Clear information about the details you share.

Who is responsible for the information?

Makey Group Limited is the data controller for The Barnsley Christmas Project.

What we collect

For a gift request or referral, we may collect:

• The adult applicant’s or referrer’s name, contact details and contact preference.
• The household’s full postcode, used to check the published S35, S36, S63, S70 to S75, WF4 and WF9 eligibility rule and help identify possible duplicate requests.
• How the request reached the project, such as through a local service, the project website, social media, local news, or a friend or family member.
• For professional referrals, the referrer’s organisation, role and service type, plus the parent or guardian’s name and either their contact details or confirmation that contact should remain through the referrer for safety or privacy.
• Each child’s first name or nickname, age, interests, gift ideas and any practical gift considerations the adult chooses to share.
• The circumstances selected by the adult and any optional context they choose to provide.
• A handover preference, a separate private or optional car-experience preference and practical access notes. A full address is collected only when a home handover is requested.
• The applicant’s declarations about age, authority, the privacy notice and the accuracy of the information supplied.
• Request status, possible duplicate-review flags, confirmation and approval-email status, and an audit record of key project decisions.

For a contact enquiry, we collect the sender’s name, chosen contact details, message, topic and any gift-request reference they include.

While the form is being completed, a temporary draft and random submission key are saved in session storage in that browser tab. The draft is not sent to us until the applicant submits it. It is cleared after a successful submission, when the tab session ends, or when an expired draft is next checked after 12 hours.

Why we use it and our lawful basis

We use the information to consider requests fairly, choose suitable gifts, prevent duplicate or abusive submissions, contact the adult applicant or authorised referrer, arrange a safe handover, respond to enquiries and keep the service secure.

To identify possible duplicates, we may compare normalised versions of adult email addresses, telephone numbers and full postcodes together with limited child details. A possible match is flagged for a person to review. It is not automatically rejected and the project does not make solely automated eligibility decisions.

Our main lawful basis under the UK GDPR is legitimate interests: running a safe, fair and effective community gift project and responding to people who ask us for support. Because the records concern children, we take extra care to minimise the information, limit access and consider their rights and interests. We may also use information where necessary to comply with a legal obligation or deal with a legal claim.

We ask applicants not to provide diagnoses or medical histories. If information revealing health or another special category is supplied unexpectedly, it is not used to rank a request. Access is restricted while the project decides whether it should be removed, retained for safeguarding, or processed under an applicable additional legal condition.

The form acknowledgement confirms that you have read this notice; it is not used to take away a data-protection right. Participation in project photographs is separate and optional.

There is no solely automated approval or rejection. The project team reviews requests individually. Required fields are marked on the form; without them we may not be able to understand or assess a request. Other fields are optional.

Who receives it

Access is limited to authorised project team members who need the information. Our hosting and database provider, DigitalOcean, and transactional-email provider, Resend, process limited information for us to operate the website and send confirmations. A venue or partner organisation receives only the practical information needed for an agreed handover, and only where appropriate.

The request checker requires the private reference, the contact detail used for confirmation and the household postcode. It shows a limited request summary and status. For a professional referral, the checker accepts only the contact route chosen on the request. It never returns a home address, private access instructions or practical notes. For a home visit it states only that arrangements were confirmed directly with the adult applicant or referrer. An exact agreed collection point may be shown only after all three checker details match; venue addresses are not published on the open homepage.

We do not sell personal information. We may disclose information where the law requires it, or where sharing is necessary to protect someone from a serious and immediate risk.

Some technical providers may process information outside the UK. Where UK data-protection law treats this as an international transfer, we require an applicable adequacy decision or approved contractual safeguards.

How long we keep it

• Gift-request and child records are scheduled for deletion after 31 March 2027.
• Contact enquiries are scheduled for deletion 180 days after they are received.
• A browser draft is held only in that browser tab, cleared after successful submission and treated as expired after 12 hours.
• Short-lived anti-abuse counters use salted, non-reversible identifiers rather than storing raw lookup entries, and expire automatically.
• Application workflow history is stored inside the application and is deleted with it. Separate staff-security audit events are kept for up to 24 months and contain only limited account, action and technical identifiers.
• The ordinary gift-request record is not extended beyond that deletion date. If limited information must be kept for a safeguarding concern, data-rights request, complaint, legal duty or legal claim, the authorised lead must copy only what is necessary into a separate restricted record with its own documented retention date before the gift-request record is deleted.

Your data-protection rights

Depending on the circumstances, you can:

• ask for a copy of personal information we hold about you or a child you represent;
• ask us to correct incomplete or inaccurate information;
• ask us to delete information in circumstances where the law gives that right;
• ask us to restrict how information is used, or object to processing based on legitimate interests;
• ask for information about applicable safeguards for an international transfer; and
• complain to the Information Commissioner’s Office if you are unhappy with how we use personal information.

To exercise a right or make a data-protection complaint, email the address above or use the contact form and select “Privacy, data rights or complaint”. We may need to verify that you are the adult connected with the record before disclosing or changing it.

We aim to acknowledge a data-protection complaint within 30 days, investigate it without undue delay, keep you informed and explain the outcome. This does not affect your right to contact the Information Commissioner’s Office at any time.

You can also contact the Information Commissioner’s Office. We would appreciate the opportunity to address your concern first.

Photography and filming

The default is that the project does not take or publish photographs or video in which a child can be identified. Families may take photographs of their own children where the venue arrangements allow it, but must avoid including other families.

If the project proposes identifiable photography at an event, it will use a separate event-time information and consent process. Consent is never part of the gift request, never affects support and can be refused without disadvantage. The separate notice must identify the intended uses, publication channels, retention period and withdrawal contact before consent is requested.

Cookies and browser storage

The public website does not use advertising or analytics cookies. It uses session storage only to recover an unfinished application in the same browser tab and to reuse its random submission key safely after a connection problem. The draft is not used for tracking.

The protected Project Desk uses one strictly necessary, HTTP-only security cookie after an authorised team member signs in. The cookie contains a random token, while only its cryptographic hash is stored in the database. It keeps that person signed in for up to eight hours, can be revoked on sign-out and is not used for tracking. Because the site currently uses only strictly necessary technology, it does not show a cookie-consent banner.