Privacy Statement
Privacy Statement
Last updated: June 2026
St Giles is committed to protecting and respecting your privacy. This Privacy Statement explains how we collect, use, store and protect your personal data and the rights available to individuals under UK data protection law.
About us
St Giles is a registered charity (charity number 801355) and act as data controller when processing personal information for its own purposes. In some circumstances, we may act as a data processor on behalf of other organisations when delivering contracted services.
Contact details:
St Giles Trust
Georgian House, 64-68 Camberwell Church Street London SE5 8JB
Email: info@stgilestrust.org.uk
Phone: 020 7708 8000
Data Protection Team: dataprotection@stgilestrust.org.uk
Working with Partner Organisations
Many of our services are delivered in partnership with local authorities, government departments, criminal justice agencies, healthcare providers, housing organisations, charities and other support services.
Depending on the nature of the service, St Giles and these organisations may act as joint controllers, independent controllers or controller and processor. The specific arrangement will depend on the purpose of the information sharing and the responsibilities of each organisation.
Where personal information is shared, we ensure there is an appropriate lawful basis and, where required, suitable contractual or information sharing arrangements are in place.
Categories of personal information we process
The categories of personal information we process, the purposes for which we use it and the lawful bases we rely upon are set out below:
| Categories of personal data | Purposes of processing | Article 6 UK GDPR | Article 9 UK GDPR (where applicable) | ||
| Identity information, contact details, case notes, referral information, support records, housing, employment and education information | Delivering support, advice and rehabilitation services | Article 6(1)(b) UK GDPR – Performance of a Contract; Article 6(1)(e) UK GDPR – Public Task; and/or Article 6(1)(f) UK GDPR – Legitimate Interests | Article 9(2)(g) UK GDPR – Substantial Public Interest (Safeguarding of Children and Individuals at Risk and Support for Individuals Experiencing Vulnerability or Disadvantage) | ||
|
|
Safeguarding vulnerable adults and children | Article 6(1)(c) UK GDPR – Legal Obligation; Article 6(1)(d) UK GDPR – Vital Interests; and/or Article 6(1)(f) UK GDPR – Legitimate Interests | Article 9(2)(g) UK GDPR – Substantial Public Interest (Safeguarding of Children and Individuals at Risk) | ||
| Physical health, mental health, disabilities, support requirements, safeguarding records, health information, risk assessments, criminal offence information | Provide support services, safeguarding and adjustments | Article 6(1)(e) UK GDPR – Public Task; Article 6(1)(f) UK GDPR – Legitimate Interests; and/or Article 6(1)(d) UK GDPR – Vital Interests | Article 9(2)(g) UK GDPR – Safeguarding of children and individuals at risk | ||
| Ethnicity, religion, sexual orientation, disability information for equality purposes | Equality monitoring, service improvement, reporting obligations | Article 6(1)(f), Article 6(1)(c) Legal Obligation | Article 9(2)(g) UK GDPR – Equality of opportunity or treatment | ||
| Contact details, donation history, Gift Aid declarations and communication preferences | Managing donations, Gift Aid and supporter records | Article 6(1)(c) UK GDPR – Legal Obligation; and/or Article 6(1)(f) UK GDPR – Legitimate Interests | N/A | ||
| Email address, phone number, communication history and preferences | Send fundraising and marketing communications | Article 6(1)(a) Consent and/or Article 6(1)(f) Legitimate Interests, subject to PECR requirements and depending on the communication channel | N/A | ||
| Employment records, payroll information, performance records and contact information | Recruiting, employing and supporting staff and volunteers | Article 6(1)(b) UK GDPR – Performance of a Contract; Article 6(1)(c) UK GDPR – Legal Obligation; and/or Article 6(1)(f) UK GDPR – Legitimate Interests | Article 9(2)(b) UK GDPR – Employment, social security and social protection obligations | ||
| Identity information and vetting information | Conducting DBS and suitability checks | Article 6(1)(c) UK GDPR – Legal Obligation; and/or Article 6(1)(f) UK GDPR – Legitimate Interests | Article 9(2)(g) UK GDPR – Substantial Public Interest (Safeguarding of Children and Individuals at Risk) | ||
| CCTV footage, access records and security information | Protecting individuals, premises and systems | Legitimate Interests | N/A |
Criminal offence information
As part of delivering rehabilitation, resettlement, safeguarding and criminal justice services, we may process information relating to criminal allegations, offences, convictions, cautions, prison and probation involvement, safeguarding concerns and risk assessments.
