Clear information about what you share.

Who is responsible for the information?

Makey Group Limited is the data controller for The Barnsley Christmas Project.

What we collect

For a charity support request, we may collect:

• the registered charity’s name, registration number and optional website;
• the referrer’s name, role, work email and optional work phone number;
• confirmation that the family agreed to the request;
• a postcode district or broad local area, but not the family’s full postcode or address;
• each child’s first name or nickname, age, interests, gift wishes and any practical preferences the referrer chooses to share;
• a short explanation of why support would help, what is being requested and any safe contact notes;
• the referrer’s declarations about authority, accuracy and this privacy notice; and
• the request reference, status, project replies, key staff actions and technical records needed to keep the service secure and reliable.

While the form is being completed, a temporary draft and random submission key are stored in that browser tab. The draft is not sent to us until the referrer submits it. It is cleared after a successful submission, when the tab session ends, or when an expired draft is next checked after 12 hours.

Why we use the information

We use it to verify that a request comes through a registered charity, understand what support is being sought, contact the referrer, consider and respond to the request, prevent misuse or duplicate submissions, keep an accountable staff record, protect the service and meet legal obligations.

Our main lawful basis under UK data protection law is legitimate interests. The interests are operating a responsible charitable support process, communicating with authorised referrers, allocating limited resources fairly, maintaining records of decisions and protecting the service. We limit the information requested and route communication through the referrer to reduce the effect on families and children.

Where the law requires a different basis for a particular record, such as compliance with a legal obligation or handling a safeguarding record, that basis will be recorded separately. Agreement to the privacy notice confirms that it has been read; it is not used as a substitute for a lawful basis.

Who receives the information

Access is limited to authorised project staff who need it to consider or manage the request. Contracted providers may process information for website hosting, database storage, security and project email. They act under appropriate data-protection terms and are not allowed to use the information for their own purposes.

We may share limited information where required by law, needed to establish or defend legal claims, or necessary to respond to a serious safeguarding concern. We do not sell support-request information and do not use it for unrelated marketing.

Some technical providers may process information outside the United Kingdom. Where that happens, we use an applicable legal transfer mechanism and contractual safeguards, and assess the provider before use.

How long we keep it

An ordinary support-request record is scheduled for deletion 365 days after it is received. Technical security records, staff audit records, rights requests, complaints, legal records and safeguarding records may have different retention periods where there is a documented reason. Backups may retain protected copies for a limited additional period before they are overwritten.

We periodically review whether records are still needed. If an older backup must be restored after ordinary data has expired, expired records must be removed before the restored system returns to normal use.

Your data rights

Depending on the circumstances, you may:

• ask for a copy of personal information we hold about you or a child you represent;
• ask us to correct incomplete or inaccurate information;
• ask us to delete information where the law gives that right;
• ask us to restrict how information is used, or object to processing based on legitimate interests;
• ask about safeguards used for any international transfer; and
• complain to the Information Commissioner’s Office if you are unhappy with how personal information is used.

Email [email protected] and include the private reference if you have it. We may need to verify identity and authority before disclosing or changing a record.

The Information Commissioner’s Office can be contacted through ico.org.uk/make-a-complaint or on 0303 123 1113.

How information is protected

Cookies and browser storage

The public site does not use advertising or behavioural tracking cookies. The request form uses session storage in the current browser tab to keep a temporary draft for up to 12 hours. Staff sign-in uses a strictly necessary secure session cookie. These are used to provide the service and protect private staff pages.