Last updated: 16.09.2026
Controller: TreeAction UK CIC
Registered address: Freedom Works, Hove Business Centre, Fonthill Road Freedom Works, Hove Business Centre, Fonthill Rd, Hove, United Kingdom, BN3 6HA
Company registration number: 12357150
Contact: Data Protection Lead, Ricky Purnell, CEO, ricky@treeaction.org.uk

This notice explains how TreeAction UK CIC (“we”, “us”, “our”) collects and uses personal information about you when you:

• visit our website Tree Action UK | Getting trees planted in schools, colleges, and communities
• sign up for newsletters or updates;
• donate or fundraise for us;
• apply to volunteer, work experience or intern with us;
• work for us as an employee, contractor or consultant;
• partner, sponsor or collaborate with us;
• attend our events or activities;
• contact us by email, phone, social media or in person.

It also explains your data protection rights and how to contact us

1. Who we are

TreeAction UK CIC is a community interest company focused on tree planting, tree care, environmental education and community environmental action in Sussex.

For data protection purposes, we are the data controller of the personal information described in this notice. This means we decide how and why your data is processed.

Our Data Protection Lead can be contacted at:
Ricky Purnell, CEO, ricky@treeaction.org.uk Freedom Works, Hove Business Centre, Fonthill Road Freedom Works, Hove Business Centre, Fonthill Rd, Hove, United Kingdom, BN3 6HA

2. The personal information we collect

The types of personal data we collect depend on how you interact with us.

2.1 Website visitors

When you visit our website, we may automatically collect:

• device and usage information (e.g. IP address, browser type, pages viewed, time and date of visit);
• information collected via cookies and similar technologies

We may also collect information you give us via:

• contact forms;
• newsletter sign-up forms;
• event registration forms;
• donation or fundraising pages;
• job/volunteer application forms.

2.2 Donors, supporters and event participants

We may collect:

• name, email, postal address, phone number;
• donation amount, date, method and transaction reference;
• fundraising page information and pledges;
• event registration details (e.g. emergency contact, dietary or access requirements);
• communication preferences (e.g. whether you want to receive emails, post, phone calls);
• thank-you and recognition preferences (e.g. whether you consent to being named in reports or on our website).

2.3 Volunteers, work experience and interns

We may collect:

• name, contact details, date of birth (where required for safeguarding or insurance);
• application form information (skills, interests, availability, motivations);
• references and interview notes;
• training, supervision and feedback records;
• DBS or other safeguarding checks where required;
• limited health or disability information (e.g. for risk assessments or reasonable adjustments);
• diversity monitoring data (e.g. ethnicity, gender) where collected on a voluntary basis;
• photos or videos where you consent to be featured.

2.4 Employees, contractors and consultants

We may collect:

• name, contact details, date of birth, National Insurance number;
• bank details and tax information;
• right-to-work and ID documents;
• employment/contract details (role, hours, pay, benefits, holiday, sickness);
• performance, training, disciplinary and grievance records;
• health information where necessary (e.g. for occupational health, reasonable adjustments, safety);
• diversity monitoring data where collected.

(For more detail, see our internal Data Protection Policy)

2.5 Partners, sponsors, collaborators and funders

We may collect:

• organisational details and key contacts’ names, roles and contact information;
• contract, grant and funding details;
• meeting notes, project plans and reporting information;
• logos, branding and public recognition information;
• bank and invoicing details.

2.6 Other individuals

We may also process personal data about:

• parents/guardians and emergency contacts;
• referees for volunteers or staff;
• visitors to our premises or events (e.g health & safety records).

3. How we get your information

We collect most information directly from you, for example when you:

• fill in a form on our website or on paper;
• email, call or message us;
• donate, register for an event, apply to volunteer or work with us;
• attend an event or activity;
• correspond with us on social media.

We may also receive information indirectly, such as:

• from third-party donation or fundraising platforms (e.g. [JustGiving, GoFundMe, etc.]);
• from partners or host organisations (e.g. for joint projects or placements);
• from referees you nominate;
• from publicly available sources where lawful and appropriate (e.g. to verify organisational details).

