Privacy Policy

Last updated: 2 November 2026

This notice explains how Crawley Down Village School Friends Of & Parents Association (T/A Fundraising Team), registered charity in England and Wales number 1161820, uses personal information in connection with our website, fundraising, events and supporter communications.

Who is responsible for your information?

The charity is the data controller for the information it uses to run its activities and keep in touch with supporters. For privacy questions or requests, email info@cdft.org.uk, marked “Privacy”. You can check our details on the Charity Commission register.

What information we use

The information depends on how you interact with us. It may include:

Your name, email address and any other contact details you provide when you contact us, sign up for updates or offer to help.
Donation, purchase and booking information, such as the amount, date, campaign or event, transaction reference, ticket details, and information you choose to include in a form or message. Gift Aid declarations and address details are used where applicable.
Information needed to organise an activity or respond to an enquiry or complaint, including relevant correspondence.
Technical information associated with website use, such as IP address, browser information, requested pages, security logs and cookie preferences, where collected by our website and service providers.
Trustee names and roles published to explain who runs the charity.

Information may come directly from you, from someone acting with your permission, or through Zeffy or SumUp when you use their services in connection with our charity. Please avoid sending unnecessary personal information, sensitive information or full card details by email.

Why we use information and our lawful bases

Donations and fundraising administration: to record donations, manage campaigns, reconcile payments and answer related questions. We rely on our legitimate interests in running and funding the charity, and on legal obligations where records are required by charity, accounting or tax law.
Event bookings and purchases: to arrange tickets, provide the activity or goods requested, and manage essential booking updates, cancellations and refunds. Where there is a contract with you, processing is necessary to enter into or perform that contract. Related administration and event organisation may also rely on our legitimate interests.
News and fundraising updates: to send the updates you have signed up for. We rely on your consent. Making a donation, buying a ticket or paying through SumUp does not by itself sign you up for marketing.
Enquiries, volunteering and complaints: to respond to you, coordinate help and investigate concerns. We rely on our legitimate interests in administering the charity, supporting our community and putting things right, and on legal obligations where applicable.
Optional website analytics: when Google Analytics is enabled, to understand how visitors find and use the website and improve its content. We use consent as the basis for this optional analytics processing. You can decline analytics and continue using the site, or withdraw consent through the cookie preferences control.
Website operation and security: to deliver the site, remember privacy choices, diagnose problems and protect against misuse. We rely on our legitimate interests in providing a secure website and on consent where required for optional cookies or similar technologies.
Charity governance: to identify trustees, demonstrate accountability and maintain required records. We rely on our legitimate interests in transparency and on applicable legal obligations.

When relying on legitimate interests, we consider the effect on your privacy and use only information reasonably necessary for that purpose. Providing information is generally your choice, but we may be unable to process a booking, donation-related request or enquiry without the details needed to handle it.

Zeffy and SumUp

We use Zeffy as our main system for fundraising, donations, event bookings and supporter sign-ups and communications. Information submitted through our Zeffy forms is handled through that platform and made available to the charity as appropriate to the service.

We also use SumUp for some payments. Depending on the payment and receipt options used, payment and transaction information is processed by SumUp and relevant financial service providers, and the charity receives the transaction information needed to administer and reconcile the payment.

These providers have their own responsibilities for processing information, including payment security, fraud prevention and legal requirements. In some circumstances they process information on our behalf; in others they determine their own purposes. Their notices explain their processing, recipients, retention and international arrangements:

The automatic feed on cdft.org.uk uses public event and campaign details. It does not display donor records or payment details.

Website hosting and charity systems

Stablepoint hosts cdft.org.uk. Hosting involves processing the website’s content and technical information needed to deliver and protect the site, such as IP addresses, requested pages, access and error logs, and website backups. Stablepoint provides hosting services to the charity; its privacy information also explains how it handles its own customer and account information.

We use Microsoft 365 Business (Office 365) for the charity’s internal systems, email, documents and administration. Correspondence and charity records containing personal information may be held in these services and accessed by authorised trustees and volunteers as needed for their work. Microsoft processes customer information under its Products and Services Data Protection Addendum. See also Microsoft’s Office 365 data protection information.

Who may receive information

Relevant information is available to trustees and authorised volunteers who need it for their role. It may also be handled by Stablepoint, Microsoft, Zeffy, SumUp, payment providers and banks, and providers of security and cookie-consent services. Google receives website usage information when optional Google Analytics is enabled and you consent. We may share information with professional advisers, insurers, regulators or public authorities where necessary to meet a legal requirement, deal with a claim or protect people. Information you choose to publish on a fundraising platform is subject to that platform’s public-display settings.

We do not sell supporter information.

International processing

Some service providers, including Microsoft, Zeffy, SumUp and Google, may process information outside the UK. The providers’ privacy information and applicable data processing terms explain their international processing and safeguards. Hosting and Microsoft 365 data locations depend on the services and account configuration; using a UK provider or business account does not by itself mean all processing stays in the UK. For restricted transfers for which the charity is responsible, the applicable UK transfer requirements must be met, for example through an adequacy arrangement or approved contractual safeguards. Contact us if you would like details of the arrangements relevant to your information.

