Privacy Policy

SimpalUK is a trading name of Your Simpal (registered charity number 1172270, company number 10459151), which is committed to protecting your personal data and respecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have in relation to it.

This policy was last updated on 29 April 2026.

Who We Are

The data controller for your personal data is:

Your Simpal (trading as SimpalUK)

1, Court Hill, Sanderstead

South Croydon, Surrey

CR2 9NB

Data Protection Officer: Mr Chris Lewis

Email: chris@yoursimpal.com

Website: https://simpaluk.org

We are registered with the Information Commissioner’s Office (ICO) under registration reference ZC107530.

What Personal Data We Collect

2.1 Website Visitors

• Your IP address and browser information, collected automatically when you visit our website.
• Information about your browsing behaviour on our website, collected via cookies. Please see our Cookie Policy for full details.

2.2 Support Applicants and Beneficiaries

When you apply for support from SimpalUK, we may collect:

• Your name, address, telephone number and email address.
• Information about your personal circumstances, which may include health or medical information, information relating to domestic abuse, information relating to modern slavery or human trafficking, or other information relevant to your eligibility for our services.
• Information provided by a referring organisation or professional acting on your behalf.

Some of the information described above is classified as special category data under the UK General Data Protection Regulation (UK GDPR). This includes health and medical information and information relating to domestic abuse or human trafficking. We take particular care with this type of data. Please see Section 4 of this policy for further information.

2.3 Donors and Supporters

• Your name, contact details and donation information, if you make a donation or otherwise support SimpalUK.

2.4 Communications

• If you contact us by email, telephone or through our website, we may keep a record of that correspondence.
• If you complete a feedback form or survey, we will collect the information you provide.

How We Collect Your Data

• Directly from you, when you complete a form on our website, contact us by email or telephone, or apply for support.
• From a referring organisation or professional acting on your behalf, with your knowledge.
• Automatically, through cookies and similar technologies when you visit our website. Please see our Cookie Policy for full details.

Special Category Data

Certain categories of personal data are subject to additional protections under UK GDPR. These include health and medical information, information relating to domestic abuse, and information relating to human trafficking or modern slavery.

Where we collect and process special category data, we do so on one or more of the following legal bases:

• With your explicit consent (Article 9(2)(a) UK GDPR). We will ask for your consent before collecting this information and will make clear what it will be used for.
• Where processing is necessary for reasons of substantial public interest (Article 9(2)(g) UK GDPR and Schedule 1, Part 2 of the Data Protection Act 2018), specifically in connection with the provision of support services to vulnerable adults.

You may withdraw your consent at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before the withdrawal. However, it may affect our ability to provide services to you.

Legal Basis for Processing Ordinary Personal Data

For personal data that is not special category data, we rely on the following legal bases under Article 6 of UK GDPR:

• Consent: where you have given us your agreement to process your data for a specific purpose.
• Legitimate interests: where processing is necessary for our legitimate interests as a charity, including providing and administering our support services and communicating with donors and supporters, provided those interests are not overridden by your rights.
• Legal obligation: where processing is necessary to comply with a legal obligation to which we are subject.

How We Use Your Personal Data

• To assess your eligibility for our support services and to provide those services to you.
• To communicate with you about your application or the support we are providing.
• To process donations and to acknowledge donors for their support.
• To carry out research and to improve our services.
• To comply with our legal and regulatory obligations.
• To detect and prevent fraud or misuse of our services.
• To administer and improve our website.

We will not use your personal data for any purpose that is incompatible with the purpose for which it was collected without first informing you and, where required, obtaining your consent.

How Long We Keep Your Data

We retain your personal data only for as long as is necessary for the purposes for which it was collected, and in accordance with our legal obligations.

• Support applicant and beneficiary records: retained for a maximum of twelve months from the date of your last contact with us, unless a shorter or longer period is required by law.
• Donor records: retained for seven years from the date of the last donation, in accordance with financial record-keeping requirements.
• Website visitor data: retained for the period specified in our Cookie Policy.
• General correspondence: retained for three years from the date of the correspondence, unless it relates to a matter requiring a longer retention period.

Who We Share Your Data With

We will not sell, rent or trade your personal data to third parties.

We may share your personal data with:

• Third-party service providers who assist us in operating our website and providing our services, including our website hosting provider and email service provider. These providers process your data on our behalf and are required to do so only in accordance with our instructions and in compliance with applicable data protection law.
• Referring organisations or professionals where it is necessary and appropriate to do so in connection with the provision of services to you.
• Regulatory authorities or law enforcement agencies where we are required to do so by law, or where it is necessary to prevent or detect fraud or other unlawful activity.

Transferring Data Outside the United Kingdom

Some of our third-party service providers may be based outside the United Kingdom. Where we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place to protect your data in accordance with the UK GDPR and the Data Protection Act 2018.

Children and Young People

We are committed to protecting the privacy of children and young people who engage with our services. If you are under 18, please ensure that you have obtained consent from a parent or guardian before providing us with your personal data.

Where we collect information about a person under the age of 18, we will make clear why we are collecting it and how it will be used, and we will take particular care in handling that information.

Website Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. Information submitted to us via our website is protected using Secure Socket Layer (SSL) encryption.

However, the transmission of data over the internet cannot be guaranteed to be completely secure. Any transmission is at your own risk.

Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of any third-party website you visit.

Your Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• The right to be informed: the right to be told how we use your personal data. This privacy policy fulfils that obligation.
• The right of access: the right to request a copy of the personal data we hold about you (a Subject Access Request).
• The right to rectification: the right to ask us to correct personal data that is inaccurate or incomplete.
• The right to erasure: the right to ask us to delete your personal data in certain circumstances.
• The right to restrict processing: the right to ask us to restrict how we process your personal data in certain circumstances.
• The right to data portability: the right to receive your personal data in a structured, commonly used and machine-readable format in certain circumstances.
• The right to object: the right to object to our processing of your personal data in certain circumstances.
• Rights relating to automated decision-making and profiling: the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

To exercise any of these rights, please contact us using the details in Section 1 of this policy.

How to Make a Complaint

If you are unhappy with how we have handled your personal data, you have the right to make a complaint to the Information Commissioner’s Office (ICO), which is the supervisory authority for data protection in the United Kingdom.

ICO contact details:

• Website: www.ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would welcome the opportunity to address any concerns before you contact the ICO. Please contact us in the first instance at chris@yoursimpal.com.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or in applicable law. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

Governing Law

This privacy policy is governed by the laws of England and Wales. Any dispute arising in connection with this policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.