Privacy Policy

Last updated: August 2026

Important disclaimer: This is a sample/template privacy policy drafted from publicly available information about KindLift CIC (website kindlift.org, registered office, activities as a Community Interest Company). It is not legal advice. You should review and customise it with a qualified solicitor or data protection advisor to match your actual data practices, systems, and to ensure full compliance with the UK GDPR and Data Protection Act 2018. Do not publish it without checking and adapting it.

1. Who we are

Kindlift CIC (“we”, “us”, “our”) is a Community Interest Company registered in Scotland (Company Number SC798069).

Registered office / main address: 18 Old Sneddon Street, Paisley, PA3 2AL, Scotland

We operate a shop and reuse project that collects unwanted household furnishings and goods, sells second-hand (and some new) items, provides free furnishings to people transitioning from homelessness, runs community spaces, and undertakes local projects such as adopting Paisley Gilmour Street Station.

Data Controller: Kindlift CIC Contact for privacy matters: Email: dataprotection@kindlift.online (at the shop during opening hours (currently Thursday and Friday, 12pm–5pm)

2. What personal data we collect

We may collect and process the following categories of personal data, depending on how you interact with us:

Identity and contact data: name, address, email address, telephone number (e.g. when you donate items, request an uplift, buy from the shop, volunteer, or contact us).
Transaction data: details of purchases, donations of goods, or payments (if any) related to collections or shop sales.
Volunteer / supporter data: information you provide when signing up to volunteer or help with projects (including the station adoption).
Communications data: records of emails, messages, or notes from conversations with us.
Technical / website data: IP address, browser type, device information, and limited usage data if you visit kindlift.org (via standard web server logs or any analytics tools we use).
Special category data: We do not routinely collect special category (sensitive) data. If any arises in the course of supporting people in need (e.g. related to housing circumstances), we will only process it where necessary and with appropriate safeguards or explicit consent.

We do not collect more data than is reasonably needed for our community and reuse purposes.

3. How we collect your data

Directly from you (in the shop, when arranging collections/uplifts, volunteering, or contacting us by phone/email).
Via our website (kindlift.org) if you submit any form or interact with it.
Automatically when you visit the website (basic technical data).
Occasionally from referral partners or community organisations when arranging support for people in need (with appropriate basis).

4. Why we process your data and our lawful bases

We process personal data for the following purposes under UK GDPR:

Purpose, Lawful basis

Providing our services (collections, shop sales, free furnishings to those in need, community projects)Performance of a contract / Legitimate interests

Managing volunteers and community helpers, Legitimate interests / Consent

Communicating with you about donations, collections, or shop matters, Legitimate interests / Consent

Operating and improving our website, Legitimate interests

Legal, accounting, and regulatory obligations (including CIC reporting) Legal obligation

Safety, security, and preventing misuse, Legitimate interests

Where we rely on legitimate interests, we have balanced these against your rights and freedoms. You can object to processing based on legitimate interests (see Your rights below).

5. Who we share your data with

We do not sell your personal data. We may share it with:

Service providers who help us run the organisation (e.g. IT, website hosting, accounting, payment processors if used) under strict contracts.
Community or referral partners only where necessary to deliver support (e.g. coordinating free furnishings).
Professional advisors or regulators when required by law.
Law enforcement or courts if legally obliged.

Any third parties are required to keep your data secure and use it only for the agreed purposes.

6. International transfers

We primarily process data within the UK. If any data is transferred outside the UK, we ensure appropriate safeguards (such as adequacy decisions or standard contractual clauses) are in place.

7. How long we keep your data

We retain personal data only as long as necessary for the purposes collected, or to meet legal, accounting, or reporting requirements. Typical periods:

Customer / donation / transaction records: usually 6–7 years (tax and accounting).
Volunteer records: while active plus a reasonable period afterwards.
Website logs: shorter periods (often 12 months or less).
Contact enquiries: until resolved plus a short archive period.

We securely delete or anonymise data when no longer needed.

8. How we protect your data

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. This includes limiting access to those who need it, using secure systems where possible, and training relevant people. No method of transmission or storage is 100% secure, but we aim to maintain appropriate standards for a small community organisation.

9. Your rights under UK GDPR

You have the following rights (subject to certain conditions and exemptions):

Access – request a copy of the personal data we hold about you.
Rectification – ask us to correct inaccurate or incomplete data.
Erasure (“right to be forgotten”) – ask us to delete your data in certain circumstances.
Restriction – ask us to restrict processing in certain cases.
Data portability – receive your data in a structured, commonly used format (where applicable).
Object – object to processing based on legitimate interests or for direct marketing.
Withdraw consent – where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us using the details in section 1. We will respond within one month (or explain if we need longer). You also have the right to complain to the Information Commissioner’s Office (ICO): Website: ico.org.uk Helpline: 0303 123 1113

10. Cookies and website tracking

Our website (kindlift.org) may use essential cookies necessary for it to function and, if enabled, limited analytics cookies. We will update this section and provide a cookie notice/banner if we use non-essential cookies or third-party analytics. You can control cookies via your browser settings.

11. Children’s data

Our services are not aimed at children. We do not knowingly collect personal data from children under 13 without appropriate parental involvement where required.

12. Changes to this privacy policy

We may update this policy from time to time. The latest version will be posted on kindlift.org with the updated date. Significant changes will be highlighted where practicable.

13. Contact us

If you have any questions about this privacy policy or how we handle your data, please contact:

Kindlift CIC 18 Old Sneddon Street Paisley PA3 2AL Email: dataprotection@kindlift.online

Thank you for supporting Kindlift CIC’s work in the community.

Next steps for you:

Replace placeholder contact details with your preferred public email/phone.
Confirm what data you actually collect (e.g. do you take card payments, run an email list, use Google Analytics, store volunteer forms, etc.) and adjust the sections accordingly.
Add a clear link to this policy in the website footer and any forms.
Consider whether you need a simpler cookie banner or further ICO registration checks (most small CICs processing limited data do not need to pay the data protection fee, but verify).
Have a solicitor or data protection specialist review it before publishing.