Website Privacy Policy - Updated June 2026

Who we are and what we do

Every day, supporters of the Anne Frank Trust (the “Charity”) make a valuable difference by supporting our mission to empower young people aged 9-15 to challenge all forms of prejudice. We value building long-lasting relationships with our supporters based on trust, transparency and compassion. Processing your information helps maintain a secure, well-managed database and adhere to best practices so that your data and preferences are updated.

The data we collect on you helps us better understand you and be more appropriate when communicating with you. For instance, we can recognise and acknowledge your support and commitment to the Charity over the years. This also equips us to handle enquiries, deliver materials, and process payments. Above all, it facilitates our providing quality support.

The Charity is registered with the Charity Commission (charity numbers 1003279 and SC040488 (Scotland)) and Companies House (company number 02612141). It is also registered with the Information Commissioner’s Office as a data controller (registration number ZB016998). Our Data Protection Officer can be contacted via email at [email protected].

This Privacy Policy sets out the basis for processing any personal data we collect from you or that you provide. Please read this Privacy Policy carefully to understand our views and practices regarding your data and how we will treat it.
In meeting its charitable purposes, the Charity, as a data controller, processes the personal data of the following categories of people:

• Supporters
• Programme Participants, Ambassadors & Teachers

Audience-specific privacy notices covering each of the above categories support this Privacy Policy. We encourage you to read those relevant to your relationship with us for greater detail on how we manage and use your data.

We may need to change or update this Privacy Policy occasionally; if we do so, we will post the changes here. Where the changes are significant, we will inform individuals.

Dated: June 2026

Your personal data

The personal data we may collect about you, why we collect it, and what we do with it will depend on your relationship with us. We collect personal data in many ways, such as when you sign up for a programme, subscribe to our email newsletter, or donate to us.
Please see the audience-specific privacy policies, which can be found below, for more details.

Your rights

Under data protection law, you have rights, including:

• The Right of Access. You have the right to ask us for copies of your personal information.
• The Right to Rectification. You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• The Right to be Forgotten. You can ask us to erase your personal information in certain circumstances.
• The Right to Restrict Processing. You have the right to ask us to restrict the processing of your personal data in certain circumstances.
• The Right to Object. In certain circumstances, you have the right to object to the processing of your personal data.
• The Right to Withdraw Consent. If we rely on consent to process your personal data, you can withdraw that consent at any time.
• The Right to Portability. You have the right to ask that we transfer the personal data you gave us to another organisation or you in certain circumstances.

If you make a request, we have one month to respond. If you have any questions, please contact us at [email protected]. Please note that not all the above rights are absolute, and requests may be refused where exceptions apply.

Complaints

If you have concerns about how we collect, use, store or share your personal data, we encourage you to contact us first so that we can investigate and try to resolve the issue.

You can submit a data protection complaint by contacting our Data Protection Officer via email at [email protected].

Please provide as much detail as possible about your concern, including:

• your contact details.
• the nature of your complaint.
• any relevant dates or correspondence.
• the outcome you are seeking.

We will:

• acknowledge receipt of your complaint within 30 days.
• investigate the matter appropriately and proportionately.
• keep you informed of progress where necessary.
• provide you with the outcome of your complaint without undue delay.

We may need to request additional information from you to help us investigate your complaint.

Subject Access Request

You can ask us to confirm if we are keeping any personal information about you, and you can also request to receive a copy of that personal information – this is called a Subject Access Request.

To make a Subject Access Request, we may ask you to provide proof of identity, such as a copy of your passport, birth certificate, or driving license, before your request can be processed. Please try to be as straightforward as possible about the information you seek, as this will help us respond to your request more efficiently.

If you make a request, we have one month to respond. If you have any questions, please contact us at [email protected].
You can also complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data. The ICO’s address is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Alternatively, you can phone their helpline at 0303 123 1113 or complete an online form via the ICO website (https://www.ico.org.uk).

Updating your communication preferences

We will respect your email privacy. This means we carefully manage the communications we send you to ensure that we are contacting you in the most relevant way.