How long information is kept

Accounting and financial records: at least six years from the end of the financial year in which the records are made, and longer where another legal requirement or an unresolved matter requires it.
Event and purchase administration: for the time needed to deliver the activity and complete reconciliation, refunds, queries and any related claims. Information that forms part of the accounting record is kept for the financial-record period above.
Newsletter sign-ups: while you remain subscribed. After you unsubscribe, a minimal record may be kept for as long as needed to respect your opt-out.
General enquiries and volunteering correspondence: until the enquiry or arrangement and reasonable follow-up are complete, with longer retention only where needed for a documented legal, safeguarding or dispute-related reason.
Complaints: normally three years after closure. Records may be kept longer where a legal, safeguarding, insurance or regulatory matter requires it.
Technical information: for the period needed to operate, troubleshoot and secure the service or investigate an incident. Cookie lifetimes and information kept by providers for their own purposes depend on the relevant service and its privacy information.

When information is no longer needed, it should be securely deleted or anonymised. Zeffy and SumUp may retain information for their own legal and regulatory obligations independently of the charity’s records.

Records held in Microsoft 365 follow the retention purposes above. Hosting logs and backups are kept for operational, security and recovery needs according to the hosting service and any applicable legal requirements. Deleting a live record may not immediately remove it from a backup; retained copies should be used only for recovery or other necessary purposes until overwritten or expired.

Cookies and similar technologies

Cookies are small files stored in your browser. Similar technologies, such as browser session storage, can also remember information. CookieAdmin provides our cookie-preference controls. Use the cookie icon to reopen your preferences, choose Reject All to decline optional categories, or choose categories and Save Preferences. Necessary cookies support functions such as security and remembering your choices. You can also delete cookies through your browser; this may reset your preferences or sign you out.

The homepage cookie scan on 2 November 2026 identified cookieadmin_consent, a necessary first-party cookie that remembers your cookie choices for 365 days. It did not identify analytics or advertising cookies. This scan describes the homepage at that time; cookies can differ after opening an external form, signing in, or enabling a new service.

WordPress login cookies: if you visit the login page or sign in to administer the site, WordPress uses cookies such as wordpress_test_cookie, wordpress_logged_in_* and security cookies to test cookie support and maintain a secure login. These relate to signing in, rather than ordinary public browsing. Their lifetime depends on the session and whether “Remember me” is selected.
Emoji support: WordPress may store wpEmojiSettingsSupports in browser session storage to remember whether your browser can display emoji. This lasts for the browser session. Emoji graphics may be requested from WordPress.org’s asset service, which receives the technical information needed to deliver them, including your IP address.
Google Analytics cookies, when enabled and accepted: _ga distinguishes browsers and _ga_* maintains session information. Google lists a default lifetime of two years for each; browser limits and the site’s configured settings may shorten this, and expiry may refresh on later visits. These are optional analytics cookies, separate from the cookie that remembers your consent.

Google Analytics

We plan to use Google Analytics 4 to understand visits, popular pages, traffic sources and how the website is used. It was not detected on the homepage when this notice was updated. When enabled, analytics is intended to operate only after you accept the Analytical Cookies category. It may process cookie identifiers, page and interaction information, referring websites, approximate location and device or browser information. This is separate from the donor and payment records held in Zeffy and SumUp.

Google processes this information to provide analytics reports. See how Google uses information from sites that use its services and Google’s GA4 cookie information. Analytics record retention is separate from cookie expiry: standard GA4 properties offer two- or 14-month retention for user and event data, while aggregated reports can be kept longer. The charity’s Analytics property settings have not yet been confirmed; we will update this notice when the service is enabled and its settings are verified.

Newsletter popup and other websites

The Zeffy sign-up form is loaded in the newsletter popup when you choose to open it. Using the form involves connecting to Zeffy, whose privacy information applies to its service. Links to Zeffy, SumUp, Facebook and other websites take you to services with their own privacy arrangements.

Children’s information and photographs

Our website and supporter sign-ups are intended primarily for adults. Please do not submit information about a child unless it is requested for a specific activity and you are authorised to provide it. If additional information about a child or a photograph is needed, we will explain the purpose and applicable privacy arrangements when requesting it. Separate permission will be sought where consent is the appropriate basis.

Your choices and rights

You can unsubscribe from fundraising updates using the unsubscribe option in an email or by contacting info@cdft.org.uk. Withdrawing consent does not affect processing that was lawful before withdrawal. Essential booking or payment messages may still be needed to administer your transaction.

Depending on the circumstances, you can ask to access or correct your personal information, have it deleted, restrict its use, object to processing, or receive a portable copy. Some rights have exceptions, including where records must be kept by law. You have an absolute right to object to the use of your information for direct marketing.

Email our privacy contact to make a request. We normally respond within one month, subject to the extensions and other provisions allowed by data protection law. We may need proportionate information to confirm your identity. The charity does not make decisions about you based solely on automated processing that produce legal or similarly significant effects; payment providers’ own checks are explained in their notices.

Concerns and complaints

Please contact us first if you have a concern about your information. Our Complaints Procedure explains how we handle concerns. You can also complain to the Information Commissioner’s Office, the UK data protection regulator.

Changes to this notice

We will update this page when our arrangements change. The date at the top shows when it was last revised.