Privacy policy

1. Introduction

Felix Charity (“we”, “us”, “our”) is a charitable company limited by guarantee with company number 4837373 and charity number 1100051 whose registered office
is Building 3 White Collar Factory, 2 Old Street Yard, London EC1Y 8AF.

We are committed to protecting and respecting your privacy. We take the use of your personal data seriously and handle all information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant charity-sector best practice.

This privacy policy explains how we collect, use, and protect personal data when you engage with us through our services, websites, volunteering, donations, events, or other forms of contact.

For data protection purposes, Felix is the Data Controller of your personal information.

2. What personal data we collect

We may collect the following categories of personal data about you:

Name and contact details (postal address, email address, telephone numbers)
Date of birth
Job title, employer, and details of any directorships
Information necessary to process job or volunteer applications (education, career history, references, and any relevant unspent convictions)
Financial and donation information (bank details, card details processed securely by third-party payment processors, Gift Aid status)
Accident records and health information where required for health and safety, or for reasonable adjustments (volunteers or staff)
Details of your volunteering, support, or engagement with our services
Photographs, videos, or case studies used with your consent for promotional or reporting purposes
Website and email interaction data (IP address, browser type, pages visited, links clicked)
Demographic and publicly available data (e.g. estimated income, property value, philanthropic interests, professional affiliations)
CCTV images where recorded at one of our sites.
Special category data: Special category data is considered more sensitive than other data. It covers things such as your race, health, ethnicity, religion, political
beliefs, genetics, biometrics, trade union membership, sex life and sexual orientation. We only collect this type of information if there is a clear reason to
do so, for example asking for health information where you are a volunteer or member of staff, so that we can make any reasonable adjustments

3. How we collect your data

You may provide your data directly when you:

Register as a volunteer
Apply for a job
Make a donation
Sign up for a newsletter or marketing updates
Take part in campaigns or events
Respond to a survey, give feedback, or make a complaint
Enter into a contract or agreement with us
Supply us with images, testimonials, or case studies

We may also receive personal data from:

Third-party fundraising or donation platforms
Third party brokers
Our network of regional partners and delivery organisations
Volunteer management or recruitment systems
Service providers, the press, search engines, social media
Publicly available sources such as corporate websites, the Charity Commission, Companies House, or social media platforms like LinkedIn
Service providers, funders, and partner charities as part of joint projects
Analytics or cookie-based technologies on our website
One of our third-party Delivery Partners

4. How we use your personal data

We use your data to:

Provide and manage our services – including food redistribution, logistics, and volunteer engagement
Recruit staff and volunteers – assessing applications, sharing data with partner delivery organisations where necessary
Manage relationships – keeping accurate records of engagement and support
Fundraise and process donations – including Gift Aid claims and reporting to funders
Communicate with you – via email, phone, or post about news, campaigns, events, and opportunities to support us (only where you’ve consented or where
we rely on legitimate interests)
Undertake market research – to improve our services and understand supporter engagement
Profile supporter data – to identify potential major donors or funders; this may include demographic or publicly available information
Track email effectiveness – such as when emails are opened or links clicked, to tailor communications and manage frequency
Record and respond to feedback or complaints
Comply with legal obligations – including health and safety reporting, financial records, and employment requirements
Organise events and campaigns, including volunteer awards and community initiatives
Ensure building and staff security – through CCTV and attendance logging systems
Improve our website and digital channels – using analytics and cookies (see Section 10).

We will not sell or trade your personal data to any third party.

5. Our lawful bases for processing

Felix will only use your data when we have a lawful basis under data protection law. These are:

Consent – when you have agreed to specific uses (e.g. receiving newsletters or use of your image)
Contract – when processing your data is necessary to perform a contract, such as fulfilling an employment or volunteer agreement
Legal obligation – when we are required by law to process data (e.g. tax or health and safety reporting)
Legitimate interest – where processing is necessary for our charitable functions, such as managing relationships, promoting our aims, or fundraising,
and your rights do not override these interests.

