Data Protection and UK GDPR Policy

Al-Waris Foundation is committed to protecting personal data and respecting the privacy rights of individuals whose information it processes.

The charity will process personal data lawfully, fairly, transparently and securely in accordance with applicable data protection law, including the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

Al-Waris Foundation recognises that responsible data protection is essential to maintaining the trust of donors, beneficiaries, volunteers, supporters, trustees and other people who interact with the charity.

The Board of Trustees has ultimate responsibility for ensuring that appropriate data protection governance is maintained.

Operational responsibilities may be delegated to authorised individuals, but the Board retains overall accountability.

This policy applies to personal data processed by or on behalf of Al-Waris Foundation.

It applies to:

It applies regardless of whether information is held:

Personal data means information relating to an identified or identifiable living individual.

Examples include:

Special category personal data includes information revealing or concerning:

Additional legal conditions apply to processing this information.

Personal data relating to criminal convictions, offences or related security measures is subject to additional legal requirements.

Processing includes collecting, recording, organising, storing, accessing, changing, using, sharing, transmitting, restricting, deleting or destroying personal data.

A data subject is the living individual to whom personal data relates.

A controller determines why and how personal data is processed.

Al-Waris Foundation will normally act as controller for personal data collected for its own charitable activities.

A processor processes personal data on behalf of a controller.

External technology and service providers may act as processors for Al-Waris Foundation.

Al-Waris Foundation will process personal data in accordance with the UK GDPR principles.

Personal data must be:

Personal data must be processed lawfully, fairly and in a way individuals can reasonably understand.

Personal data must be collected for specified, explicit and legitimate purposes and not subsequently used incompatibly with those purposes.

The charity should collect only the personal data reasonably necessary for the relevant purpose.

Reasonable steps should be taken to ensure personal data is accurate and, where necessary, kept up to date.

Personal data must not be kept indefinitely without a legitimate reason.

Retention requirements should be documented.

Appropriate technical and organisational measures must protect personal data against:

Al-Waris Foundation must be able to demonstrate appropriate compliance with these principles.

Before processing personal data, the charity must identify an appropriate lawful basis.

Depending on the circumstances, this may include:

The individual has given valid consent for a specified purpose.

Processing is necessary to enter into or perform a contract with the individual.

Processing is necessary to comply with a legal obligation.

Processing is necessary to protect someone's life.

Processing is necessary for a task in the public interest where the relevant legal requirements are met.

Processing is necessary for a legitimate interest pursued by the charity or another person, provided those interests are not overridden by the individual's rights and interests.

The charity must not automatically rely on consent where another lawful basis is more appropriate.

Special category personal data must only be processed where:

Where required, an additional condition under the Data Protection Act 2018 must also be identified.

Examples of situations where Al-Waris Foundation may encounter special category data include:

Access to special category data must be restricted appropriately.

Criminal offence data must only be processed where there is lawful authority to do so.

This may arise in connection with:

Such information must be subject to appropriate access and security controls.

Al-Waris Foundation may process personal data relating to:

Depending on the relationship and purpose, Al-Waris Foundation may process:

The charity should not collect information merely because it may be useful in the future.

Donor information may be processed for purposes including:

The charity will not sell donor personal data.

Payment-card information should be handled by approved payment processors rather than unnecessarily stored by Al-Waris Foundation.

Beneficiary data requires particular care because individuals may be experiencing hardship or vulnerability.

Only information reasonably required for:

should be collected.

Beneficiary information must not be collected merely for publicity.

Access should be restricted to people who genuinely require it.

A person's receipt of charitable assistance should not normally be publicly disclosed without an appropriate basis.

Volunteer information may include:

Access must be limited appropriately.

Information collected for safer recruitment must be handled in accordance with applicable legal requirements.

The Al-Waris Foundation website may process information relating to:

Access controls must ensure that users cannot access another person's private information merely by manipulating URLs or requests.

Administrative access must be appropriately restricted.

Al-Waris Foundation may use external payment processors, including Stripe, to process online donations.

Payment processors may process personal data independently or on behalf of the charity according to the circumstances and their contractual terms.

Al-Waris Foundation should avoid storing complete payment-card details where they are processed securely by the payment provider.

Payment information must only be accessible to authorised persons where required for legitimate purposes.

Production payment credentials must never be exposed in:

Al-Waris Foundation may use reputable technology providers to operate its services.

These may include providers for:

Current providers may include systems such as:

where these services are actively configured and used.

The use of a named provider in this policy does not permanently authorise that provider.

Appropriate due diligence and contractual arrangements must be maintained according to the nature of the processing.

Where practical, operational records should maintain the current list of processors and relevant data-processing arrangements so this policy does not require amendment every time a provider changes.

Al-Waris Foundation must provide appropriate privacy information explaining how personal data is processed.

Privacy information should include, where applicable:

Website privacy information should be readily accessible.

Where consent is relied upon, it must be:

Consent must not be inferred from silence or pre-ticked boxes.

Records of consent should be maintained where appropriate.

People must be able to withdraw consent as easily as they gave it.

Withdrawal does not invalidate processing lawfully undertaken before withdrawal.

Personal data relating to children requires additional care.

The charity should consider:

Privacy information intended for children should be understandable to the intended audience.

See the Safeguarding Children Policy and Photography, Video and Beneficiary Consent Policy.

Photographs and video may constitute personal data where individuals are identifiable.

Before collecting or publishing identifiable imagery, the charity must consider:

Receiving charitable assistance must not be made conditional on agreeing to publicity unless there is a legitimate and lawful reason for doing so.

See the Photography, Video and Beneficiary Consent Policy.

Marketing and fundraising communications must comply with applicable data protection and electronic communications requirements.

Where required, valid consent must be obtained.

Individuals must be provided with an appropriate method to opt out.

Opt-out and suppression records may need to be retained to ensure the charity does not contact people who have asked not to receive marketing.

Operational or transactional communications should not be incorrectly treated as marketing merely because they are sent electronically.

Personal information must be handled carefully when using email.

People acting for the charity should:

Sensitive personal data should not be sent insecurely merely for convenience.

Access to personal data must be based on legitimate organisational need.

The charity should apply the principle of least privilege.

Appropriate controls may include:

Shared administrative accounts should be avoided where reasonably practicable.

Passwords must not be:

Where authentication is provided by a secure identity platform, password handling should remain within that system rather than being recreated unnecessarily by the charity.

Multi-factor authentication should be used for sensitive administrative systems where available and proportionate.

Al-Waris Foundation will maintain technical and organisational security measures proportionate to:

Measures may include:

This replaces reliance on named legacy encryption products or software.

See the Information Security and Cybersecurity Policy.

Where personal devices are used for legitimate charity purposes, appropriate safeguards must be maintained.

Sensitive information should not be stored permanently on personal devices unless necessary and appropriately protected.

Relevant safeguards may include:

Loss or theft of a device containing charity personal data must be reported promptly.

Where personal data is held on paper:

Personal data must not be shared merely because another person or organisation requests it.

Before sharing, the charity should consider:

Data-sharing agreements should be used where appropriate.

Data protection law does not prevent appropriate safeguarding information sharing.

Where a child or adult may be at risk, the charity should consider whether information needs to be shared with:

Consent may not always be required.

The reason for significant safeguarding information-sharing decisions should be recorded.

Where another organisation processes personal data on behalf of Al-Waris Foundation, the charity must consider whether a legally compliant processor arrangement is required.

Processor contracts should address applicable matters required by UK GDPR, including:

The charity should conduct due diligence proportionate to the risk.

Al-Waris Foundation will not assume that personal data remains within the United Kingdom merely because a service is accessed from the UK.

Cloud, email, analytics, hosting, payment and other providers may process information internationally.

Where personal data is transferred to a country outside the United Kingdom, the charity must determine whether the transfer is permitted under UK data protection law.

Appropriate mechanisms may include:

Where required, an appropriate transfer risk assessment or data protection test should be completed.

International transfers must be documented appropriately.

Overseas charitable activities may involve personal data concerning:

Only information reasonably necessary for legitimate purposes should be transferred between countries.

Sensitive beneficiary data should not routinely be transferred to the UK merely because a project takes place overseas.

Where project evidence can be provided using anonymised or less identifiable information, this should be considered.

Al-Waris Foundation may maintain evidence relating to projects, including:

Accountability does not require unnecessary disclosure of beneficiary personal data.

Public transparency records should therefore distinguish between:

Reasonable steps must be taken to keep personal data accurate where accuracy is relevant to its use.

Individuals should be provided with appropriate ways to correct inaccurate information.

Material corrections should be reflected across relevant systems where reasonably practicable.

Personal data must be retained only for as long as necessary for:

Different categories of information may require different retention periods.

Detailed periods should be maintained in the Records Retention and Disposal Policy or Schedule.

Information must not simply be retained forever because storage is inexpensive.

When personal data no longer needs to be retained, it should be securely deleted or destroyed.

Appropriate methods may include:

The charity should recognise that immediate deletion from every backup may not always be technically possible. Backup retention and expiry should therefore be appropriately controlled.

Depending on the circumstances, individuals may have rights including:

Not every right applies in every circumstance.

Requests must be assessed under the applicable law rather than automatically accepted or rejected.

An individual may request access to personal data held about them.

Requests do not need to use particular legal wording to be valid.

Anyone receiving a request that may constitute a subject access request should promptly refer it to the person responsible for data protection.

The charity will:

Records should be maintained of the request and response.

Where personal data is inaccurate or incomplete, individuals may request correction.

The charity should correct inaccurate data without undue delay where required.

Where relevant, recipients of inaccurate information may also need to be informed.

Individuals may have a right to request deletion of personal data.

This right is not absolute.

The charity may need to retain information for reasons including:

For example, deleting a donor account does not necessarily require deletion of financial transaction records that the charity is legally required to retain.

Requests to object to processing or restrict processing must be assessed promptly.

Direct marketing objections must be respected where applicable.

The charity may retain limited suppression information to ensure that a person who has opted out is not inadvertently contacted again.

Al-Waris Foundation will not make solely automated decisions producing legal or similarly significant effects on individuals unless the processing is lawful and appropriate safeguards are provided.

If such processing is introduced in future, the charity must assess the legal and privacy implications before deployment.

Privacy and data protection should be considered when designing or changing:

The default configuration should avoid collecting or exposing unnecessary personal information.

A Data Protection Impact Assessment (DPIA) should be considered where processing is likely to result in a high risk to individuals' rights and freedoms.

Examples may include:

Where a DPIA is required, it should be completed before the relevant high-risk processing begins.

The website may use cookies or similar technologies.

Strictly necessary technologies may be used where legally permitted without consent.

Non-essential technologies, including analytics or advertising technologies where consent is required, must not be activated before valid consent is obtained.

Users should be provided with meaningful choices.

Withdrawing consent should be reasonably straightforward.

The website's cookie information should accurately reflect the technologies actually in use.

Where Al-Waris Foundation uses analytics services such as Google Analytics, they must be configured consistently with applicable privacy and electronic communications requirements.

Where consent is required:

Analytics should not be configured to intentionally collect unnecessary personal information.

A personal data breach is a security incident resulting in accidental or unlawful:

personal data.

Examples may include:

All suspected personal data breaches must be reported internally without unnecessary delay.

When a suspected breach occurs, the charity should:

The charity must not automatically notify the Information Commissioner's Office of every incident.

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, the charity must notify the Information Commissioner's Office where required by UK GDPR.

Where notification is required, it should be made without undue delay and, where feasible, within 72 hours after the charity becomes aware of the breach.

If notification is made later than required, the reason for delay should be documented.

Where a breach is unlikely to result in risk to individuals, ICO notification may not be required, but the breach and assessment should still be documented appropriately.

Where a breach is likely to result in a high risk to an individual's rights and freedoms, affected individuals must be informed where required by law.

Communications should explain clearly:

Al-Waris Foundation should maintain an appropriate record of personal data breaches.

The record should include:

The register should include relevant breaches even where ICO notification was not required.

People may raise privacy or data protection concerns directly with Al-Waris Foundation.

The charity should attempt to investigate and resolve legitimate concerns appropriately.

Individuals also have the right to complain to the Information Commissioner's Office where applicable.

The charity must not obstruct or penalise a person for exercising their data protection rights.

Al-Waris Foundation should maintain documentation proportionate to its processing activities.

This may include:

Trustees, staff and volunteers who handle personal data should receive information and training proportionate to their responsibilities.

Training may include:

Training should be refreshed periodically.

Anyone given access to charity personal data must:

Access must be revoked promptly when a person's role ends or no longer requires it.

The Board of Trustees has ultimate responsibility for data protection governance.

The Board should receive proportionate assurance concerning significant privacy and security risks.

A formal Data Protection Officer will be appointed where legally required.

Where Al-Waris Foundation is not legally required to appoint a statutory Data Protection Officer, responsibility for coordinating data protection compliance may be assigned to an appropriately authorised person without inaccurately representing that person as a statutory DPO.

The charity should maintain an appropriate contact route for privacy and data protection enquiries.

The current contact details should be published through the charity's Privacy Notice and maintained centrally rather than unnecessarily hard-coded throughout this policy.

General organisational contact information may be available at:

https://alwarisfoundation.org

Al-Waris Foundation recognises the Information Commissioner's Office as the UK's independent regulator for data protection and information rights.

Current regulatory contact and complaint information should be obtained directly from the ICO rather than hard-coded into this policy where it may become outdated.

Failure to comply with this policy may result in:

Serious or deliberate misuse of personal data will be treated seriously.

This policy should be read alongside, where applicable:

This policy will be reviewed:

Changes must be approved in accordance with Al-Waris Foundation's governance arrangements.

Version: 2.0 Status: Approved Approved by: Board of Trustees Approval date: 25/08/2026 Next scheduled review: 24/08/2027