Privacy policy

Pepala CIC (“we,” “us,” or “our”) is committed to protecting and respecting your privacy. This policy explains how we collect, use, share, and protect your personal information when you interact with us, whether via pepala.org.uk (the “Site”), email, telephone, or in person.

1. Data Controller

Pepala CIC
Registered CIC No. 16208930
Email: info@pepala.org.uk
Address: [Your Registered Address]

2. Personal Data We Collect

  • Identity & Contact Details: Name, job title, organisation, postal address, email address, and telephone number.

  • Donation & Transaction Data: Gift amount, method of payment, gift aid declarations, billing details.

  • Communications Data: Your preferences for receiving updates, newsletters, and marketing.

  • Technical Data (Site Users): IP address, browser type, operating system, pages visited, referring/exit pages, and dates/times of visits (via cookies—see Section 11).

3. How We Collect Your Data

  • Directly from You: When you complete forms on our Site, email us, call us, or attend events.

  • Automated Means: Cookies and similar tracking technologies on our Site.

  • Third Parties: Payment processors (e.g. Stripe, PayPal) and mailing-list providers.

4. Legal Basis for Processing

We process your data lawfully under UK GDPR as follows:

  • Consent (Art. 6(1)(a)): When you opt in to receive marketing or newsletters.

  • Contract (Art. 6(1)(b)): To fulfil donations or partnership agreements.

  • Legal Obligation (Art. 6(1)(c)): To comply with accounting, Gift Aid, and charity-regulation requirements.

  • Legitimate Interests (Art. 6(1)(f)): To run and improve our operations, communications, and services in a way that you would reasonably expect.

5. How We Use Your Data

  • To Process Donations & Partnerships: We transmit your details to our payment and logistics partners.

  • To Communicate: We send you receipts, updates on impact, and opportunities to get involved.

  • To Improve Our Services: We analyse usage patterns to optimise our Site and communications.

  • To Comply with Legal Requirements: We retain records for tax, accounting, and regulatory purposes.

6. Sharing Your Data

We may share your data with:

  • Service Providers: Payment processors, mailing-list platforms, and logistics partners, strictly on a “need-to-know” basis under data-processing agreements.

  • Regulatory Authorities: As required by law (e.g. HMRC, Charity Commission).

  • Professional Advisors: Accountants, auditors, and legal advisers under a duty of confidentiality.

We never sell or rent your personal data to third parties.

7. International Transfers

Personal data is normally processed within the UK or EEA. If we need to transfer data outside the EEA (e.g. to a logistics partner), we will ensure adequate safeguards such as standard contractual clauses.

8. Data Retention

We retain your personal data only as long as necessary to fulfil the purposes set out above and in accordance with legal and regulatory requirements:

  • Donation Records & Gift Aid: Minimum 6 years after the end of the tax year to which they relate.

  • Marketing Consents & Preferences: Until you unsubscribe or withdraw consent.

  • General Enquiries & Partnerships: Up to 3 years of inactivity.

9. Your Rights

Under UK GDPR, you have the right to:

  • Access: Request a copy of your personal data.

  • Rectification: Correct inaccurate or incomplete data.

  • Erasure (“Right to be Forgotten”): In certain circumstances, ask us to delete your data.

  • Restrict Processing: Ask us to limit how we use your data.

  • Data Portability: Receive your data in a structured, machine-readable format.

  • Object: Object to direct marketing or processing based on legitimate interests.

  • Withdraw Consent: At any time for processing based on consent.

To exercise any right, email privacy@pepala.org.uk. We aim to respond within one month.

10. Security

We use appropriate technical and organisational measures (encryption, secure servers, staff training) to safeguard your data against unauthorised access, disclosure, or loss.

11. Cookies & Tracking

Our Site uses cookies to distinguish you from other users, improve functionality, and analyse performance. You may refuse cookies by adjusting your browser settings, but some features may then be unavailable. See our Cookie Policy for details.

12. Changes to This Policy

We may update this policy to reflect changes in our practices, technology, or legal requirements. The “Last updated” date will indicate when changes were made.

13. Complaints

If you have concerns about our data practices, please contact privacy@pepala.org.uk. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

Thank you for supporting Pepala’s mission to turn surplus stationery into tools for education. Your trust and partnership make everything we do possible.