Privacy Policy

Policies

Arcangelo Privacy Policy

This version was approved by the Board on 23 February 2026. This Policy will be reviewed at least every 12 months, or sooner if required by changes in law or guidance.

Who We Are

Arcangelo is an independent charity registered in England and Wales (No. 1139783) and a company limited by guarantee registered in England and Wales (No.07299583). For the purposes of data protection law, Arcangelo is the data controller of the personal data described in this policy.

Our Data Protection Officer (DPO) is the Executive Director, currently Julian Forbes.

How to Contact Us

If you would like to:

  • Make an enquiry about data protection
  • Update the information we hold about you
  • Opt out of marketing communications
  • Exercise your data protection rights
  • Make a complaint

Please contact us by email (or by post if you prefer) at the following address:

Data Protection Officer
Arcangelo
℅ Gibbons Mannington Phipps LLP,
82 High St, Tenterden, Kent, TN30 6JG

Email: info@arcangelo.org.uk 

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO). We would, however, appreciate the opportunity to address your concerns before you approach the ICO.

The Information We Collect

We collect personal data that you provide to us when you:

  • Book tickets
  • Make a donation or purchase
  • Join as a Friend/member
  • Sign up to our mailing list
  • Participate in an event

Personal data we collect may include:

  • Full name and title
  • Date of birth
  • Postal address and postcode
  • Email address
  • Telephone number
  • Payment details (processed securely via third-party providers)
  • Gift Aid status
  • Communication preferences

We also collect information relating to your interactions with us, including:

  • Ticket purchases and attendance
  • Membership or donor status
  • Retail purchases
  • Event attendance
  • Correspondence sent or received
  • Records of donations and payment history

We do not knowingly collect unnecessary personal data.

Lawful Basis for Processing

We process your personal data under the following lawful bases under the UK GDPR:

Contract - Where processing is necessary to fulfil a contract with you, such as processing ticket purchases, memberships, or donations.

Legal Obligation - Where we are required to retain records for legal or regulatory purposes, including financial reporting and Gift Aid claims (HMRC requirements).

Legitimate Interests For purposes including:

  • Managing relationships with supporters
  • Improving our services and events
  • Administrative record-keeping
  • Preventing fraud

We ensure that our legitimate interests do not override your rights and freedoms.

Consent Where required by law (for example, certain email marketing communications). You may withdraw your consent at any time.

How We Use Your Information

Depending on your relationship with Arcangelo, we may use your data to:

  • Process bookings, purchases and donations
  • Administer memberships and events
  • Claim Gift Aid
  • Send service communications
  • Send marketing, fundraising or supporter communications 
  • Maintain accurate financial, administrative records and supporter records
  • Improve our provision of activities and your experience
  • Facilitate your participation in our work (where applicable)

We do not sell your personal data.

Marketing Communications

We may contact you by post, telephone, or electronic means depending on:

  • The preferences you have indicated
  • Whether we rely on consent or legitimate interests

Marketing communications may include:

  • News and updates about Arcangelo
  • Fundraising appeals
  • Information about events and products
  • Supporter newsletters

You may opt out of marketing communications at any time by:

  • Clicking the unsubscribe link in emails
  • Contacting us using the details above

CCTV Monitoring

Arcangelo operates Closed-Circuit Television (CCTV) systems at its premises at Container City Building, 48 Trinity Buoy Wharf, London E14 0FN for the purposes of ensuring the safety and security of visitors, staff, volunteers and property, and for the prevention and detection of crime. The lawful basis for processing this personal data is our legitimate interests in maintaining a safe environment and protecting our assets.

CCTV footage may capture images of individuals entering or moving around our premises. Recordings are stored securely, access is restricted to authorised personnel only, and footage is retained for a limited period (normally no longer than 30 days) unless required for investigation or legal proceedings.

We may share CCTV footage with law enforcement agencies or insurers where necessary for the purposes described above. CCTV is operated in accordance with applicable data protection law and relevant guidance issued by the Information Commissioner’s Office.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, or reporting requirements.

Typical retention periods include:

  • Financial transaction records: 6 years
  • Gift Aid records: 6 years after the relevant tax year
  • Membership records: up to 6 years after expiry
  • Marketing contacts: until consent is withdrawn or after a defined period of inactivity

Retention periods may vary where legal obligations require longer storage.

Sharing Your Information

We use carefully selected third-party service providers to support our charitable activities. These providers process data on our behalf under written agreements that comply with UK GDPR requirements.

Our providers include:

  • MailChimp (Intuit) – email marketing services
  • GoodCRM – donation and membership management
  • Stripe – payment processing
  • GoCardless - payment processing
  • Enthuse – online fundraising platform
  • Benevity – corporate giving platform
  • CAF – donation processing
  • Myriad USA – US donation processing
  • Every.org  - US donations processing

We conduct due diligence on all providers and require appropriate security standards. We may disclose personal data where required by law or regulatory obligation.

International Data Transfers

Some of our third-party providers may transfer personal data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as:

  • UK adequacy regulations
  • International Data Transfer Agreements (IDTAs)
  • Standard contractual clauses approved under UK data protection law

Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. While transmission of information over the internet cannot be guaranteed to be completely secure, we use secure systems and procedures to safeguard the data we receive. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO and affected individuals where legally required.

Your Rights

Under UK data protection law, you have the right to:

  • Access your personal data
  • Request rectification of inaccurate data
  • Request erasure (where applicable)
  • Restrict processing
  • Object to processing (including direct marketing)
  • Data portability (where applicable)
  • Object to automated decision-making

We will respond to requests within one month of verifying your identity. No fee will normally be charged.

Cookies and Website Tracking

Our website may use cookies and similar technologies to improve user experience and analyse website performance. Where required, we will seek your consent before placing non-essential cookies. Further details are provided in our Cookie Policy.

Third-Party Links

Our website may contain links to external websites. These organisations have their own privacy policies, and we are not responsible for their content or data practices.

Changes to This Policy

We may update this Privacy Policy from time to time. Any significant changes will be communicated via our website or direct communication where appropriate.