Privacy Policy

Effective from: 1st June 2026

KND Community Organisation (“KND”, “we”, “us”, or “our”) respects your privacy. This policy explains how we collect, use, and protect your personal information when you use our services, website, or volunteer with us. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to service users, volunteers, donors, website visitors, and anyone who contacts us for advice or support. Please read it carefully. If you have questions, you can contact our Data Protection Officer at [enter email] or by post at the address below.

Information We Collect

We collect different types of information depending on how you interact with KND.

Basic contact information includes your name, email address, phone number, and postal address. We collect this when you sign up for services, volunteer, donate, or subscribe to our newsletter.
Health and wellbeing information is collected only when you join a support group, mentorship programme, or coaching session. This may include details about your long-term illness, mental health challenges, or recovery goals. We treat this as special category data under UK GDPR.
Usage data includes how you use our website, such as pages visited and time spent. We collect this through cookies. You can manage cookie preferences in your browser.
Payment information is collected if you donate online. We do not store full payment card details. Our payment processors handle that securely.
Communication records include emails, messages through our contact form, and notes from advice sessions. We keep these to provide better support.

How We Use Your Information

We use your information only for lawful purposes under UK GDPR. The main purposes are listed below.

To provide services such as support groups, coaching, mentorship, and wellbeing workshops. This includes matching you with volunteers or peer supporters.
To communicate with you about appointments, programme updates, or changes to services. We may also send volunteer rotas or donation receipts.
To improve our charity by analysing anonymised data. This helps us understand what works and where we need more resources.
To comply with legal obligations including safeguarding, health and safety, and charity reporting requirements.
To process donations and issue gift aid declarations to HMRC. We keep donation records for seven years as required by UK charity law.

We never sell your personal data to third parties. We never share your health data without explicit consent unless required by law.

Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases for different types of processing.

Consent is used when you voluntarily join a support group or share health information. You can withdraw consent at any time by emailing info@domain.com.
Contractual necessity applies when you enrol in our 24 month programme. We need your information to deliver the services you requested.
Legal obligation applies to safeguarding reports, HMRC gift aid claims, and certain health and safety records.
Legitimate interests applies to anonymised data analysis, internal training, and fraud prevention. We always balance our interests against your privacy rights.
Vital interests applies in rare emergency situations where we believe you or someone else is at serious risk.

Sharing Your Information

We share your information only when necessary and always with appropriate safeguards.

With healthcare partners only if you give explicit written consent. For example, we may share progress notes with your GP or mental health team if you ask us to.
With volunteer buddies only the basic information needed for them to support you. This may include your first name and preferred contact method. Volunteers sign confidentiality agreements.
With service providers who help us run the charity, such as email platforms, payment processors, or website hosts. These providers are contractually bound to protect your data and cannot use it for their own purposes.
With legal authorities if required by law. This includes safeguarding concerns, court orders, or prevention of serious crime.

We never share your data for marketing purposes. We never sell or rent your information to any organisation.

Data Retention

We keep your information only as long as necessary for the purposes described in this policy.

Service user records are kept for seven years after your last interaction with KND. This is standard practice for UK charities offering health related support.
Volunteer records are kept for six years after your last volunteer shift. This aligns with employer reference and insurance requirements.
Donation records are kept for seven years to comply with HMRC gift aid rules.
Enquiry and advice session notes are kept for two years. If you do not become a service user, we delete your information after 24 months.
Website usage data is anonymised after 26 months. Raw logs are deleted monthly.

You can request deletion of your data at any time, subject to legal retention requirements. Email info@domain.com.

Your Rights

Under UK GDPR, you have the following rights regarding your personal data.

Right to access – You can request a copy of all information we hold about you. We will respond within 30 days.
Right to rectification – You can correct inaccurate or incomplete information.
Right to erasure – You can request deletion of your data where no legal obligation requires us to keep it.
Right to restrict processing – You can ask us to stop using your data while we resolve a dispute.
Right to data portability – You can request your data in a machine readable format to transfer to another organisation.
Right to object – You can object to processing based on legitimate interests, including direct marketing.
Rights related to automated decision making – We do not use automated decision making or profiling that significantly affects you.

To exercise any of these rights, email info@domain.com. or write to the address in Section 11. We do not charge a fee unless the request is manifestly unfounded or excessive.

Cookies and Website Tracking

Our website uses essential cookies to function properly. These include session cookies and security cookies. You cannot turn these off without breaking the website.

We also use analytics cookies to understand how visitors use our site. This helps us improve content and navigation. Analytics data is anonymised and does not identify you personally.

You can manage non-essential cookies through your browser settings. Most browsers allow you to block third party cookies or delete existing ones.

We do not use advertising cookies or trackers. We do not share browsing data with advertising networks.

For more details, see our full Cookie Policy available on our website.

Security of Your Data

We take data security seriously. Your trust is everything to us.

All digital data is stored on encrypted servers based in the United Kingdom. Access is restricted to staff members who need it to perform their roles. We use strong passwords and two factor authentication.

Paper records are kept in locked cabinets in locked offices. Only authorised staff have keys. Paper records are shredded using a cross cut shredder when no longer needed.

Our website uses SSL encryption (HTTPS). Any form you submit is encrypted during transmission.

We train all staff and volunteers on data protection annually. Breach reporting procedures are in place. If a data breach occurs that risks your rights and freedoms, we will notify you and the Information Commissioner’s Office within 72 hours.

Children and Vulnerable Adults

KND serves adults aged 18 to 65. We do not knowingly collect data from children under 18.

If you are a vulnerable adult, we take extra care to ensure you understand how your data is used. We explain this policy in plain language during your first session. You can ask for a supporter, carer, or family member to be present during any data related discussion.

Safeguarding concerns override privacy in emergency situations. If we believe you or another person is at risk of serious harm, we may share information with relevant authorities without prior consent. We will always tell you afterwards unless doing so would increase risk.

Changes to This Privacy Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated effective date.

If we make material changes that affect how we use your data, we will notify you directly by email or post. For minor changes such as clarity improvements, we will simply update the website.

Please check this page occasionally. Continued use of our services after changes constitutes acceptance of the updated policy.

Contact Information

If you have any questions about this privacy policy or how KND handles your data, please contact us.

Data Protection Officer:

KND Community Organisation

Address:

Email:

Phone:

Information Commissioner’s Office (ICO) – You have the right to lodge a complaint with the UK supervisory authority. Visit ico.org.uk or call 0303 123 1113.

We would appreciate the chance to resolve any concerns before you contact the ICO. Please reach out to us first.