Registered Charity 1183086
Harry’s Hydrocephalus Awareness Trust (Harry’s HAT) takes the privacy and security of personal information seriously. This notice explains what information we collect, why we use it, how we protect it, who we may share it with and the rights you have.
Harry’s HAT is a registered charity in England and Wales, charity number 1183086. For data protection purposes Harry’s HAT is the data controller, which means we are responsible for deciding how and why personal information is used.
If you have a question about your personal information, want to exercise a data protection right or want to make a data protection complaint, please contact:
| Information Officer / Data Protection Lead Harry’s Hydrocephalus Awareness Trust Email: info@harrys-hat.org Telephone: 07961 001710 |
We process personal information in accordance with applicable UK data protection and electronic communications law, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended. We also take account of changes made by the Data (Use and Access) Act 2025.
The information we collect depends on how you interact with Harry’s HAT. It may include:
Families may share information with us about hydrocephalus, treatment and other health matters. Health information is special category personal data and receives additional protection under data protection law.
We only use health information where we have a clear purpose and an appropriate legal basis and special category condition. Depending on the circumstances this may include explicit consent, or a condition in the Data Protection Act 2018 that allows a not-for-profit body to support people affected by a particular medical condition or to safeguard children and people at risk.
Children are central to our work. We collect only information that is reasonably necessary, limit access to people who need it and take additional care before publishing a child’s name, photograph, film, story or health information.
We may collect information directly from you when you:
We may also receive information from third parties where they are permitted to provide it to us, for example fundraising and donation platforms, event organisers, professional partners or someone acting on your behalf.
We only use personal information where we have a lawful reason. The lawful basis depends on what we are doing and may include consent, contract, legal obligation, legitimate interests, vital interests or a task carried out in the public interest.
| Activity | Why we use information | Typical lawful basis |
|---|---|---|
| Family support and services | To respond to families, deliver support, manage groups/events and keep appropriate service records. | Usually legitimate interests and/or consent. Where health information is involved we also identify an Article 9 / Data Protection Act condition. |
| Donations, Gift Aid and fundraising | To process donations, administer Gift Aid, support fundraisers and keep financial records. | Contract, legal obligation and/or legitimate interests. |
| Newsletter and email marketing | To send the Harry’s HAT newsletter and other electronic marketing where permitted. | For our current newsletter list we rely on consent. We also comply with PECR. |
| Events and activities | To administer bookings, safety, communications and participation. | Contract, legitimate interests, consent and/or legal obligation depending on the activity. |
| Volunteers, staff and recruitment | To recruit, manage and support people working with or for the charity. | Contract, legal obligation and legitimate interests, with additional conditions for special category or criminal offence data where needed. |
| Safeguarding | To identify, record, share and respond to safeguarding concerns where necessary. | Legal obligation, vital interests, legitimate interests and/or public interest depending on the circumstances, with the appropriate special category condition where relevant. |
| Impact, research and reporting | To understand our reach and improve our work. We normally use aggregated or anonymised information for external reports. | Legitimate interests, consent and/or public interest as appropriate. |
| Website and security | To operate, protect and improve our website and systems. | Legitimate interests, consent for non-essential cookies and legal obligations where relevant. |
Harry’s HAT sometimes invites families, children and young people to share their experiences through surveys, interviews and other research activities. Taking part is entirely voluntary and your decision will not affect the support you receive from us.
Before you take part, we will explain what the research involves, how your information will be used and how long it will be kept. We will seek separate permission where appropriate to record interviews, use quotations or share identifiable stories. You can also choose whether you would like us to contact you about future research opportunities.
We take particular care when research involves children, young people or sensitive health information. Research findings will normally be shared anonymously wherever possible.
Harry’s HAT uses Donorfy as our charity customer relationship management (CRM) system. Depending on your relationship with us, Donorfy may hold information such as your contact details, donations, fundraising activity, event engagement, family engagement and communication preferences.
Donorfy processes information on our behalf. Harry’s HAT remains responsible for deciding how and why the information is used. Access is limited to authorised members of our team according to their role.
