Privacy Policy
Legal Information
Last updated: 28th May 2026
We are firmly committed to protecting your privacy. We aim to be clear about the information we collect, why we collect it, and to use it only in ways you would reasonably expect.
In this Privacy Policy, “We”, “Us” and “Our” refer to The Karuna Trust, a charity registered in England and Wales (charity number 327461) and a company limited by guarantee (company number 2132178). Our registered office is at 72 Holloway Road, London, N7 8JG.
We are the data controller responsible for the personal information described in this policy. We are registered with the Information Commissioner’s Office (ICO). Registration No. ZA025499
Contents
How we use personal information
Our legal basis for processing personal information
How we collect personal information
The personal information we collect
How we share your personal information
International transfers
Cookies and tracking technologies
Automated decision-making and profiling
How long we keep your personal information
Your rights
Changes to this policy
Contact us
How we Use Personal Information
We will not use your personal information unless we have first told you how we will use it, or it is obvious from the context how we will use it.
We collect and use personal information for the following purposes:
- Fundraising and processing donations
- Supporter development and administration
- Responding to general enquiries
- Volunteer recruitment and administration
- Governance and trustee management
- Employee recruitment and administration
- Improving our website and communications
- Meeting our legal and regulatory obligations
Our legal basis for processing personal information
Under UK GDPR, we rely on one of the following lawful bases for each use of personal information:
- Consent — where we ask for your clear, opt-in agreement (for example, when you sign up to our newsletter or agree to be contacted by post).
- Contract — where we need your information to deliver a service you have asked for (for example, processing a donation or registering you for an event).
- Legitimate interests — where the processing is necessary for our work as a charity and does not override your rights (for example, analysing how our website is used, or contacting existing supporters about our work in a way they would reasonably expect).
- Legal obligation — where we are required to process information by law (for example, Gift Aid records or employment records).
You can withdraw your consent at any time — by contacting us, or by using the unsubscribe link at the bottom of any email.
We process employee personal information to meet our legal obligations as an employer.
How we collect personal information
We collect personal information in a few different ways:
- Directly from you — when you donate, sign up to our newsletter, volunteer, apply for a job, attend an event, contact us, or interact with us on social media.
- From third parties — for example, fundraising platforms (such as JustGiving, Stripe and PayPal), Gift Aid forms, employment references, or publicly available sources where you have chosen to make information public.
- Automatically through our website — through cookies and similar technologies (see “Cookies and tracking technologies” below).
The personal information that we collect
The type and quantity of information we collect, and how we use it, depends on why you are providing it.
For fundraising and processing donations, we collect:
• Your name
• Your contact details
• Your mailing preferences
• Your bank or card details (handled by our payment providers, not stored by us)
For supporter development, we may also collect:
• Your interests
• Your date of birth
• Your occupation
• Information about your demographic background
• Information about your specialities or qualifications
For volunteer recruitment and administration, we collect:
• Your name
• Your contact details
• Your employment history
• Your interests or any information which may support your application
• Your mailing preferences
• Your tax details, date of birth and photo ID (where required)
• Your bank details (for expenses or payments)
• Medical information, which is optional
• Your likeness in an image or video, which is optional
• Any unspent criminal record offences under the Rehabilitation of Offenders Act 1974
For employee recruitment and administration, we collect:
• Your name
• Your contact details
• Your employment history
• Your interests or any information which may support your application
• Your mailing preferences
• Your tax details, date of birth and photo ID
• Your bank details
• Your gender, nationality, ethnicity, religion and whether you have a disability, where we have a legal obligation to record this
• Your spiritual or religious preferences, which are optional and only recorded if volunteered at the point of application
• Medical information, which is optional
• Your spent and/or unspent criminal record offences, under the Rehabilitation of Offenders Act 1974, depending on the role applied for
How we share your personal information
We do not sell your personal information to anyone, and we do not share it with third parties for their own marketing purposes.
We do share information with carefully selected service providers who help us run the charity. These currently include:
- Microsoft (Microsoft 365) — email, document storage, and internal collaboration.
- Blackbaud (Raiser’s Edge NXT) — our supporter and donor database.
- Constant Contact — email marketing and newsletter delivery.
- Dataro – Supporter and donation analytics
- Xero — accounting and financial records.
- Payment providers — such as Stripe and PayPal, for secure donation processing.