You will only receive communications from us that you have requested, except where we may write to thank you for a donation or send you administrative paperwork such as a receipt. You can change your email preferences or unsubscribe at any time by:

• clicking the “unsubscribe” link at the end of any emails you receive from us.
• by contacting [email protected] or calling 020 7284 5858.
• Alternatively, you can unsubscribe from other email communications by replying to the sender.

Please note that we may embed links to third-party websites or pages not managed by the Charity. If you follow any of these links, please note that they have privacy policies. Please check those third-party policies before submitting personal information to those websites. We do not accept any responsibility or liability for these policies.

How do we keep your information secure?

The security of your personal data is essential to us, and to protect your data, we take several necessary measures, including the following technical and organisational measures:

• Limiting access to your personal data to those employees, contractors, and other third parties with a legitimate need to know and ensuring that they are subject to duties of confidentiality.
• Procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data), including notifying you and/or the Information Commissioner’s Office where we are legally required.
• Training all staff when they join the Anne Frank Trust UK and at regular intervals after that.
• Entering into Data Processing Agreements with any third party who processes your personal data on our behalf.
• Data protection and IT policies and procedures reduce the risk of data loss, alteration, accidental or unlawful destruction, and unauthorised disclosure.

Contact us

You can contact us anytime to change your communication preferences or let us know when something changes. If you have any queries about our Privacy Policy or want to raise a concern about how we process the information we hold about you, please email [email protected]. You can also call us on 020 4583 9050.

Audience-Specific Privacy Notices

• Supporters
• Programme Participants, Ambassadors & Teachers
• Trustees

Supporters

What data do we collect?

• Identity data: full name, title
• Contact data: address, email address(es), telephone number, mobile phone number.
• Financial data: donation amount, gift aid declarations, credit card details
• Organisation data: business name
• Profile data: preferences and interests, donation history.
• Opinion data: your views on our services and activities.
• Technical data: (read our Cookie Policy) IP address, browser type and version, operating system.

How do we use your data (and the legal basis for processing)?

Most of the personal data we process is provided directly by you. Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing this information. The table below lists the processing purposes and the lawful basis.

Purpose for Processing	Legal Basis
To process your donation(s) and any gift aid	Legal Obligation
To process grant and trust payments, and any legacy gifts.	Legal Obligation
Seeking views on the services or activities AFT carry out so that we can make improvements.	Legitimate Interest
Sending invitations for events AFT are holding, decide on catering.	Legitimate Interests
To subscribe you to the Anne Frank Newsletter(s)	Consent
To send you communications that may be of interest to you (these may include information about our services and activities, campaigns, appeals asking for donations, and other fundraising activities, for which we seek support).	Consent
To maintain our organisational records to ensure we know how you prefer to be contacted.	Legitimate Interests
To use profiling and database segmentation techniques to analyse supporter data and to create a profile of your interests, preferences, and ability to donate.	Consent
To cultivate relationships to increase the level of donation.	Legitimate Interests
To identify and manage income generation opportunities.	Legitimate Interests

If you become a Patron of the Anne Frank Trust UK, we may publish your name on our website as part of our Patron recognition programme. We rely on our legitimate interests to recognise and acknowledge our Patrons' support. If you would prefer not to have your name published, you may object at any time, and we will respect your wishes.

We may process personal information indirectly from the following sources:

• A table host who has invited you to attend the Anne Frank Annual Lunch.
• We may conduct due diligence research on existing and potential supporters to ensure that donations accepted are unlikely to cause reputational damage to the Charity that could impact our ability to fundraise from other sources or to provide our services.
• We may hold data about people with whom we do not have a relationship. Still, we need to know who we believe will support the charity: local philanthropists, those known to help our area of work or anyone else interested in supporting the charity. In these instances, we may research these people using the above methods and hold their data for up to three years before contacting them. At this point, we will collect the individual’s communication preferences.

Who do we share your data with?