4. Why we use your information and our lawful bases

We only use your personal data where the law allows us to. Under UK GDPR, our main lawful bases are:

• Consent – you have given clear consent for a specific purpose.
• Contract – processing is necessary to perform a contract with you or take steps at your request.
• Legal obligation – processing is necessary to comply with the law.
• Legitimate interests – processing is necessary for our legitimate interests (or those of a third party), provided your rights do not override them.
• Vital interests / public task – where relevant.

Below are our main purposes and the typical lawful bases we rely on.

4.1 To manage our website and communications

We use your data to:

• operate and improve our website;
• respond to your enquiries;
• send newsletters and updates you have requested;
• inform you about our work, campaigns, events and volunteering opportunities (where permitted).

Lawful bases: consent (for marketing emails where required), legitimate interests (for updates to existing supporters where permitted), contract (where you request a service).

You can opt out of marketing at any time via the unsubscribe link in emails or by contacting us.

4.2 To process donations and fundraising

We use your data to:

• process donations and issue receipts;
• manage regular giving and payments;
• carry out anti-fraud and financial checks where needed;
• recognise and thank donors (where you agree);
• report to funders and regulators as required.

Lawful bases: contract (to process donations), legal obligation (financial records), legitimate interests (donor relationship management), consent (for public recognition or certain communications).

4.3 To manage volunteering, work experience and internships

We use your data to:

• assess applications and match you to suitable roles;
• arrange training, supervision and support;
• carry out safeguarding and risk assessments;
• keep records of your contribution and provide references;
• monitor diversity and impact.

Lawful bases: legitimate interests (volunteer management), contract-like arrangements (for placements), legal obligations (safeguarding, health and safety), explicit consent or other special category conditions for sensitive data where required.

You can withdraw consent for certain types of processing (e.g. photos, special category data) at any time, though this may limit some opportunities.

4.4 To employ staff and engage contractors/consultants

We use your data to:

• recruit, employ and pay staff;
• manage contracts and consultancy agreements;
• meet tax, employment and health & safety obligations;
• support performance, training and wellbeing;
• handle grievances, disciplinaries and references.

Lawful bases: contract, legal obligation, legitimate interests, and where required, explicit consent or other special category conditions for sensitive data.

4.5 To manage partnerships, sponsorships and projects

We use your data to:

• develop and manage partnerships and projects;
• administer contracts, grants and funding;
• report on progress and impact;
• recognise partners and sponsors (with agreement);
• communicate about future collaboration opportunities.

Lawful bases: contract, legal obligation, legitimate interests, and consent where we use personal data for marketing or public communications beyond what is reasonably expected.

4.6 To ensure safety, safeguarding and compliance

We use your data to:

• manage health and safety risks at events and on our sites;
• carry out safeguarding checks where required (especially for roles involving children or vulnerable adults);
• investigate incidents and complaints;
• defend legal claims and comply with regulatory requirements.

Lawful bases: legal obligation, vital interests, legitimate interests, and where required, explicit consent or other special category conditions.

4.7 To monitor and improve our work

We may use data to:

• analyse how people use our website and services;
• evaluate the impact of our projects;
• plan and improve our activities;
• produce anonymised statistics and reports.

Lawful bases: legitimate interests, and consent where required (e.g. for certain cookies or analytics).

Where possible, we anonymise or aggregate data so individuals cannot be identified.

5. Special category (sensitive) data

We sometimes process special category data, such as information about:

• health or disability (e.g. for risk assessments, reasonable adjustments);
• ethnicity, religion, gender or sexual orientation (e.g. for diversity monitoring);
• criminal convictions or offences (e.g. DBS checks where required).

We only do this where:

• it is necessary for a clear purpose (e.g. safeguarding, health and safety, equal opportunities); and
• we have an additional lawful condition under UK GDPR (e.g. explicit consent, legal obligations, substantial public interest).

We will explain clearly when we collect such data and why.

6. Sharing your information

We do not sell your personal data.

