Data Protection

1. Data controller

The data controller for this website is One Woman at a Time (OWAAT), a UK registered charity. We are responsible for deciding how and why your personal data is collected and used.

Website: onewomanatatime.co.uk

2. What personal data we hold

We may collect and hold the following personal data depending on how you interact with us:

• Your name, email address, and phone number
• Donation records and Gift Aid declarations
• Fundraising event registration details, including charity challenge sign-ups
• Volunteer and supporter information
• Communications sent to us via our website, email, or social media
• Newsletter subscription preferences

We only collect information that is necessary to support our charitable activities, process donations, or communicate with you about our work.

3. Lawful basis for processing

We process your personal data on the following lawful bases:

• Contract — to process event registrations, challenge sign-ups, and related arrangements
• Legal obligation — to meet HMRC requirements in relation to Gift Aid claims and financial record-keeping
• Legitimate interests — to manage our charity, communicate with supporters, and further our charitable mission
• Consent — where you have opted in to receive newsletters, updates, or fundraising communications from us

4. Sensitive and beneficiary data

Our work involves supporting vulnerable women and girls in challenging circumstances. Any stories or case studies shared on our website are used with consent and with names or identifying details changed to protect privacy. We do not hold or process personal data relating to our overseas beneficiaries on this website.

5. How we store your data

Your personal data is stored securely and is only accessible to authorised members of the OWAAT team and trustees. We apply appropriate technical and organisational measures to protect your information from unauthorised access, loss, or misuse.

6. How long we keep your data

We retain your personal data only for as long as necessary. Donor and Gift Aid records are kept for a minimum of 6 years in line with HMRC requirements. Event and challenge registration data is held for up to 2 years after the event. Newsletter subscribers’ data is held for as long as you remain subscribed. You can unsubscribe at any time.

7. Sharing your data

We do not sell your personal data. We may share it with trusted third parties only where necessary, such as event booking platforms (TryBooking, BookItZone) used to manage our charity challenge registrations. These parties are required to handle your data in accordance with UK GDPR.

8. Your rights

Under UK GDPR, you have the following rights:

• The right to access the personal data we hold about you
• The right to have inaccurate data corrected
• The right to have your data deleted (where applicable)
• The right to restrict or object to how we process your data
• The right to withdraw consent at any time, including unsubscribing from communications

To exercise any of these rights, please contact us and we will respond within one month.

9. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

ICO website: www.ico.org.uk  |  ICO helpline: 0303 123 1113