Privacy Notice

The purpose of this privacy notice is to explain how Charities Advisory Trust (“CAT”) processes personal data to fulfil our data protection responsibilities for anyone making enquiries either through the website contact page or by direct contact, and for anyone that uses our services i.e. our customers.

The role of CAT in data protection terms is that of a data controller where we determine the purpose and use of your personal data. Our Privacy Manager (PM) ensures we process your personal data in accordance with UK data protection law. The PM is contactable using accounts@charitiesadvisorytrust.co.uk.

This privacy notice also covers CAT’s activities as follows:

  • Good Gifts

  • Knit for Peace

The sort of personal data collected by CAT will be basic contact details sufficient to be able to respond to your general enquiries, promote our services when we are allowed, and to administer transactions we make with you as one of our customers.

CAT’s duty of confidentiality means that our staff will treat your personal data with due respect and confidence. It is only disclosed to others when absolutely required. We use reasonable organisational and technical measures to ensure personal data is kept secure. We also expect the same duty of confidentiality of all third parties with whom we share your personal data.

Processing takes place on-site and/or agreed off-site locations, all within the UK, with routine backups performed on UK and EU based servers, with the exception for orders and payments relating to the Knit for Peace activity. For this we use Squarespace, where the processing takes place in the US, but the relevant assurances are provided for under the UK extension to the EU-US Data Privacy Framework.

The processing of personal data by CAT is processed in accordance with the principles of data protection and always against a lawful basis such as those below:

  • We will pursue our legitimate interests to respond to your general enquiries and stay in touch with you for marketing purposes

  • To fulfil our contractual obligations in the preparation and delivery of our services when orders are placed by you

  • To comply with our legal obligations

  • When processing for a pre-defined purpose for which your consent will be sought prior to the processing commencing – please note that consent can be withdrawn at any time by contacting the PM

CAT will share your personal data but only when necessary, with some or all of the following:

  • Administrative support where personnel are bound by a data processing agreement and/or contractual arrangements

  • Appointed contractors for specific outsourced services who are subject to a data processing agreement or equivalent as bound by their contracts

CAT follows a retention schedule to determine the length of time we hold different types of personal data. The key retention periods are as follows:

  • Routine correspondence for casual enquiries in hard copy or in emails will be stored for no mor than 3 years after the last interaction with CAT

  • Contact data is stored indefinitely unless a valid request to erasure has been received, in which case it will be given due consideration

At the end of the retention period, CAT will destroy or delete your personal data and any associated emails or relevant documentation for which CAT has no lawful basis to justify their retention. If it is technically impractical to delete electronic copies of your data, it will be put beyond operational use. Please note, CAT allows up to 3 months after the retention period has ended to complete this action.

The UK General Data Protection Regulation defines the rights that you have (although these do not apply in all situations) and are summarised below:

  • Right to be informed as to how your personal data are being processed – this is done through this notice

  • Right to access personal data held by us; this is done by submitting a ‘Subject Access Request’ (SAR) to the PM

  • Right to rectification of personal data if we have collected it incorrectly or it needs to be updated

  • Right to erasure of your personal data for which we no longer have a legitimate purpose to process

  • Right to restrict processing under certain circumstances, during which your personal data will be taken out of operational use until the matter is resolved

  • Right to data portability of your personal data in a machine-readable version, but this only applies to data provided with your consent or under contract

  • Right to object to processing personal data for which we do not have a legal or contractual obligation

  • Rights related to automated decision making and profiling, however, CAT does not use these techniques in its decision making

Further details of all these rights can be found on the Information Commissioner’s Office (ICO) website: https://ico.org.uk.

Raising concerns/ complaints, exercising rights, or simply making a query about our processing of your personal data can be done by contacting the PM. Please be aware that CAT will need to verify your identity before responding fully. For that reason, you may be asked for proof of identification that, in context, will enable us to confirm your identity. Alternatively you may, in the first instance, contact the ICO directly.

November 2025