We may share your data with:

• Service providers who help us run our operations (e.g. IT, email, website hosting, payment processors, payroll, accounting, cloud storage).
• Banks and payment processors to handle donations and payments.
• Professional advisers (e.g. lawyers, accountants, insurers).
• Funders, regulators and auditors where required by contract or law (e.g. grant bodies, HMRC, Companies House, ICO).
• Partner organisations for joint projects, events or placements (with clear agreements and only what is necessary).
• Authorities where we are legally required (e.g. in response to a court order, or to prevent serious harm).

Where third parties process data on our behalf, we put written agreements in place requiring them to keep your data secure and use it only as we instruct.

7. International transfers

We aim to keep your data within the UK. Some of our service providers (e.g. cloud storage, email, website tools) may store or process data outside the UK.

Where this happens, we will ensure appropriate safeguards are in place under UK GDPR, such as:

• using providers who commit to UK GDPR–equivalent protections; and/or
• putting in place approved transfer mechanisms (e.g. UK International Data Transfer Agreement).

Details of key services and transfers are recorded in our internal Records of Processing Activities.

8. How long we keep your information

We keep personal data only as long as necessary for the purposes described in this notice, taking into account legal, regulatory, insurance and operational needs.

Examples (actual periods are set out in our internal Data Retention Schedule):

• Website and analytics data: kept for 12 months unless you are a registered user or subscriber.
• Newsletter and marketing contacts: kept until you unsubscribe or after 6 years of inactivity.
• Donor and supporter records: kept for 7 years for financial and legal reasons; marketing preferences may be kept longer to respect opt-outs.
• Volunteer records: kept for the duration of your role and for 6 years afterwards (considering safeguarding, insurance and reference requests).
• Employee and contractor records: kept in line with employment, tax and pension law for 6 years after employment/contract ends, or longer for certain records.
• Partner and sponsor records: kept for the duration of the relationship and for 7 years afterwards for reporting and legal purposes.

When data is no longer needed, we securely delete or anonymise it.

9. Keeping your information secure

We use appropriate technical and organisational measures to protect your personal data, including:

• secure servers and password-protected systems;
• access controls so only authorised people can see your data;
• training for staff and volunteers on data protection;
• secure disposal of paper and digital records.

No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your information.

10. Your data protection rights

Under UK GDPR, you have the right to:

• Access – request a copy of the personal data we hold about you.
• Rectification – ask us to correct inaccurate or incomplete data.
• Erasure – ask us to delete your data in certain circumstances.
• Restriction – ask us to restrict how we use your data in certain cases.
• Object – object to our processing, including for direct marketing.
• Data portability – receive your data in a structured, commonly used format and transfer it to another controller where feasible.
• Withdraw consent – where we rely on your consent, you can withdraw it at any time.
• Complain – lodge a complaint with the Information Commissioner’s Office (ICO) if you believe we have not complied with data protection law.

To exercise any of these rights, please contact our Data Protection Lead at:
Ricky Purnell, CEO, ricky@treeaction.org.uk

We will usually respond within one month. We may ask for proof of identity and may extend the response time for complex requests (up to two further months), informing you if so.

There is normally no fee for exercising your rights, unless requests are manifestly unfounded or excessive.

11. Children’s data

We do not knowingly collect personal data from children under 16 without appropriate parental/guardian consent, except where necessary for safeguarding, event participation or legal reasons.

Where we run activities for young people or families, we will:

• explain clearly what data we collect and why;
• obtain parental/guardian consent where required;
• apply extra care with how we store and share that data.

If you are a parent/guardian and believe your child has provided us with data without your consent, please contact us.

12. Changes to this privacy notice

We may update this privacy notice from time to time to reflect changes in our practices, services or the law.

• The “Last updated” date at the top will show when it was last changed.
• Significant changes will be communicated via our website, email or other appropriate channels.

We encourage you to review this notice periodically.

13. How to contact us and complain

If you have any questions, concerns or requests about how we use your personal data, please contact:

Data Protection Lead
Ricky Purnell
CEO
Ricky@treeaction.org.uk
Freedom Works, Hove Business Centre, Fonthill Road Freedom Works, Hove Business Centre, Fonthill Rd, Hove, United Kingdom, BN3 6HA

If you are not satisfied with our response, you can complain to the Information Commissioner’s Office (ICO):

Website: www.ico.org.uk

Address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF