Cord is committed to respecting and protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal data, and how we comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and related legislation.
We aim to be open and transparent about how we use personal information and to ensure it is handled lawfully, fairly, and securely.
1. Who we are
Cord is a peacebuilding charity working with communities affected by conflict and injustice. For the purposes of data protection law, Cord is the data controller responsible for the personal data described in this policy.
Data controller: Cord
ICO registration number: Z7163794
Contact email: info@cord.org.uk
Postal address:
Cord
Office G7
Enterprise House
Courtaulds Way
Coventry
CV6 5NX
United Kingdom
2. What personal data we collect
We may collect and process the following types of personal data:
- Contact details such as name, postal address, email address, and telephone number
- Donation and transaction details, including Gift Aid declarations
- Website usage information, including IP address, browser type, pages visited, and referral source
- Communications preferences, including whether you have opted in or out of receiving marketing
- Information you provide voluntarily, for example through enquiry forms, event registrations, or correspondence with us
We do not intentionally collect special category data via our website.
3. How we collect personal data
We collect personal data when you:
- Make a donation or purchase via our website
- Sign up to receive our newsletters or other communications
- Contact us with an enquiry or request
- Visit our website (through cookies and similar technologies)
4. How we use your personal data
We use personal data for the following purposes:
- To process donations, payments, and Gift Aid claims
- To administer and improve our website and services
- To communicate with you about your donations, enquiries, or support
- To send newsletters and fundraising communications, where you have consented or where we have a legitimate interest
- To meet our legal and regulatory obligations
- To maintain accurate records and manage supporter relationships
We will not use your personal data in ways that are incompatible with these purposes.
5. Lawful bases for processing
Under UK GDPR, we rely on the following lawful bases to process personal data:
- Consent – where you have explicitly agreed (for example, to receive email marketing)
- Contract – where processing is necessary to fulfil a donation, purchase, or other request
- Legal obligation – for example, retaining Gift Aid records for HMRC
- Legitimate interests – to communicate with supporters, improve our work, and raise funds, where these interests are not overridden by your rights
You can withdraw consent or object to processing at any time by contacting us using the details provided in Section 14.
6. Sharing your personal data
We only share personal data where necessary and proportionate. This includes:
- Payment service providers (such as PayPal and Stripe) to process donations and payments
- Service providers and suppliers who support our operations, under appropriate contractual safeguards
- Regulatory or legal authorities where required by law
We do not sell personal data or share it with third parties for their own marketing purposes.
7. International data transfers
Some of our service providers may process personal data outside the UK or European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses, to protect your personal data in line with UK GDPR requirements.
8. Data retention
We retain personal data only for as long as necessary for the purposes for which it was collected, including legal, regulatory, and reporting requirements.
In particular:
- Gift Aid records are retained for at least six years in line with HMRC requirements
- Supporter contact details are reviewed regularly and securely deleted when no longer needed, or where you have opted out and there is no lawful reason to retain them
9. Your rights
You have the following rights under data protection law:
- The right to access the personal data we hold about you
- The right to request correction of inaccurate or incomplete data
- The right to request erasure of your personal data in certain circumstances
- The right to restrict or object to processing
- The right to data portability, where applicable
- The right to withdraw consent at any time
- The right to lodge a complaint with the Information Commissioner’s Office (ICO)
You can exercise these rights by contacting us using the details in Section 14.
10. Cookies and website analytics
Our website uses cookies to improve functionality and understand how visitors use the site. Some cookies are essential, while others (such as analytics cookies) are used only with your consent.
We use Analytical tools to review website usage. Information collected is used to produce statistical reports and does not identify individual users.
You can manage or withdraw your cookie preferences at any time by clicking on the Cookie Settings icon at the bottom left of our website.
Types of Cookies we use
11. Security of your personal data
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, or disclosure. These include access controls, secure systems, and encryption of online transactions.
While we take reasonable steps to protect your information, no method of transmission over the internet is completely secure.
12. Data breaches
In the event of a personal data breach, we will assess the risk and report it to the Information Commissioner’s Office within 72 hours where required, and notify affected individuals where appropriate.
13. Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page, and we encourage you to review it periodically.
14. Contact us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
Email: info@cord.org.uk
Post:
Cord
Office G7
Enterprise House
Courtaulds Way
Coventry
CV6 5NX
United Kingdom
