1.         Your personal data – what is it?

Personal data relates to a living individual who can be identified from that data.  Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the UK General Data Protection Regulation (the “GDPR”) and UK Data Protection Act 2018.

2.         Who are we?

World Sight Foundation (WSF) is the data controller.  This means that the WSF decides how your personal data is processed and for what purposes.

3.         How do we process your personal data?

WSF complies with its obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

We use personal data for the following purposes: –

• To fundraise and promote the interests of the WSF
• To inform you of news, events, activities and charitable services of the WSF
• To maintain a list of people who have donated to us before, so that we can contact them to ask them to do so again
• To maintain a list of people who have explicitly told us that they don’t want to contact us again
• To manage our volunteers and teachers
• To maintain our own accounts and records (including the processing of Gift Aid applications)
• To track attendance of our courses and activities, seek feedback from the course participants and inform them of WSF activities.

4.         What is the legal basis for processing your personal data?

We rely on a combination of lawful bases including legitimate interests, contract, legal obligations and, where appropriate, consent. 

5.         Sharing your personal data
Your personal data will be treated as strictly confidential. 

We may share your information with:

• HMRC – to reclaim Gift Aid on eligible donations
• Our service providers – such as IT suppliers, mailing houses, and payment processors, who are contractually bound to handle data securely and only for specified purposes
• Regulators and public authorities – such as the Charity Commission, police, or local authority, where required by law or to safeguard individuals
• Other charities or partner organisations – only where you have consented, or where we have a legitimate interest in doing so

Where we share data with third parties outside the UK, we ensure appropriate safeguards are in place in accordance with GDPR. 

6.         How long do we keep your personal data?

We will keep your information for as long as required to enable us to operate our services but we will not keep your information for any longer than is necessary. When we no longer need to retain your information, we will ensure it is securely disposed of, at the appropriate time. 

Specifically, we retain:

• Donor records and Gift Aid declarations and associated paperwork for up to 6 years after the calendar year to which they relate.
• Volunteer and contractor records: seven years after the relationship ends
• Safeguarding records: in line with statutory guidance (often indefinitely for serious concerns)
• General enquiry records: up to two years
• Website analytics data: up to two years

7.         Your rights and your personal data 

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: –

• The right to request a copy of your personal data which the WSF holds about you
• The right to request that the WSF corrects any personal data if it is found to be inaccurate or out of date
• The right to request your personal data is erased where it is no longer necessary for the WSF to retain such data
• The right to withdraw your consent to the processing at any time
• The right to receive your data in a structured, machine-readable format
• The right to object to processing based on legitimate interests or for direct marketing
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing
• The right to lodge a complaint with the Information Commissioners Office
• With respect to the rights in relation to automated decision-making, we do not carry out solely automated decision-making

In addition, you can opt out of fundraising communications at any time by contact us as per below.

8.         Further processing

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

9.         Cookies and Website Analytics

What are cookies?

Cookies are small text files placed on your device when you visit our website. We use analytics cookies to help us understand how visitors use our site, so we can improve it over time.

Analytics cookies we use

We use a third-party analytics service to collect anonymised information about how our website is used — for example, which pages are visited most often, how long visitors stay, and how they arrived at our site. This helps us improve the website experience for our users. The information collected by analytics cookies does not identify you personally. It is aggregated and used only for statistical purposes.

Your consent

In accordance with the Privacy and Electronic Communications Regulations (PECR), we will ask for your consent before placing any non-essential cookies on your device. You can accept or decline analytics cookies using the cookie banner shown when you first visit our website. You may also change your cookie preferences at any time by clicking the “Cookie Settings” link in the footer of our website.  If you decline analytics cookies, your visit will not be tracked and your experience of the site will not be affected.

How long are cookies stored?

Analytics cookies are typically retained on your device for up to 13 months, after which they expire automatically. Any personal data collected via analytics (such as IP addresses, where applicable) is held by us for up to two years, in line with our retention schedule in section 6 above.

Third-party processors

Where we use a third-party analytics provider, that provider acts as a data processor on our behalf and is bound by a data processing agreement. We ensure that any such provider offers appropriate safeguards, including where data may be processed outside the UK. For more information about how our analytics provider handles data, please see their privacy policy on their website.

10.       Security

We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect against unauthorised access, loss or destruction, including:

• Secure, password-protected systems with access controls
• Encryption of data in transit (SSL/TLS)
• Physical security of paper records

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Officer (ICO) within 72 hours and affected individuals without undue delay, as required by law.

11.       Contact Details and Complaints Process

To exercise all relevant rights, queries of complaints please in the first instance contact the Chairman of the WSF at info@worldsightfoundation.com or at WSF’s registered address: 3 Tedworth Square, London, SW3 4DU.

If you are not satisfied with our response, or believe we are processing your data unlawfully, you have the right to complain to the ICO on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/.

This privacy policy may be updated from time to time.

May 2026