What this privacy policy covers

ShelterBox is committed to protecting your personal information and being transparent about what information we hold.

Developing a better understanding of our supporters through their personal data allows us to fundraise more efficiently, which ultimately helps us to ensure no family goes without shelter. We have made improvements to this policy so that transparency is at the core of what we do, especially around our policy on profiling and wealth screening.

The purpose of this policy is to give you a clear explanation about how ShelterBox collects and uses the personal information you provide to us and that we collect, whether online, via phone, email, in letters or in any other correspondence or from third parties.

We ensure that we use your information in accordance with all applicable laws concerning the protection of personal information. This policy explains:

Our details

ShelterBox Trust is a charitable company limited by guarantee in England and Wales Company number: 04612652 Charity number: 1096479 ICO registration number: Z928330X

ShelterBox is a charity, independent of Rotary International and the Rotary Foundation.

Contacting us

If you would like to make an enquiry about data protection, update the information we hold about you, request or opt out of receiving marketing communications or change the way we process your information, you can let us know in the following ways:

  • Email: [email protected]
  • Phone: +44 (0)300 0300 500
  • Post: Supporter Care, ShelterBox, Falcon House, Charles Street, Truro, TR1 2PH

You can also use these details if you would like to make a request to access the information we hold about you (see ‘Your rights’ section at the end of this document).

To raise a concern about how your personal information has been used please contact us on the details listed.

If you would like to make a complaint, or would like more information about our complaints process please email [email protected]

Alternatively, you are entitled to raise a concern to the Information Commissioner’s Office (ICO) without first referring your complaint to us. See here for more information.

1. Information we collect about you

Personal information is collected directly from you when you interact with ShelterBox, for example making a donation, sending or receiving an email, making an enquiry, visiting our websites, applying for a role with us, participating in an event or when signing up for our newsletter.

Information may be collected in person, over the phone, through our websites, social media or from something you’ve posted to us. Some information is vital in order for us to process a donation and is legally required, other information will be used to ensure we communicate with you in the right way.

The information we hold will typically include some of, or all of, your name, postal and email addresses, your phone number, and may include information like your date of birth and your bank details if you are supporting us financially, for example through a regular monthly donation. We may on occasion also research information about you from other sources (including public sources). This is explained in the ‘How we might use your information’ section below.

Our legal basis for contacting you and using your personal information

When we collect and use your personal information, we will make sure this is only done in accordance with at least one of the legal grounds available to us under Data Protection law.

One of these is where we have obtained your specific consent to use your information for a previously notified purpose, such as to send you email/text marketing or to provide you with a product, service or information at your request.

Another is where we have a legal obligation to use or disclose information about you – for instance, where we are ordered by a court or regulatory authority or we are legally required to hold donor transaction details for Gift Aid or accounting/tax purposes.

In certain instances, we may collect and use personal information where this is necessary in our legitimate interest as a charity, this includes being able to:

  • send direct marketing material to supporters by post or contacting them by telephone for fundraising purposes (subject to checking against the Telephone Preference Service and any existing marketing preferences).
  • conduct research to better understand who our supporters are and better target our fundraising activity to ensure resources are used in the most cost effective way.
  • monitor who we deal with to protect our charity against fraud, money laundering and other risks;
  • maintain and administer our donor database and systems for audit trail purposes and to ensure we are communicating with you in your preferred way.

In all cases, we carefully consider your rights as an individual and make sure we only use personal information in a way or for a purpose that you would reasonably expect in accordance with this Policy and that does not intrude on your privacy or previously expressed marketing preferences. We always carefully balance our legitimate interests against your rights as an individual, to ensure the best possible outcome for the families who need our support.

Marketing Materials

We want to ensure you receive the level of information about ShelterBox that is right for you, and will ensure that we honour your communication preferences.

Email/text marketing

If you actively provide your consent to us along with your email address and/or mobile phone number, we may contact you for marketing purposes by email or text message. By subscribing to ShelterBox emails or opting in to email communication from ShelterBox, you grant us the right to use the email for both email marketing purposes and advertisement targeting.