Such information is processed in accordance with Article 10 UK GDPR and Schedule 1 of the Data Protection Act 2018, including conditions relating to safeguarding, preventing or detecting unlawful acts and supporting individuals experiencing vulnerability or disadvantage.
Our legitimate interests
Where we rely on legitimate interests, these interests include:
- Delivering and improving our charitable services;
- Safeguarding service users, staff, volunteers and members of the public;
- Preventing fraud, crime and misuse of our services;
- Managing and administering donations and supporter relationships;
- Promoting our charitable objectives and fundraising activities;
- Ensuring the security of our premises, systems and information;
- Managing our workforce and volunteers effectively;
- Defending and establishing legal claims.
Before relying on legitimate interests, we consider the impact on individuals and ensure that our interests are not overridden by their rights and freedoms.
How do we collect personal data
We will collect personal data if you require our services, use our website, contact us, attend one of our events, work and/or volunteer for us. We may collect personal information:
- Directly from you;
- Through referrals from partner organisations;
- From local authorities and government departments;
- From criminal justice agencies, including prisons, probation services and the police;
- From healthcare providers and social care organisations;
- From employers, educational establishments and training providers;
- From donors, supporters and fundraisers;
- Through our website and online services;
- Through CCTV systems operating at our premises;
- From publicly available sources where appropriate.
How long we keep your information
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including legal, regulatory, safeguarding, employment, accounting and operational requirements. Retention periods vary depending on the type of information and the purpose for which it is processed.
Further information about our retention periods can be obtained by contacting our Data Protection Team.
Your rights
Under UK data protection law, you have a number of rights in relation to your personal information. Depending on the circumstances, these rights may include:
- The right to be informed about how we collect and use your personal information;
- The right of access to the personal information we hold about you;
- The right to rectification of inaccurate or incomplete personal information;
- The right to erasure (sometimes known as the "right to be forgotten") where there is no lawful reason for us to continue processing your information;
- The right to restrict processing of your personal information in certain circumstances;
- The right to data portability, allowing you to receive certain personal information you have provided to us in a structured, commonly used and machine-readable format;
- The right to object to processing carried out on the basis of our legitimate interests;
- The right not to be subject to solely automated decision-making, including profiling, where such decisions produce legal or similarly significant effects;
- The right to withdraw consent at any time where we rely on consent as the lawful basis for processing. The withdrawal of consent will not affect the lawfulness of any processing carried out before consent was withdrawn.
To exercise any of your rights, please contact us using the details provided in this Privacy Notice. We may ask you to provide proof of identity before responding to your request.
Automated decision-making
St Giles does not carry out solely automated decision-making that produces legal or similarly significant effects on individuals.
Complaints
If you have concerns about how we collect, use or protect your personal information, we encourage you to contact our Data Protection Team in the first instance so that we can investigate and try to resolve the issue.
Email: dataprotection@stgilestrust.org.uk
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection matters.
Further information about how to make a complaint can be found on the ICO's website:
https://ico.org.uk/make-a-complaint/
Sharing personal information
To deliver our services, fulfil our legal obligations and support our charitable objectives, we may share personal information with trusted third parties where there is a lawful basis to do so. Depending on the circumstances, we may share information with:
- Local authorities and government departments;
- Criminal justice agencies, including prisons, probation services and the police;
- Healthcare providers and social care organisations;
- Housing providers and homelessness support services;
- Education, training and employment support providers;
- Partner charities and voluntary sector organisations involved in delivering support services;
- Professional advisers, including legal, financial and audit providers;
- IT, communications and cloud service providers;
- Fundraising, payment processing and customer relationship management providers;
- Regulators, law enforcement agencies and other public bodies where required or permitted by law.
Depending on the nature of the service being provided, St Giles and other organisations may act as independent controllers, joint controllers or controller and processor. Further information about specific information sharing arrangements will be provided where appropriate.
We only share personal information where we are satisfied there is a lawful basis to do so and where appropriate safeguards are in place. These safeguards may include information sharing agreements, data processing agreements, confidentiality obligations and security requirements.
We may also disclose personal information where required to comply with a legal obligation, protect an individual's vital interests, prevent or detect crime, safeguard vulnerable individuals, establish or defend legal claims, or otherwise protect the rights, property or safety of St Giles, our service users, staff, volunteers or the wider public.
International Transfers
Some of our suppliers, partners and service providers may process personal information outside the United Kingdom. Where personal information is transferred internationally, we will take appropriate steps to ensure it remains protected and that any transfer complies with applicable data protection legislation.
