Privacy Notice

Becky's Button respects the privacy of people who visit our website, subscribe to updates, contact us, support our work, donate, participate in or enquire about our programmes, or otherwise interact with us. This Privacy Notice explains what personal information we collect, how and why we use it, who we may share it with, how long we keep it, and the rights available to you.

This notice explains how we use personal information under UK data-protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and changes made by the Data (Use and Access) Act 2025. It should be read together with our Cookie Policy and, where relevant, any additional privacy information provided for a specific programme, event, safeguarding process, grant, employment or volunteer activity.

For the purposes of UK data-protection law, Becky’s Button is the controller of personal information described in this notice, unless another notice expressly states otherwise.

Organisation: Becky’s Button, a charitable incorporated organisation (CIO) registered with the Charity Commission for England and Wales

UK charity number: 1212641

Website: https://beckysbutton.org

If we appoint a Data Protection Officer or another formal privacy lead, we will publish their contact details here.

• Visitors to the Becky’s Button website and people using website forms.
• Newsletter subscribers and people who receive permitted email updates.
• Donors and supporters where Becky’s Button receives personal information relating to their support.
• People enquiring about volunteering, fundraising, partnerships, schools, universities, programmes, media or other collaboration.
• Representatives of partner organisations, suppliers, advisers and other professional contacts.
• Young people, parents/carers, educators and programme participants where information is collected through an online Becky’s Button process that links to this notice.
• People who raise a data-protection complaint or exercise privacy rights.

• Directly from you when you complete a form, subscribe, email us, contact us, participate in a programme or otherwise communicate with us.
• From a school, university, partner organisation, professional adviser or other third party where it is lawful and appropriate for them to share the information with us.
• From fundraising/payment platforms such as Enthuse where the platform is authorised to provide supporter information to us. The platform’s own privacy notice and settings may also apply.
• From publicly available professional or organisational sources where appropriate for legitimate charity, partnership, research or stakeholder engagement purposes.
• Automatically from our website or security systems, including necessary storage/access technologies and, if you agree, analytics technologies.

You do not have to give us personal information. However, if you do not provide information marked as required on a form (for example, your email address when subscribing to our newsletter), we may not be able to respond to you or provide what you have asked for. You are not under a legal or contractual obligation to provide personal information through our website.

Emails that promote Becky’s Button’s aims, fundraising, volunteering or other charitable activity can be “direct marketing” for data-protection and PECR purposes. We will only send such communications where we have a lawful route to do so and will provide a clear way to opt out in every marketing email.

When you subscribe through our website, we will ask you to confirm your subscription by clicking a link in a confirmation email (double opt-in). We keep a record of who subscribed, when and how, and the wording shown at the time.

We will only send marketing emails to people whose details we receive from a fundraising platform if they have agreed to hear from us.

You can unsubscribe at any time using the link in an email or by contacting us. We may retain a minimal suppression record so that we can respect your opt-out.

The Becky’s Button website directs you to an external donation provider (currently Enthuse) to make a donation. Donations and card payments are processed by that provider under its own terms and privacy information. Becky’s Button does not collect or store full payment-card details through this website or its administration area.

The donation provider may provide Becky’s Button with information needed to administer a donation, fundraising relationship, Gift Aid or related reporting, depending on the supporter’s choices and the provider configuration. Becky’s Button will use such information only for lawful charity, fundraising, accounting and communication purposes.

Because Becky’s Button works in areas connected with violence against women and girls, prevention, safeguarding and people at risk, communications may occasionally contain particularly sensitive information. General website forms are not designed as confidential safeguarding-reporting or emergency-response channels.

Please do not send medical records, criminal-allegation details, highly sensitive safeguarding files or unnecessary special-category information through a general website form.

If you do send us sensitive information, we will limit access to authorised people and only use it where we have a lawful basis and, where the law requires, an additional legal condition for doing so.

If someone is in immediate danger, contact the emergency services straight away (999 in the UK, or the local emergency number in other countries, such as 112). Becky’s Button’s website is not an emergency service.

Young people are central to Becky’s Button’s programmes. We aim to use children’s and young people’s information fairly, transparently, proportionately and with appropriate safeguards. Where an online service we provide is likely to be accessed by children, we will follow the Age Appropriate Design Code (Children’s Code) where it applies.

Where a programme collects children’s information, we may provide a programme-specific privacy notice and safeguarding information, and ask for permission from a parent or carer where appropriate. If you are under 13, please ask a parent or carer before sending us your details.

