Privacy Notice
Who we are
Chance for Childhood is a registered charity in England and Wales (charity number 1013587) and a company limited by guarantee (company number 2735643). Our registered address is 48 High Street, Hemel Hempstead, Hertfordshire, HP1 3AF. Our correspondence address is Chance for Childhood, PO Box 82209, London, EC1P 1HL.
We work with children living with disabilities across Ghana, the Democratic Republic of Congo (DRC), Rwanda, Kenya and Uganda. This privacy notice explains how we collect, use, store, and protect personal data about our supporters, donors, beneficiaries, partner organisations, and anyone else whose data we process in the course of our work.
This notice is written in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the Data (Use and Access) Act 2025. Where we collect and process personal data in our programme countries, we also comply with applicable local data protection legislation.
Chance for Childhood is registered with the Information Commissioner’s Office as a data controller, registration number ZA387528
Chance for Childhood is not legally required to appoint a Data Protection Officer. However, responsibility for overseeing data protection has been assigned to Matt Zeqiri, the Head of Fundraising and Communications.
For any questions about how we handle your personal data, or to exercise any of your data protection rights, please contact:
Email: supportercare@chanceforchildhood.org
Phone: 01483 230 250
Post: Chance for Childhood, PO Box 82209, London, EC1P 1HL
What personal data we collect
We collect only the personal data that is necessary for the purposes described in this notice. The data we hold depends on your relationship with us.
Donors and supporters
When you donate to us, sign up for communications, attend an event, or otherwise support our work, we may collect your name, postal address, email address, telephone number, date of birth, payment information (including bank details for direct debits and card details for online donations), Gift Aid declarations, communication preferences, and donation history. For payroll giving, we may also collect your employer name and payroll reference.
Website visitors
When you visit our website, we collect technical data including your IP address, browser type and version, device information, pages visited, time spent on pages, and referral source. We also use cookies and similar technologies. See section 12 for full details.
Beneficiaries and programme participants
Through our programmes, we collect personal data about the children and families we work with. Depending on the programme, this may include names, ages or dates of birth, location, family composition, education status, safeguarding records or concerns, programme participation and outcomes data, photographs, video or audio recordings, and case study narratives or quotes.
Through our Disability Detect platform, we collect screening and assessment information to help identify children who may require further assessment or support. This includes information relating to disability type and severity, and health.
Some of the data collected through both our programmes and Disability Detect, particularly information relating to disability, health, and safeguarding, constitutes special category personal data under UK GDPR. We process special category data only where strictly necessary and with enhanced protections in place.
Children
We recognise that we hold data on children, many of whom have disabilities, and we take particular care with this information. Where we collect data on children under the age of 13, we obtain consent from a parent or guardian. Children aged 13 and above may consent to the use of their image and story themselves, alongside parental or guardian involvement where appropriate. We provide privacy information in a form and language that is accessible and understandable to children and their families in each country where we operate.
Trustees, ambassadors, and volunteers
We hold the names, email addresses, photographs, role descriptions, and biographical information of our trustees, ambassadors, and volunteers for governance, communications, and operational purposes.
In-country partners and their staff
We hold professional contact details and, where required, safeguarding training records and financial information related to grant management for staff and representatives of our partner organisations. This data is held for partnership management, governance and reporting purposes.
Job applicants and employees
When you apply for a role with us, we collect the information contained in your application, including your CV, cover letter, employment history, qualifications, references, and any equal opportunities monitoring information you choose to provide.
If you become an employee, we will collect and hold additional personal data necessary for the employment relationship. This may include contact details, emergency contact information, payroll and pension information, right to work documentation, performance and training records, absence records, disciplinary and grievance records, and information required to meet our legal, safeguarding, and employment obligations. Where necessary, we may also process special category personal data in accordance with applicable data protection law.
Event participants
When you take part in a fundraising event or other activity, we collect your name and email address for event administration purposes.
How we collect personal data
We collect personal data in the following ways: directly from you when you make a donation, sign up for our newsletter, register for an event, contact us, or apply for a role; through our website when you browse our pages (via cookies and analytics tools); through our digital programme tools such as Disability Detect when data is collected in the course of programme delivery; through third-party fundraising platforms such as JustGiving and CAF; and from publicly available sources where we carry out prospect research (see section 6 for details).
Why we process your personal data and our lawful basis
We only process personal data where we have a lawful basis to do so under UK GDPR. The table below sets out our purposes and the corresponding lawful basis for each.
