How we collect, use, and protect your personal data
For website and general use · Version 1.0 (Draft), July 2026 · Last updated: July 2026
1. Introduction
ORCD UK is committed to protecting your privacy and handling your personal data responsibly, transparently, and in line with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy explains what personal data we collect when you use our website or interact with us, why we collect it, how we use and protect it, and what rights you have over it. We’ve tried to write it in plain English rather than dense legal language.
ORCD UK is a newly established UK charity (registration in progress). This policy will be reviewed and updated as our activities develop, including once we are able to accept donations directly and once our charity registration is complete.
2. Who We Are
The data controller
ORCD UK is the “data controller” for the personal data described in this policy, meaning we decide how and why your data is used.
| Detail | Information |
|---|---|
| Organisation | ORCD UK |
| Status | UK charity (registration in progress) |
| Contact email | ima.raza@orcduk.org and info@orcduk.org |
| Postal address | [To be added once confirmed] |
If you have any questions or concerns about how we handle your data, please contact us at the email above in the first instance. If you remain unhappy, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.
3. What Data We Collect
We only collect personal data that is necessary for the purpose it’s collected for. The table below sets out what we currently collect through our website and general activities.
| What we collect | When | Why |
|---|---|---|
| Name and email address | When you sign up to our mailing list, or contact us via the website | To respond to you, and to send updates about ORCD UK’s work, if you’ve agreed to hear from us |
| Any information you provide in a message | When you use our contact form | To respond to your enquiry |
| Technical data (IP address, browser type, pages visited) | Automatically, when you browse our website | To understand how our website is used and to keep it secure |
| Donation and payment details | When our donation system is live (not currently active) | To process your donation and, where applicable, claim Gift Aid, once we are registered to do so |
| Application details (CV, cover letter, etc.) | When you apply for a volunteer or trustee role | To assess your application |
We do not currently operate live donation collection on our website. When we do, this policy will be updated to explain exactly how payment and Gift Aid information is handled, and by which payment provider.
4. Our Legal Basis for Using Your Data
UK data protection law requires us to have a valid legal basis for every way we use personal data. We rely on the following:
| Legal basis | When we rely on it |
|---|---|
| Consent | When you opt in to our mailing list, or otherwise actively agree to hear from us. You can withdraw this consent at any time. |
| Legitimate interests | To respond to enquiries, keep our website secure, and understand how it’s used, where this doesn’t override your own rights and interests. |
| Contract | Where we need to process data to fulfil a request you’ve made, for example processing a donation once that function is live. |
| Legal obligation | Where we’re required to keep or share information by law, for example financial or charity regulatory record-keeping. |
5. How We Share Your Data
We do not sell your personal data, ever. We only share it in the limited circumstances below:
- With service providers who help us operate, such as our email/newsletter platform and website hosting provider, who process data on our behalf under appropriate agreements.
- With payment processors, once our donation system is live, solely to process your donation.
- With ORCD Global or other delivery partners, only where necessary and with appropriate safeguards, for example to coordinate a donor-funded project you’ve specifically supported, and never more data than necessary.
- Where required by law, for example to comply with a legal obligation or protect against fraud.
Some of the tools we use (such as email and file-storage platforms) may store data on servers outside the UK, including in the United States. Where this happens, we take reasonable steps to ensure your data is protected to a standard equivalent to UK law, for example through providers offering standard contractual clauses or equivalent safeguards.
6. Your Rights
Under UK data protection law, you have a number of rights over your personal data. These are yours regardless of your relationship with ORCD UK — whether you’re a donor, supporter, applicant, or simply someone who’s contacted us.
| Right | What it means |
|---|---|
| Access | You can ask us what personal data we hold about you, and for a copy of it. |
| Rectification | You can ask us to correct inaccurate or incomplete data. |
| Erasure | You can ask us to delete your data, sometimes known as the “right to be forgotten”, subject to any legal reason we may need to keep it. |
| Restriction | You can ask us to limit how we use your data in certain circumstances. |
| Objection | You can object to us using your data for certain purposes, including direct marketing, at any time. |
| Portability | You can ask for your data in a portable format to transfer to another organisation, where technically feasible. |
| Withdraw consent | Where we rely on your consent (such as mailing list sign-up), you can withdraw it at any time. |
To exercise any of these rights, please contact us at ima.raza@orcduk.org. We will respond within one month, as required by law.
7. Cookies
Cookies are small text files placed on your device when you visit a website. We use them to help our website function properly and to understand how visitors use our site.
| Type of cookie | Purpose |
|---|---|
| Essential cookies | Needed for the website to work properly. These cannot be switched off. |
| Analytics cookies | Help us understand how visitors use our site, so we can improve it. Used only with your consent. |
You can control or delete cookies through your browser settings at any time. Blocking essential cookies may affect how the website functions.
8. Children’s Privacy, Data Retention and Security
Children’s privacy
Our website is not directed at children, and we do not knowingly collect personal data from children through it. Where our work involves images or stories of children in the communities we support, these are handled under our separate Safeguarding Policy, with appropriate consent and care taken to protect identity and dignity.
How long we keep your data
- Mailing list data: for as long as you remain subscribed, and a short period afterwards in case you resubscribe, unless you ask us to delete it sooner.
- Enquiry and application data: typically no longer than 12 months, unless there’s a good reason to keep it longer.
- Donation and financial records: for as long as required by law once our donation system is live (typically at least 6 years, for financial and Gift Aid record-keeping).
How we keep your data secure
We take reasonable technical and organisational steps to protect your personal data against unauthorised access, loss, or misuse, including restricting access to those who need it, and using reputable, secure service providers.
9. Changes to This Policy
We may update this policy from time to time, for example as our activities grow, our donation system goes live, or the law changes. Any significant changes will be reflected on our website with an updated date at the top of this page. We encourage you to review this policy periodically.
If you have any questions about this policy or how we handle your data, please contact us at ima.raza@orcduk.org.