Privacy

1. Introduction

At Spaniel Rescue Foundation we are committed to protecting your privacy. This Privacy Notice explains how and why we collect and use your personal data – which means any information that identifies you, or that can be linked back to you – and the rights you have over that information. We will never sell your personal data. We will only ever share it with organisations who help us deliver our charitable objects, and only where this is strictly necessary and where they comply fully with UK data protection law.

Please read this notice alongside any additional information we may give you when we collect personal data on a specific occasion (for example, on a fostering application form, an event sign-up page or a donation form), so that you have the full picture of how we are using your information.

Our use of your personal data is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. This notice reflects the changes brought in by that Act, including improved complaints handling, clarified subject access rights and the extension of the “soft opt-in” for charity electronic marketing.

2. Who we are

Spaniel Rescue Foundation (“SRF”, “we”, “us” or “our”) is the data controller for the personal data described in this notice. This means that we decide how and why your personal data is processed.

You can contact us about anything in this notice – including how to exercise your rights, or to raise a data protection concern – using the details below:

Email: chair@spanielrescuefoundation.org
Telephone: 07557 846371
Postal address: Bramble Bank, Low Church Road, Middle Rasen, Lincs, LN8 3TY
Registered charity number: 1206092

In the considered opinion of the trustees, the scope and nature of the personal data we hold does not require us to appoint a Data Protection Officer under UK GDPR Article 37. Instead, the Trustee with responsibility for governance leads on data protection matters and is the contact point for the Information Commissioner’s Office (ICO).

3. Information we collect about you

3.1 Personal data you provide

We collect the personal data that you give to us. This includes information you share when you sign up for our newsletter, make a donation, volunteer with us, contact us about a dog for rehoming, bring your dog to us or to a veterinary practice or dog warden we work with in partnership, request dog care advice, register or take part in an event, purchase goods or services or send us an email.

The personal data we collect may include:

Personal details (name, date of birth, email, postal address, telephone numbers).
Financial information (payment information such as credit or debit card or direct debit details, and whether donations are gift-aided).
Details of your preferences and interests, for example which spaniel breed type you are most interested in.

If you sponsor a dog as a gift for someone else, your details will be recorded along with your relationship to that person.

3.2 Personal data created through your involvement with us

Your activities and involvement with SRF will result in personal data about you being created. For example, this may include details of dogs you have rehomed or fostered, how you have helped us as a volunteer or your involvement in one of our appeals. If you donate to us, we will keep a record of when you donated, how much and through what route (for example, an appeal, sponsoring a dog or a charitable trust). If you Gift Aid a donation, we will ask for your address and UK taxpayer status, as we need this to meet our obligations under tax and charity law. This information is shared with HMRC for tax regulation purposes.

3.3 Personal data we generate

From time to time, we conduct research and analysis on the information we hold, which can in turn generate further personal data. For example, by analysing your interests and involvement with our work, we may be able to build a profile that helps us decide which types of communication are most likely to interest you. Section 7 contains more information about how we use information for profiling and targeted communications.

3.4 Information from third parties

We sometimes receive personal data about individuals from third parties such as veterinary practices, dog wardens and other animal welfare organisations we work with to rehome dogs and to provide veterinary care. If you take part in an event organised by an external party, or make a donation through a donation aggregator such as JustGiving, they may pass personal data about you to us. We may also use trusted third parties to help us conduct research and analysis (see section 7).

3.5 Special category data and criminal convictions

We do not normally collect special category data (such as data about your race, ethnicity, religious beliefs, health, sex life or sexual orientation), or data about criminal offences and convictions. There are limited situations where we may need to: for example, if you tell us about a health condition that is relevant to a fostering placement, or where a check on unspent criminal convictions is needed for safeguarding reasons. Where we do collect this kind of information, we identify and document an appropriate condition for processing under UK GDPR Article 9 or Article 10 and we treat it with extra care.

3.6 Accidents or incidents

If an accident or incident occurs involving one of our volunteers, a record of what happened and the action we have taken may include personal data and special category data. We use this information only for the purposes of managing the incident and learning from it.

4. How we use your personal data and our lawful basis

We only use your personal data with your consent, or where the processing is necessary to:

Enter into or perform a contract with you, for example when you adopt or foster a dog.
Comply with a legal duty, for example our duties under the Gift Aid scheme or the Microchipping of Dogs Regulations.
Protect your vital interests, for example in a life-or-death situation.
Pursue our (or a third party’s) legitimate interests, where your rights and freedoms do not override those interests, for example to send you direct marketing communications unless you tell us you would prefer not to receive them.
Pursue a “recognised legitimate interest” under UK GDPR Article 6(1)(ea), which was added by the Data (Use and Access) Act 2025. This basis only applies to specific pre-approved purposes such as safeguarding vulnerable individuals, responding to emergencies, crime prevention and disclosures to other organisations to help them perform a public task. We rely on it only in those limited situations.

In every case, we only use your information for the purpose or purposes for which it was originally collected, or for closely related purposes.

