Skip to content

Privacy notice

This notice explains how Barnability collects and uses personal data through this website, and your rights under the UK GDPR and the Data Protection Act 2018.

Last updated: 20 August 2026

Who we are

The data controller is BARNABILITY CIO, a Charitable Incorporated Organisation registered in England & Wales (charity number 1211632).

For any privacy question, or to exercise your rights, email us at barnability@gmail.com.

What we collect

We keep data collection to a minimum. Through this website we process:

  • Contact form details - the name, email address and message you submit on our contact page. These are emailed to us so we can reply; they are not stored in a database on this site.
  • Donation and Gift Aid details - if you donate, your payment is taken by our payment provider, Stripe; your card details never touch this website. We record the amount, date and the email address you give Stripe. If you add Gift Aid, we also record your name, house name or number and postcode, because HMRC requires them for the declaration. Within the charity, donation records are visible only to authorised site administrators.
  • Technical request data processed by Cloudflare - like every website, our hosting and security provider (Cloudflare) processes limited request data such as your IP address and browser information to deliver pages and protect the site from abuse.
  • Cookieless analytics - we use Cloudflare Web Analytics, which measures aggregate page visits without cookies and without tracking you across sites. It does not build a profile of you.

This website sets no cookies that require your consent, so there is no cookie banner.

Lawful basis

We rely on the following lawful bases under Article 6 UK GDPR:

  • Contact enquiries - our legitimate interest in responding to and managing the enquiry you chose to send us. We use your details only to reply.
  • Donations - our legitimate interests in receiving, recording and accounting for the donation you chose to make, and in thanking you and answering queries about it. Where taking your payment forms part of a transaction you asked us to carry out, we also rely on contract. Keeping Gift Aid declarations and donation records is a legal obligation under HMRC's Gift Aid rules and charity accounting requirements.
  • Site security and delivery - legitimate interests in keeping the site available and secure.
  • Aggregate analytics - legitimate interests in understanding overall site usage, using a cookieless tool that does not identify you.

We do not ask for, or intentionally collect, special category data through this website.

How long we keep it

We keep enquiry emails only as long as needed to deal with your enquiry and any follow-up. We delete them within 12 months of the enquiry being resolved, unless we're required to keep them longer for a legal reason.

Donation records, including Gift Aid declarations, are kept for 6 years after the end of the accounting period they relate to, as HMRC and charity accounting rules require, and deleted within 12 months after that unless we still need them for an open HMRC enquiry or a legal claim.

Who receives your data

We keep the list of organisations that handle data for this website short:

  • Cloudflare, Inc. - website hosting, content delivery, security (including the cookieless Turnstile bot-check on our donation form) and cookieless analytics. See Cloudflare's privacy policy.
  • Web3Forms - delivers your contact-form message to our inbox by email. See Web3Forms' privacy policy.
  • Stripe Payments UK, Ltd. - takes donation payments on our behalf and is the only party that handles your card details. Stripe acts as our processor for taking the payment, and as a separate controller in its own right for fraud prevention and its own legal and regulatory obligations. See Stripe's privacy policy.
  • HM Revenue & Customs (HMRC) - if you make a Gift Aid declaration, we send your name, house name or number, postcode, and the date and amount of your donation to HMRC as part of our Gift Aid claim. HMRC uses this information as an independent data controller under its own privacy notice.

We do not sell your data or share it for advertising.

International transfers

Cloudflare and Web3Forms are US-headquartered, and Stripe Payments UK may share data with Stripe group companies outside the UK. Where data leaves the UK, the transfer is covered by an appropriate safeguard - the UK International Data Transfer Addendum to the EU Standard Contractual Clauses - as set out in each provider's data processing terms.

Your rights

Under UK GDPR you have the right to:

  • be informed about how your data is used (this notice);
  • request access to the data we hold about you;
  • have inaccurate data corrected;
  • have your data erased;
  • restrict or object to processing;
  • data portability, where applicable.

To exercise any of these, contact us at barnability@gmail.com. We respond within one month.

Complaints

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We'd appreciate the chance to resolve it with you first.