Post/telephone marketing

If you have provided us with your postal address or telephone number we may send you direct mail or telephone you about our work unless you have told us that you would prefer not to receive such information in this way. We also actively check telephone numbers against the Telephone Preference Service. We will only make telephone calls to you where your telephone number is listed on the TPS if you have specifically told us that you do not object to such calls and have consented to receive them.

We will only write to your postal address if you have provided your address and not opted out of receiving communications, or if we judge it to be in your legitimate interest to be written to, for example to provide a receipt for your donation. You can up-date your preferences and opt out of receiving communication to your postal address at any time, see Contacting us section above.

Your choice

It is always your choice as to whether you want to receive information about our work, how we raise funds and the ways you can get involved. If you do not want us to use your personal information in these ways please indicate your preferences on the form on which we collect your data.

You can let us know at any time if you’d prefer to change how we share this information with you or stop it altogether. Simply use the details we’ve provided in the ‘Contacting us’ section to let us know your preferences. If you receive our e-newsletters, you can also use the unsubscribe link in the emails we send.

We will not use your personal information for marketing purposes if you have indicated that you do not wish to be contacted by us for such purposes. However, we will retain your details on an unsubscribe list to help ensure that we do not continue to contact you.

How we might use your information if you are a supporter who receives marketing materials or makes donations

We may use your information for administration purposes.

When you make a donation or other payment to ShelterBox, we will use your payment and contact details, payment amount, date and time of payment; to process that payment and take any follow-up administrative action needed (for example, sending a receipt).

If you choose to include Gift Aid with a donation to us, then we will also ask for your address and UK taxpayer status as this information is required by law. You can read more about how Gift Aid works here. This information is needed for us to fulfil our obligations under tax (sections 413 to 430 Income Tax Act 2007) and charity law. Information associated with Gift Aid declarations must be retained for 7 years. This information will be shared with HMRC for tax regulation purposes and may also be shared with the Fundraising Regulator and the Charity Commission in the event of an enquiry or investigation.

Responding to enquiries

Conversations with you matter to us. If you contact us with a question, comment, compliment or complaint then we will keep a record of this correspondence and any associated documents so that we have the information available in the event of a follow-up, dispute or investigation, and so that we can be as helpful as possible in quickly and efficiently providing you with any information you might be seeking.

Notifying you of changes to policies

If we make significant changes to our policies which may affect you, we will use your contact details to inform you of the changes.

Requesting information if you are attending our events

If you participate in an event that we have organised, we may ask you to provide information to make sure we can manage the event safely and efficiently. We may also ask you for details of any accessibility need which you may have, so that we ensure our event is inclusive (in line with the provisions of the Equality Act 2010).

If you participate in an event organised by an external party or make a donation through a processor like JustGiving, then your information may be passed to us by the processor. We would only use it for marketing purposes if you have given your consent for this.

We may use your information to invite you to become involved with us in new ways, raise funds and grow our supporter base.

Targeting our communications and researching our supporters

We are committed to spending your donations wisely, and that means being as informed and targeted with our decisions as possible. We want to send the most effective messages that we can in the most efficient way possible. In order to do this, we may carry out the following activities:

Email or SMS marketing

If you have opted in to receive email updates from us, we will contact you from time to time to share information with you about where we’re working, who you’re helping, and how you can get involved. If you change your mind and no longer wish to receive our marketing emails, you can click the ‘unsubscribe’ link at the end of our marketing emails at any time. You can also contact our Supporter Care team on [email protected], or by calling 0300 0300 500.

We will not market to you via SMS without your consent. You are able to unsubscribe at any time by replying to the message with the word STOP or contacting our Supporter Care team on [email protected], or 0300 0300 500.

Analysing how emails are opened and read

We track emails which we have sent to you to see which messages have the highest response rates and whether there are messages that resonate with particular groups of people. We do this by logging whether emails we send have been opened, deleted and interacted with (for example, by clicking on links within the emails). Although we only use this information to look at general patterns, it is still personal information because it is linked to your email address.


This is where we analyse information such as postcodes of supporters, and whether donations have been given regularly. This helps us to tailor appropriate communications to you, as well as improve your experience as a ShelterBox supporter. For example, if we see that you have only ever donated to us at a time of major disaster, we may only contact you in future in the event of another major disaster, rather than including you in updates about other aspects of our work.

