Date reviewed: 6th January 2026

Date of next review: 6th January 2027

1. Policy Statement

Little Miracles Charity (the Charity) is committed to protecting the personal data of children, young people, families, staff, volunteers, supporters and partners. We recognise our responsibilities under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and all associated legislation.

The Charity will ensure personal data is:

• processed lawfully, fairly and responsibly
• collected for specified and legitimate purposes
• limited to what is necessary 
• accurate and kept up to date
• retained only for as long as necessary
• stored and processed securely

2. Scope

This policy applies to all personal data processed by the Charity and all trustees, staff, volunteers and partner organisations acting on behalf of the Charity.

3. Contact Details and Data Protection Officer

Little Miracles Charity (the Charity)

The Spinney, Hartwell Way, Peterborough, PE3 7LE 

Email: data@littlemiraclescharity.org.uk

Telephone: 01733 262226

The Charity's Data Protection Officer (DPO) is: Michelle King, Chief Executive Officer (CEO)

4. Categories of Personal Data

The Charity collects and processes information relating to families, beneficiaries, staff, volunteers, donors and supporters as required for lawful operation of the organisation.

5. Purposes for Processing Personal Data

Personal data will only be used to support charitable operations, safeguarding, HR, finance, service delivery and lawful administration.

6. Lawful Basis for Processing

Processing is carried out in accordance with UK GDPR under legitimate interest, legal obligation, contract, consent or vital interests.

7. Special Category Data

Where necessary, sensitive information such as health data or safeguarding information is processed securely and lawfully.

8. Data Sharing and Data Processors

The Charity will only share data where lawful and necessary.

The Charity uses the following key third party data processors to support safe and efficient operation of the organisation:

• HubSpot - CRM and case recording
• Xero - financial accounting and records
• Make (Integromat) - secure workflow automation
• Zapier - automation platform
• Microsoft 365 - secure email and document storage
• Jotform - secure digital forms and data capture
• Stripe - donation payment processing
• SumUp - payment processing
• Eventbrite - event booking and ticketing
• JustGiving - online fundraising platform
• Airtable
• LocalGiving - online donations platform
• BreathHR - HR system
• Mailchimp - email marketing platform
• Arkflux - case management
• Bookalet - venue and activity booking
• Ucheck - Disclosure and Barring Service (DBS) checks

All suppliers engaged as data processors are required to comply with UK data protection legislation and have appropriate technical and organisational security controls in place.

9. International Transfers

The Charity does not routinely transfer personal data outside the UK. Where this becomes necessary appropriate legal safeguards will be applied.

10. Data Retention

The Charity retains data only for as long as necessary, in line with safeguarding, HR, legal and regulatory requirements.

11. Data Security

Personal data is stored securely and only accessed by authorised personnel. Any breach will be reported and managed appropriately.

12. Individual Rights

Under data protection law individuals have the right to access, correct, delete or restrict their data, object to processing, and withdraw consent where applicable.

Requests may be made by contacting:

Email: data@littlemiraclescharity.org.uk

Telephone: 01733 262226

Address: Little Miracles Charity (the Charity), The Spinney, Hartwell Way, Peterborough, PE3 7LE 

The Charity will respond in line with statutory timescales.

13. Responsibilities

Trustees retain overall legal responsibility. Staff and volunteers must comply with this policy at all times.

14. Review

This policy will be reviewed annually and be updated as required.

In addition to the information below, the Little Miracles Charity data and Confidentiality Policy 2026 is attached at the bottom of this page.

Form Submissions

We may collect information about your approximate location when you submit a form on our website.

This may include:

• Your IP address
• Geographic location (such as city or region), inferred from your IP address or device data

We collect this information to:

• Identify and prevent fraudulent or malicious activity
• Diagnose technical issues

We process this data under our legitimate interests in operating and improving our website and ensuring its security.

We do not use this information to identify your precise location, and we do not share it with third parties for marketing purposes.

Cookies Used

Necessary

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms.

You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.