Depending on the destination country and circumstances of the transfer, these safeguards may include:
- Transfers to countries that have been recognised by the UK Government as providing an adequate level of protection for personal information;
- The use of the UK International Data Transfer Agreement (IDTA) or other approved contractual safeguards;
- Transfer risk assessments and supplementary security measures where appropriate; and
- Other transfer mechanisms permitted under UK data protection legislation.
Further information about any international transfers and the safeguards applied can be obtained by contacting our Data Protection Team.
Fundraising Communications
As a charity, we rely on the generosity and support of donors, supporters, volunteers and fundraisers to help us achieve our charitable objectives. We may contact you to provide information about:
- Our charitable activities and services;
- Fundraising appeals and campaigns;
- Events and community initiatives;
- Volunteering opportunities;
- Ways to support St Giles;
- The impact of our work and how donations are used.
Depending on the circumstances and the communication channel used, we will rely on either your consent or our legitimate interests as the lawful basis for processing your personal information for fundraising and supporter engagement activities.
We may contact you by post, telephone, email or text message where permitted by applicable UK data protection.
Charitable soft opt-in
Where permitted by law, St Giles may rely on the charitable soft opt-in to send fundraising communications by email or text message to individuals who have previously supported our charitable purposes.
This may include individuals who have made a donation, participated in a fundraising event, volunteered, registered for one of our activities or otherwise engaged with St Giles and its charitable objectives.
Where we rely on the charitable soft opt-in:
- We will provide a clear opportunity to opt out when your contact details are collected;
- We will remind you of your right to opt out in every fundraising communication;
- We will stop sending fundraising communications where you tell us that you no longer wish to receive them.
You can update your communication preferences or unsubscribe from fundraising communications at any time by using the unsubscribe link included in our emails, following the instructions provided in text messages or by contacting us directly.
Your choice to opt out of fundraising communications will not affect any service-related communications that we may need to send to you.
Supporter Analysis and Profiling
To help us understand our supporters, improve our fundraising activities and ensure our communications are relevant and appropriate, we may analyse information about donors, supporters and fundraisers. This may include information such as:
- Donation history;
- Fundraising activity and event participation;
- Communication preferences;
- Responses to previous campaigns;
- Previous interactions with St Giles;
- Geographic location and engagement trends.
We use this information to better understand our supporters, tailor our communications, improve supporter experience and make our fundraising activities more effective and cost-efficient. Where profiling is undertaken, it is used to support fundraising planning and supporter engagement and does not involve solely automated decision-making that produces legal or similarly significant effects on individuals.
You have the right to object to processing carried out on the basis of our legitimate interests, including profiling undertaken for direct marketing and fundraising purposes. Please contact us if you wish to exercise this right.
Cookies
We employ a number of cookies across our website in order to enhance the user experience and ensure that we are able to provide the relevant content that our visitors might expect. You can find more information on our cookie policy here: https://www.stgilestrust.org.uk/cookies-policy/.
E-newsletter
If you sign up to receive a copy of our e-newsletter it will be sent to the email address that you provide.
You can unsubscribe from the newsletter at any time either by clicking the unsubscribe link in a newsletter email.
We collect information on the subscribers (email address) that open emails, when they were opened, which links were clicked, and the geographical location the clicks came from to help us ensure the content of the newsletter is geographically relevant to all our subscribers. This information is used to help us make decisions about the content of future e-newsletters.
Online donations via our website
We use a third party CRM Beacon to host our secure online donation facility. For more information, please read their privacy notices which you can find here:
http://beaconcrm.org/legal/privacy
Donor details are stored securely on Beacon. We use these details for the purposes of downloading remittance, for administration purposes and manual profiling.
When you apply for a job or to volunteer
Any information you provide during the application process such as your CV, will only be used for the purpose of progressing your application. We use the contact details you provide to give updates on your application.
We will use the other information you provide to assess your suitability for the role you have applied for during shortlisting and, if applicable, interviews.
During the offer process we ask for equal opportunities information (so we can produce and monitor equal opportunities statistics) and details of referees that we will then contact.
New starters are asked to provide bank details (so we can pay you), emergency contact details (so we know who to contact if you have an emergency at work)
We are required to confirm the identity of our staff and contractors their right to work in the UK by asking you to provide proof of identity.
We may ask you to complete a questionnaire about your health to establish your fitness to work; we share personal data to perform health checks with suppliers of these services.
We may need to perform a Disclosure and Barring Service (DBS) check if the role involves working with vulnerable groups of people; we share personal data to perform DBS checks with suppliers of these services.
We need to share some details with our payroll and pension providers, and our bank, to the extent that we can pay you and into your pension. We use a secure online HR system to hold HR data.
Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in legislation, guidance, technology or our processing activities.
The most recent version will always be available on our website.