Donorfy states that its standard service is hosted using Microsoft Azure in the North Europe data centre in Dublin, Republic of Ireland. We assess our suppliers and contractual arrangements and take appropriate steps where information is processed outside the UK.
Our current newsletter is sent only to people who have consented to receive it. We keep a record of communication preferences and, where we rely on consent, evidence of that consent.
Every newsletter contains an unsubscribe link. You can unsubscribe at any time. We may keep a minimal suppression record after you unsubscribe so that we can respect your preference and avoid adding you back to the mailing list accidentally.
UK electronic marketing law also allows charities to use a charitable-purpose soft opt-in in certain circumstances. If Harry’s HAT uses this route for any communication, we will only do so where the legal conditions are met and every message will provide a simple way to opt out.
Families sometimes choose to share experiences to help raise awareness, support other families or raise funds. We explain how identifiable photographs, films, stories and case studies will be used before publication and obtain appropriate permission where consent is our lawful basis.
If we rely on consent you may withdraw that consent for future use. We will take reasonable steps to stop further use, although we may not always be able to retrieve material that has already been printed, published or legitimately shared.
We may take photographs or film at Harry’s HAT events for appropriate charitable communications. We will normally make general event photography clear through event information or signage and provide a practical way for people to tell us if they do not wish to be photographed. We take additional care with identifiable children and young people and obtain appropriate permission where required.
We do not sell personal information. We may share information where necessary and lawful with:
Where another organisation acts as a processor for us we put appropriate contractual and security arrangements in place. Where another organisation is a separate or joint controller we consider the respective responsibilities and provide appropriate privacy information.
Some service providers may store or process personal information outside the UK. Where this happens we use the safeguards required by UK data protection law, such as a recognised adequacy arrangement or approved contractual safeguards, where required.
Our website may use cookies and similar technologies. Cookies that are strictly necessary may be used without consent. Where cookies are not strictly necessary, such as certain analytics or advertising cookies, they should only be set after you have made an appropriate choice through our cookie controls.
For more information about the cookies used on our website and how to manage your preferences, please see our Cookie Notice or the cookie settings available on our website, where provided.
We keep personal information only for as long as it is needed for the purpose for which it was collected and to meet legal, financial, safeguarding, regulatory or operational requirements. Different information is therefore kept for different periods.
Harry’s HAT maintains a retention schedule and reviews information periodically. When information is no longer required it is securely deleted, destroyed or anonymised unless there is a lawful reason to retain it.
Where you take part in research carried out by Harry’s HAT, we will normally retain identifiable research responses, questionnaires and interview transcripts for up to three years after the research project has finished. Audio and video recordings will normally be securely deleted within three months of transcription and verification.
Research consent records will normally be kept for three years after the project has ended, or longer where necessary to demonstrate permission or meet legal requirements.
Contact details collected solely for research will be deleted when no longer required. Where you have agreed to be contacted about future research, we will review your contact details and preferences at least annually. You can withdraw your permission for future contact at any time.
Fully anonymised research findings may be retained for future research, reporting and service development. We will explain any different retention arrangements before you take part.
We use proportionate technical and organisational measures to protect personal information. These include access controls, secure systems, appropriate passwords and authentication, staff awareness and procedures for responding to suspected personal data breaches.
Depending on the circumstances you may have rights to:
These rights are not absolute and exemptions can apply. To exercise a right, contact info@harrys-hat.org. We may need to confirm your identity and will respond within the applicable legal time limit.
Harry’s HAT does not currently use solely automated decision-making that produces legal or similarly significant effects on individuals.
If you are concerned about how we have used your personal information, please contact our Information Officer / Data Protection Lead at info@harrys-hat.org or 07961 001710.
We will provide a clear route for data protection complaints, acknowledge a complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.
You also have the right to raise a concern with the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. You do not have to complain to us before contacting the ICO.
We have procedures for identifying, assessing and managing personal data breaches. Where the law requires it, we will notify the ICO within the required timescale and tell affected individuals where the breach is likely to result in a high risk to them.
We keep this Privacy Notice under review and may update it when our activities, systems or legal obligations change. The current version will be published on our website.
Last reviewed: August 2026
Next scheduled review: August 2027