Digital advertising

Where you have agreed to receive email or SMS marketing communications from us, we may provide your email address or mobile phone number in an encrypted format to:

  • social media companies, such as Facebook, Instagram, Twitter or YouTube, or
  • digital advertising networks that are providing services to us by displaying our advertising to you on those social media platforms and other websites, as well as identifying audiences with interests similar to yours.

You can opt out of your data being used to display advertising to you by contacting our Supporter Care Team at [email protected], or by calling 0300 0300 500. However, this will not prevent our advertisements being shown to you on a randomised basis or based on cookie data.

Analysing our supporter base to send different communications to people who might give higher amounts or in different ways

We undertake research to help us identify people who may give higher amounts or in other ways, for example by leaving a gift in a will. Most of that research is conducted in-house but we may also use research from external organisations like Experian or Factary. Whether done in-house or with the help of trusted third parties, our goal is to communicate with you in the most interesting, relevant and effective way.

Examples of sources we might use:

  • Public registers (such as the Electoral roll, Companies House, and Charity Commission) and aggregators that collate info from same sources (Duedil, and Directory Enquiries for example)
  • Subscription services (Directory for Social Change and are two examples.)
  • Public records of other charities or organisations you might support, for example, if you are patrons of the British Museum.
  • Professional registers, posts on professional networking sites like LinkedIn, and company websites and annual reports.
  • Articles about you in newspapers or magazines
  • Internet search engine results

Finding other people like you who might like to hear from us

We may use the email address you give us to help find more people like you, so that we can grow our supporter base through our online channels. We use third party services to do this which you are likely to be familiar with, including Google, Facebook and Twitter.

We may also use publicly available information about you to help find other likeminded people who may be interested in supporting ShelterBox. These sources provide broad demographic information based on where you live, for example geographic location, type of household, media consumption, likely interests and hobbies. If we understand these common interests we can invest our resources more efficiently to reach people who are more likely to be interested in supporting our work.

When might we add information to your record that you may not have given to us directly?

We may also add information or update your record with us, from publicly available sources. This may include address related information, information from death registers, age or the information mentioned in the section above ‘Targeting our communications and researching our supporters’. We use this information to tailor our communications with you and send you more appropriate information and be as efficient as possible. For example, if you have moved house but forgotten to tell us, we may add this information from external publicly available sources to avoid sending mail to the wrong address.

These activities form a vital part of keeping support for our work going. You can request more information on these activities, or change your preferences, by using the information in the ‘Contacting us’ section at the beginning of this document.

We may use your information to enforce and comply with the law

As with all charities, we ensure that our activities comply with the law. Therefore, we may need to share or use your personal information if we are required to do so by law (for example, in response to a warrant or court order) and we may use information from other sources for the purposes of fraud prevention, for example to comply with money laundering regulations, or to protect people’s rights, property or safety.

If certain levels of donation are made, the Fundraising Regulator’s Code of Fundraising Practice requires us, and all charities in the UK, to perform checks. More details can be found at

Your debit and credit card information

If you use your credit or debit card to donate to us, or pay for a registration online or over the phone, we will ensure that this is done securely and in accordance with the

Payment Card Industry Data Security Standard. You can find our more information about PCI DSS here –

We do not store your credit or debit card details at all, following the completion of your transaction. All card details and validation codes are securely destroyed once the payment or donation has been processed. Only staff authorised and trained to process payments will be able to see your card details.

If we receive an email containing any credit or debit card details, it will be immediately deleted, no payment will be taken and you will be notified about this.

How we use social media

We operate a number of social media pages (including Facebook, Twitter, LinkedIn, Instagram and YouTube). This policy covers how we will use any data collected from those pages. It does not cover how the providers of social media websites will use your information. Please ensure you read the privacy policy of the social media website before sharing data and make use of the privacy settings and reporting mechanisms to control how your data is used.

2. How we might use your information if you are applying for a role within shelterbox

Your CV, covering letter and application form for any position with ShelterBox will be used during the recruitment process to short-list suitable candidates who will be invited to proceed to the interview stage, and to select the final candidate that the role will be offered to.

