Last updated: 24th September 2026
The Sussex Heart Charity is committed to protecting your personal information and respecting your privacy.
This privacy policy explains what personal information we collect, why we use it, how we keep it safe, when we may share it and how long we keep it. It also explains your rights under data protection law.
Who we are
The Sussex Heart Charity is a registered charity and company limited by guarantee. Our purpose is to improve the lives of people with heart conditions in Sussex.
For data protection purposes, the Sussex Heart Charity is the data controller for the personal information covered by this policy. This means that we are responsible for deciding how and why that information is used.
The Sussex Heart Charity
Southpoint
8 Paston Place
Brighton
East Sussex
BN2 1HA
Registered charity number: 1120998
Company number: 06339790
Email: info[at]sussexheartcharity.org
Telephone: 01273 523 026
The Chief Executive is the main contact for data protection and privacy enquiries. We have not appointed a Data Protection Officer.
Who this policy applies to
This policy applies when you interact with the Sussex Heart Charity. This may include when you:
- make a donation or support our fundraising
- subscribe to our newsletters or other communications
- apply for funding, an educational bursary or support from one of our programmes
- book or attend an event, Rescue Ready session or Heart to Heart meeting
- apply for or act as the custodian of a charity-funded AED
- purchase something from our online shop
- contact or correspond with us
- appear in photographs or video connected with our work
- work with us as a healthcare professional, supplier, contractor, trustee, volunteer or employee
- visit our website.
What personal information we collect
The information we collect depends on how you interact with us.
Contact and identity information
This may include your name, postal address, email address, telephone number, organisation, job title or professional role.
Donations and supporter information
When you donate or fundraise for us, we may hold information including your donation history, Gift Aid status and declaration, communication preferences and correspondence with us.
Our supporter records help us maintain an appropriate history of our relationship with individual supporters. We may therefore keep relevant notes about communications or requests you have made, for example if you ask us not to contact you in a particular way.
Some donation and fundraising services allow you to leave a message with your donation. These messages may be retained alongside the relevant donation record.
Payment information
We do not normally receive or store your full payment card details.
Card, Direct Debit and online payments are processed through appropriate payment, banking or fundraising providers.
Where you pay by BACS, information such as your name and payment reference may appear in our banking and accounting records.
Where you donate by cheque, we will necessarily receive the information printed on the cheque. Cheques and other financial records are handled securely and retained only where required for banking, accounting or legal purposes.
We may also receive donations through third-party organisations, fundraising platforms, funeral directors or charitable giving services. Those organisations may process your personal information under their own privacy policies.
Gift Aid
Where you ask us to claim Gift Aid, we collect the information required to administer your Gift Aid declaration and submit claims to HM Revenue & Customs.
This normally includes your name, home address, declaration and relevant donation history.
Funding and grant applications
If you apply to us for funding, we may collect information such as your name, contact details, organisation, role, information about the proposed project, quotes or supporting documents and details of other people involved in the application.
Applications may include professional contact information for line managers, service leads or others involved in the proposed project.
Where applications are shared with trustees or committees for consideration, we remove unnecessary personal information where practicable. Contact details may be removed and applicants may be referred to using a title, surname or initial where their full identity is not required.
Educational bursaries and reimbursements
For educational bursaries, we may hold details of your role, employer, line manager, course or conference, dates, amount requested, funding decision, evidence of attendance and reimbursement information.
Where reimbursement is approved, we ask for bank details separately. These details are used only to make the agreed payment and are not intended to form part of the permanent bursary record.
AED applications and custodians
If you apply for a charity-funded AED or become responsible for one, we may collect your name, organisation, contact details, proposed AED location and other information necessary to consider the application and maintain an ongoing relationship with the AED custodian.
We may continue to hold appropriate custodian contact information while the AED remains in service so that we can communicate about matters such as consumables, maintenance, recalls or changes of custodian.
Where appropriate, relevant information about an AED and its location may also be shared with national defibrillator systems.
Rescue Ready
For Rescue Ready bookings, we collect the contact details of the person organising the session together with information about the organisation, group and proposed session.
An attendance register is taken for each session and the Sussex Heart Charity may receive the first and surname of attendees so that participation certificates can be produced.