We may share personal information only where necessary, proportionate and lawful. Recipients may include:

• Technology, hosting, database, authentication, storage, security and email service providers acting on our instructions.
• Our website development, hosting and technical support provider, which is based in Australia and acts on our instructions under a written contract containing data-protection terms.
• Our cloud database and staff log-in (authentication) provider, which stores website enquiry, newsletter and account records on our behalf.
• Our email delivery provider, which sends our newsletters and automated confirmation emails.
• Google, for website analytics, but only if you agree to analytics cookies (see our Cookie Policy).
• Our donation platform (currently Enthuse) and other approved fundraising or payment platforms, for donations and fundraising services.
• Professional advisers, auditors, insurers, banks and other service providers where necessary.
• Schools, universities, programme partners or collaborating organisations where a specific activity requires appropriate information sharing and participants have been informed.
• Regulators, courts, law-enforcement bodies or public authorities where disclosure is required or permitted by law.

Service providers acting on our behalf may only use personal information on our documented instructions and under contracts containing the protections required by data-protection law. We do not sell personal information. If you would like more details about the organisations we share information with, please contact us.

Becky’s Button works internationally. Our website development and technical support provider is based in Australia, and some of our technology providers are based in, or may process information in, the United States and other countries. A transfer can occur even where our main database is hosted in the UK, if someone overseas is given access to personal information.

Where a transfer is a “restricted transfer” under UK data-protection law, we use an appropriate legal safeguard and carry out any assessment the law requires. Depending on the circumstances, this may be UK adequacy regulations (for example, for the European Economic Area, or for US organisations certified under the UK Extension to the EU–US Data Privacy Framework), the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another approved safeguard. Australia is not currently covered by UK adequacy regulations, so we use the IDTA for access from Australia. You can ask us for more information about these safeguards, including how to obtain a copy, using the contact details below.

Where the EU GDPR applies to a particular activity (for example, a programme we run in an EU country), we will provide the rights and safeguards it requires.

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, safeguarding, regulatory, dispute-resolution and audit requirements. Retention may vary by record type.

We use organisational and technical safeguards designed to protect personal information against unauthorised access, loss, alteration, disclosure or misuse. Measures include role-based access, individual staff log-ins, encrypted connections, restricted administrative access, backups, security logging, confidentiality obligations for staff and contractors, and incident-response procedures. No internet service can guarantee absolute security.

Depending on the circumstances and applicable law, you may have rights to:

• be informed about how your personal information is used;
• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to processing based on legitimate interests or to direct marketing;
• receive or transfer certain information in a portable format where the right applies;
• withdraw consent at any time where processing is based on consent, without affecting processing already carried out lawfully;
• raise a data-protection complaint with Becky’s Button; and
• complain to the Information Commission, the UK’s data-protection regulator.

These rights are not absolute. We may need to verify your identity and may lawfully refuse or limit a request in some circumstances; if so, we will explain why where the law requires. We will respond within one month, which may be extended by up to two further months for complex requests. The time limit may be paused while we wait for information we reasonably need to confirm your identity or to clarify your request.

If you believe Becky’s Button has not handled your personal information correctly, you can make a data-protection complaint directly to us. We will provide a clear way to submit a complaint, acknowledge receipt within 30 days, take appropriate steps to investigate without undue delay, keep you appropriately informed, and communicate the outcome without undue delay, in accordance with applicable UK law.

You also have the right to complain to the Information Commission, the UK’s independent data-protection regulator. We encourage you to contact us first so that we have an opportunity to resolve your concern.

ICO website: https://ico.org.uk/ | Telephone: 0303 123 1113

We do not currently intend to make decisions about website visitors or newsletter subscribers solely by automated means where the decision produces legal or similarly significant effects. If this changes, we will update our privacy information and provide any additional safeguards required by law.

Becky’s Button operates internationally. This notice is written for UK law. If you are outside the UK, local laws may give you additional rights, and we will respect the mandatory requirements that apply to us.

If you are in the European Economic Area and the EU GDPR applies to the way we use your information, you have equivalent rights under that law, and you may also complain to the data-protection authority in your country.

We may update this Privacy Notice when our services, technologies, legal obligations or organisational practices change. The date at the top of this notice shows when it was last updated. Where a change materially affects how we use personal information, we will take reasonable steps to draw it to your attention.

For privacy questions, rights requests or data-protection complaints, please contact Becky’s Button using the privacy contact details below: