Privacy Policy

Updated December 2025

As part of our work, we collect and process personal data about the people who interact with us. The kind of data we collect depends on how people support our work, whether that’s working for us, supporting our campaigns, making donations, or volunteering.

We only collect the bare minimum we need to offer our services and do our work. We are completely committed to protecting your data and privacy, and pride ourselves on taking great care to ensure it stays completely safe. We promise we’ll never share or sell your personal data to a third-party organisation for marketing, fundraising or campaigning purposes.

This policy outlines what data we collect, how we may use it, how we protect your data and your rights, and how you can exercise those rights.

References to ‘we’ or ‘us’ are to:

The ONA Foundation, 45 Edith Grove, SW10 0LB, London

We regularly review this policy to make sure we’re giving you the most up-to-date information available about how we’re processing our data. We recommend you re-read this page from time to time to make sure you’re happy with any changes that might be made.

While we’ve tried to make our privacy policy as comprehensive as possible, it doesn’t include an exhaustive list of every aspect of how we collect and use personal information. If you need any further information or explanation though, we’re happy to help.If you have any questions about this policy, please contact us using the details in the ‘Contact us’ section below.

Why we collect your data

We collect and process personal data about the people who interact with us. The kind of data we collect depends on someone’s needs, and how they’re using our services. For instance, we might collect data to communicate with someone and send requested information to them, to help us administer campaigns and donations, or to improve our services.

We collect the minimum of data required to provide our services and do our work. We’re completely committed to protecting your data and privacy, and we pride ourselves on taking great care to ensure it stays completely safe.

Some of the reasons we might collect your data include:

to record and contact you regarding payments we make to you or you make to The ONA Foundation
to administer services The ONA Foundation is providing to you
to communicate with you regarding The ONA Foundation work, fundraising, and campaigning activities
to process donations and administer Gift Aid information for any donation you make to The ONA Foundation
to manage your communication preferences
to process job applications or volunteer placements
to conduct surveys, research and gather feedback
to obtain information to improve The ONA Foundation services and user experiences
to address and resolve complaints about The ONA Foundation and our services
to carry out research to find out more information about our supporters’ and prospective supporters’ backgrounds and interests
to comply with applicable laws and regulations, and requests from statutory agencies
to comply with our contractual obligations to our funders
to administer access to and use of The ONA Foundation app where you have opted to use this service

Information we collect

Depending on how you work with us, the types of information we collect from you might include:

your name and date of birth
contact details – including your postal address, telephone number(s), and email address
your bank details
records of your correspondence and engagement with us
donation history and Gift Aid details
information you may enter on The ONA Foundation website
photographs, video or audio recordings
occupation
biographical information
other information you share with us

This information may be collected via:

any paper forms you complete
telephone, or email conversations, or face-to-face interactions
digital forms completed via our website, or online surveys
third-party companies and websites
publicly available sources
communication via social media

We sometimes also collect sensitive, personal data about individuals. We will only record this data where we have your explicit consent, unless we are permitted to do so in other circumstances under data protection law. Where we are providing you with advice or support services, we may record your sensitive personal data if this is necessary for the establishment, exercise or defence of legal claims, or if it is in the substantial public interest because we would not be able to provide our services without doing so.

Using your personal data

If you are receiving grants or support from us, or if someone else has referred you to us for such a service, we will need to process your data because of your specific relationship with us. We will keep all your relevant personal information – including notes, letters, emails and information given to us about you – in a confidential record that is specific to you.

We use an electronic case management system (customer relationship management system (CRM) or other electronic system, depending on the service) as well as paper records to support our advice, guidance and support provision.

This means that we can keep the information you provide us, so we are able to see the history and relevant details of your support and interests. This ensures that we provide appropriate and accurate information. We take information security very seriously.

We will discuss this with you as we go along, and will only act with your express consent unless one of the other legal bases in data protection legislation applies.

We may use your data for general statistical reports. These statistics will not include any information that could be used to identify any individual.

Where you have opted to use The ONA Foundation app, we will use the personal data you provide to create and maintain your account and to enable you to access the services offered within the app.

Fundraising/campaigning/direct marketing

We would love to keep you up to date with our fundraising, marketing and campaign activity.

We use a range of marketing activities and channels to contact our supporters – including our website, face-to-face fundraising, direct mail, email, and telephone.

We will obtain your consent to contact you by email and text message for marketing purposes. We will send you marketing by post, on the basis of it being within our legitimate interests to do so, unless you opt out.

We send the following marketing materials:

updates about The ONA Foundation work – including newsletters and other publications informing you about our work
campaigns – information about our campaigning activities including how you can support such campaigns,
appeals and fundraising activities – including requests for donations, information about how you can leave us a gift in your will, how you can raise money on our behalf and updates on the impact that your fundraising activities have had on our work
volunteering – information about how you can help support The ONA Foundation by giving up your time or using your influence to progress our aims, along with updates on the impact of your work

We will never share or sell your personal data to a third-party organisation for its marketing, fundraising or campaigning purposes. You can withdraw your consent, unsubscribe from or update your marketing preferences at any point using the details in the ‘Contact us’ section below.

Any electronic communications, such as emails, will have a link to unsubscribe from future electronic communications, so you can manage your own communication preferences.

If you make any changes to your consent, we will update your record without undue delay and at the latest within one month of receipt. It may take 60 days for our systems to update and stop any postal communications from being sent to you. Email communications will, however, be stopped immediately. If you tell us you do not wish to receive marketing, fundraising or campaign communications, you may still receive transactional and service-based communications confirming and servicing other relationships you have with us (as described below).

Where possible, we cleanse and remove out of date data by checking it against publicly available records such as deceased records. This helps us to improve the delivery rate of our mailings and minimise wasted expenditure.

Administrative communications to supporters

In addition to the fundraising and marketing communications that you receive from The ONA Foundation, we will also communicate with you by post, telephone, and email in relation to administrative and transactional matters. For example, we will call you after you have set up a Direct Debit to confirm your details, and upon cancellation. There may also be other occasions where we need to contact you about your donation – for example, if there is a problem with a payment or in relation to your gift aid declaration. As mentioned above, we may still need to communicate with you for administrative purposes even where you have opted out of marketing communications from us.

Supporter research and analysis

We may use profiling and database segmentation techniques to analyse your personal information, and create a profile of your interests, preferences and ability to donate. This allows us to ensure communications are relevant and timely, to provide an improved experience for our supporters. It also helps us understand the background of our supporters so that we can make appropriate requests to those who may be willing and able to donate more than they already do, or leave a gift in their will. This enables us to raise funds quicker and in the most cost-effective way.

Our fundraising team uses information that is already in the public domain (information that has been published in print or online) to identify high net worth individuals who may be interested in supporting our work with a major gift. These publicly available sources of information include Companies House, the electoral register, the phone book, the Charity Commission’s Register of Charities, LinkedIn, company annual reports, and articles in newspapers and magazines.

Under data protection legislation, you have the right to object to your data being processed in this way. If you wish to opt out of being identified as a high net worth individual, please contact our fundraising team at this address: info@theonafoundation.org

We are also legally required to carry out checks on individuals who give us large donations, to comply with our duties in respect of anti-money laundering legislation and the prevention of fraud.

Social media/digital

Depending on your settings or the privacy policies for social media messaging services like Facebook, and Instagram, you may receive targeted advertisements through our use of social media audience tools.

Our website also uses pixels through third-party service providers that allow us to track conversions and activity on our website as well as generating advertisements that appear on Facebook and other search engines, like Google, for you and other potential users. If you receive an email, open it, don’t open it, select a link and/or browse our website, we collect this information to ensure that the information we send to people is received and relevant.

When we’re seeing what people do online like this, we’re using cookies. We use cookies to tailor your browsing experience and ensure we show you more relevant information. If you don’t want cookies, you can set your browser to notify you when you receive one, then choose to decline it.

Applying for a job

When you apply for a job with us, your personal data will be collated to monitor the progression of your application, and the effectiveness of the recruitment process through the statistics collected.

Where we need to share your data – such as for gathering references – you will be informed beforehand, unless the disclosure is required by law.

Personal data about unsuccessful applicants are held for 12 months after the recruitment exercise is complete for that vacancy. You, as an applicant, can ask us to remove your data before this time if you do not want us to hold it.

Once you have taken up employment with The ONA Foundation, we will compile a file relating to your employment.

The information contained in this will be kept secure and will only be used for purposes directly relevant to your employment.

