PRIVACY NOTICE
Last updated: October 01, 2026
Vision 21 Cyfle Cymru (operating as V21, "we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Notice explains how we collect, use, store, and share your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 when you:
* Visit our website or interact with embedded store/booking forms or our secure internal organisation management platform
* Purchase merchandise, book event tickets, hire facilities/halls, set up direct debits, or make donations through our online or in-person channels (including Etsy, Zeffy, Eventbrite, Square, PayPal Giving Fund, GoCardless, Sage, and Meta/Facebook)
* Subscribe to our newsletters or updates via Mailchimp
* Engage with us on social media (Instagram, TikTok, Facebook) or contact us for support and charitable activities
Questions? If you have questions about this policy or how we handle your data, please contact us at dataprotection@v21.org.uk.
--------------------------------------------------------------------------------
1. WHAT PERSONAL INFORMATION WE COLLECT
We collect personal information that you provide directly to us or that we receive from our third-party accounting, checkout, ticketing, payment, fundraising, and communication partners.
A. Information You Disclose Directly to Us:
* Identification & Contact Data: Name, email address, telephone number, mailing address, billing address, and delivery address.
* Transaction & Invoicing Data: Details of products purchased, facility/hall hire bookings, invoicing records, event tickets booked, direct debits established, or donations made.
* Internal Database Records: Contact details, order and invoice history, event attendance, and supporter engagement records stored securely in our core organisation management platform.
* Communications & Preferences: Enquiries, booking requests, support messages, and marketing newsletter preferences.
B. Information Received from Third-Party Platforms & Embedded Tools:
When you interact with Vision 21 via third-party services or checkout forms embedded on our website, we receive order, payment, invoicing, donation, and subscriber details necessary to fulfil your request or record your support:
* Zeffy: Supporter name, email address, postal address, and donation/purchase/ticket details submitted via forms hosted on Zeffy or embedded on our website.
* Square: Buyer name, contact details, payment receipts, and itemised purchase history for in-person and online point-of-sale transactions.
* Sage: Invoicing details, customer/hirer contact information, payment receipts, and accounting transaction histories for facility hire, sales, and service billing.
* Etsy: Buyer name, shipping address, and order items.
* Eventbrite: Attendee name, email address, and ticket type/event registration details.
* GoCardless: Supporter name, email address, billing address, and mandate status for direct debit payments or recurring donations.
* PayPal Giving Fund: Donor name, email address, donation amount, and Gift Aid declaration status.
* Facebook & Instagram (Meta): Supporter name, email address, and donation/engagement details for contributions or enquiries made on our Meta pages.
* TikTok (ByteDance): Profile interaction details, campaign engagement data, and message enquiries sent via our official TikTok account.
* Mailchimp: Subscriber name, email address, opt-in consent records, and email engagement metrics (e.g., open and click-through rates).
Note on Financial & Payment Card Data: Credit/debit card numbers and bank account details are processed securely by our third-party payment gateways (Square, GoCardless, Etsy, Zeffy, Eventbrite, PayPal). Vision 21 does not collect or store full payment card numbers or bank credentials on our servers.
C. Sensitive Personal Data:
We do not collect or process sensitive ("special category") personal data through our standard shop, facility hire, ticketing, or donation services.
--------------------------------------------------------------------------------
2. HOW AND WHY WE PROCESS YOUR INFORMATION
Under UK GDPR, we must have a lawful legal basis to process your personal data. We process your data for the following purposes:
* Invoicing & Facility Hire (Performance of a Contract): To generate invoices and process transactions via Sage for hall/facility hire, sales, and booked services.
* Order Fulfilment & Service Delivery (Performance of a Contract): To process purchases via Square, Etsy, or embedded Zeffy checkout forms, ship physical goods, issue event tickets, process GoCardless direct debits, and handle returns or exchanges.
* Secure Data Management (Legitimate Interests): To maintain accurate central records of customer orders, hirers, supporters, event attendees, and donations in our secure organisation management platform.
* Donation Processing & Gift Aid (Legitimate Interests / Legal Obligation): To process charitable contributions from Zeffy, GoCardless, PayPal Giving Fund, Square, and Facebook/Instagram, and to maintain financial accounting records.
* Email Communications & Newsletters (Consent): To send newsletters, campaign updates, and marketing emails via Mailchimp where you have opted in. You can unsubscribe at any time using the link in any email.
* Social Media & Audience Engagement (Legitimate Interests / Consent): To communicate with supporters on Instagram, TikTok, and Facebook, respond to messages, and analyse engagement with our social content.
* Customer Support (Legitimate Interests): To respond to your questions, booking enquiries, or order support requests.
* Administrative Communications (Contract / Legal Obligation): To send invoices, transaction receipts, order updates, direct debit notifications, or essential information regarding booking changes.
* Fraud Prevention & Legal Compliance (Legal Obligation): To maintain account security, prevent fraudulent transactions, and meet statutory accounting, audit, or tax reporting duties.
--------------------------------------------------------------------------------
3. WHEN AND WITH WHOM WE SHARE YOUR DATA
We do not sell your personal information. We share data only with service providers, platform partners, and secure cloud infrastructure hosting our database necessary to run our operations:
* Accounting, E-Commerce, Point-of-Sale & Payment Processors: Sage (invoicing & accounting), Square (in-person & web payments), Eventbrite (ticketing), Etsy (online store), Zeffy (donations, shop forms & embedded website checkouts), GoCardless (direct debit payments), and PayPal Giving Fund (donations).
* Database & Cloud Infrastructure Hosts: Secure UK/EU-compliant cloud server providers hosting our internal organisation management platform.
* Social Media Platforms: Meta (Facebook & Instagram) and ByteDance (TikTok) where you interact with our official accounts, social fundraising campaigns, or embedded content.
* Email & Communications Providers: Mailchimp (Intuit), which hosts our email subscriber databases and sends automated mailing campaigns.
* Shipping & Logistics Services: Postal carriers and couriers used to deliver physical goods to your shipping address.
* Legal & Regulatory Authorities: HM Revenue & Customs (HMRC) for tax and Gift Aid claims, auditors, or other regulatory bodies where required by law.
International Data Transfers:
When data is transferred outside the UK (for example, to Mailchimp, Meta, TikTok, Square, or Sage cloud servers internationally), we ensure appropriate UK GDPR safeguards are in place, such as Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs).
--------------------------------------------------------------------------------
4. COOKIES AND TRACKING TECHNOLOGIES
Our website, embedded Zeffy forms, social media pages (Facebook, Instagram, TikTok), and Mailchimp emails use cookies, web beacons, tracking pixels, and similar technologies to ensure basic site functionality, analyse visitor traffic, and monitor campaign performance. You can adjust your browser or social media privacy settings to decline non-essential cookies and tracking. For full details, please refer to our Cookie Policy.
--------------------------------------------------------------------------------
5. DATA RETENTION & SECURITY
* Retention: We retain your personal data only as long as necessary to fulfil the purposes outlined in this notice, including satisfying tax, accounting, and legal requirements (typically 6 years following the end of the tax year for statutory financial and accounting records in the UK, including invoices in Sage).
* Security: We maintain appropriate physical, organisational, and technical safeguards—including restricted access controls and data encryption on our internal database platform and Sage cloud accounting system—designed to protect your personal data against unauthorised access, loss, or misuse.
--------------------------------------------------------------------------------
6. YOUR PRIVACY RIGHTS UNDER UK GDPR
As a UK resident, you have specific rights regarding your personal data:
* Right to Access: Request a copy of the personal information we hold about you in our central database, Sage accounting records, or third-party systems.
* Right to Rectification: Request correction of inaccurate or incomplete personal data.
* Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where there is no legal requirement for us to keep it (note that financial invoice records in Sage must be retained for legal tax compliance).
* Right to Restrict or Object: Request that we limit or stop processing your personal data under certain conditions.
* Right to Withdraw Consent: Where processing relies on consent (such as Mailchimp newsletters or social tracking), you may withdraw consent at any time.
To exercise any of these rights, please email us at dataprotection@v21.org.uk.
--------------------------------------------------------------------------------
7. HOW TO COMPLAIN
If you have concerns about our data handling, please contact us first so we can resolve the issue:
Email: dataprotection@v21.org.uk
If you remain dissatisfied, you have the right to lodge a complaint with the UK data protection regulator:
Information Commissioner’s Office (ICO)
Website: https://ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
--------------------------------------------------------------------------------
8. CONTACT US
For any questions regarding this Privacy Notice or your personal data, please contact our Data Protection Officer:
Vision 21 Cyfle Cymru
Unit 10-12 Fieldway
Heath, Cardiff CF14 4HY
Wales, UK
Email: dataprotection@v21.org.uk
Phone: 029 20621194