1. Introduction

This policy explains how The Little Things UK (“the Charity”, “we”, “us”) collects, uses, stores and shares personal data in connection with our website, our outreaches and our dealings with the public. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

2. Data controller

The Little Things UK is the data controller of the personal data described in this policy.

Email: thelittlethingsadmin@gmail.com
Address: 4 Queen Anne’s Grove, Enfield, EN1 2JP

We have not appointed a Data Protection Officer. For data protection enquiries, please contact us using the details above.

3. Personal data we collect and why we use it

3.1 Enquiries. If you complete our contact form or email us, we collect your first name, last name, email address and the content of your message. We use this information to respond to your enquiry, manage any follow-up and keep a record of our communications. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR), namely our interest in responding to people who contact us. You are not obliged to give us this information, but we cannot respond without it.

3.2 Website technical data. Our website is provided by Squarespace. When you visit, technical data such as your IP address, browser type, device and the pages requested may be processed automatically to deliver the website and keep it secure. Our lawful basis is legitimate interests, namely the security and operation of our website.

3.3 Donations. Donations are made through JustGiving, a third-party fundraising platform. JustGiving collects and processes payment information under its own privacy policy, and we do not receive or store your card details. Where JustGiving shares donor information with us, such as your name, contact details or Gift Aid declaration, we use it to record and acknowledge donations, administer Gift Aid where applicable and keep the financial records required by law. Our lawful bases are legitimate interests and, for Gift Aid and financial records, legal obligation.

3.4 Messaging updates. If you choose to receive updates about our outreaches and events, we collect and use your contact details to send you these communications through the channel you have agreed to. We only add you to our messaging lists where you have actively agreed to receive updates. Our lawful basis is your consent, which you can withdraw at any time by contacting us or following the instructions in our messages. Depending on the method used, your contact details may be visible to other recipients, and we will explain this before adding you to any group or list where it applies.

3.5 Volunteers and cooks. If you volunteer with us, we collect your name and contact details and, where relevant, any address needed to arrange deliveries or collections. We use this information to organise outreaches, coordinate volunteers and arrange logistics. Our lawful basis is legitimate interests. We keep this information while you volunteer and review it at least once a year.

3.6 What we do not do. We do not sell your personal data or use it for automated decision-making or profiling. We do not send marketing or fundraising emails. Any messaging updates we send are limited to information about our charitable activities, outreaches and events, and are sent in accordance with applicable consent and electronic communications requirements.

4. Data sources

We generally collect personal data directly from you, in person, through our website, by email or through social media. We may also receive information from third parties, such as JustGiving or someone contacting us on your behalf.

5. Recipients of personal data

We share personal data only where necessary, with:

• Squarespace, which hosts our website and processes contact form submissions;

• Google, which provides our email service;

• JustGiving, in respect of donations;

• messaging and social media providers, which process your details under their own privacy policies;

• professional advisers or insurers, where necessary for the purposes described in this policy; and

• the police, regulators or other authorities, where required by law or where necessary to protect a person’s vital interests.

Squarespace and Google process personal data on our behalf when providing the relevant services. Other third-party providers may act as independent controllers or processors, depending on the services they provide and how they handle personal data.

6. International transfers

Our service providers may process personal data outside the United Kingdom, including in the United States. Where personal data is transferred internationally, we ensure that an appropriate transfer mechanism or safeguard is in place in accordance with UK data protection law. Further information about the safeguards used can be requested by contacting us.

7. Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, taking into account legal, accounting and record-keeping requirements.

We retain your messages and contact details only for as long as is necessary to respond to your enquiry and to carry out any related follow-up. Contact details used for messaging updates are kept while you remain on our list. We review our emails, form submissions and messaging lists at least once a year, removing inactive or unnecessary records and securely deleting any information that is no longer required. Where necessary, we may keep a limited record of people who have opted out so that their wishes are respected. Photographs are kept while there is a reason to use them, taking account of any withdrawal of consent. Where the law requires us to keep a record for a specified period, we keep it for that period.

8. Your rights

Under UK data protection law you have the right to:

• be informed about how your data is used;

• access a copy of your personal data;

• have inaccurate data corrected;

• have your data erased, in certain circumstances;

• restrict our processing of your data, in certain circumstances;

• object to processing based on legitimate interests;

• receive your data in a portable format, where applicable; and

• not be subject to solely automated decisions, though we do not carry out any.

Where we rely on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before you withdrew it. Not every right applies in every circumstance.

To exercise any of these rights, contact us at thelittlethingsadmin@gmail.com. We may ask you to verify your identity. We will respond within one month, which we may extend by up to two further months for complex or numerous requests, and we will tell you if so. We do not charge a fee unless a request is manifestly unfounded or excessive.

9. Complaints

If you are concerned about how we have handled your personal data, please contact us at thelittlethingsadmin@gmail.com. We will review your complaint and respond as soon as reasonably possible. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or by telephone on 0303 123 1113 at any time.

10. Children and young people

We take particular care when handling personal data relating to children and young people. Where appropriate, we involve a parent or guardian and take account of the child’s age and understanding when collecting or using their personal information. We collect only what is necessary and apply appropriate safeguards to protect it. If you have concerns about information relating to a child, please contact us using the details above.

11. Cookies

Cookies are small files placed on your device by websites. We use only essential cookies that are necessary for our website to function and remain secure. We do not use analytics, advertising or tracking cookies, and we do not embed third-party content that sets them. Because essential cookies are exempt under PECR, we do not request your consent for them. You can block or delete cookies in your browser settings, though parts of the website may not function as a result.

12. Photographs

We may publish photographs of individuals on our website and social media. We do so only with the consent of the people shown or, for anyone under 18, of a parent or guardian, and we explain how the photographs will be used. Permission to take a photograph is separate from permission to publish it. You may withdraw your consent at any time by contacting us at thelittlethingsadmin@gmail.com, and we will stop using the image and take reasonable steps to remove it from channels under our control. We cannot guarantee the removal of copies already shared by others.

13. Security

We use appropriate technical and organisational measures to protect personal data, including access limited to those who need it and password protection on our systems. No system is entirely secure. If a personal data breach occurs, we will assess the risks and take appropriate steps to contain it. Where legally required, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

14. Third-party links

Our website links to third-party sites, including JustGiving. We are not responsible for their content or privacy practices, and we encourage you to read their policies.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our activities, legal requirements or the way we process personal data. The latest version will always be available on our website, with the date of the most recent update shown at the top. Where significant changes affect how we use your personal data, we will take appropriate steps to bring them to your attention.

UPDATED: 1 NOVEMBER, 2026