Purpose | Lawful basis |
Processing donations and Gift Aid
| Contract (to process and administer your donation) and Legal obligation (Gift Aid reporting to HMRC)
|
Sending fundraising communications to supporters by electronic means (email, SMS)
| Consent
|
Sending fundraising communications by post | Legitimate interests (our interest in raising funds to support our charitable work, balanced against your right to privacy)
|
Programme delivery, monitoring, and evaluation
| Legitimate interests (our interest in delivering effective programmes for children with disabilities)
|
Processing beneficiary disability and health data through Disability Detect and other programme tools
| Explicit consent, or substantial public interest (Article 9 (2) (g) UK GDPR and Schedule 1, Part 2, DPA 2018)
|
Safeguarding
| Legal obligation, and vital interests (to protect children and vulnerable individuals from harm)
|
Storytelling, case studies, and imagery
| Explicit consent (documented through our imagery consent process)
|
Website analytics and performance monitoring
| Consent
|
Recruitment and employment
| Contract and legal obligation
|
Grant reporting to institutional funders
| Contract and legitimate interests
|
Compliance with anti-money laundering and counter-terrorism financing requirements
| Legal obligation
|
Prospect research and wealth screening using publicly available sources
| Legitimate interests
|
Where we rely on legitimate interests as our lawful basis, we consider the impact of our processing on your rights and freedoms and seek to ensure that our interests do not override them. You can contact us if you would like further information about how we have assessed our legitimate interests.
Where we rely on consent, you can withdraw your consent at any time by using the unsubscribe link in our emails or by contacting us. Withdrawing consent or opting out will not affect the lawfulness of any processing carried out before your request.
Imagery, storytelling, and ethical content
As an international development organisation working with children, we take particular care with how we collect and use photographs, video, audio recordings, and personal stories from the communities we work with.
Before photographing or filming any beneficiary, we obtain informed consent through a written consent form. For children under the age of 13, consent is obtained from a parent or guardian. For children aged 13 and above, the child themselves may consent alongside parental or guardian involvement. Consent forms are available in English and are translated into local languages at the point of use.
Consent is obtained for specific uses. Our consent form sets out whether an image or story may be used on our website, social media, annual report, printed materials, press releases, or media coverage. Consent remains valid until withdrawn.
You can withdraw consent for the use of your image or story at any time by contacting us. Where consent is withdrawn, we will take reasonable steps to remove the image or story from our active communications, though we may not be able to retrieve materials already distributed in print or shared by third parties.
Where media organisations, institutional funders, or partner organisations wish to use imagery from our work, they may do so only with our express permission and subject to restrictions on use.
Chance for Childhood has an ethical imagery policy that governs how we depict the children and communities we work with. We are committed to representing people with dignity, agency, and accuracy, and we do not use images that stereotype, sensationalise, or exploit vulnerability. We do not use AI-generated imagery of children.
Who we share your personal data with
We do not sell your personal data to any third party. We may share your data with the following categories of organisation where necessary for the purposes described in this notice.
Service providers and data processors: We use third-party organisations to help us deliver our work. These organisations process data on our behalf and under our instructions. They include Beacon (our CRM and donor management system), Mailchimp (email marketing), Donor platforms such as CAF, Givestar, Charities trust, Enthuse Charitable Giving, Paypal giving and Stripe (payment processing), Access (finance software), Doshi Accountants (accountancy services), NEST (workplace pension provider), and Microsoft (OneDrive and Microsoft 365 for cloud storage and collaboration).
Institutional funders and grant-makers. We may share programme data with our institutional funders where required for grant reporting and compliance purposes. This will usually consist of aggregated or anonymised information. Where identifiable photographs, stories or other personal data are shared, we will do so only where appropriate consent has been obtained or another lawful basis applies.
Regulatory bodies and authorities. We may share data with the Charity Commission, HMRC (for Gift Aid), the Information Commissioner’s Office, and other regulatory bodies where required by law.
Safeguarding authorities. Where a safeguarding concern arises, we may share personal data with local authorities, police, or child protection agencies in the relevant country in order to protect children and vulnerable individuals from harm.
Professional advisors. We may share data with our auditors and legal advisors where necessary for governance and compliance purposes.
Prospect research and wealth screening
We may use publicly available information to help us understand more about our supporters and identify individuals who may be willing and able to support our work. This may include searching public records such as Companies House, LinkedIn profiles, published lists and articles, and property information. We do this to ensure that our fundraising is efficient, that we approach supporters with appropriate and relevant requests, and that we make the best use of our charitable resources.
