Privacy Policy

Christmas Toy Drive is a registered charity. Our contact details are on the Contact page. We are the data controller for the personal information described in this policy.

We collect the minimum personal data needed to run the campaign:

• Drop-off point applications: organisation name, address, contact name, email and phone — to process and manage your participation.
• Volunteer registrations: name, email, phone, availability and preferences — to assign and manage shifts.
• Staff & portal accounts: name and email for login, role administration and audit.
• Referral & family support: anonymised child age groups and needs only — no child names or identifiable details are stored publicly.
• Service logs & audit: metadata about system actions for security and accountability.

We rely on legitimate interests to run the charity, contract for drop-off point and volunteer participation, legal obligation for record-keeping and audit, and consent for any optional marketing communications. Referral data involving children is handled under the strict safeguards set out in our Safeguarding Policy.

Data is stored in a secure hosted database with role-based access controls and encryption in transit. Sensitive referral and child data is isolated and restricted to authorised roles only. We never sell your data.

Under UK GDPR you have the right to access, rectify, erase, restrict, object to and port your personal data, and to withdraw consent where we rely on it. To exercise any of these rights, contact us via the Contact page. We will respond within one month.

We keep records only as long as needed. Unsuccessful applications are retained for a limited period then removed. Campaign records are kept permanently as aggregated, anonymised impact statistics. Referral data is retained under our Safeguarding Policy and removed when no longer required.

If you have a concern about how we handle your data, contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.