We do not need to maintain a permanent record of the identity of individual attendees. Once certificates have been produced and any necessary corrections have been dealt with, identifiable attendance registers are deleted.
We retain anonymised information such as the date, location and total number of people attending for monitoring and reporting purposes.
Heart to Heart
If you join the Heart to Heart mailing list, we hold the information you provide, normally your name and email address.
We may ask whether you expect to attend a particular meeting and use a temporary attendance list on the day to help us manage the meeting.
We do not maintain a permanent named attendance history for Heart to Heart meetings. Temporary attendance lists are destroyed or deleted once they are no longer needed.
Heart to Heart may also use optional third-party messaging services for group communication. If you choose to join one of these groups, the provider of that service will process information in accordance with its own privacy terms. Depending on the type of group used, other participants may be able to see information associated with your account, such as your telephone number or profile information.
Events
We use third-party booking services to manage registrations for some events.
Depending on the event, we may collect information such as your name, postal address, email address, telephone number, emergency contact information, fundraising information, T-shirt size and other information needed to administer your participation.
Where a child takes part in an event, we ask that registration and relevant information is provided by their parent or guardian rather than directly by the child.
Online shop
If you place an order through our online shop, we may process information including your name, contact details, delivery address and details of the products ordered.
Payment information is processed by the relevant payment provider rather than being stored directly by the Sussex Heart Charity.
We retain information necessary to fulfil your order, deal with enquiries and meet our accounting and legal responsibilities.
Photographs and video
Photography is an important part of documenting and promoting the charity’s work.
At public fundraising events and similar activities, we may take photographs or video on the basis of our legitimate interests in promoting the charity, reporting on our work and maintaining a record of our activities.
Where practical, we provide a clear way for people to tell us that they do not wish to be photographed. We will take reasonable steps to avoid photographing those people and will not knowingly publish identifiable images of someone who has objected.
For posed photographs, sensitive situations, children or circumstances where specific permission is more appropriate, we may ask for verbal or written consent.
Written photographic permissions are retained with the relevant image or event records for as long as they remain necessary.
Selected photographs may be retained long term as part of the historical record of the Sussex Heart Charity.
Photographs may be published on our website and social media. We may also provide appropriate photographs to newspapers, media organisations or publicity platforms when promoting our charitable work.
If you appear in a photograph that we have published and have concerns about its use, please contact us.
Newsletters and communications
We use an email communications provider to distribute newsletters and manage mailing lists.
For our general supporter newsletter, we normally contact you where you have chosen to subscribe.
You can unsubscribe at any time using the link contained in our emails or by contacting us.
Our email communications service may provide information such as whether an email was opened or a link was clicked. We use this information to understand how useful our communications are.
We may also maintain limited professional mailing lists, for example for NHS cardiac staff and other relevant healthcare contacts who may reasonably be interested in our grants, bursaries or charitable programmes.
Where we contact someone in their professional capacity and the communication is relevant to their role, we may rely on our legitimate interests rather than consent. You can ask us to stop these communications at any time.
We do not sell or rent personal information to other organisations for marketing.
Health information and other sensitive information
We do not generally ask donors or supporters to provide medical information.
However, people sometimes voluntarily tell us about their own health, the health of someone close to them or the circumstances surrounding a donation. For example, this may be included in a donation message or correspondence with us.
We treat this information with additional care. We do not use health information supplied in this way for marketing or profiling and we do not deliberately collect more information than we need.
Where sensitive information is not required for the purpose for which it was provided, we may remove it from our records where practicable.
Participation in some of our charitable activities may also reveal information about a person’s connection with heart disease or cardiac care. We do not ask Heart to Heart participants to provide a medical diagnosis and we do not use membership of the group to create health profiles.
Where we intentionally need to process special category information, including health information, we will only do so where data protection law provides an appropriate additional condition for us to do so. This may include explicit consent where appropriate.
How we use personal information
We may use personal information to:
- administer donations and Gift Aid
- maintain appropriate records of our supporters and our relationship with them
- respond to enquiries and correspondence
- assess, administer and monitor grants, funding requests and educational bursaries
- make reimbursement payments
- administer our AED programme and maintain contact with AED custodians
- arrange and evaluate Rescue Ready sessions
- administer Heart to Heart
- organise fundraising and other events
- fulfil online shop orders
- communicate about our work, fundraising opportunities, services and programmes
- maintain financial, accounting, governance and regulatory records
- manage relationships with healthcare professionals, suppliers and partner organisations
- employ staff and administer payroll
- manage trustees, volunteers and other people who work with us
- protect the security and integrity of our systems
- improve our website and understand how it is used
- promote and document the work of the charity through appropriate photography and publicity
- establish, exercise or defend legal rights
- meet our legal and regulatory obligations.
Our lawful bases for using personal information
Data protection law requires us to have a lawful basis for using personal information. The basis we rely on depends on what we are doing with the information.
Legitimate interests
We rely on legitimate interests where using personal information is reasonably necessary for the operation and charitable purposes of the Sussex Heart Charity and where those interests are not overridden by your rights and interests.
Examples include maintaining supporter relationships, considering funding applications, administering charitable programmes, maintaining contact with AED custodians, communicating with relevant professional contacts, responding to enquiries, protecting our systems and taking appropriate photographs at public charity events.
Where we rely on legitimate interests, we consider the purpose of the processing, whether it is necessary and the potential impact on the people concerned.
Consent
We rely on consent where this is the most appropriate basis, including for our general email newsletter and certain uses of photographs or sensitive information.
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not make earlier processing unlawful.
Contract
We may need to process information to enter into or carry out an agreement with you.
This may apply, for example, to online shop orders, event bookings, employment arrangements and some funding or bursary agreements.
Legal obligation
We process some information because we are legally required to do so.
This includes information required for accounting, taxation, Gift Aid, employment and charity or company administration.
Where we obtain personal information
Most of the personal information we use is provided directly by you.
We may also receive information from:
- fundraising and donation platforms
- payment providers and banks
- event booking services
- organisations arranging donations in memory of someone
- healthcare organisations and professional contacts
- organisations helping us deliver our charitable programmes
- suppliers and partner organisations
- publicly available professional sources where relevant to our charitable work.
Where another organisation collects your information in its own right, its own privacy policy may also apply.
Who we share information with
We only share personal information where there is an appropriate reason to do so.
Depending on how you interact with us, this may include organisations that provide services to the Sussex Heart Charity, including:
- payment, banking and fundraising providers
- supporter relationship and mailing-list providers
- website hosting, forms, analytics and security providers
- cloud storage and business administration providers
- event registration and online shop providers
- accounting, payroll and other professional service providers
- our independent examiner and professional advisers
- organisations helping us deliver particular charitable programmes
- HM Revenue & Customs, regulators, law enforcement bodies or other authorities where required by law.
We may also share limited information with organisations involved in delivering a particular activity or programme.
Where we provide photographs or publicity material to media organisations, they may process that material independently under their own data protection responsibilities.
We require organisations processing personal information on our behalf to handle it appropriately and in accordance with applicable data protection requirements.
We do not sell personal information.
International transfers
Some of the service providers we use operate internationally. This means that personal information may sometimes be processed or stored outside the United Kingdom.
Where personal information is transferred outside the UK, we take steps to ensure that the transfer is permitted under UK data protection law.
This may include using providers based in countries recognised as providing an adequate level of protection or relying on appropriate contractual and other safeguards.
You can contact us if you would like further information about the safeguards applying to a particular transfer.
Website, cookies and analytics
When you visit our website, certain technical information may be processed automatically. This can include your IP address, browser or device information and information about how you use the site.
Some cookies are necessary for the website to function.
Other cookies, including analytics cookies, are used only where the appropriate consent has been obtained.
We use analytics services to help us understand how visitors use the website and improve its content and performance.
Further information about individual cookies, analytics and your choices is provided through our website’s cookie settings and cookie policy.
You can change your cookie preferences at any time through the cookie settings available on the website.
How long we keep personal information
We do not keep personal information for longer than we reasonably need it.
Different information needs to be retained for different periods depending on its purpose and any legal, accounting or regulatory requirements.
