Mtima Heart Foundation, registered charity 1211684, is the controller of personal information described in this notice. Our postal address is The Piccadilly Business Centre, Unit C, Aldow Enterprise Park, Blackett Street, Manchester, M12 6AE, United Kingdom; email info@mtimaheartfoundation.org. This notice explains what we collect, why we use it, who receives it, how long we keep it and the rights available to you.
Information we collect
- Identity and contact details provided through enquiries, donations, events, volunteering or partnership discussions.
- Donation, payment status, Gift Aid declarations, communication preferences and correspondence. Card and PayPal credentials are processed by our payment providers and are not stored in full by MHF.
- Information needed to assess and deliver educational support, including family circumstances, school records, attendance, financial need, guardian and school contacts, and safeguarding information.
- Images, stories and consent records where participation is voluntary and safe.
- Technical information such as IP address, device, browser, cookie choices and website activity where collected by our website and service providers.
- Governance, due-diligence and compliance information about trustees, volunteers, partners, suppliers and significant or unusual transactions.
Why we use information and our lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Process donations, issue receipts and administer campaigns | Contract and legitimate interests |
| Accounting, Gift Aid, fraud prevention and regulatory reporting | Legal obligation and legitimate interests |
| Assess and deliver educational support | Legitimate interests; contract where applicable; vital interests in emergencies |
| Safeguarding and handling sensitive information | Legal obligation, vital interests, substantial public interest or another applicable special-category condition |
| Respond to enquiries and manage relationships | Legitimate interests or steps requested before a contract |
| Send fundraising or news communications | Consent where required; otherwise legitimate interests where permitted and balanced |
| Improve and secure the website | Legitimate interests for essential functions; consent for non-essential cookies |
| Use a person’s image or story | Consent, plus a separate safety and dignity assessment |
Children
We take extra care with children’s information. We use clear explanations, collect only what is needed, consider the child’s best interests and restrict access. Participation in publicity is optional and never a condition of educational support. Names may be changed and images blurred or withheld to reduce identification risk.
Who receives information
We may share necessary information with schools, approved delivery partners, professional advisers, auditors or independent examiners, payment and fundraising providers, website and cloud providers, regulators, HMRC and safeguarding or law-enforcement authorities. Each recipient receives only what it needs. We do not sell personal information.
International transfers
MHF works in Zimbabwe and uses technology providers that may process information outside the UK. Where UK data protection rules treat this as a restricted transfer, we use an applicable adequacy regulation or approved contractual safeguard and assess relevant risks. In an emergency, information may be shared where a lawful exception applies to protect a person.
How long we keep information
We keep information only as long as necessary for the relevant purpose, legal obligations, safeguarding and the establishment or defence of claims. Accounting and Gift Aid evidence is generally kept for at least six years after the relevant period. Programme, safeguarding and application records have separate risk-based schedules. We then securely delete or anonymise information.
Your rights
- Ask for access to your information and a copy.
- Ask us to correct inaccurate or incomplete information.
- Ask for erasure or restriction where the law allows.
- Object to processing based on legitimate interests or to direct marketing at any time.
- Withdraw consent without affecting earlier lawful processing.
- Ask for portability where applicable and challenge qualifying automated decisions.
To exercise a right or ask a question, email info@mtimaheartfoundation.org. We may verify identity. You may complain to the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. We would welcome the opportunity to resolve your concern first.
Updates
This notice is effective from 21 September 2026. We may update it when our work, providers or the law changes. Material changes will be highlighted on https://www.mtimaheartfoundation.org.
Reference framework
- ICO. UK GDPR guidance and resources. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
- ICO. Children and the UK GDPR. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/children-and-the-uk-gdpr/
- ICO. International transfers. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/
This policy is a governance document and does not replace case-specific legal, safeguarding, accounting or regulatory advice.