Fundraising Privacy Notice

• Supporter, purchaser, sponsor or participant name and contact details
• Campaign, team, player or beneficiary associations where relevant
• Ticket, entry, account, QR, sale and receipt references
• Transaction amount, payment status, payment method and payment-provider references
• Fundraising allocations, sponsorship details, donations and event participation
• Prize, winnings or payout information where relevant to an event
• Messages, communication history and delivery/audit records
• Account, role, access and security information for organisers and helpers
• Technical information needed to operate secure public links and event workflows

We do not intentionally store full payment-card details where a third-party payment provider collects them directly.

• To run and administer fundraising campaigns and events
• To process or reconcile payments, purchases, donations, refunds and payouts
• To issue tickets, receipts, QR links and event/account access
• To allocate fundraising to the correct player, team, campaign, tour or club purpose
• To contact supporters or participants about a transaction or event they have joined
• To prevent duplicate, fraudulent or unauthorised activity
• To maintain audit, finance and compliance records
• To manage campaign permissions, helpers and organisers

The lawful basis depends on what is being done. Depending on the campaign and transaction, processing may be necessary for a contract, legal obligation, legitimate interests, consent, or another lawful basis available under UK data-protection law.

Marketing is not treated as automatically permitted merely because somebody has bought a ticket or made a donation.

Payment providers such as PayPal may process payments through their own systems. We may receive the information necessary to identify, confirm and reconcile the transaction.

Where a campaign uses another fundraising or communications provider, that provider may process information under its own terms or as a processor acting for the campaign organiser.

Some tickets, receipts, accounts or event pages are accessible using a unique public token or QR link. These links should be treated like a private ticket: do not publish or forward them unnecessarily.

Public pages are designed to show only the information needed for the relevant event or transaction. Sensitive internal data should not be exposed on a public campaign page.

A campaign may be associated with a child or youth team. We minimise the personal information used publicly and avoid publishing unnecessary contact, school, date-of-birth or other private details.

Where a player is identified publicly, the organiser should use the minimum information reasonably needed for the campaign and follow the relevant club/Academy safeguarding and media standards.

Information may be shared with authorised campaign organisers, club/Academy finance or administrative staff, payment providers, event operators, technology providers, regulators or professional advisers where reasonably necessary.

Campaign and platform permissions are used to restrict internal fundraising data to authorised users.

Records are retained for as long as reasonably necessary for the fundraising, accounting, audit, legal, dispute, prize/payout or safeguarding purpose concerned. Different records may therefore have different retention periods.

We use access controls, audit logs, tokenised links and other technical/organisational measures where appropriate.

Depending on the circumstances, you may have rights of access, correction, erasure, restriction, objection or portability, and the right to withdraw consent where consent is relied upon.

Data-protection complaints should be raised with the organisation responsible for the relevant campaign. Prestbury organisations aim to acknowledge formal privacy complaints within 5 working days, investigate them appropriately and communicate the outcome. You may also complain to the Information Commissioner's Office.

See our Cookie & Storage Technology Policy for information about cookies, localStorage, sessionStorage and similar technologies.

For a campaign-specific question, contact the organiser named on the fundraiser. For Prestbury Girls Academy data-protection matters, use the contact details in the Academy's master Privacy & Data Protection Notice.