Privacy Statement

The Karen Hilltribes Trust (KHT) is committed to protecting your privacy and we will process your personal data in accordance with the General Data Protection Act 2018. Your details will be kept safe and secure, only used by us or those who work for us. Your details will not be shared or rented to third parties for marketing purposes. We may use information you provide for analysis, research or screening purposes in order to help us understand our supporters, so we can save resources and deliver the best service possible.

We may update this notice from time to time. We will highlight when this policy was last updated at the end of this policy.

Please read our privacy notice carefully. By providing KHT with your personal information, you consent to the use of it in accordance with the conditionals of this notice. In keeping with data protections legislation, we will not hold your personal information for longer than is absolutely necessary. If you have any questions about this policy, please email us at

Where we collect personal information

We collect personal information in the following ways:

When you give it to us directly

Examples of this include:

When you give it to us indirectly

For example, when it is shared with us by third parties such as professional fundraisers, partners, or subcontractors acting on our behalf, or through fundraising sites such as JustGiving or Virgin Money. These organisations will have their own privacy policies, and/or statements so please do ensure you check when providing your personal information to them.

When you visit our website or social media

On our website, KHT tracks non-personal statistical information about visits to the site through a tracking programme that shows how many visits each page receives, the route taken through the pages and other general information. We use this information to help us understand more about how our site is used and work on ways to improve your experience. This information is not linked to any personal details on the actual visitors.

Upon visiting our website, information about your visit is recorded and stored. See our Cookies Policy on the use of cookies for more details. Our website may contain links to enable you to visit other websites of interest easily. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Depending on your settings and the relevant policies and terms of service, when using social media and messaging services like Facebook and Twitter, you might give us permission to access information about you from those accounts or services.

When you have given other organisations permission to share it

You may have provided your details to another organisation that KHT manages. For example, you may have purchased something from our Etsy shop. When working with other organisations, we work to ensure it’s completely clear to you that your information will be shared with KHT. The information we get from these third parties depends on your settings and the permissions and choices you have provided, so you should regularly check what you have agreed that these third party organisations may share with us or with others.

When your information is available from public sources

We may collect personal information about you from the public domain, such as from open social networks, company websites, political and property registers and news archives. We may use third party agencies to collect this information. Please see the section below on “What categories of personal information do we collect?” for more details.

To administer legacies

In the course of administering legacies gifted to KHT we may obtain the personal information of, for example, other beneficiaries to the will. We also work with third party probate specialists who provide us with this information, and sometimes obtain it from other charities who are named in the will.

What personal information does The Karen Hilltribes Trust collect from me?


KHT will only collect the personal information that you provide. There are various occasions where you will be asked to give personal information, for example when making a donation or signing up to receive communications from us. You may also provide personal information when you contact KHT via email.

Personal information is anything that can be used to identify you as an individual. It can include your name, email address, postal address, telephone number, bank account details, credit/debit card details and whether you are a UK tax payer (so that we can claim Gift Aid).

Credit, debit card payment information

KHT takes particular care over online giving. KHTuses one of the world’s leading online payment companies, PayPal, which specialises in the secure capture and processing of online transactions. The credit card form is secure and your information is encrypted and stored on a secure database. We do not store credit card details nor do we share customer details with any 3rd parties.

If you use your credit or debit card to buy something from us, donate or fundraise for us, we will ensure that this is done securely and in accordance with the Payment Card Industry Data Security Standard (PCI DSS). To find out more about PCI DSS standards, visit their website at Following the completion of your transaction, card details and validation codes are securely destroyed once the payment or donation has been processed.

How does The Karen Hilltribes Trust store the information it collects about me?

When KHT receives personal information from you, we make it a priority to ensure that this information is kept safe. When KHT provides personal data to an external agency for a specific project such as the mailing out of our newsletter, this is done under strict agreements regarding the security and confidentiality of all personal data.

We ensure that there are security measures in place to protect your personal data. For example, we use encryption technology on our websites and carry out regular security reviews on our network.

We only allow authorised personnel to have access to your information i.e. KHT staff, volunteers or contractors and ensure that they are appropriately trained.