As a general guide:
- financial, accounting, donation, Gift Aid and grant payment records are normally retained for at least the period required by law, which will commonly be around six years
- core records relating to successful grants and educational bursaries are normally retained for six years after the relevant financial year
- unsuccessful funding applications will normally be retained for up to two years after the decision, unless there is a particular reason to keep them longer
- duplicate website form submissions are removed once they are no longer required for administration and the appropriate master record has been retained
- bank details collected specifically for reimbursements will normally be deleted within 30 days of a successful payment
- identifiable Rescue Ready attendance registers will normally be deleted within 30 days of certificates being produced, while anonymised attendance statistics may be retained
- temporary Heart to Heart attendance or RSVP lists are deleted once they are no longer needed for the relevant meeting
- mailing-list information is retained while you remain subscribed. Limited suppression information may be retained after you unsubscribe so that we can respect your request not to contact you
- AED custodian information may be retained while the AED remains in service and for a reasonable period afterwards where this is necessary to maintain an appropriate record of the charity’s funding and support
- supporter relationship records are retained while there is an ongoing relationship or another legitimate reason to retain them. We periodically review information relating to inactive supporters and remove or minimise information that is no longer required, subject to financial and legal retention requirements
- selected photographs may be retained indefinitely as part of the charity’s historical archive. Where an image is retained or continues to be used on the basis of a specific photographic permission, the corresponding permission may also be retained
- ordinary correspondence is kept according to its subject matter and deleted when it no longer has an administrative, legal or historical purpose
- employment and personnel information is retained in accordance with applicable employment, payroll, pension and legal requirements.
Moving information into an archive does not mean that it has been deleted. Archived personal information remains subject to our data protection responsibilities.
Keeping your information secure
We take appropriate technical and organisational measures to protect personal information from accidental loss, misuse, alteration, unauthorised access or disclosure.
Access to personal information is restricted to those who need it for their role.
The Chief Executive has overall administrative access to the charity’s principal systems and other members of staff are given access only to the information and systems required for their work.
Trustees do not have general access to our supporter databases or operational systems. Where information needs to be provided to trustees or a committee, we aim to minimise the personal information disclosed.
We regularly review how information is stored, accessed and backed up and take reasonable steps to protect it throughout its lifecycle.
No system can be guaranteed to be completely secure, but we take our responsibilities for protecting personal information seriously.
Children
Our website and services are not intended to collect personal information directly from children without appropriate adult involvement.
Children may participate in family events such as our Sponsored Walk. Where this happens, we ask that their registration and relevant information is provided by a parent or guardian.
We take additional care when using identifiable photographs of children and seek appropriate parental or guardian permission where required.
Your rights
Depending on the circumstances and the lawful basis we are relying on, you may have the right to:
- ask us for a copy of the personal information we hold about you
- ask us to correct information that is inaccurate or incomplete
- ask us to delete your personal information in certain circumstances
- ask us to restrict how we use your information
- object to particular uses of your personal information
- receive certain information in a portable format
- withdraw your consent where we are relying on consent
- object to direct marketing at any time
- complain about the way we have handled your personal information.
These rights do not apply in exactly the same way in every situation and there may be circumstances where the law allows or requires us to retain or continue using information.
You have an absolute right to object to the use of your personal information for direct marketing. If you ask us to stop sending you marketing communications, we will do so.
You can exercise your rights by contacting the Chief Executive using the contact details at the beginning of this policy.
We will normally respond to a valid data protection request within one month.
Automated decision-making
We do not use personal information to make decisions about individuals based solely on automated processing where those decisions would have legal or similarly significant effects.
Complaints
If you have any concern about the way the Sussex Heart Charity has collected or used your personal information, please contact the Chief Executive in the first instance. We will take your concern seriously and will try to resolve it.
You also have the right to raise a complaint with the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.
Information about making a complaint and exercising your data protection rights is available on the Information Commissioner’s Office website.
Other websites and services
Our website contains links to websites operated by other organisations.
This privacy policy applies to the personal information for which the Sussex Heart Charity is responsible. Other organisations and websites have their own privacy policies and we recommend reading those where you provide information directly to them.
Changes to this privacy policy
We review this privacy policy periodically and will update it where our activities, systems or legal obligations change.
The date at the top of this page shows when the policy was most recently updated.
If we make a significant change to the way we use personal information, we will take reasonable steps to bring that change to the attention of people affected.