Privacy policy
How we collect, use and protect your personal information, and the rights you have over it.
1. Who we are
The Ambrose Initiative Limited (“we”, “us”, “the charity”) is a charity registered in England and Wales, charity number 1212816, with its registered office at 71 Woodsford Square, London, W14 8DS.
We are the data controller for the personal information described in this notice. That means we decide why and how your personal data is used, and we are responsible for looking after it.
You can contact us about anything in this policy by emailing help@theambroseinitiative.org.uk, or by writing to us at the address above.
2. What information we collect
The information we hold depends entirely on your relationship with us.
If you contact us or use our website
- Your name, email address and any other details you choose to put in your message.
- Technical information created automatically when you visit the site: your IP address, browser type, and the pages you requested. This sits in our hosting provider’s server logs.
If you donate
- Your name, contact details, the amount and date of your donation, and your Gift Aid declaration and tax status where you provide one.
- We do not receive or store your full card number. Card payments are processed by a regulated payment provider, who handle those details under their own security standards.
If you volunteer or work with us
- Contact details, emergency contact, availability, references, and records of training you have completed.
- Where a role requires it, the result of a Disclosure and Barring Service (DBS) check. We record the outcome and the certificate number, and do not retain a copy of the certificate itself.
If we support you through our services
- Information necessary to help you safely and to meet our legal duties: contact and identity details, your support needs, accommodation and referral records, and notes of the help provided.
- This may include special category data — such as information about your health, disability, ethnicity or religious beliefs — and information about criminal offences, where that is relevant to keeping you and others safe or to accessing services on your behalf.
- We collect this because we cannot safely provide accommodation, safeguarding or advocacy without it. We collect the minimum we need, we tell you what we are recording, and wherever possible we agree it with you.
3. Our lawful bases for using it
Under the UK GDPR we must have a lawful basis for every use of personal data. Ours are:
| What we are doing | Lawful basis |
|---|---|
| Replying to your enquiry | Legitimate interests — responding to someone who contacted us |
| Providing shelter, food, clothing and support | Legitimate interests, and for special category data, substantial public interest (safeguarding individuals at risk) or your explicit consent |
| Processing a donation and its record-keeping | Legal obligation (charity and tax law) and legitimate interests |
| Claiming Gift Aid | Legal obligation, on the basis of the declaration you give us |
| Sending you marketing emails or newsletters | Your consent, which you can withdraw at any time |
| Recruiting and managing volunteers, including DBS checks | Legitimate interests, legal obligation, and substantial public interest for safeguarding |
| Keeping our accounts and meeting regulators’ requirements | Legal obligation |
| Protecting people from harm, including safeguarding referrals | Legal obligation, vital interests, and substantial public interest |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and concluded it is not. You can object to this — see section 7.
4. Who we share it with
We do not sell, rent or trade personal data. Ever. We share it only where we need to:
- Service providers acting on our instructions — our website host, email provider, payment processor and any database we use. They act as processors under a written contract and cannot use your data for their own purposes.
- HM Revenue & Customs — where you have made a Gift Aid declaration.
- Local authorities, the NHS, the police and partner agencies — where necessary to arrange your care or housing, or to protect someone from serious harm. Wherever it is safe and practical to do so, we discuss this with you first.
- Our regulators, auditors and professional advisers — where they require it, including the Charity Commission.
- Anyone we are legally required to disclose to — for example under a court order.
Some of our suppliers may process data outside the UK. Where that happens we make sure an appropriate safeguard is in place, such as UK adequacy regulations or the International Data Transfer Agreement.
5. How long we keep it
We keep personal data only as long as we need it, then delete it securely.
| Record | Kept for |
|---|---|
| General enquiries | 2 years from your last contact |
| Donation and Gift Aid records | 7 years, as required by HMRC and charity law |
| Volunteer records | 3 years after you stop volunteering with us |
| Records of people we have supported | Normally 7 years after our last contact, reflecting safeguarding and insurance requirements |
| Safeguarding records and serious incidents | Retained in line with statutory safeguarding guidance, which may be considerably longer |
| Marketing consent records | Until you withdraw consent, plus 2 years to evidence that we acted on it |
6. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your data — this notice.
- Access a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — ask us to delete data, where we have no overriding reason to keep it.
- Restrict processing while a concern is investigated.
- Data portability for data you gave us, in a machine-readable form.
- Object to processing based on legitimate interests, and to direct marketing at any time — an objection to marketing is always absolute.
- Withdraw consent at any time, where consent was our basis.
To exercise any of these, email help@theambroseinitiative.org.uk. We will respond within one month. There is no charge, and we may ask you to verify your identity first.
7. Complaining to the regulator
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at any time:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · Helpline 0303 123 1113 · ico.org.uk/make-a-complaint
8. How we protect your information
We use access controls so that staff and volunteers can only see the data their role requires, encrypted connections (HTTPS) across this website, reputable providers for hosting and payments, and secure disposal of paper records. We train everyone who handles personal data. No system is perfectly secure, but we take these duties seriously and will notify you and the ICO where the law requires it if something goes wrong.
9. Children
Our services are designed for adults. We do not knowingly collect data from children through this website. If we become aware that we hold a child’s data without an appropriate basis, we will delete it. Where a child is encountered through our work, we follow our safeguarding policy and refer to statutory children’s services.
10. Cookies
How this site uses cookies and similar technologies is set out separately in our cookie policy.
11. Changes to this notice
We review this notice at least annually. If we make a material change to how we use personal data, we will update the date at the top of this page and, where appropriate, tell you directly.
This policy was adopted by the trustees of The Ambrose Initiative Limited and is reviewed at least annually, or sooner if the law or our practice changes.