stripe, so we never handle your card details
• Agreements with our service providers requiring them to protect data to an equivalent standard

Our fundraising and marketing activities are not directed at children. Where we hold data about children (for example, through UK youth programmes or overseas project beneficiaries), we apply additional safeguards in line with our Safeguarding Policy, and rely on appropriate lawful bases such as legal obligation, vital interests, or the consent of a parent/guardian where relevant.

We may update this notice from time to time to reflect changes in our practices or the law. The "last updated" date at the top of this notice shows when it was last revised. We encourage you to check this notice periodically.

If you have questions about this notice or how we handle your personal data, contact:

STEP Foundation
61 Bridge Street, Kington, Herefordshire, HR5 3DJ
info@step-foundation.org.uk