We share your personal information with the following third parties:

Recipient Activity	Carried Out	Location
Salesforce CRM	Our central fundraising and education programme platform.	United States.
Creative Clinic	Design of fundraising materials and the Anne Frank Trust website.	United Kingdom.
MailChimp	To create, store and disseminate the Anne Frank Trust newsletter.	United States.
Microsoft Office 365	To correspond with individuals.	EEA
Xero Accounting Software	To reconcile donations and gift-aid	United States.

Your data may be transferred to a third party if we transfer or merge parts of our organisation or assets. Any new owner of our organisation may continue to use your data in the same way(s) we have used, as specified in this Privacy Notice.

Do we transfer your data outside of the UK?
We store some of your data in countries outside the UK, which are known as “third countries.” We will only store or transfer personal data in or to countries:

• Deemed to provide adequate protection for personal data via an Adequacy Decision.
• Using Adequate Safeguards, such as the UK’s International Data Transfer Addendum.

How long will we retain your data?
We will not keep your data any longer than necessary, and it will be kept for the following periods:

Type of Personal Data	Retention Period
Financial Data	Six Years
Identity, Contact, Opinion, and Organisation Data	Ten Years

Per our Retention and Data Disposal Policy, we will securely destroy your data.

Programme Participants, Ambassadors & Teachers

What data do we collect?

We currently collect and process the following information:

• Identity data: full name, title
• Contact data: address, email address(es), telephone number, mobile phone number.
• School data: school name, job title, profession
• Attendance data: programmes attended, dates of attendance.
• Profile data: photos, video and audio content, age
• Special categories of data: ethnicity, disability, medical information, food allergies, and language(s) spoken.
• Impact Questionnaire data: comparing views/opinions before and after attending the programme/workshop.
• Technical data: (read our Cookie Policy) IP address, browser type and version, operating system.

How do we use your data (and the legal basis for processing)?

Most of the personal data we process is provided directly by you. Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing this information. The table below lists the processing purposes and the lawful basis.

Purpose for Processing	Legal Basis
To organise and curate case studies or stories from young people.	Consent.
To cultivate relationships to increase the level of donation from the annual lunch.	Legitimate Interests
To organise and manage peer education programme and workshops with primary and secondary schools across the UK.	Legitimate Interests
To organise and manage live online events.	Legitimate Interests
To appoint peer educators into the Anne Frank Ambassador Programme.	Legitimate Interests
To mentor individuals on the Anne Frank Ambassador Programme.	Legitimate Interests
To evaluate and monitor the Anne Frank education programmes	Legitimate Interests Special categories of personal data: explicit consent.
To organise and manage the annual National Youth Conference	Legitimate Interests
To safeguard the welfare of children and young adults participating in an Anne Frank education programme or workshop.	Legal Obligation

We also receive personal information indirectly from the following sources:

• Teachers from Primary and secondary schools who are participating in one of our peer education programmes or workshops.

Who do we share your data with?

We share your personal information with the following third parties:

Recipient Activity	Carried Out	Location
Salesforce CRM	Our central fundraising and education programme platform.	United States.
Youth Empowerment Panel	To appoint peer educators into the Anne Frank Ambassador Programme	United Kingdom.

Your data may be transferred to a third party if we transfer or merge parts of our organisation or assets. Any new owner of our organisation may continue to use your data in the same way(s) we have used, as specified in this Privacy Notice.

Do we transfer your data outside of the UK?

We store some of your data in countries outside the UK, which are known as “third countries.” We will only store or transfer personal data in or to countries:

• Deemed to provide adequate protection for personal data via an Adequacy Decision.
• Using Adequate Safeguards, such as the UK’s International Data Transfer Addendum.

How long will we retain your data?

We will not keep your data any longer than necessary, and it will be kept for the following periods:

Type of Personal Data	Retention Period
Identity, Contact, Assessment data, and School Data, and special categories of personal data.	Two Years
Safeguarding data	Ten Years

Per our Retention and Data Disposal Policy, we will securely destroy your personal data.