Mtima Heart Foundation, registered charity 1211684, is the controller of personal information described in this notice. Our postal address is The Piccadilly Business Centre, Unit C, Aldow Enterprise Park, Blackett Street, Manchester, M12 6AE, United Kingdom; email info@mtimaheartfoundation.org. This notice explains what we collect, why we use it, who receives it, how long we keep it and the rights available to you.
Information we collect
- Identity and contact details provided through enquiries, donations, events, volunteering or partnership discussions, including your name, email address and any other contact details you choose to give us.
- Donation amounts, dates, payment status, transaction references, Gift Aid declarations, communication preferences and correspondence.
- Recurring donation details, such as the amount, frequency and status of a regular gift.
- Payment method information made available to us by our payment providers, such as the card type and last four digits. Card and PayPal credentials are processed by our payment providers and are not stored in full by MHF.
- Messages sent through our website contact form, including your name, email address, subject and message.
- Marketing preferences and records of any consent you give to receive updates.
- Information needed to assess and deliver educational support, including family circumstances, school records, attendance, financial need, guardian and school contacts, and safeguarding information.
- Images, stories and consent records where participation is voluntary and safe.
- Technical information such as IP address, device, browser and cookie data where collected by our website and service providers, as described in our Cookie Policy.
- Governance, due-diligence and compliance information about trustees, volunteers, partners, suppliers and significant or unusual transactions.
Why we use information and our lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Process donations, issue receipts and administer campaigns | Contract and legitimate interests |
| Manage recurring donations and send donation-related communications | Contract and legitimate interests |
| Accounting, Gift Aid, fraud prevention and regulatory reporting | Legal obligation and legitimate interests |
| Assess and deliver educational support | Legitimate interests; contract where applicable; vital interests in emergencies |
| Safeguarding and handling sensitive information | Legal obligation, vital interests, substantial public interest or another applicable special-category condition |
| Respond to enquiries and manage relationships | Legitimate interests or steps requested before a contract |
| Send fundraising or news communications | Consent where required; otherwise legitimate interests where permitted and balanced |
| Improve and secure the website | Legitimate interests for essential functions; consent for non-essential cookies |
| Use a person’s image or story | Consent, plus a separate safety and dignity assessment |
Simply visiting our website does not mean you have consented to all processing. Processing needed to administer a donation is separate from optional marketing: you do not need to agree to receive fundraising updates in order to donate, and you can withdraw marketing consent at any time.
Donations and payment providers
MHF uses Fundraise Up to facilitate online donations, with payment processing supported by providers including Stripe and PayPal where applicable. These providers process the information needed to take your payment securely, prevent fraud and send donation receipts. MHF does not itself store complete payment card numbers or card security codes; our providers retain payment information in line with their own legal and security obligations.
Supporters may have access to a secure Fundraise Up Donor Portal, where they can view their donation records and manage recurring donations, depending on the settings available for their donation.
Children
We take extra care with children’s information. We use clear explanations, collect only what is needed, consider the child’s best interests and restrict access. Participation in publicity is optional and never a condition of educational support. Names may be changed and images blurred or withheld to reduce identification risk.
Who receives information
We may share necessary information with schools, approved delivery partners, professional advisers, auditors or independent examiners, payment and fundraising providers, website and cloud providers, regulators, HMRC and safeguarding or law-enforcement authorities. Each recipient receives only what it needs. We do not sell personal information.
International transfers
MHF works in Zimbabwe and uses technology providers that may process information outside the UK. Where UK data protection rules treat this as a restricted transfer, we use an applicable adequacy regulation or approved contractual safeguard and assess relevant risks. In an emergency, information may be shared where a lawful exception applies to protect a person.
How long we keep information
We keep information only as long as necessary for the relevant purpose, legal obligations, safeguarding and the establishment or defence of claims. Accounting and Gift Aid evidence is generally kept for at least six years after the relevant period. Programme, safeguarding and application records have separate risk-based schedules. Contact form messages and general correspondence are kept only for as long as needed to respond and manage the relationship. We then securely delete or anonymise information. Because financial records must be kept to meet legal and accounting requirements, we may not be able to delete donation records on request until the required period has ended.
Your rights
- Ask for access to your information and a copy.
- Ask us to correct inaccurate or incomplete information.
- Ask for erasure or restriction where the law allows.
- Object to processing based on legitimate interests or to direct marketing at any time.
- Withdraw consent without affecting earlier lawful processing.
- Ask for portability where applicable and challenge qualifying automated decisions.
To exercise a right or ask a question, email info@mtimaheartfoundation.org. We may verify identity. You may complain to the UK Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. We would welcome the opportunity to resolve your concern first.
Updates
This notice is effective from 21 September 2026. We may update it when our work, providers or the law changes. Material changes will be highlighted on https://www.mtimaheartfoundation.org.
Reference framework
- ICO. UK GDPR guidance and resources. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
- ICO. Children and the UK GDPR. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/children-and-the-uk-gdpr/
- ICO. International transfers. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/
This policy is a governance document and does not replace case-specific legal, safeguarding, accounting or regulatory advice.