- Postal and print partners — for postal communications and mailings.
- Our payroll and pensions providers — for staff records and salary administration.
- Professional advisers — including auditors, legal and HR advisers, where necessary.
All of these processors are bound by data processing agreements that require them to keep your information secure and to use it only as we instruct.
We may also share information where we are required to do so by law (for example, with HMRC for Gift Aid claims), or where it is necessary to protect someone’s vital interests.
International transfers
Some of the service providers above (notably Microsoft, and some analytics and marketing providers) store or process personal data outside the UK.
Where this happens, we make sure appropriate safeguards are in place. These typically include:
- UK International Data Transfer Agreement (IDTA) — or the UK Addendum to the EU Standard Contractual Clauses.
- An adequacy decision — where the UK government has recognised the receiving country as offering an equivalent standard of data protection.
If you would like more information about a specific transfer or safeguard, please contact us using the details at the end of this policy.
Cookies and tracking technologies
Our website uses cookies and similar technologies to help it work, to understand how it is used, and to support our fundraising.
A cookie is a small text file stored on your device when you visit a website. We use both first-party cookies (set by us) and third-party cookies (set by services we use).
We group cookies into four categories:
- Strictly necessary — required for the site to function (for example, remembering that you have accepted the cookie banner). These do not require your consent.
- Analytics — help us understand how visitors use the site, so we can improve it. Set only with your consent.
- Marketing — help us measure and improve our fundraising and outreach. Set only with your consent.
- Functional — improve your experience using the site, such as embedded video or social media content. Set only with your consent.
The third-party tools that may set cookies or collect information through our website currently include:
- Google Tag Manager (used to manage other tracking scripts)
- Google Analytics
- Facebook Pixel
- Brevo (newsletter sign-up and email engagement)
- Blackbaud (donation forms and supporter engagement)
You can review and change your cookie preferences at any time using the cookie settings link in the footer of our website. You can also block or delete cookies through your browser settings, though some parts of the site may not work as expected if you do.
Automated decision-making and profiling
We may use information about your supporter history — such as donation patterns or engagement with our communications — to help us understand which messages and appeals are most relevant to you. This is sometimes called “profiling”.
We do not make decisions that produce legal or similarly significant effects on you using fully automated processing.
You can ask us to stop profiling your information for marketing purposes at any time.
How long we keep your personal information
We keep personal information only for as long as we need it for the purposes set out in this policy, or for as long as the law requires.
Our standard retention periods are:
- Donor and Gift Aid records — at least 7 years from the end of the relevant tax year (HMRC requirement).
- Supporter contact details and engagement history — until you ask us to stop, or until our records show you have not engaged with us for an extended period.
- Volunteer records — for the duration of your volunteering, plus a defined period afterwards.
- Unsuccessful job applicant records — typically 6 months.
- Employee records — for the duration of employment, plus 6 years afterwards (for legal and HMRC purposes).
- Website analytics data — typically up to 26 months.
- Marketing consents — until you withdraw them.
When the retention period ends, we either delete or securely anonymise the information.
Your rights
Under UK data protection law, you have several rights in relation to your personal information:
- The right to be informed — to know what information we hold and how we use it.
- The right of access — to ask for a copy of the personal information we hold about you.
- The right to rectification — to ask us to correct anything that is inaccurate or incomplete.
- The right to erasure — to ask us to delete your personal information where there is no good reason for us to keep it.
- The right to restrict processing — to ask us to pause processing while we resolve a query.
- The right to data portability — to receive your information in a portable format, or have it transferred to another organisation.
- The right to object — to ask us to stop processing your information, particularly for direct marketing.
- Rights relating to automated decision-making — to ask us not to make purely automated decisions about you.
These rights are subject to certain legal exceptions and exemptions.
To exercise any of these rights, please contact us using the details below. We will respond within one month.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe we have not handled your personal information properly. You can contact the ICO at ico.org.uk, by phone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top of the page will always show when it was most recently revised.
If we make significant changes to how we use your personal information, we will let you know directly — by email, post, or a prominent notice on our website.
Contact
If you have any questions, concerns, or requests about this policy or your personal information, please get in touch:
- Email: info@karuna.org
- Phone: 020 7700 3434
- Post: The Karuna Trust, 72 Holloway Road, London, N7 8JG
We will treat any enquiry with care, and respond as quickly as we can.
