Privacy Policy

1. Who we are

This website is operated by STXBP1 UK Foundation. When we refer to “we”, “us”, or “our” in this policy, we mean STXBP1 UK Foundation.

If you have questions about this policy or how we handle your data, please contact us at hello@stxbp1.co.uk.

2. What data we collect

We may collect the following personal data when you use our website:

• Contact information — name, email address, and any message content when you submit our contact form.
• Donation information — including Gift Aid eligibility details (name and address), collected separately from payment card data, which we never see or store.
• Usage data — pages visited, time spent, and browser/device information via analytics (if enabled).
• Cookies — session cookies for functionality and, with your consent, analytics cookies.

3. How we use your data

We use the data we collect to:

• Respond to enquiries and process donations.
• Send confirmation and transactional emails related to your enquiry or donation.
• Reclaim Gift Aid on eligible donations from HMRC.
• Improve the website and understand how visitors use it.
• Meet our legal and charity regulatory obligations.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal basis (UK GDPR)

We process your data under the following lawful bases:

• Legal obligation — to reclaim Gift Aid, which requires HMRC to be able to verify donor details.
• Legitimate interests — to respond to enquiries and improve our service.
• Consent — for non-essential cookies, where you have opted in.

6. Third-party services

We use the following third-party services that may process your data:

• Sanity — our content management system, used to store news, stories and resources.
• Resend — transactional email delivery.
• Vercel — website hosting and edge delivery.
• Our online payment provider — to be confirmed once donations go live. This policy will be updated at that time.

7. How long we keep your data

We retain donation records for at least 6 years to meet Gift Aid and charity accounting obligations. Enquiry data is retained for as long as needed to respond, then deleted. Analytics data is retained for up to 14 months.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request erasure of your data.
• Object to or restrict processing.
• Lodge a complaint with the ICO at ico.org.uk.

To exercise any of these rights, email us at hello@stxbp1.co.uk.

9. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last revised. Continued use of the site after changes constitutes acceptance of the updated policy.