We sometimes use third-party job application platforms to publish and receive applications for roles at ShelterBox. When you apply through these portals the organisation’s privacy information will be available to you. We only work alongside other organisations in this way if we are satisfied that they will keep your information safely and use it only in the same legal ways that we would.

During the recruitment process, we will perform some checks on your identity, your right to work in the UK, your eligibility to work with vulnerable people and your past employment references. If we deem a DBS check necessary for your role, in order to process the check, we will send an applications via the Cornwall County Council portal. This keeps confidential, electronic records for a maximum of seven years. This portal’s privacy information will again be available to you.

If your application is successful, this information will then form part of your personnel file.

We delete the personal information of unsuccessful applications six months after the application process ends in case there are follow-up queries about the process, unless a candidate requests that we keep their details for longer. After these six months all details are deleted from our own records, as well as from the external recruitment platform. Statistical information like ethnicity, sexuality and disability is kept to ensure that our recruitment processes are inclusive and not discriminatory, but this is completely anonymised.

If we are required by law to share your information, (for example; in response to a warrant or court order), we will do so.

All employee information is kept securely and only if we have a legitimate interest for keeping it (for example payroll requirements). This information is stored securely internally and also via an external HRIS platform (CIPHR). All standard employee records will be deleted after six years.

3. How we might use your information if you have visited our website

Cookies and IP address

We may collect information about your computer, including where available your IP address, operating system and browser type, for system administration. This is statistical data about browsing actions and patterns, and does not identify any individual.

We log the IP address of the computer you are using in order to protect our servers against abuse and malicious activity. The logs are deleted every 60 days. Other information is used to measure the performance of the website, the volume of traffic that the site receives, how users move around the site and what sort of users the site attracts. This is statistical data that help us identify actions and patterns, and does not identify and individual.

When you access our website, some cookies are saved to your computer, for example if you have chosen a particular language setting or created a user account. Cookies are small text files that are automatically placed onto your device by some websites that you visit. They are widely used to improve the performance of a website, for saving different options and to provide website owners with information on how the site is being used.

Cookies enable us to:

  • estimate our audience size and usage pattern.
  • store information about your preferences, and so allow us to customise our site according to your individual interests; and
  • recognise you when you return to our site.

We use cookies to enhance the experience of the website, to increase the performance, to identify how the website is being used and where we can make improvements and to monitor how our advertisements perform. Some of our cookies are vital for the website to operate effectively and others are optional, but may decrease the usability or performance of the website.

You can turn off your cookies so that we can’t access that information. However if you select this setting you may be unable to access certain parts of the website.


We use Hotjar, a service that analyses the online behaviour of visitors to our website.

It uses a combination of analysis tools and feedback tools that allow Hotjar and ShelterBox to measure and observe what you do on our site, and hear what you have to say. This site uses a tracking code which contacts Hotjar’s servers and provides a script to the computer or device accessing our website. The script captures non-personal information including standard internet log information and details of your behavioural patterns on the site. This information is then sent to Hotjar’s servers for processing. When collecting data with Recordings, Hotjar also has various automated suppression features in place and data is suppressed in your browser, meaning personally identifiable information never reaches our servers keeping your session private.

We use this tool to provide you with a better experience, identify preferences, diagnose technical problems, analyse trends and generally to improve the website. You can opt out from Hotjar here.

Other information that might be collected

  • information that you provide by filling in forms on our site This includes information provided at the time you sign up for our newsletter. We may also ask you for information when you report a problem with our site;
  • if you contact us, we may keep a record of that correspondence; and
  • details of your visits to our site and the resources that you access.

4. Who shelterbox shares personal information with and why

We promise to make all reasonable efforts to keep your details secure and will only share them with suppliers or professional agents working on our behalf, for example professional fundraising organisations or specialist print production agencies who send out our fundraising or marketing materials, or telephone agencies making fundraising calls on our behalf. We carefully select these partners and will only share information with them if we are confident that they will protect it, and we have a contract in place with them that assures this.

We will never share your details with other organisations to use for their own purposes, other than where we are required to by law, for example with HMRC for Gift Aid auditing purposes. ShelterBox will not, under any circumstances, share or sell your personal information to any third party for marketing purposes and you will not receive offers from other companies or organisations as a result of giving your details to us.

