Privacy Policy

The AT Society is committed to protecting and respecting your personal information. We handle personal information lawfully, fairly, securely and transparently.

This Privacy Notice explains:

  • what personal information we collect;
  • where we get it from;
  • how and why we use it;
  • the legal basis on which we use it;
  • who we may share it with;
  • how long we keep it;
  • your rights in relation to your personal information;
  • how to complain.

1. Who we are

The AT Society (Ataxia Telangiectasia Society) is a registered charity in England and Wales (No. 1105528) and a company limited by guarantee (No. 5177145), based at Unit 54, Thrales End Business Centre, Thrales End Lane, Harpenden, AL5 3NS.

The AT Society is the data controller for the personal information described in this Privacy Notice. We are registered with the Information Commissioner’s Office (ICO), registration number Z1838610.

2. How to contact us about your information

The AT Society has appointed a member of staff with responsibility for data protection compliance. If you have questions about this Privacy Notice, how we use your personal information, or would like to exercise any of your data protection rights, please contact us at: [email protected], or at the address above.

You also have the right to raise a concern with the Information Commissioner’s Office (ICO). See section 17 for further information.

3. What personal information we collect

Depending on your relationship with us, we may collect and process information including:

  • your name and contact details, such as your address, email address and telephone number;
  • date of birth and gender, where relevant;
  • if you are under 18 years old, we will collect the contact details of your parent or carer;
  • photographs or video recordings that you send to us, or that we take at our events;
  • donation, fundraising and Gift Aid information;
  • information about events, services and activities you take part in;
  • dietary information including allergies and health conditions;
  • communication and marketing preferences;
  • feedback and survey responses;
  • information you provide when seeking information, advice or support from us;
  • information relating to your relationship with the AT Society;
  • technical information when you use our website and digital services;
  • payment or banking details;
  • purchase and donation history;
  • taxpayer information (for Gift Aid purposes);
  • marketing preferences and records of consent;
  • information relating to compliments or complaints.

We may collect this information when you:

  • donate or fundraise;
  • use our services;
  • register for events;
  • contact us or complete forms; or
  • engage with us online.

If you apply to work or volunteer with us, we may collect or use information such as:

  • contact details (e.g. name, address, telephone number or personal email address);
  • date of birth, where required;
  • National Insurance number, where required;
  • copies of passports or other photo ID, where required;
  • employment history (e.g. job applications, employment references or secondary employment);
  • education history and qualifications;
  • right-to-work information; and
  • details of any criminal convictions or Disclosure and Barring Service (DBS) checks where appropriate for the role.

We may process criminal-offence information, for example where a DBS check is required for a particular role. We will only process this information where we are permitted to do so under data protection law and where the relevant legal requirements are met.

We may collect limited technical information, such as IP addresses and website usage data, through cookies and similar technologies. Please see our Cookies Policy for further information.

4. Special category information

Because of the nature of our work, we may need to process more sensitive personal information, known under data protection law as special category data. This may include information about a person’s health or medical condition and, where relevant, genetic information or information about racial or ethnic origin.

We will only process special category information where we have both an appropriate lawful basis under Article 6 of UK GDPR and a relevant condition under Article 9 of UK GDPR. Depending on the circumstances, this may include your explicit consent or another condition permitted by data protection law. Where required, we will also meet the relevant requirements of the Data Protection Act 2018.

We take additional care to protect sensitive information. Access is restricted to authorised people who need it for their role.

5. How we collect personal information

We may collect information:

  • directly from you, for example when you contact us, use one of our services, donate, fundraise for us, register for an event, complete a form or survey, or communicate with us;
  • through our website and digital services; and
  • from third parties where appropriate, such as fundraising platforms, event organisers, healthcare professionals or family members.

For example, we may receive information through fundraising platforms such as JustGiving or CAF. Where information comes from someone other than you, we will only use it where we have an appropriate reason and are permitted to do so under data protection law.

6. How we use your personal information

We may use personal information to:

  • Provide services and support
    To respond to enquiries, provide information, advice and support and manage your relationship with the AT Society.
  • Process donations and fundraising
    To process donations and other transactions, administer fundraising activities, manage Gift Aid and meet financial and reporting requirements.
  • Communicate with you
    To provide information about services, activities, events or other matters relevant to your relationship with us.
  • Fundraising and marketing
    To tell you about our charitable work, fundraising activities, events, appeals and ways you may wish to support us.
  • Improve our services
    To understand how people use and engage with our services and activities, obtain feedback and improve what we offer.
  • Manage staff and volunteers
    To recruit and select applicants and manage and support people who work or volunteer with us.
  • Meet legal and administrative requirements
    For purposes including financial administration, record keeping, regulatory compliance and the prevention of fraud or misuse.
  • Safeguarding
    We may process personal information where necessary to protect children, young people or adults from harm and to fulfil our safeguarding responsibilities.

7. Our lawful bases for using personal information

Data protection law requires us to have a lawful basis for collecting and using personal information. Depending on why we are using your information, we may rely on:

  • Consent, where you have given us permission to use your information for a particular purpose. Where we rely on consent, you can withdraw your consent at any time.
  • Contract, where processing is necessary to enter into or fulfil a contract with you, or to take steps at your request before entering into a contract.
  • Legal obligation, where we need to process information to comply with a legal obligation.
  • Legitimate interests, means we may use your personal information where this is necessary for our legitimate charitable or organisational interests and where we have considered and balanced those interests against your rights and freedoms. Some typical examples of when we might use the approach are:
    • furthering the AT Society’s charitable purposes and supporting people affected by AT;
    • managing our relationships with supporters, donors and volunteers;
    • administering and improving our fundraising activities;
    • communicating with supporters where it is lawful and reasonable to do so;
    • understanding engagement with our services and communications;
    • improving our services and activities;
    • preventing fraud and protecting our systems and information; and
    • administering the charity effectively.

    When we rely on legitimate interests, we consider whether the processing is necessary and whether your rights and interests override our interests. You have the right to object to processing based on legitimate interests.

  • Recognised legitimate interests: In certain circumstances we may rely on a recognised legitimate interest provided for by UK data protection law, for example where processing is necessary for safeguarding, responding to an emergency or preventing or detecting crime. We will only rely on this basis where the relevant legal conditions are met.
  • Vital interests: We may rely on vital interests where collecting or using personal information is necessary to protect someone’s life, physical or mental health or wellbeing in an urgent or serious situation.

These bases may apply to our activities in the following ways:

Donations and fundraising: We may rely on contract where processing is necessary to administer a donation, event or fundraising activity; legal obligation where we need to meet legal, tax or accounting requirements; consent where appropriate; and legitimate interests for purposes such as managing supporter relationships, administering and improving our fundraising activities and understanding engagement with our work.

Service updates and marketing: We may rely on consent or legitimate interests, depending on the circumstances. Where we send electronic direct marketing, we will also comply with the Privacy and Electronic Communications Regulations (PECR), including the charitable purposes soft opt-in where applicable.

Recruitment: We may rely on contract or steps taken before entering into a contract, legal obligation and legitimate interests, depending on the information being processed and the stage of the recruitment process. Where we process special category or criminal offence information, we will only do so where the additional legal requirements for that information are met.

Queries and complaints: We may rely on legitimate interests where processing is necessary to respond to and manage enquiries or complaints, and legal obligation where we are required by law to process the information. In some circumstances, another lawful basis may apply.

8. Marketing and fundraising communications

We may contact you about our charitable work, services, events, fundraising activities, appeals and ways you can support the AT Society.

We will send electronic marketing communications, such as emails and text messages, where:

  • you have given us consent; or
  • we are otherwise permitted to do so under the Privacy and Electronic Communications Regulations (PECR), including, where applicable, the charitable purposes soft opt-in.

Where permitted by law, we may rely on the charitable purposes soft opt-in to send electronic marketing about our charitable work, services, fundraising, events, appeals and other ways to support the AT Society. We will only do this where the legal requirements are met, including providing a clear and simple opportunity to opt out when we collect your contact details and in each subsequent marketing communication.

We may also contact you by post where it is lawful and appropriate to do so, unless you have asked us not to.

You can change your communication preferences or opt out of marketing at any time by:

  • using the unsubscribe or opt-out option in our communications; or
  • contacting us directly.

We will never sell your personal information or share it with another organisation for that organisation’s marketing purposes.

9. Children’s and young people’s information

We provide services and support to children and young people and recognise that their personal information requires particular care and protection. When we collect and use children’s personal information, we take appropriate steps to protect their privacy and ensure that we have an appropriate lawful basis for using their information.

Where appropriate, we will provide information about how personal information is used in a way that is clear and understandable to the child or young person. Where consent is the appropriate lawful basis, we will consider the child’s age and understanding and obtain consent from a parent or legal guardian where required or appropriate.

10. Profiling and personalisation

We may use limited profiling to help us understand people’s interests and tailor our communications. For example, we may consider previous engagement with the AT Society or donation history. Profiling is carried out by authorised staff, and we do not use it to make solely automated decisions that have legal or similarly significant effects. Where we rely on legitimate interests for this processing, you have the right to object.

11. Sharing your personal information

We may share personal information where necessary with:

  • trusted suppliers and service providers acting on our behalf, such as CRM, IT, payroll, HR and cloud-hosting providers, email platforms and payment processors;
  • accountants, auditors, legal advisers and other professional advisers;
  • event organisers and fundraising platforms where relevant;
  • healthcare professionals or other organisations where appropriate in connection with the support we provide and where we have a lawful basis for doing so; and
  • regulators, public authorities, law enforcement or other bodies where required or permitted by law.

Where organisations process information on our behalf, we require appropriate arrangements to be in place to protect it and limit its use to the agreed purposes.

We do not sell personal information.

12. International transfers

Some of our service providers may process or store personal information outside the UK. Where this involves a restricted transfer under UK data protection law, we ensure that an appropriate legal mechanism is in place, such as UK adequacy regulations or appropriate contractual safeguards. You can contact us using the details in section 2 for further information about the safeguards we use.

13. How long we keep your information

We only keep personal information for as long as we reasonably need it for the purpose for which it was collected, including to meet legal, regulatory, accounting or reporting requirements.

Our current retention arrangements include:

  • financial records, typically seven years;
  • supporter records, which are regularly reviewed and deleted where they are no longer required;
  • volunteer records, typically four years;
  • beneficiary records, which are regularly reviewed and retained where necessary to provide ongoing support and fulfil our charitable purposes;
  • unsuccessful job-applicant records, normally six months unless the individual has agreed that we may retain the information for future opportunities; and
  • safeguarding records, retained in accordance with our safeguarding and data-retention requirements.

We may retain a limited record of people’s communication preferences where necessary to ensure that we continue to respect requests not to receive marketing communications.

14. Keeping your information secure

We take appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. These measures include appropriate access controls, secure systems, staff training, regular security reviews, confidentiality requirements, password controls, multi-factor authentication, secure disposal arrangements and encryption where appropriate.

15. Personal data breaches

We have procedures for identifying, investigating and responding to personal data breaches. Where a breach occurs, we will assess it promptly and notify the Information Commissioner’s Office and affected individuals where required by data protection law.

16. Your data protection rights

Under UK data protection law, you have a number of rights in relation to your personal information. Which rights apply depends on the circumstances and the lawful basis on which we use your information. These may include:

Your right of access – You have the right to ask us for copies of your personal information and certain other information about how we use it. There are exemptions in some circumstances, which may mean that you do not receive all of the information you request.

Your right to rectification – You have the right to ask us to correct personal information you think is inaccurate or complete information you think is incomplete.

Your right to erasure – You have the right to ask us to delete your personal information.

Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information.

Your right to object to processing – You have the right to object to certain uses of your personal information, including processing based on legitimate interests. You also have the right to object to direct marketing.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.

Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

If you make a request, we will respond to you without undue delay and in any event within one month. To exercise any of your rights, please contact us using the details in section 2.

17. Data protection complaints

If you have concerns about how we have handled your personal information, please contact us in the first instance using the details in section 2. We will consider data protection concerns fairly and respond appropriately.

You also have the right to complain to the Information Commissioner’s Office if you are unhappy with how we have used your information. The ICO’s address is: ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL. Helpline number: 0303 123 1113. Website: https://www.ico.org.uk/make-a-complaint

18. Links to other websites

Our website may contain links to websites operated by other organisations. We are not responsible for their privacy practices and encourage you to read their privacy notices when providing personal information to them.

19. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our activities, services or legal requirements. The latest version will be available on the AT Society website at www.atsociety.org.uk

Last updated: 15 October 2026
Next review: 15 October 2027