Privacy Policy

Last updated: 19/7/26

This Privacy Policy explains how Cubed Group Vision Limited (“the Charity”, “we”, “us” or “our”) collects, uses, shares, and protects personal data when you visit or interact with our website at www.cubedsvision.com (the “Website”), and when you otherwise interact with us as a supporter, volunteer, or member of the public.

We are committed to protecting your privacy and handling your personal data responsibly, transparently, and in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (“PECR”), as well as guidance issued by the Fundraising Regulator and the Charity Commission.

1. Who We Are — the Data Controller

Cubed Group Vision Limited is the “data controller” for the purposes of the UK GDPR and the Data Protection Act 2018. We are a charitable company limited by guarantee, registered in England and Wales under company number 13718049 and registered with the Charity Commission for England and Wales under charity number 5198021.

Registered office: 1 Allied Business Centre, Coldharbour Lane, Harpenden, Hertfordshire, AL5 4UT
Contact for data protection queries: mark.munnelly@cubedsvision.com

If we appoint a formal Data Protection Officer or nominated individual responsible for data protection compliance, their details will be provided here.

2. Donations and the Website’s Current Functionality

The Website provides a link to a third-party donation platform, Zeffy (“the Donation Platform”), to allow you to make a donation to the Charity. When you make a donation, you do so on the Donation Platform’s own website or app, and the Donation Platform — not the Charity — is the party that directly collects your payment details.

Aside from this donation link, the Website does not use cookies, does not use analytics or tracking tools, does not offer a newsletter or mailing list sign-up, and does not provide user accounts or member log-in facilities. This Policy is drafted to reflect that functionality.

If any of this changes in the future — for example, if we begin accepting donations directly on the Website, using Google Analytics or similar tools, or operating an email newsletter — we will update this Policy before introducing the relevant functionality, and will put in place the appropriate consent mechanisms (including a cookie banner where required under PECR) at that time.

3A. Personal Data We Collect

Beyond the donation and Gift Aid data described in Section 3B below, we may also collect limited personal data in the following circumstances:

When you contact us using a contact form, email address, or telephone number published on the Website (e.g. name, email address, telephone number, and the content of your enquiry);
When you express interest in volunteering, applying for a role, or otherwise engaging directly with our work;
When you raise a safeguarding concern or complaint, which may include sensitive information about yourself or a third party;
Automatically, through standard web server logs maintained by our hosting provider (such as IP address, browser type, device type, and pages visited), which are used solely for the security and technical administration of the Website and are not used to identify individuals for marketing purposes.

Summary table

Category of data	Purpose	Lawful basis (UK GDPR)
Contact/enquiry details (name, email, phone, message content)	To respond to your enquiry, question, or request	Legitimate interests (Art. 6(1)(f)) — responding to enquiries directed to us
Volunteer or role application details	To assess suitability and correspond regarding involvement with the Charity	Legitimate interests (Art. 6(1)(f)) / steps prior to entering an agreement (Art. 6(1)(b))
Donation details passed to us by the Donation Platform (name, contact details, donation amount/date)	To thank you, keep a record of your support, and manage our relationship with you as a donor	Legitimate interests (Art. 6(1)(f)) — administering donor relationships
Gift Aid declaration details (name, home address, taxpayer confirmation)	To reclaim Gift Aid from HMRC and to keep the records HMRC requires	Legal obligation (Art. 6(1)(c)) — HMRC Gift Aid record-keeping requirements
Safeguarding concern or complaint details (may include special category data)	To investigate and respond appropriately, and to meet our safeguarding responsibilities	Legal obligation (Art. 6(1)(c)) / substantial public interest — safeguarding (Art. 9(2)(g), DPA 2018 Sch. 1)
Server/technical logs (IP address, browser/device type)	Website security, fraud prevention, and technical administration	Legitimate interests (Art. 6(1)(f)) — keeping our systems secure

3B. Donations and Gift Aid — How Your Data Is Handled

3B.1 When you make a donation via the Donation Platform, the Donation Platform acts as an independent data controller for the payment transaction itself (e.g. your card or bank details) — this data is handled entirely under the Donation Platform’s own privacy policy, and the Charity never sees or stores your payment card details.

3B.2 The Donation Platform will typically pass certain donor information to us, such as your name, contact details, the amount and date of your donation, and — where you have completed one — your Gift Aid declaration. In relation to this information, the Charity acts as the data controller.

3B.3 We use this information to thank you for your donation, to maintain our own donor and financial records, and, where you have made a Gift Aid declaration, to reclaim Gift Aid from HMRC on eligible donations.

3B.4 HMRC requires charities to keep Gift Aid records (including declarations and supporting donation records) for a minimum period — generally at least 6 years after the end of the accounting period to which they relate, and HMRC may in some circumstances require access to older records. We retain Gift Aid-related data for this purpose even where other donor correspondence would ordinarily be deleted sooner.

3B.5 We may share Gift Aid declaration data with HMRC as required by law, and, where needed, with our independent examiner or auditor for the purposes of verifying our accounts.