Certain third party organisations collect information on our behalf as well as for their own use. We may receive your personal details from other organisations for our marketing purposes where example Just Giving and Virgin Money Giving. These organisations have their own data protection and privacy policies and we urge you to make yourself aware of these before signing up.

We may also use other companies to provide services and process your personal information on our behalf, including delivering or receiving postal mail, making telephone calls to our supporters, sending emails, sending SMS messages, processing credit card payments and analysing our supporter information as outlined above, to help us offer you communications that are most appropriate to you and your interests. In some cases, our suppliers may use software which analyses publicly available information (as outlined above) to build up a picture about you based on the factors set out in the ‘Targeting our communications and researching our supporters’ section.

5. Transfer of personal information outside of the eea

ShelterBox is aware that countries outside the European Economic Area have differing approaches to data privacy laws, and that enforcement may not be as robust as it is within Europe’s borders.

If you have applied for a role at ShelterBox which has an international element that requires you to work overseas or work closely with teams based outside the UK, then your personal information will be transferred to those countries in order for you to be able to carry out your role and the organisation to provide the support that enables you to do this.

The transfer of your information is governed by EU model contract clauses which set out how the organisation outside the EEA is required to protect your privacy rights by adhering to European data protection standards.

6. Information storage and security

When you give us your details, you agree to us recording your details on our secure database. We hold your personal information for as long as required to provide you with the information or services you have requested, to administer your relationship with us and your contact preferences, to comply with the law, fulfil statutory obligations (for example, the collection of Gift Aid) or to ensure we do not communicate with people who no longer wish to hear from us.

We take the care of your information seriously and protects your personal information in a range of ways including secure servers, firewalls and SSL encryption. We follow payment card industry (PCI) security compliance requirements when processing credit card payments. We operate a policy of restricted, password controlled, access to any of your information which is stored on our systems.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot

guarantee the security of your data transmitted to our site and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

7. Children’s information

While we do not actively collect information from children (under 16s) in the UK, we appreciate that our supporters are of all ages, and many amazing young people decide to support our work and raise funds to help families affected by disaster. All ShelterBox events will have clear rules on whether or not children can take part, and the collection of information will be managed in accordance with each individual event, with appropriate safeguards in place.

We may store contact details for children in the instance they are the donor or fundraiser, however will ensure that this contact is marked as not to be contacted for marketing under any circumstances. A personalized suppression will be applied to the record of anyone who is a child to ensure they cannot be contacted.

8. Your rights

You have various rights in respect of the personal information we hold about you – these are set out in more detail below. If you wish to exercise any of these rights or make a complaint, you can do so by contacting ShelterBox using the contact details in the ‘Contact us’ section.

Access to your personal information: You have the right to request access to a copy of the personal information that we hold about you, along with information on what personal information we use, why we use it, who we share it with, how long we keep it for and whether it has been used for any automated decision making. You can make a request for access free of charge. Please make all requests for access in writing, and provide us with evidence of your identity. Please note that if you ask for the material to be sent electronically but prefer not to use our secure file transfer, ShelterBox cannot be held responsible for the security risk to your information as it travels across the Internet.

Right to object: You can object to our processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes. Please contact us, providing details of your objection.

Consent: If you have given us your consent to use personal information (for example, for marketing), you can withdraw your consent at any time.

Rectification: You can ask us to change or complete any inaccurate or incomplete personal information held about you.

Erasure: You can ask us to delete your personal information where it is no longer necessary for us to use it, you have withdrawn consent, or where we have no lawful basis for keeping it.

Portability: You can ask us to provide you or a third party with some of the personal information that we hold about you.

Restriction: You can ask us to restrict the personal information we use about you where you have asked for it to be erased or where you have objected to our use of it.

9. For more information about data protection

You can find out more about your data protection rights on the Information Commissioner’s Office (ICO) website here.

You can find out more about data protection law here: Data Protection Act 1998 until the 25th May 2018 General Data Protection Regulation 2018 from 25th May 2018

This policy was last updated in May 2018.

ShelterBox reserves the right to make alterations from time to time. Please check the ShelterBox website for the latest version.