Unfortunately, despite all these measures, no data transmission over the Internet can be guaranteed to be 100% secure. As a result, while it strives to protect your personal information, KHT cannot ensure or warrant the security of any information you transmit to us, and you do so at your own risk.

How do we use your personal information?

KHT would like to use your data to keep you informed about our work and fundraising activities. However, if you would rather not receive such information, please email us at with your full postal address and email address, or write to us at: The Karen Hilltribes Trust, Tower House Business Centre, Fishergate, York YO10 4UA

We will only contact you for marketing purposes if you have opted in to receiving communications from us, for example, through signing up through our website, donation forms or verbally consenting. We do not do any indirect mailing.

Legitimate interests

We may use your personal information in the following ways:

Legal basis for processing personal information

There are times when it is just not practical to ask a person for consent. In many situations, the best approach for KHT and our supporters, beneficiaries, and volunteers is to process personal data because of our legitimate interests, rather than consent.

Analysis, research and building supporter profiles

When building a supporter profile, we may conduct research and/or analyse demographic, geographic and other information you’ve provided about your interests and preferences. We may also use this information to help us determine other things you might be interested in getting involved in, or what capacity you might have to donate or fundraise for us, particularly if you have made a substantial donation or are highly engaged with KHT. Currently we do very little research and analysis at this level, but we may do more in future. If you do not want us to analyse your information or combine it with publicly available information to profile you, please email us at or call us on 01904 373 001.


We may process your personal information for our legitimate business interests, which pertains to any activity which is mutually beneficial for ourselves as a service provider and you as an end user. For example, we have an interest in making sure our marketing is relevant for you, so we may process your information to send you marketing that is tailored to your interests. You have the right to object to your data being processed if you wish – if so, please email us at To find a more detailed explanation of ‘legitimate business interests’ read the Guidance on the use of Legitimate Interests under the EU General Data Protection Regulation.

Supporter Stories

Some people choose to tell us about their experiences with KHT to help further our work.  They may take on a role as an Ambassador or Media Volunteer or speak at an event. This may include them sharing their biographical and contact information.  

We use some of the information provided, for example their demographic background, to target opportunities for others to get involved.  We will also monitor the types of people who are involved to ensure that the views we hear are representative of all groups.

If we have the explicit and informed consent of the individuals, or their parent or guardian if they are under 18, this information may be made public by us at events, in materials promoting our campaigning and fundraising work, or in documents such as our annual report.

How long do we keep your personal information?

We will retain your personal information for as long as reasonably necessary for the relevant activity and relationship you have with us, as well as for any legal or regulatory requirement. For example, we will keep a record of your donations for six years after the year in which the last donation was made if you have opted in to Gift Aid, to comply with HMRC rules.

If you request that we stop sending you marketing, campaigning or fundraising communications we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us, we won’t keep any information that we don’t need. We may need to keep some of your details in order to contact you about administrating your account, under legitimate interest.

Generally, we hold your personal information on our systems for as long as is necessary for the relevant activity, for example, in general we will only keep your contact information for as long as our interactions with you continue and for six years thereafter.

After such a period, within our database, we anonymise records so we can reference behavioural patterns in our data analytics, but the information is no longer personal to you.

We may keep some of your personal information for at least 13 years after we receive the full gift or longer in some circumstances, so that we can administer legacy gifts and communicate effectively with the families of people leaving us legacies. This also enables us to identify and analyse the source of legacy income we receive.

How to access, correct or delete your personal information

Data protection legislation allows you to request a copy of the personal information relating to you which is kept by KHT. Please email us if you would like to submit a request.

If you would like to:

We endeavour to amend or update your contact details and communications preferences as soon as possible after you make your request, however you should expect the approximate time-frames for the changes to be made:

To amend any details, please email or call 01904 373001

Changes to this notice and questions about this notice

We will regularly review and update our privacy notice at our discretion. Any significant changes to the way we treat your personal information will be made clear on our website and/or we may contact you directly if possible. Any changes posted after these changes or updates will be taken to mean you agree with these changes. Ensure you keep up to date with our privacy notice intermittently, or any time you provide personal information.

This privacy notice was last updated in June 2018.