3.6 If the Donation Platform is based outside the UK, your data may be processed outside the UK as part of that transaction — please refer to the Donation Platform’s own privacy policy for details of any international transfers it makes, and see Section 7 below for how we handle any onward transfer of donor data that we hold ourselves.

4. How We Use Your Personal Data

We only use your personal data for the purposes for which we collected it, or for a closely related purpose, unless we reasonably consider we need to use it for another reason and that reason is compatible with the original purpose. We do not use your personal data for any automated decision-making or profiling.
We will not use your personal data for direct marketing purposes unless you have separately and clearly consented to this, in line with PECR requirements. As the Website does not currently operate a newsletter or mailing list, we do not currently send marketing communications via the Website.

5. Special Category and Safeguarding Data

5.1. Where a safeguarding concern is raised with us, we may need to collect and process sensitive personal data (which may include information about a person’s health, or details of an alleged incident) in order to fulfil our safeguarding responsibilities and to protect the welfare of children and adults at risk.

5.2. We process this information under the substantial public interest condition for safeguarding purposes (Article 9(2)(g) UK GDPR, read with Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018), and, where necessary, to comply with our legal obligations.

5.3. Access to safeguarding information is strictly limited to those trustees and individuals within the Charity who need it in order to respond appropriately, and it is held separately and securely from general correspondence.

6. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We may share personal data with the following categories of recipients, only where necessary and proportionate:

Our professional advisers, including accountants, auditors, and legal advisers, where necessary for the proper administration of the Charity;
IT and website hosting providers who process data on our behalf as data processors, under appropriate data processing agreements;
The Charity Commission for England and Wales, statutory safeguarding authorities, the police, or other regulators or authorities, where we are legally required to do so or where disclosure is necessary to protect the welfare of a child or adult at risk;
Any successor or replacement charity, in the unlikely event of a merger or transfer of the Charity’s operations, subject to appropriate safeguards.

We do not currently share personal data with any third party for their own marketing purposes, and we do not currently use any third-party analytics, advertising, or social media tracking tools on the Website.

7. International Transfers

Our Website is hosted in the United Kingdom. If any personal data is ever transferred outside the UK or the European Economic Area, we will ensure appropriate safeguards are in place, such as the UK’s International Data Transfer Agreement, adequacy regulations, or equivalent legally recognised transfer mechanisms.

8. Data Retention

We keep personal data only for as long as is necessary for the purposes for which it was collected, or as required to satisfy any legal, accounting, safeguarding, or reporting requirements. As a general guide:

General enquiry correspondence is retained for a reasonable period (typically no longer than 24 months from the last contact) unless a longer period is needed to resolve an ongoing matter;
Volunteer and role application records are retained in accordance with our internal recruitment and volunteering policies;
Donation records and Gift Aid declarations are retained for at least 6 years after the end of the accounting period to which they relate, in line with HMRC’s Gift Aid record-keeping requirements, and may be retained for longer where HMRC guidance or an ongoing enquiry requires it;
Safeguarding records are retained for the period recommended by relevant statutory and sector safeguarding guidance, which is typically significantly longer than general correspondence, reflecting the need to protect vulnerable individuals over time;
Server/technical logs are retained by our hosting provider only for the short period necessary for security and technical administration purposes.

Specific retention periods are set out in our internal data retention policy, available on request from the trustees.

9. How We Keep Your Data Secure

We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, and against accidental loss, destruction, or damage. These measures include restricting access to personal data to those who need it, using reputable and secure hosting and email providers, and reviewing our practices periodically. However, no method of transmission over the internet, or method of electronic storage, is completely secure, and we cannot guarantee absolute security.

10. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:
Right of access — to request a copy of the personal data we hold about you;
Right to rectification — to ask us to correct inaccurate or incomplete data;
Right to erasure — to ask us to delete your personal data in certain circumstances;
Right to restrict processing — to ask us to limit how we use your data in certain circumstances;
Right to object — to object to our processing of your data where we rely on legitimate interests, including for any direct marketing;
Right to data portability — to ask us to transfer your data to another organisation, in certain circumstances; and
Rights relating to automated decision-making and profiling — although we do not currently carry out any such processing.

To exercise any of these rights, please contact us at mark.munnelly@cubedsvision.com. We will respond to any valid request within one month, in accordance with the UK GDPR. We may need to verify your identity before responding to a request.

11. Your Right to Complain

If you have concerns about how we have handled your personal data, we would welcome the opportunity to address them — please contact us in the first instance using the details above.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection, at any time:

Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Children’s Data

The Website is intended for a general audience and is not directed at children. We do not knowingly collect personal data directly from children through the Website. Where our charitable activities involve working with or engaging children, this is governed by our separate safeguarding policy and any data collected in that context is handled with additional care and restricted access, as set out in Section 5 above.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Website’s functionality, or legal requirements. Any changes will be posted on this page with an updated “last updated” date. We encourage you to review this Policy periodically.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at mark.munnelly@cubedsvision.com or by post at 1 Allied Business Centre, Coldharbour Lane, Harpenden, Hertfordshire, AL5 4UT.