When legitimate interest applies, we balance our interests with your rights and expectations, consistent with ICO guidance.

We may share your data with:

Third-party suppliers who support our operations (e.g. IT providers, payment processors, survey platforms)
Our regional food partners, third party delivery partners, or associated charities who use this shared data, for example, to manage local volunteering or organise and deliver essential services
Funders and partner charities in joint campaigns (only with your consent for particular uses where your image or name is used)
Law enforcement, HMRC, or regulators when required by law
Analytics and remarketing platforms (subject to your cookie choices)
Event organisers and contracted agencies – when participation requires sharing necessary information
Data processors acting on our behalf under strict contractual controls, in order to provide our services

All our suppliers and partners are required to handle personal data securely and use it only for the purposes we instruct.

7. Transfers outside the UK

Personal Data is normally stored within the UK. However, some service providers may process data outside the UK or the EEA. In such cases, we ensure appropriate
safeguards are in place – such as standard contractual clauses, EU-US Data Privacy Framework, transfer impact assessments, or equivalent adequacy decisions – to
protect your information.

All online transactions are transmitted using secure SSL encryption.

8. Data retention

We retain personal data for as long as it is necessary for the purposes it was collected, in line with our data retention schedule.

Examples include:

Volunteer and recruitment data: up to three years after your last engagement
Financial and Gift Aid records: for as long as legally required (usually six years)
Website analytics data: approximately 50 months
Accident or health and safety records: for the duration required by law.

When data is no longer needed it is securely deleted or anonymised.

9. Security of data

We use appropriate technical and organisational measures to protect personal data, including encryption, access controls, and secure network infrastructure. However, no method of transmission over the Internet is completely secure; any transmission is at your own risk.

Where passwords are used, you are responsible for keeping them confidential.

10. Cookies and analytics

Cookies are small text files that are automatically placed on your computer or mobile device when you visit a website. They help websites work efficiently and provide information to the site owners. Each cookie is unique to your web browser and contains anonymous information such as an identifier and site name.

Felix uses cookies to understand how people navigate our website and social media channels. This helps us improve the user experience, tailor content, and evaluate how our communications are performing.

We use:

Essential cookies – Necessary for website functionality and security (including login access for staff or authorised users)
Performance cookies – To understand how visitors use our site, such as which pages are visited and how long users spend on each page
Third-party cookies – Set by services such as Google and Facebook, to help us measure web traffic and improve how we engage with our supporters online.

All cookies used by Felix are anonymous. We do not use cookies to personally identify you.

When you first visit our site, you can choose whether to accept or reject non-essential cookies through our on-screen cookie preference tool. Essential cookies will remain active because they are required to operate the website securely.

You can control or delete cookies through your web browser settings. Most browsers let you:

Delete existing cookies
Block cookies from all or specific websites
Receive alerts before cookies are store

If you disable cookies, some parts of our website may not function properly.

To learn more, visit aboutcookies.org or allaboutcookies.org.

Analytics services (including Google Analytics) help us understand how users navigate our sites. You can opt out using Google’s tools.google.com.

11. Behavioural marketing

Where you have consented to advertising cookies, we may use remarketing tools such as Google Ads or Meta (Facebook) Ads to show relevant content after you have visited our site.

You can opt-out via:

12. Your data protection rights

Under UK data protection law, you have the following rights:

To be informed about how your data is used
To access a copy of your personal data
To rectification – to correct inaccurate data
To erasure (“right to be forgotten”) – where applicable
To restrict processing – if you contest accuracy or processing grounds
To object – to processing based on legitimate interests or for direct marketing
To data portability – to receive your data in a structured, machine-readable format
Rights related to automated decision-making – to not be subject to decisions made solely by automated means

We may ask you to verify your identity before acting on any request and will respond within one month.

To exercise these rights, contact:

DPO@felix.org

You can also raise concerns with the Information Commissioner’s Office (ICO) via ico.org.uk or phone 0303 123 1113.

13. How to contact us

If you have questions or wish to exercise your rights, contact our Data Protection Officer:

Data Protection Officer