Data Protection, UK GDPR & Donor Privacy Policy
Organisation: The Creative Impact Studio CIC
Website: tcistudio.org
Effective date: September 2026
Policy owner: Managing Director / Data Protection Lead
Review: At least annually and after material changes to processing or law
This policy sets out how The Creative Impact Studio CIC ("the Studio", "we", "us" or "our") handles personal data. It applies to directors, employees, contractors and volunteers and covers personal data relating to clients, donors and supporters, campaign participants, event attendees, newsletter subscribers, partners, suppliers, website users and other individuals who interact with us. It specifically covers online one-off and recurring donations, including SEPA Direct Debit arrangements.
We aim to process personal data in accordance with the UK GDPR, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003 (PECR), as amended. This policy is an operational document and should be reviewed if our systems, providers or processing activities change.
Personal data must be processed lawfully, fairly and transparently; collected for specified and legitimate purposes; adequate, relevant and limited to what is necessary; accurate; kept no longer than necessary; and protected by appropriate security. The Studio must also be able to demonstrate accountability for its processing.
Depending on the relationship, we may process names, contact details, organisation and role details, correspondence, client/project information, event registrations, accessibility information where necessary, marketing preferences, website/device data, invoices and transaction records. For donors this may include donation amount, frequency, date, payment status, donor reference, mandate status and donation history. For SEPA Direct Debit, information may include the donor's name, address, country of residence, IBAN, BIC where required, mandate information and unique mandate reference.
Before processing personal data, the Studio will identify and document the lawful basis appropriate to the particular purpose. These may include consent, contract, legal obligation and legitimate interests. Where legitimate interests is used, the Studio will consider and document whether the processing is necessary and whether the individual's interests, rights or freedoms override those interests. Where consent is relied upon, it must be freely given, specific, informed and capable of withdrawal.
When an individual makes an online donation, we may use their personal data to process and reconcile the donation, administer a recurring payment or SEPA mandate, provide confirmations and receipts, send required payment or mandate communications, deal with failed or returned transactions, cancellations, refunds or disputes, respond to enquiries, prevent or investigate fraud, maintain accounting records and comply with legal or regulatory obligations. We will collect only the information reasonably necessary for these purposes.
Payments may be processed by banks, Direct Debit bureaus, payment gateways and other payment service providers. We will minimise the financial data stored on our own systems and will not intentionally store full payment-card details where the payment provider can process them securely. Providers may act as our processors or as independent controllers depending on the service and contract. Appropriate contractual and due-diligence arrangements must be used where required.
For SEPA Direct Debit donations, the Studio may process data necessary to establish and administer the mandate, including donor identity and contact information, IBAN, BIC where required, collection amount and frequency, mandate date, unique mandate reference, transaction status and relevant correspondence. This information may be shared with the relevant bank, bureau or payment provider as necessary to administer the payment, deal with R-transactions and meet financial or regulatory requirements.
Administrative or transactional messages about a donation are distinct from marketing. We may send information necessary to administer a donation or mandate, including receipts, payment notifications, failed-payment notices, mandate changes and cancellation confirmations. A donation does not by itself enrol a donor into general electronic marketing. Where consent is the appropriate route, marketing consent will be sought separately and will not be a condition of donating. Individuals can object to direct marketing at any time and their preference must be respected.
We do not sell personal data. We may disclose personal data where necessary to trusted service providers such as payment processors, banks, Direct Debit/SEPA providers, accountants, CRM providers, website hosts, email platforms, cloud/IT providers and professional advisers, or where disclosure is required by law. Access and disclosure must be limited to what is necessary for the stated purpose.
If a provider processes personal data outside the UK, the Studio will assess the transfer and use an appropriate UK data-transfer mechanism or other lawful safeguard where required. Supplier records should identify relevant processing locations and safeguards.
Access to personal data must be limited to people who need it for their role. The Studio will use appropriate password controls, multi-factor authentication where available, device and account security, secure cloud storage, access reviews and secure disposal. Personal data must not be copied to personal accounts or unapproved systems without authorisation.
The Studio will avoid collecting special category data unless there is a clear, necessary and lawful reason. Where it is processed, an Article 9 condition and any required Data Protection Act condition must also be identified. Children's personal data requires particular care, transparency and age-appropriate safeguards.
Subject to applicable conditions and exemptions, individuals may have rights to be informed; access their data; have inaccurate data corrected; request erasure; restrict processing; receive certain data in portable form; object to processing; and have safeguards in relation to solely automated decision-making and profiling. Requests must be passed promptly to the Data Protection Lead and handled within the applicable statutory period.
The Studio will maintain a retention schedule. Personal data must not be retained indefinitely or merely because it may be useful later. Retention periods must reflect the purpose, legal/accounting requirements, contractual requirements, dispute periods and the need to establish or defend legal claims. At expiry, data should be securely deleted, destroyed or irreversibly anonymised unless a lawful reason for continued retention applies.
Any actual or suspected loss, unauthorised disclosure, access, alteration or destruction of personal data must be reported immediately to the Data Protection Lead. The Studio will record the incident, assess risk, contain and remediate it, and determine whether notification to the ICO and/or affected individuals is required. Where an ICO notification is required, it must be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
The website will provide appropriate information about cookies and similar technologies. Non-essential cookies or tracking technologies will not be activated before consent where PECR requires consent. Users should be able to manage relevant choices and withdraw consent as easily as it was given.
Everyone handling personal data for the Studio must keep it confidential, use approved systems, follow access and security controls, respect communication preferences, report incidents promptly and complete appropriate data-protection training. The Data Protection Lead is responsible for oversight, record keeping and coordinating rights requests and breach response.
Privacy questions and rights requests should be sent to: Data Protection Lead, The Creative Impact Studio CIC, [insert registered office address], [insert privacy email]. Individuals may also complain to the Information Commissioner's Office (ICO) if they are unhappy with how their personal data has been handled.
This policy will be reviewed at least annually and whenever there is a significant change in law, systems, providers, fundraising activities or the categories/purposes of personal data processed.
Approved by: _H Clarke______________ Date: _1st September 2026______________
Next review: September 2027