This research is carried out in-house by our fundraising team. We do not use third-party wealth screening services.
If you would prefer us not to carry out this research in relation to your data, you can let us know at any time by contacting us using the details in section 14, and we will stop.
International data transfers
Chance for Childhood UK determines how and why beneficiary personal data is processed across our programmes. Our country offices and programme partners process personal data in accordance with our policies, procedures and data protection requirements.
Transfers to and from programme countries
Personal data, including beneficiary information, programme records and safeguarding data, is transferred between the UK and our programme offices in Ghana, the Democratic Republic of Congo, Rwanda, Kenya and Uganda. Data is transmitted via email, SharePoint and other organisational platforms. Staff in both the UK and programme countries have access to this data where necessary for their roles.
Where personal data is transferred between the UK and our programme countries, we apply appropriate organisational, technical and contractual safeguards to protect it in accordance with UK data protection law. These include access controls, encryption where appropriate, staff training, and data sharing arrangements with programme offices and partners.
Transfers to technology providers
We use a number of third-party technology providers to support our operations, including Microsoft (for cloud storage and collaboration), Mailchimp (for email marketing), Google Analytics (to help us understand how visitors use our website), and online payment providers such as PayPal and Stripe. Some of these providers may process personal data outside the UK.
Where personal data is transferred to a US-based technology provider, we use an appropriate transfer mechanism in accordance with UK data protection law. Where the relevant provider has an active certification under the UK Extension to the EU-US Data Privacy Framework and the transfer is covered by that certification, we may rely on the UK Extension. Where the UK Extension does not apply, we use another lawful transfer mechanism or safeguard where required.
Further information about the technologies we use on our website is provided in section 12, Cookies and website tracking.
How long we keep your personal data
We keep personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. The table below sets out our indicative retention periods.
Data category | Retention period
| Reason for retention |
Donor and supporter financial records
| 7 years from last transaction
| Financial reporting, audit, accounting and applicable tax requirements, including the need to retain records to support financial transactions and Gift Aid claims. |
Gift Aid declarations | 6 years after the end of the relevant tax year | HMRC/Gift Aid record-keeping requirements |
Supporter contact data | Duration of active relationship plus 2 years | To maintain an appropriate record of our relationship with supporters, manage communications and preferences, and address potential queries or disputes after the active relationship ends. |
Beneficiary programme data | Duration of programme plus period required by funder for evaluation and audit purposes (typically between 5 and 7 years) | Programme monitoring and evaluation, contractual and reporting requirements of funders, audit and accountability requirements, and the need to evidence programme delivery and outcomes. |
Safeguarding records | 7 years after case closure, or longer where justified | To protect children and vulnerable individuals, support safeguarding investigations and follow-up, meet legal and regulatory obligations, and protect individuals and the organisation where records may be needed in connection with serious safeguarding matters. |
Imagery and associated consent records | Until consent is withdrawn and a reasonable period after to allow removal from active use.
| To manage the use of imagery and stories, demonstrate the basis on which consent was obtained, and administer requests to withdraw consent and remove material from active use.
|
Job application data (unsuccessful candidates) | 6 months after recruitment decision | To administer recruitment, deal with queries or complaints about the recruitment process, and defend potential legal claims. |
Employee records | 6 years after end of employment. | Employment administration, legal and regulatory obligations, tax and payroll requirements |
Legacy pledges and administration | Pledges will be kept for as long as the relationship is active. |
|
Legacy Payments | 6 years from end of financial year. Executor/third party correspondence may be held for the duration of estate administration plus some reasonable time thereafter for potential claims. | Administration and audit of the legacy, accounting and tax requirements, and the need to retain records for potential legal or financial queries and claims. |
Website analytics data | 14 months (GA4 default setting) | To understand website use and performance, produce analytics and improve our website, subject to the applicable consent requirements for analytics cookies. |
Trustee and volunteer records | 7 years after the trustee’s term or volunteer engagement ends, unless a longer retention period is required for legal, regulatory, safeguarding, insurance, audit, or governance purposes.
| To administer governance and volunteering relationships, maintain appropriate organisational records, meet legal or regulatory requirements and deal with potential claims or disputes. |
We review the data we hold on a regular basis and securely delete or anonymise data that is no longer needed.
Your data protection rights
Under UK data protection law, you have the following rights in relation to your personal data.
The right to be informed – this notice fulfils our obligation to tell you how we use your data.
