Privacy Policy
This privacy policy describes how we will collect and use your personal data.
Our Contact Details
Our site https://www.oneinfour.org.uk is owned and operated by One in Four (London), a Charity registered in England and Wales (1081726) registered address: 219 Bromley Road, London SE6 2PG.
Our ICO registration number is CSN8254991 Our Data Protection Officer can be contacted via email at data@oneinfour.org.uk
Please read this policy carefully, and if you have any questions, please contact us on 0208 3692112 or email data@oneinfour.org.uk
What data do we collect?
We currently collect and process the following information: via online forms, emails, social media and telephone.
Contact Data – enquiries, counselling, training, advocacy
Full name, email address, postal address, telephone number, mobile phone number, the general nature of your contact with us.
Supporter data
First name, surname, email, gender, postal address, phone number, social media handle(s), fundraising page, streaming handle. Meta event link, in memory of, relationship to ‘in memory of’.
Volunteer, employee and contractor data
First name, surname, email, gender, postal address, phone number, data to support job applications, DBS applications, onboarding
Financial data
Payment card details, bank details (if paying via BACS transfer), donations, gift-aid declarations and payroll.
Health data
To ensure safety of people accessing our venues, those supporting our fundraising and events we hold information about medical conditions (only for sporting or high-risk event registrants).
Technical data (e.g. cookies and other technologies such as pixels)
IP address, browser type and version, and operating system.
We also receive personal information indirectly from the following sources:
- Independent event organisers such as TCS London Marathon, Lets do This, Just Giving, Go Fund Me, Laine 8 Events, Skyline Sky Dives.
- Fundraising and events sites include Eventbrite, Just Giving, PayPal, Go Fund Me, Benevity, Action Funder, Easy Fundraising, Much Loved, Lewisham Lottery.
- Family members or friends, for example, if they are signing up multiple people for an event.
How We Use Your Personal Data (and the legal basis for processing)
Most of the personal data we process is provided directly by you. Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing this information. The table below lists the processing purposes and the lawful basis.
| Purpose for processing | Legal Basis |
|---|---|
| To administer, progress and monitor your interest in accessing and engaging in our services. | Legitimate interest |
| To keep you informed of our latest news and events. | Legitimate interest |
| To respond to any queries you may have . | Legitimate interest |
| To tell us about your experience. | Legitimate interest |
| To process and fulfil orders, bookings and donations. | Legitimate interest |
| To register you for a challenge event. | Legitimate interest |
| To tell us about your fundraising for One in Four. | Legitimate interest |
| To thank you for regular and one off donations. | Legitimate interest |
| To identify and contact you about becoming an ambassador | Legitimate interest |
| Due diligence and fundraising research *see Gift Acceptance policy. | Legitimate interest |
| If you are taking part in a sporting or high-risk event, we ask you to provide details of any medical conditions that we need to be aware of for health and safety purposes | Explicit consent |
| If you are taking part in an event, and in the case of an emergency we ask you to provide us with your emergency contact details. | Explicit consent |
| Photographs – to be used for publicity | Explicit consent |
| Recruitment job, contract and volunteer applications | Contractual necessity |
| To make DBS applications. | Contractual necessity |
| To record, process and claim gift aid on donations. | Contractual necessity |
| To analyse how you interact with the One in Four website and social media | Consent |
| To share your webpage interactions with Meta | Consent |
Who do we share your data with?
We store some or all your personal data in countries outside of the UK. These are known as “third countries”. We will only store or transfer personal data in or to countries deemed to provide adequate protection for personal data. If any of your personal data is shared with a third party, as described above, we will ensure that your personal data is handled safely, securely, and per your rights, our obligations, and the third party’s obligations under the UK GDPR.
We share your personal information with the following:
| Recipient | Activity Carried Out | Location |
|---|---|---|
| Donorbox | Cloud-based CRM – fundraising donations and events | United States |
| Woo Commerce | E-commerce platform. | United States |
| Eventbrite | E–commerce event platform | United States |
| Payment Gateway Providers (e.g., Stripe, Sumup and PayPal) | Contributions and donations. | United States |
Data Storage
How do we store your personal data?
The security of your personal data is essential to us, and to protect your data, we take several necessary measures, including the following:
- Limiting access to your personal data to those employees, agents, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to duties of confidentiality.
- Procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data), including notifying you and/or the Information Commissioner’s Office where we are legally required.
- Training staff on data protection and cybersecurity at induction and offering refresher training.
- Procedures for managing data protection compliance include but are not limited to, data protection policies, handling individual rights requests, and data retention schedules.
- Data processing agreements are signed with suppliers acting as data processors.
How long will we retain your personal data?
We will only keep your personal data as long as necessary, we will securely anonymise identifying personal data and destroy inactive data after 6 years as per our data disposal policy.
Reporting of Numerical Data
One in Four needs to provide evidence to its funders and fundraisers how their donations are used, so we need to provide a business narrative and statistical analysis of our service. This is only statistical data in a numerical format, it is stored in a secure database held on a secure UK based server. There are no personally identifying details i.e. name or phone number contained in any records. Any public communication used by One in Four to demonstrate impact and outcomes of our service is generalised and therefore completely anonymous and not traceable back to any client.
What are your Individual Rights?
Under data protection law, you have rights, including:
The Right of Access You have the right to ask us for copies of your personal information
The Right to Rectification You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to update information you think is incomplete.
The Right to be Forgotten You can ask us to erase your personal information in certain circumstances.
The Right to Restrict of Processing You have the right to ask us to restrict the processing of your personal data in certain circumstances.
The Right to Object You can object to processing your personal data in certain circumstances.
The Right to Withdraw Consent We rely on consent to process your personal data, you can withdraw that consent at any time.
The Right to Portability You have the right to ask that we transfer the personal data you gave us to another organisation or to you in certain circumstances.
You are not required to pay any charge to exercise your rights. If you make a request, we have one month to respond.
Right to Complain
If you have any concerns about our use of your personal information, you can complain to us at data@oneinfour.org.uk
You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data. The ICO’s address is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or complete an online form via the ICO website (https://www.ico.org.uk).
Version 14/11/2025