Privacy Notice

Effective date: 7 September 2026

Moments is a registered charity in England and Wales, charity number 1213338.

Our address is:

Hallen Farm
Severn Road
Hallen
Bristol
BS10 7RZ

For privacy questions, contact momentshallen@outlook.com, marked for the attention of James Burns. James is Moments’ privacy contact. Moments has not appointed a statutory Data Protection Officer.

Information we collect

We may collect:

  • donors’ first name, last name, home address and email address;

  • information needed to administer Gift Aid;

  • grant applicants’ organisation details and primary contact details;

  • information in grant applications, budgets, supporting documents and correspondence;

  • merchandise order and delivery information;

  • photographs and videos taken at Moments events;

  • technical information collected through Squarespace Analytics and cookies; and

  • information provided when making a complaint or raising a concern about Moments’ fundraising or other activities.

Please do not include unnecessary personal or sensitive information in a grant application.

How we use information and our lawful bases

Administer donations and maintain donation records
We rely on our legitimate interests in operating the charity.

Claim Gift Aid and retain Gift Aid evidence
We rely on our legal obligations, together with our legitimate interests in administering donations.

Process merchandise orders and payments
We rely on the contract with you, or steps taken at your request before entering into a contract.

Assess and manage grant applications
We rely on our legitimate interests in running Moments’ grant programme.

Maintain accounts and meet legal or regulatory requirements
We rely on our legal obligations.

Prevent fraud and protect charitable funds
We rely on our legitimate interests in protecting the charity and its funds.

Handle complaints and fundraising concerns
We use complaint and concern information to investigate matters fairly, respond to people, improve our activities and meet our regulatory responsibilities. We rely on our legitimate interests and, where applicable, legal obligations.

Incidental photography at public Moments events
We rely on our legitimate interests, subject to clear notice and a practical opt-out.

Posed, close-up or promotional photographs, and identifiable photographs of children
We rely on consent.

Website analytics and non-essential cookies
We rely on consent where required.

Website security and administration
We rely on our legitimate interests.

We do not currently use donor information to send marketing emails or newsletters.

Grant applications and special-category information

Grant applicants must not include personal information revealing an identifiable person’s health, disability, racial or ethnic origin, religion, trade-union membership, sex life, sexual orientation, biometric data or genetic data.

Project descriptions should use anonymised or aggregated information wherever possible.

If special-category information is submitted unexpectedly, Moments will restrict access and delete it when it is not necessary. If Moments considers that the information is genuinely necessary, it will identify an appropriate UK GDPR Article 6 lawful basis and an Article 9 condition before using it further. This may include obtaining explicit consent from the person concerned or their authorised representative.

Moments’ website and grant programme are not directed at children. If information about a child is included in a donation, grant application or event record, we will collect and use only what is necessary and take particular care to protect the child’s interests.

Grant applications and fraud screening

Grant applications may be viewed by all trustees and forwarded to our secretary, Debra Burns.

We may use artificial-intelligence tools, including ChatGPT or other OpenAI services, to assist with fraud screening and administrative checks. We aim to submit only the information reasonably necessary for that purpose. A human trustee makes grant decisions, and we do not make grant decisions solely by automated processing.

Before uploading identifiable personal information to an AI service, Moments will ensure that the relevant account is covered by appropriate business data-processing terms. If those arrangements are not in place, we will remove identifying information or use another method.

Who we share information with

We may share information with:

  • Squarespace, which hosts the website and processes website submissions;

  • Squarespace Payments;

  • Outlook or Microsoft, which provides our email service;

  • James Burns, Steve Moorlen, Debra Burns and other trustees where access is needed;

  • our third-party accountant where financial information is needed;

  • HM Revenue & Customs for Gift Aid;

  • technology providers used for fraud screening or website services; and

  • trustees, advisers, insurers, regulators or law-enforcement bodies where this is necessary to investigate a complaint, protect people or comply with the law.

We do not routinely share grant-application personal information with charities applying for or receiving grants.

Where a fundraising complaint is escalated, we may share relevant information with the Fundraising Regulator.

Where a provider processes information on our instructions, Moments will use written data-processing terms or equivalent contractual terms where required by law. These arrangements should address confidentiality, security, assistance with individual rights, and deletion or return of information.

International transfers

Some suppliers may process information outside the United Kingdom. Before making a restricted transfer, Moments will identify the applicable lawful safeguard. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another lawful mechanism. Where required, we will complete and document a transfer risk assessment.

For OpenAI or ChatGPT processing, Moments will use the transfer safeguard applicable to the business account and supplier agreement. We will not upload identifiable grant-application information where an appropriate safeguard and data-processing arrangement are not in place.

Photographs and videos

For general event photography, we rely on legitimate interests to document and promote Moments’ activities. We will provide clear notice at events and offer a practical way to opt out. People who do not want to appear should tell an organiser or contact momentshallen@outlook.com.

We will obtain affirmative consent before publishing posed or close-up photographs and identifiable photographs of children. Consent may be withdrawn by contacting us, although withdrawal does not affect uses that took place before withdrawal.

Retention

We keep information only for as long as necessary for the purpose for which it was collected, legal requirements, accounting requirements or the establishment or defence of legal claims.

Our intended retention periods are:

  • Gift Aid records: at least six years after the end of the relevant tax year;

  • unsuccessful grant applications: normally up to two years after the decision;

  • successful grant records: normally up to seven years after the grant closes;

  • donation, payment and order records: normally up to seven years for accounting and audit purposes;

  • fundraising complaints and other complaints: normally up to six years after the complaint is closed, unless the information is needed longer for legal, regulatory or safeguarding reasons;

  • photographs and videos: while relevant to the charity’s work, unless there is a good reason to retain them longer; and

  • exported analytics reports: normally up to 12 months.

These periods apply to copies held in Squarespace, Outlook and other Moments-controlled storage, as far as practicable. We will securely delete or anonymise information when it is no longer needed.

Security

We use access controls, strong passwords and multi-factor authentication where available. Access is limited to people who need information for charity work.

If we become aware of a personal-data breach, we will assess it and take any reporting and notification steps required by law.

Cookies and analytics

Squarespace Analytics may collect information about website visits, page views, traffic sources and purchases.

Squarespace states that its unique-visitor analytics cookies may last for up to two years and visit cookies for approximately 30 minutes. Some analytics reports may remain available from the date the site was created, depending on the analytics feature used. Moments does not keep a separate copy of analytics data unless it exports a report.

We will seek consent for non-essential analytics cookies where required. You can control cookies through the website’s cookie settings and your browser.

Your rights

Depending on the circumstances, you may have the right to:

  • access your personal information;

  • correct inaccurate information;

  • request deletion;

  • restrict processing;

  • object to processing based on legitimate interests;

  • withdraw consent; and

  • receive your information in a portable format where applicable.

Some rights are subject to legal exceptions, including the need to retain Gift Aid or accounting records.

Contact momentshallen@outlook.com to exercise a right. We may need to verify your identity.

Complaints

For privacy or data-protection concerns, contact momentshallen@outlook.com first.

For complaints about Moments’ fundraising, please use our Fundraising Complaints procedure. We ask people to contact Moments first. If the matter cannot be resolved, or cannot be dealt with appropriately by Moments, it may be escalated to the Fundraising Regulator.

You can complain about our use of personal information to the Information Commissioner’s Office at ico.org.uk.

Changes

We may update this notice when our activities, suppliers or legal obligations change. The latest version will be published on our website.