Privacy Policy
Last updated: 10 February 2026
1. Who We Are
This website is operated by Foundations for People (Charity No. 1140216) (“we”, “us”, “our”) for the Fund A Book campaign.
Registered address: 3 Paternoster Lane, Bradford, BD7 3DS.
For questions about this policy, or to use any of your data rights, email privacy@fundabook.co.uk
2. What Data We Collect
- Email address — given when you sign up for campaign updates.
- Donation data — if you donate through our website, Stripe collects payment information directly. We do not handle or store your payment card details.
- Gift Aid declarations — if you choose to add Gift Aid, we collect your first name, surname, home address and postcode. HMRC requires these to identify you as a UK taxpayer. They are held for the Gift Aid claim by the charity named in the declaration you tick.
- Server logs and IP addresses — our hosting provider (Vercel) may automatically log IP addresses and request metadata for security and performance purposes.
3. Why We Collect It (Purposes & Lawful Basis)
| Purpose | Data | Lawful Basis |
|---|---|---|
| Sending campaign updates | Email address | Consent (Art. 6(1)(a) UK GDPR) |
| Processing donations | Payment & contact info (via Stripe) | Contract performance (Art. 6(1)(b)) |
| Website security & performance | IP address, request logs | Legitimate interests (Art. 6(1)(f)) |
4. Who We Share Data With
- Resend — email delivery service (processes subscriber emails). US-based, certified under the EU-US Data Privacy Framework (UK Extension).
- Stripe — payment processor (handles card payments directly). PCI DSS compliant.
- Vercel — website hosting (may process server logs containing IP addresses). US-based, Standard Contractual Clauses in place.
- Upstash — hosted database, which stores campaign totals, donor email addresses and Gift Aid declarations.
- Cloudflare — bot protection (Turnstile) on our donation and contact forms.
We do not sell, rent or trade your personal data.
5. International Transfers
Some of our service providers are based in the United States. Transfers are safeguarded by the EU-US Data Privacy Framework (UK Extension) and/or Standard Contractual Clauses approved by the ICO.
6. How Long We Keep Data
- Email addresses — retained until you unsubscribe or for up to 2 years after last engagement, whichever is sooner.
- Donation records — retained for 7 years for accounting and tax purposes (as required by HMRC).
- Gift Aid declarations — retained for 6 years after the end of the tax year they relate to, as required by HMRC.
- Server logs — automatically deleted by Vercel after 30 days.
7. Cookies
This website does not set any non-essential cookies. We do not use analytics cookies, advertising cookies, or tracking pixels. Stripe may set cookies for payment processing and fraud prevention. See Stripe's Privacy Policy for details. For more information, see our Cookie Policy.
8. Your Rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data (“right to be forgotten”).
- Restrict processing — ask us to limit how we use your data.
- Data portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interests.
- Withdraw consent — unsubscribe from emails at any time using the link in every email or by contacting us.
To exercise any of these rights, email us at privacy@fundabook.co.uk. We will respond within one month.
9. Complaints
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
10. Changes to This Policy
We may update this policy. Changes will be posted on this page with a new date.