Our legal basis for processing personal data:

We need a lawful basis to collect and use your personal data under data protection law. This includes information that is processed on the basis of:

a person’s consent (for example, to send you direct marketing by email)
a contractual relationship (for example, to provide you with goods or services that you have purchased from us)
processing that is necessary for compliance with a legal obligation (for example to process a Gift Aid declaration, and carrying out due diligence on large donations)
The ONA Foundation legitimate interests (please see below for more information)
Personal data may be legally collected and used if it is necessary for a legitimate interest of the organisation using the data, if its use is fair and does not adversely impact the rights of the individual concerned

When we use your personal information, we will always consider if it is fair and balanced to do so and if it is within your reasonable expectations. We will balance your rights and our legitimate interests to ensure that we use your personal information in ways that are not unduly intrusive or unfair. Our legitimate interests include:

Charity Governance: including delivery of our charitable purposes, statutory and financial reporting and other regulatory compliance purposes,
Administration and operational management: including responding to solicited enquiries, providing information and The ONA Foundation services, research the administration of volunteers and employment, and recruitment requirements
Fundraising and Campaigning: including administering campaigns and donations, and sending direct marketing by post (and in some cases making marketing calls), sending thank you letters, analysis, targeting and segmentation to develop communication strategies, and maintaining communication suppressions.
Disclosure of your personal data

We will not share any of your personal data with any third party – except where:

the transfer is to a secure data processor, which carries out data processing operations on our behalf
we are required to do so by law, for example to law enforcement or regulatory bodies where this is required or allowed under the relevant legislation
it is necessary to protect the vital interests of an individual
we have obtained your consent
We will never share or sell your personal data to a third-party organisation for marketing, fundraising, or campaigning purposes.
Security of your personal data

We use appropriate technical and organisational measures and precautions to protect your personal data and to prevent the loss, misuse or alteration of your personal data. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. We are not responsible for the privacy statements, security, or other content on sites outside of the website.

Use of data processors

We may use a third-party supplier to manage mailings for fundraising appeals, campaigns, conduct research surveys or storage of your personal information on our behalf, and to manage billing and accounting on legal cases and to provide some of our advice and support services to you.

Retention of your data

Whatever your relationship with us, we will only store your information for a specified amount of time, the length of time that data will be kept may depend on the reasons for which we are processing the data and on the law or regulations that the information falls under, such as financial regulations, Limitations Act, Health and Safety regulation etc., or any contractual obligation we might have. Once the retention period has expired, the information will be confidentially disposed of or permanently deleted, or anonymised.

If you request to receive no further contact from us, we will keep some basic information about you on our suppression list to avoid sending you unwanted materials in the future.

Right of Access

You have the right to know what information we hold about you and to ask, in writing, to see your records.

We will supply any information you ask for that we hold about you as soon as possible, but this may take up to one calendar month. We will not charge you for this other than in exceptional circumstances. You will be asked for proof of identity as the person dealing with your request may not be the staff member you have met before. We need to be sure we are only releasing your personal data to you.

This is called a data subject access, and can be done by:

Emailing info@theonafoundation.org

Right to be informed

You have the right to be informed how your personal data will be used. This policy, as well as any additional information or notice that is provided to you either at the time you provided your details, or otherwise, is intended to provide you with this information.

Right to withdraw consent

Where we process your data based on your consent (for example, to send you marketing texts or emails), you can withdraw that consent at any time. To do this, or to discuss this right further with us, please contact us using the details in the ‘Contact us’ section below.

Right to object

You also have a right to object to us processing data where we are relying on it being within our legitimate interests to do so (for example, to send you direct marketing by post). To do this, or to discuss this right further with us, please contact us using the details in the ‘Contact us’ section below.

Right to restrict processing

In certain situations, you have the right to ask for processing of your personal data to be restricted because there is some disagreement about its accuracy or legitimate usage.

Right of erasure

In some cases, you have the right to be forgotten (i.e. to have your personal data deleted from our database). Where you have requested that we do not send you marketing materials, we will need to keep some limited information to ensure that you are not contacted in the future.

Right of rectification

If you believe our records are inaccurate, you have the right to ask for those records concerning you to be updated. To update your records, please get in touch with us using the details in the ‘Contact us’ section below.

Right to data portability

Where we are processing your personal data because you have given us your consent to do so, you have the right to request that the data is transferred from one service provider to another.

Complaints

If you have any complaints about the way in which we have used your data, please get in touch with us using the details in the ‘Contact us’ section below.