The right of access – you can ask us for a copy of the personal data we hold about you (a subject access request). We will respond within one month of receiving your request. Where a request is particularly complex, we may extend this by a further two months, but we will let you know within the first month if this is the case and explain why.
The right to rectification – you can ask us to correct any personal data that is inaccurate or incomplete.
The right to erasure – you can ask us to delete your personal data in certain circumstances. This right is not absolute and may not apply where we have a legal obligation to retain the data, or where it is necessary for safeguarding purposes.
The right to restrict processing – you can ask us to limit the way we use your data in certain circumstances.
The right to data portability – you can ask us to provide your data in a structured, commonly used, machine-readable format, or to transfer it to another organisation, where technically feasible.
The right to object – you can object to our processing of your data where we rely on legitimate interests as our lawful basis. You have an absolute right to object to the use of your data for direct marketing at any time.
Rights in relation to automated decision-making – you have the right not to be subject to decisions made solely by automated processing that produce legal effects or similarly significant effects on you. Chance for Childhood does not currently use automated decision-making of this kind.
To exercise any of these rights, please contact us using the details below. We will respond within one month. In some cases, we may ask you for additional information to verify your identity before processing your request.
Rights for beneficiaries in programme countries.
We recognise that exercising data protection rights can be more difficult for beneficiaries in our programme countries. If you are a beneficiary or the parent or guardian of a child in one of our programmes and you wish to access, correct, or request the deletion of personal data, you can make your request through your local Chance for Childhood programme office, through a partner organisation, or directly to our UK office. We will provide assistance in local languages where needed.
Data protection complaints
If you are unhappy with how we have handled your personal data, we want to hear from you. You can make a data protection complaint by contacting us at:
Email: supportercare@chanceforchildhood.org
Post: Chance for Childhood, PO Box 82209, London, EC1P 1HL
We will acknowledge your complaint when we receive it and aim to provide a full response within one month. If we need to conduct a more in-depth investigation, we will let you know and aim to resolve the matter as quickly as possible.
If you are not satisfied with our response, you have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s independent supervisory authority for data protection.
Information Commissioner’s Office
Website: ico.org.uk
Telephone: 0303 123 1113
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
How we keep your personal data safe
We take the security of your personal data seriously. We use appropriate physical, technical, and organisational measures to protect your data from unauthorised access, loss, or misuse. These measures include access controls so that data is only available to staff who need it for their work, encryption of data in transit and at rest, staff training on data protection and information security, secure storage of physical records, and regular review of our security practices.
Chance for Childhood holds Cyber Essentials certification.
Where personal data is stored or processed in our programme countries, we apply security protocols appropriate to the local context, including device-level protections and access restrictions.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of the breach. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
Cookies and website tracking
Our website uses cookies and similar technologies. Cookies are small text files placed on your device that help us understand how you use our website and improve your experience.
Strictly necessary cookies are required for the website to function and cannot be switched off. They include cookies that remember your cookie consent preferences.
Analytics cookies help us understand how visitors use our website. We use Google Analytics 4 for this purpose. GA4 is configured so that full IP addresses are not retained in analytics reports. Analytics data is transferred to Google’s servers in the United States; Google LLC is certified under the EU-US Data Privacy Framework, and the UK Extension to the DPF covers this transfer. Analytics data is retained for 14 months.
Marketing cookies are used to deliver relevant advertising and to measure the effectiveness of our campaigns. We use the Facebook Pixel, which allows us to show targeted content to visitors on Facebook and Instagram and to measure how people interact with our website after seeing our social media advertising. The Facebook Pixel shares data with Meta Platforms, Inc., which is based in the United States and is certified under the EU-US Data Privacy Framework. No non-essential marketing cookies are set unless you have given your consent through our cookie banner.
When you first visit our website, you will be asked to choose which cookies you accept. You can accept all cookies, reject all non-essential cookies, or choose which categories to allow. You can change your preferences at any time.
Changes to this notice
We may update this privacy notice from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Where we make material changes, we will take reasonable steps to inform you, for example by posting a notice on our website or emailing you directly.
This notice was last updated in August 2026
Contact us
If you have any questions about this privacy notice, about how we handle your personal data, or if you wish to exercise any of your data protection rights, please contact:
Email: supportercare@chanceforchildhood.org
Phone: 01483 230 250
Post: Chance for Childhood, PO Box 82209, London, EC1P 1HL
If you are not satisfied with our response, you can contact the Information Commissioner’s Office:
Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF