Privacy notice

Who we are

NBCC is a volunteer led Scottish Charitable Incorporated Organisation (SCIO), charity number SC047995, regulated by OSCR. We are the data controller for the personal data described here.

What we collect

When you give or get in touch, we may collect:

• your name and contact details, such as email address, phone number and postal address;
• if you sign up to fundraise for us, your home address, so we can post your welcome pack and anything you ask us for;
• if you fundraise for your child or a young person you look after, their first name, which is shown on their page only with your consent as their parent or guardian;
• the details of your donation, including amount and whether it is a single or monthly donation;
• your Gift Aid declaration, where you choose to add Gift Aid;
• the message you send us through the contact form.

Card payments are handled by our payment provider. We never see or store your full card number.

Why we use it, and our legal basis

We use your data to process your donation, send you a receipt and thank you where you have asked us to, claim Gift Aid from HMRC where you are eligible, and answer your enquiry. Our legal basis is your consent for optional emails, and our legitimate interest and legal obligations for processing donations and Gift Aid.

If you join our mailing list, we use your name and email address to send you our news a few times a year. If you give us your mobile number, we keep it in case we send updates by text in future. You can unsubscribe at any time using the link in any email.

Sharing your data

We do not sell your data, ever. We share it only where we must: with HMRC for a Gift Aid claim, and with the payment and email providers that help us run the campaign, who act on our instructions.

When you start filling in our contact form, it uses Cloudflare Turnstile to check that your message comes from a person rather than a program sending spam. To make that check, Cloudflare receives your IP address and some information about your browser, and may keep a small amount of data in your browser (cookies or local storage) for that purpose only. Cloudflare does not use it for advertising. Our legal basis is our legitimate interest in keeping our inbox free of spam, so that real enquiries are answered. Cloudflare explains what it collects in its Turnstile privacy addendum.

Stories you share with us

If you share a story with us through our My Story form, we collect your story and any optional details you choose to give us, such as your first name, contact details, town, age band or how the Red Bag reached you. This is held in a separate database from our other supporter records, kept apart from your donor or Gift Aid details.

We rely on your explicit consent, given at the point you submit your story. You give separate consent for us to hold your details and for how we may use and share your story, such as publishing it publicly or keeping it for internal use only. If your story is about someone else, such as a child or vulnerable adult you support, we ask you to confirm you have their permission, or that of their parent or guardian, before you share it.

We keep stories as part of our permanent archive, to show the difference NBCC makes over time, unless you ask us to withdraw or delete yours. Withdrawing means we stop using your story; deleting means we erase your details for good. You can ask us to do either at any time by emailing privacy@nbcc.scot or using our contact form.

If you run a local business

We sometimes write to local businesses to ask whether they would consider supporting us. If we have written to you, this is what that means.

We hold the business name, and where we have them, a contact name, an email address and a phone number. We take these from the business’s own website or a local business listing, and nowhere else. We do not buy lists, and we never pass your details to anyone else.

Our legal basis is legitimate interests: we are a small charity looking for local support, and one short note to a business seemed a fair way to ask. If you are a sole trader, we only email you where you have already told us we may.

Reply to any email from us and say the word, and we will not contact you again. We keep a note of the business name so that nobody here writes to you by mistake later. We also keep a record of what we sent and when. If a business does not reply and we hear nothing for three years, we remove the contact person’s name, phone number and personal email address, and keep only the business name and the fact we wrote.

The link in our email to the donate page carries a short code so we can tell which approach a donation came from. It is our own reference, it does not follow you around the internet, and no one else sees it.

Counting visits

We count visits to this website so we can see which pages help people and which do not. We do it without cookies, and nothing is stored on your phone, tablet or computer.

We keep a record of each page view: which page and when, the name of the website or the email that sent you here, your town or city and country, whether you used a phone, tablet or computer, which browser and system, how long you spent on the page and how far down you read. We also note the buttons and links that matter, such as Donate, or a link to another website or a download. The record holds no name, email address, IP address or cookie.

Your IP address is used for a moment to work out your town or city, and we never store it. Each record carries a visitor code, so we can tell one visitor from another on the same day. The code changes every day, and the key that makes it is deleted after the day, so visits cannot be linked from one day to the next, or traced back to an IP address once the day is over.

We keep these records for 13 months. If your browser sends a Do Not Track or Global Privacy Control signal, we count nothing at all. Our legal basis is legitimate interests: a small charity needs to know whether its website is working.

How long we keep it

We keep Gift Aid records for six years after your most recent claimed donation, as HMRC requires. Other data we keep only for as long as we need it, then delete it.

Your rights

You can ask us to show you the data we hold, correct it, or delete it, and you can withdraw your consent to emails at any time. To do any of these, or if you have a question about how we handle your data, email us at privacy@nbcc.scot, or get in touch.

Fundraising standards

We follow the Code of Fundraising Practice. Fundraising in Scotland is overseen by the Scottish Fundraising Adjudication Panel. If you would rather we did not contact you, you can also use the Fundraising Preference Service to manage or stop fundraising communications.