4.1 Administration

We use personal data for administrative purposes – in other words, to carry on our charitable work. These include:

Sending appointment reminders to adopters and fosterers (for example, for neutering or vaccinations).
Keeping you updated if you take part in an SRF event.
Processing donations and Gift Aid declarations.
Managing feedback and complaints (see section 15).
Maintaining our databases of supporters, volunteers and donors so the personal data we hold is accurate and up to date.
Fulfilling orders for goods or services, whether placed online, over the phone or in person.
Respecting your communication choices and preferences (for example, if you ask not to receive marketing, we keep a record so we don’t).
Inviting you to take part in surveys, prize draws or competitions.

4.2 Using your information to comply with the law

We must make sure our activities comply with the law, and we may need to share your personal data where we are required to do so by law (for example, in connection with a court order). We may also use personal data for purposes such as fraud prevention, complying with anti-money laundering regulations and protecting people’s rights, property or safety.

Where certain levels of financial donations are made, the Fundraising Regulator’s Code of Fundraising Practice requires all UK charities to perform certain checks regarding the individual making the donation. More details can be found at www.fundraisingregulator.org.uk.

Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.

4.3 Our legitimate interests

Where we rely on legitimate interests as our lawful basis, we process your personal data only where your fundamental rights and freedoms do not override those interests. Our legitimate interests include:

Keeping our records up to date.
Administering our relationship with you.
Determining how our limited resources can be used most effectively.
Protecting our security and guarding against fraud and other wrongdoing.
Informing our communications to maximise support, engagement and participation.

5. Who we share your information with and why

We take all reasonable steps to keep your details safe and secure. We will only share them with suppliers or professional agents working on our behalf – for example, professional fundraising organisations who send out our fundraising or marketing materials, or telephone agencies who make fundraising calls on our behalf.

We carefully select our partners and only share information with them where we are confident that they will protect it and comply with UK data protection law. We have a written contract in place with each of them that meets the requirements of UK GDPR Article 28.

We will never share your details with other organisations to use for their own marketing purposes.

We may use other companies to provide services and process your personal information on our behalf, for example delivering postal mail, making phone calls, sending emails or SMS messages, processing payments and analysing supporter information (as set out in section 7) so we can communicate with you in the most appropriate way.

We may share your personal information with veterinary practices, pet insurers and microchip companies to provide the products or services you have requested or that are necessary as part of rehoming, but only to the extent strictly necessary.

6. Fundraising and marketing

As a charity, we rely on donations and the support of others to continue our work. From time to time, we will contact existing supporters with fundraising communications. This might be tied to an appeal, suggest ways you can raise funds for us or invite you to take part in an event.

We will contact you by email or text message:

Where you have given your consent for us to do so; or
Where the “soft opt-in” for charities applies. The Data (Use and Access) Act 2025 extends this to charities. It means that, where we collected your electronic contact details in the course of you expressing an interest in, supporting or donating to our charitable purposes, we may send you electronic mail marketing about the same or similar charitable purposes – provided you were given a clear opportunity to object when your details were first collected, you are given a clear opportunity to object in every subsequent message, and you have not objected.

We will only telephone you if you have consented to us doing so, or where we have called you in the past and you have not objected. If you are registered with the Telephone Preference Service (TPS), we will only call you if we have your specific consent.

If you have provided us with your postal address, we may write to you about our work unless you tell us you would prefer not to hear from us in this way.

You can change your communication preferences or stop receiving communications at any time, by using the contact details in section 2 or the unsubscribe link in any email we send. If you ask us not to contact you, we will keep some basic information about you on a suppression list so that we can avoid contacting you again in the future.

7. Targeting our communications and researching our supporters

Our supporters make our vital work for spaniels in need possible, particularly as we receive no government funding. We have a duty to make sure your donations are spent wisely, and that means doing some research and analysis to inform our decisions and communicate in the most appropriate, relevant way.

In order to decide who to contact, we (or a company working on our behalf) may analyse the personal data you have provided in order to tailor our communications and make our appeals more relevant and cost-effective. Specifically, we carry out activities including donor grouping and aggregating anonymised personal data. You have the right to object to this kind of profiling at any time (see section 14).

8. Our website and cookies

We do not collect or process personal data about visitors to our website unless they choose to provide it, for example by signing up to our newsletter or contacting us via a form.

8.1 Cookies

Our website may use cookies to enhance your experience and to enable certain functionality, for example remembering that you have visited recently. In line with the Privacy and Electronic Communications Regulations 2003 (PECR), we will only set non-essential cookies on your device with your consent, which we collect through our cookie banner. Strictly necessary cookies, which are required for the website to work, do not need consent. You can choose to set your web browser to refuse cookies or to alert you when cookies are being sent. If you refuse cookies, this may affect your ability to use parts of our website.

8.2 Hyperlinks to other websites

Our website may contain hyperlinks to pages maintained by third parties. We are not responsible for the content or functionality of any of those external websites. If an external website requests personal data from you, anything you provide will not be covered by this notice. We suggest you read the privacy policy of any website before sharing any of your personal data.

