Last reviewed: 07/09/2026

1. About this notice

This notice explains how Community Voices Matter ("we", "us", "our") collects and uses personal information about you, and the rights you have over that information. It applies to visitors to our website, supporters, donors, research participants, people who contact us for information or advocacy support, volunteers, job applicants, and anyone else whose data we hold.

We are a registered charity in England and Wales (charity number 1159968) and the data controller for your personal information. We are registered with the Information Commissioner's Office (ICO) under registration number ZA117848.

2. How to contact us

Community Voices Matter, Unit 1, Byron Business Centre, Duke Street, Hucknall, Nottingham, NG15 7HP

Email: info@hwnn.co.uk
Phone: 0115 956 5313

For data protection questions specifically, contact our Data Protection Officer at dpo@dataprotection.education.

3. What information we collect

Depending on how you interact with us, we may collect:

• Contact details — name, email, postal address, phone number.
• Supporter and donation information — donation history, Gift Aid declarations, communication preferences, event attendance.
• Information you share with us — your story or experience of a health condition (where you choose to share it for our research, advocacy, or campaigning work), correspondence, survey responses.
• Research participation data — information collected with your specific consent for a defined research project, governed by a separate participant information sheet.
• Volunteer and applicant data — application details, references, right-to-work information, training records (where applicable).
• Website and technical data — IP address, browser type, pages viewed, and cookie data. See our Cookies Notice for detail.

Special category data: Information about your health, or that of a family member, is "special category" data under UK GDPR and is given extra protection. We only collect it where you have chosen to share it with us (for example, in support of our advocacy or research) and we process it on the basis of your explicit consent or another lawful condition set out in section 5 below.

4. Where we get your information

Most of the information we hold comes directly from you when you contact us, donate, sign up to a campaign, take part in research, apply to volunteer, or use our website. We may also receive information from:

• Fundraising platforms (e.g. JustGiving) when you donate or fundraise for us.
• Public sources, such as Companies House or publicly available professional profiles, where we conduct due diligence on major donors or partners.
• Third parties you have authorised to share information with us (e.g. a family member contacting us on your behalf with your knowledge).

5. Why we use your information and our lawful basis

Under UK GDPR we must have a lawful basis for using your personal data. The main purposes and bases are:

• Responding to enquiries and providing information — legitimate interests (running the charity and helping the people we exist to serve).
• Processing donations and claiming Gift Aid — legal obligation (HMRC requirements) and contract.
• Sending you updates, newsletters, and fundraising appeals — your consent (which you can withdraw at any time).
• Carrying out research and producing reports — your explicit consent, and (for health information) the "research" condition under UK GDPR Article 9(2)(j) and the Data Protection Act 2018.
• Recruiting and managing volunteers and staff — contract, legal obligation, and legitimate interests.
• Safeguarding — legal obligation, vital interests, and (for special category data) the "safeguarding of children and individuals at risk" condition in Schedule 1 of the Data Protection Act 2018.
• Running and improving our website — legitimate interests and, for non-essential cookies, your consent.

6. Who we share your information with

We do not sell your personal information. We share it only where necessary, including with:

• Airtable and Google, who act as our data processors under written contracts.
• HMRC, where required (for example for Gift Aid).
• Regulators such as the Charity Commission, ICO, or Fundraising Regulator, where required by law or to cooperate with investigations.
• Police, social services, or safeguarding authorities, where we have a legal obligation or where doing so is necessary to protect someone's vital interests.
• Research partners or academic institutions, only where you have given specific consent for a named project.

7. International transfers

Some of our service providers are based outside the UK. Where personal data is transferred outside the UK, we make sure appropriate safeguards are in place — typically the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or transfers to countries the UK government has deemed adequate. Airtable, our cloud based database, is based in the USA. Google, who provide our website analytics, also transfer data to the USA.

8. How long we keep your information

We only keep personal information for as long as we need it for the purpose we collected it. Examples:

• General enquiries: up to 2 years after our last contact.
• Donor and Gift Aid records: at least 7 years, to meet HMRC requirements.
• Research participation data: as set out in the participant information sheet for each project.
• Volunteer and job applicant data: up to 12 months for unsuccessful applicants; longer for active volunteers and staff.
• Website analytics: see our Cookies Notice.

A summary of our Data Retention approach is available on our website, and our full retention schedule is available on request.

9. Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your data (this notice).
• Request a copy of the data we hold about you (a "subject access request").
• Ask us to correct inaccurate or incomplete information.
• Ask us to delete your data in certain circumstances.
• Ask us to restrict or object to our use of your data.
• Withdraw consent at any time, where we rely on it.
• Ask for your data to be transferred to another organisation, where applicable.
• Not be subject to decisions made solely by automated means — we do not currently make such decisions.

To exercise any of these rights, contact us using the details in section 2. We will respond within one month. You can also complain to the ICO at ico.org.uk/concerns or by calling 0303 123 1113, though we would appreciate the chance to address your concern first.

10. Marketing and your choices

We will only send you marketing communications (newsletters, fundraising appeals, campaign updates) where you have actively consented. You can unsubscribe at any time using the link in our emails, by contacting us, or by registering with the Fundraising Preference Service at fundraisingpreference.org.uk.

11. Cookies

Our website uses cookies. Please see our Cookies Notice for full details of what we use and how you can manage them.

12. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last reviewed. Significant changes will be highlighted on our website.