Last updated: 26 February 2026
Rivers of Mercy (“we”, “us”, “our”) is committed to protecting your personal information and being transparent about how we use it. This Privacy Policy explains what we collect, how we use it, and your rights.
Rivers of Mercy is a registered charity in the UK (Charity Number 1209877) and operates in the UK and Palestine.
If you have any questions, please contact us using the details in the Contact us section below.
1) What this policy covers
This policy applies to personal data we collect from:
- Website visitors
- Donors and fundraisers
- Volunteers and supporters
- Beneficiaries and aid recipients (where applicable)
- People who contact us by email, phone, post, social media, or in person
- Suppliers and partners
2) The personal data we collect
Depending on how you interact with us, we may collect:
- Identity data: name, title, date of birth (if needed for safeguarding/eligibility)
- Contact data: email address, phone number, postal address
- Donation and payment data: donation amount, Gift Aid declarations, transaction references (we do not store card details as these are processed by our payment provider)
- Fundraising data: event participation, sponsorship details
- Volunteer data: availability, skills, references, DBS checks (where required), training records
- Communications data: messages you send us, preferences (e.g., email vs SMS)
- Technical data: IP address, device info, browser type, cookies, and how you use our website
- Sensitive data (special category): in limited cases (for example, health needs for aid delivery, disability access needs, or safeguarding). We only collect this where necessary and with appropriate safeguards.
3) How we collect your data
We collect data when you:
- Donate, fundraise, or sign up for updates
- Apply to volunteer or work with us
- Request support or services
- Contact us directly
- Use our website (via cookies and similar technologies)
- Engage with our social media pages
- Attend our events or activities
We may also receive information from trusted third parties, such as payment processors, fundraising platforms, or referral partners, where you’ve shared your data with them.
4) How we use your data (and our lawful bases)
Under UK GDPR, we must have a lawful reason to use your data. We use your data to:
- Process donations and manage payments
Lawful basis: Contract / Legitimate interests / Legal obligation - Claim Gift Aid (where you’ve completed a declaration)
Lawful basis: Legal obligation - Keep accurate records and prevent fraud
Lawful basis: Legal obligation / Legitimate interests - Send you updates, appeals, and fundraising communications
Lawful basis: Consent (where required) / Legitimate interests (where permitted) - Respond to enquiries and provide support
Lawful basis: Legitimate interests / Contract - Manage volunteers, recruitment, and safeguarding
Lawful basis: Legitimate interests / Legal obligation / Substantial public interest (where applicable) - Improve our website and services
Lawful basis: Legitimate interests / Consent (for non-essential cookies) - Deliver aid and services in the UK and Palestine
Lawful basis: Public task (where applicable) / Legitimate interests / Vital interests (in emergencies) / Explicit consent (where required for sensitive data)
5) Marketing preferences
We may contact you with news and fundraising updates. You can opt out at any time by:
- Clicking unsubscribe in our emails (if available), or
- Contacting us using the details below.
We do not sell your personal data.
6) Cookies
We use cookies and similar technologies to help our website work properly and to understand how visitors use it.
Where required, we’ll ask for your consent for non-essential cookies. You can also control cookies through your browser settings.
7) Who we share your data with
We may share your data with trusted service providers, such as:
- Payment processors and donation platforms
- Email and communications providers
- IT hosting and website support
- Event and fundraising partners
- Professional advisers (legal, accounting, auditing)
- Regulators and law enforcement (where required)
We only share what’s necessary and require providers to keep your data secure.
8) How long we keep your data
We keep personal data only as long as needed for the purpose it was collected, including legal, accounting, and reporting requirements.
Typical retention periods may include:
- Donation and financial records: kept in line with legal and HMRC requirements
- Gift Aid records: kept as required by HMRC
- Safeguarding records: kept in line with safeguarding guidance and legal obligations
- Marketing preferences: kept until you opt out or ask us to delete them (where applicable)
9) Keeping your data secure
We use appropriate technical and organisational measures to protect your data, including access controls, secure systems, and staff training.
No system is perfect (sadly), but we take security seriously and review our measures regularly.
10) Your data protection rights
You have rights under UK GDPR, including:
- The right to access your data
- The right to correct inaccurate data
- The right to delete your data (in some cases)
- The right to restrict or object to processing (in some cases)
- The right to data portability (in some cases)
- The right to withdraw consent (where we rely on consent)
To exercise your rights, contact us.
You also have the right to complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/
11) Children’s privacy
We do not knowingly collect personal data from children without appropriate consent. If you believe a child has provided us with personal data, please contact us so we can address it.
12) Changes to this policy
We may update this Privacy Policy from time to time. The latest version will be posted on our website with the updated date.
13) Contact us
Rivers of Mercy
Registered Charity Number: 1209877
Email: [add email]
Address: [add UK address]
Phone: [add phone number]