9. Keeping your information safe

We use a layered combination of technical and organisational measures to keep your personal data safe and to prevent unauthorised access to, or use or disclosure of, it. Electronic data and databases are stored on secure systems and access is controlled. Our trustees and volunteers receive data protection training and follow detailed data protection procedures when handling personal data.

We cannot absolutely guarantee the security of the internet, external networks or your own device, so any online communications (for example, information provided by email or through our website) are at your own risk.

10. Storage and retention

We only store personal data for as long as it is needed for the purpose(s) we collected it for, or for a related compatible purpose (such as keeping a record of a donation). For example, we will keep records of adopters for as long as the adopted dog is alive and for a minimum of three years after rehoming or other outcome. Some legal requirements mean we have to retain certain items of personal data for a set period of time (for example, Gift Aid declarations must be kept for seven years).

Our retention periods are recorded in our Data Mapping Register, which is reviewed at least annually. We regularly review what data we hold and securely delete information that is no longer needed. In certain situations you have the right to ask us to delete your personal data – please see section 14.

11. International transfers

Your personal data is stored within the UK or European Economic Area (EEA) wherever possible. Where we use a service provider whose processing involves transferring personal data outside the UK, we make sure an appropriate safeguard is in place, such as an adequacy regulation under the UK GDPR, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

12. Photography and filming

SRF welcomes the general public to its activities, such as volunteering opportunities, adoptions and fundraising events. We, our authorised service providers, or any commercial partners we engage, may photograph or film participants, volunteers and spectators attending or taking part in our work, events and activities, and use those photographs or that footage.

No personal details (including names) of any participant under the age of 16 will be used in any publicity materials without the written consent of their parent or legal guardian. We may use images where children, young adults or persons at risk are incidentally included (for example, images of family groupings at our dog shows).

We do this in order to promote and publicise the charity, its work and its events – typically for fundraising, including advertising, marketing material, social media and other media made available to the public. It also enables our service providers to publicise their involvement in or association with the event.

Please note that at our events there could be photographers from other organisations, such as the local press, for whom we are not responsible. If you have any concerns or questions about photography at our events, please speak to a trustee or volunteer of SRF on the day.

13. Children

Our website and services are not designed for, or directed at, children. We do not knowingly send marketing or fundraising communications to children under the age of 13. Where we process limited personal data relating to children under 13 (for example, the ages of children in a fostering or adoption household), we obtain consent from a person with parental responsibility. We have considered the duty introduced by the Data (Use and Access) Act 2025 in relation to online services likely to be accessed by children and we keep this assessment under review.

14. Your rights

We want you to remain in control of your personal information. Under the UK GDPR you have the following rights:

The right to be informed about how we use your personal data – this notice is part of how we meet that right.
The right of access – the right to confirmation that we hold your personal data and to obtain a copy of it (a “subject access request”).
The right to rectification – the right to have inaccurate personal data corrected.
The right to erasure – the right to ask us to delete your personal data in certain circumstances (sometimes called “the right to be forgotten”). This is not an absolute right and may not apply if we need to keep using the data for a lawful reason.
The right to restrict processing – the right to ask us to limit how we use your personal data.
The right to data portability – in certain circumstances, the right to receive your personal data in a structured, commonly used and machine-readable format and have it transferred to another organisation.
The right to object – including to your data being used for direct marketing or for profiling.
Rights relating to automated decision-making and profiling – we do not use your personal data to make decisions about you that are based solely on automated processing and which produce legal or similarly significant effects.
Where our processing is based on consent, the right to withdraw your consent at any time.

To exercise any of these rights, please contact us using the details in section 2. We will normally respond within one calendar month. In line with the Data (Use and Access) Act 2025, when we respond to a subject access request we carry out searches that are reasonable and proportionate. Where we reasonably need further information from you to confirm your identity or to clarify what you are asking for, the one-month clock is paused (the “stop the clock” rule) until you reply, after which it resumes.

There are some exceptions to the rights above and, although we will always try to respond to your satisfaction, there may be situations where we are unable to do so – for example, where the personal data no longer exists or where an exception applies.

15. How to make a complaint

If you have any concerns about how we have handled your personal data, please contact us first using the details in section 2 so that we have an opportunity to put things right.

In line with the Data (Use and Access) Act 2025, we will:

Acknowledge your complaint within 30 days of receiving it.
Take appropriate steps to investigate, including making any necessary enquiries and keeping you informed of progress.
Communicate the outcome of your complaint to you without undue delay, with a clear explanation of our conclusions and any action we have taken.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), which oversees data protection compliance in the UK. You can contact the ICO at https://ico.org.uk, by calling 0303 123 1113, or by writing to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

16. Updates to this notice

We may update this Privacy Notice from time to time. When we do, we will post a notification on our website and revise the “Last updated” date at the top of this page. We encourage you to check this page from time to time to stay informed about how we are protecting the personal information we hold.

Any questions?

If you have any data protection questions in relation to this policy, about how we use your personal data in general, or if you would like to make a request to exercise any of the rights you have over your personal data, please send them to the Data Protection Officer at Spaniel Rescue Foundation chair@spanielrescuefoundation.org.

Download a copy