Privacy Policy

1. Overview

At When You Wish Upon a Star, we respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains what information we collect, how we use it, and how we keep it safe. It applies when you interact with us in any way, including visiting our website, making a donation, fundraising, applying for or supporting a Wish, volunteering, or contacting us.

We only collect the information we need to carry out our charitable work and manage our relationships with supporters, families, volunteers and partners. We will always handle your information in line with UK data protection laws.

You also have rights over how your personal information is used. This policy explains those rights and how you can contact us if you have any questions or concerns.

Who We Are

When You Wish Upon a Star is a UK charity that grants Wishes to children living with life-threatening illnesses.

For the purposes of data protection law, When You Wish Upon a Star is the data controller , meaning we are responsible for how your personal information is used.

Contact details

When You Wish Upon a Star
G6 Ash Tree Court, Nottingham NG8 6PY
Charity Reg: 1060963
Company Reg: 3280440
OSCR Reg: SC049019
Phone: 0115 979 1720

Email: head.office@whenyouwish.org.uk
Website: www.whenyouwishuponastar.org.uk

We are registered with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

ICO registration reference: Z1024631

If you have any questions about this Privacy Policy or how we use your personal information, please contact our Data Protection Lead Amy Buxton (Head of Income Generation) at:

Email: amy.buxton@whenyouwish.org.uk
Phone: 0115 9791 720
Address: G6 Ash Tree Court, Nottingham NG8 6PY

2. What Information We Collect

We collect different types of personal information depending on how you interact with us.

Personal information may include:

• name
• postal address
• email address
• telephone number
• date of birth
• donation history
• fundraising or event participation information
• communication preferences
• information about whether you are a UK taxpayer, where you choose to provide this for Gift Aid purposes

Information relating to Wish children and families

To grant Wishes safely and appropriately we may also collect additional information such as:

• medical or health information
• accessibility or support needs
• emergency contact information
• information provided by medical professionals or referrers

Some of this information is classed as special category data under data protection law and receives additional protection.

Website information

When you visit our website we may automatically collect:

• IP address
• browser type and device information
• pages visited and time spent on the website
• approximate location

This information helps us understand how people use our website and improve our services.

3. How We Collect Information

We collect information in a number of ways, including:

• when you donate or fundraise for us
• when you apply for or are referred for a Wish
• when you register for an event
• when you volunteer with us
• when you contact us by phone, email, post or social media
• when you visit our website

In some cases we may receive information from third parties such as:

• medical professionals referring a child for a Wish
• fundraising platforms (such as JustGiving or similar services)
• event registration platforms
• partners or corporate supporters

4. How We Use Your Information

We use personal information to support our charitable activities and manage our relationships with supporters.

This may include:

• arranging and delivering Wishes for children and their families
• managing donations and fundraising activities
• administering events and campaigns
• communicating with supporters about our work
• thanking donors and recognising supporters
• managing employees and volunteers
• maintaining financial and regulatory records
• preventing fraud and ensuring security
• improving our website and services

We will only use personal information where we have a lawful basis to do so.

5. Our Legal Basis for Using Personal Data

Data protection law requires organisations to have a lawful basis for processing personal information.

The lawful bases we rely on may include:

Legitimate interests

We may process personal data where it is necessary for our legitimate interests as a charity. This includes activities such as managing our services, administering donations, and maintaining relationships with our supporters.

Where individuals have supported or engaged with us, we may use their information to keep in touch and provide updates about our work, where it is reasonable to do so and does not override their rights and interests.

We will always consider the impact on individuals and respect their preferences. You can ask us to stop contacting you at any time.

Consent

In some situations, we will ask for your consent to use your personal information.

For example:

• where you choose to receive marketing communications where consent is required
• where we use photographs, videos or personal stories, particularly in relation to Wish children and their families
• where we need permission to share sensitive personal information

Where we rely on consent, you can withdraw it at any time.

Legal obligations

We may need to process personal information to comply with legal or regulatory requirements. This may include activities such as:

• maintaining financial records and preparing accounts
• complying with charity law and regulatory requirements
• claiming Gift Aid and meeting HMRC requirements
• supporting audits and inspections

Contractual necessity

If you register for an event or service, we may process your data in order to fulfil that arrangement.

Where we process special category data such as health information relating to Wish children, we will ensure that appropriate safeguards are in place.

6. Sharing Your Information

We will not sell your personal information.

owever, we may share information with trusted third parties where necessary to carry out our work. This may include:

• payment processors and banks
• fundraising platforms
• event registration providers
• IT and database providers, including our customer relationship management (CRM) system and lottery management provider
• travel or experience providers involved in delivering a Wish
• professional advisors such as auditors
• regulators or authorities where required by law

All organisations that process personal data on our behalf are required to protect it and only use it for agreed purposes.

7. Keeping Your Information Safe

We take the security of personal information seriously.

We have appropriate technical and organisational measures in place to protect personal information from loss, misuse, unauthorised access or disclosure.

Access to personal information is limited to staff, volunteers and service providers who need it to carry out their work.

8. How Long We Keep Your Information

We only keep personal information for as long as necessary for the purposes for which it was collected, including to meet legal, accounting and regulatory requirements.

Retention periods vary depending on the type of information and the purpose for which it is used. For example:

• financial records may be kept to comply with tax and accounting rules
• supporter records may be retained to maintain ongoing relationships with our supporters
• information relating to Wishes may be retained for a period of time to manage and deliver the Wish, and in some cases limited information may be kept longer to maintain accurate records and help ensure that we do not grant duplicate Wishes

When personal information is no longer required, it will be securely deleted or anonymised.

We maintain an internal data retention policy which sets out how long different types of information are kept.

9. Your Data Protection Rights

Under UK data protection law, you have rights over your personal information.

These include the right to:

• request access to your personal data
• request correction of inaccurate information
• request deletion of your data in certain circumstances
• object to how your information is processed
• request restriction of processing
• request transfer of your data to another organisation

To exercise any of these rights, please contact us using the details at the end of this policy.

10. Cookies

Our website uses cookies to improve user experience and understand how visitors use our site.

Cookies are small files stored on your device when you visit a website.

You can control cookie settings through your browser.

More information can be found in our Cookie Policy.

11. Complaints

If you have any concerns about how your personal information has been handled, please contact us and we will do our best to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe your data protection rights have been breached.

Website: https://ico.org.uk

12. Contact Us

If you have any questions about this Privacy Policy or how your data is used, please contact us:

When You Wish Upon a Star
G6 Ash Tree Court
Nottingham
NG8 6PY

Email: head.office@whenyouwish.org.uk
Phone: 0115 979 1720

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The most recent version will always be available on our website.