Last updated: 15 July 2026

1. Introduction

1.1. We are committed to safeguarding the privacy of visitors to our website and everyone we interact with, in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003, as amended (“PECR”).

1.2. We will ask you to consent to our use of non-essential cookies in accordance with this policy when you first visit our website.

1.3. This policy applies where we act as a data controller, meaning we determine the purposes and means of processing personal data obtained through our website and our wider charitable activities.

1.4. In this policy, “we”, “us” and “our” refer to Single Homeless Project (“SHP”).

1.5. This policy explains how we collect, use, share and protect personal data, and sets out your rights under UK data protection law.

2. How we use your personal data

2.1. We are responsible for defining:

a) the categories of personal data we process;

b) the purposes for which we process personal data; and

c) the lawful basis (or bases) that applies to that processing. A full explanation of the lawful bases referred to in this policy is set out in Section 3.

2.2. Usage data

Use of our website generates data about your visit (“usage data”). Usage data may include your IP address, browser type and version, referral source, length of visit, page views, navigation paths, operating system and approximate geographical location. It may also include limited information about the frequency and pattern of your use, and information stored via any online account you hold with us, such as your name, profile picture and date of birth.

We collect usage data through analytics cookies and similar technologies. Where these are non-essential, we only set them with your consent, obtained through our cookie banner, in line with PECR (see Section 14, Cookies). The lawful basis under the UK GDPR for our subsequent processing of usage data is consent, or, in relation to strictly necessary cookies, our legitimate interest in the security and functioning of our website.

We use usage data to analyse how our website is used, to develop our services, to understand our supporters, and to improve the experience of website visitors.

2.3. Enquiry data

We process information you submit when you contact us with an enquiry about our services, or for any other reason (“enquiry data”). The lawful basis for this processing is our legitimate interest in responding to enquiries and communications directed to us, having balanced this interest against your rights and freedoms. Enquiry data is used to respond to your query, to identify recurring issues, and to improve the information available on our website.

2.4. Newsletter data

We may process information you provide when subscribing to our newsletters or updates (“newsletter data”). Where required by law, we will rely on your consent. In other circumstances, where permitted by PECR, we may rely on the charity soft opt-in (see Section 4 for further detail). You may unsubscribe at any time using the link in any email or by contacting us.

2.5. Correspondence data

We may process information contained in or relating to any correspondence you send us (“correspondence data”). The lawful basis for this processing is our legitimate interest in maintaining appropriate records of correspondence and responding to it, balanced against your data protection rights.

2.6. Transaction data

We process information necessary to fulfil a donation, purchase or other transaction made through our website (“transaction data”). The lawful basis for this processing is our legitimate interest in processing financial transactions you have requested, and/or the performance of a contract with you.

This processing is carried out with the assistance of third-party payment providers, including GoCardless and Stripe, who act as our processors (not joint controllers) for this purpose. They process transaction data only on our instructions and in accordance with their own security and compliance obligations. You can review their privacy notices here:

GoCardless: gocardless.com/legal/privacy

Stripe: stripe.com/gb/privacy

2.7. Data processed via third-party platforms

We use a number of software platforms to assist and streamline our operations, including Fundraise Up, JustGiving, Zapier, WordPress, Google, Hotjar, Beacon and Mailchimp. The lawful basis for this processing is our legitimate interest in the efficient administration of the charity and the effective use of charitable resources. 

These organisations act as our data processors: they process personal data only on our documented instructions, for our purposes, and are contractually required to protect that data. They are not joint controllers of your personal data. We encourage you to review their privacy notices if you have any concerns about how they handle data on our behalf.

2.8. Marketing data

We process personal data to keep you informed about our work, campaigns, services, fundraising activities and events (“marketing data”). Full details of how we use marketing data, including our reliance on consent or the charity soft opt-in under PECR, are set out in Section 4 (Marketing communications).

2.9. Public data

We may process publicly available data to assess potential and existing audiences and to inform our engagement strategy (“public data”). The lawful basis for this processing is our legitimate interest in reaching those who may be interested in supporting our work, in a manner that makes efficient use of our charitable resources.

2.10. Legal claims

Where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure, we may process any personal data identified in this policy. The lawful basis for this processing is our legitimate interest in protecting our legal rights and, where applicable, compliance with a legal obligation.

2.11. Insurance and risk management

Where necessary for obtaining or maintaining insurance cover, obtaining professional advice, or managing organisational risk, we may process personal data identified in this policy. The lawful basis for this processing is our legitimate interest in protecting our organisation against relevant risks.

2.12. Non-identifiable information

We may process non-personally identifiable information for a variety of purposes, including sharing it with third parties; doing so will not affect your data protection rights.

2.12.1. We will not, without your explicit consent, supply your personal information to any third party for that third party’s own direct marketing purposes.

2.13. Legal obligations and vital interests

In addition to the purposes at 2.2 to 2.7, we may process your data where necessary to comply with a legal obligation, or to protect the vital interests of an individual or our organisation’s assets, for example in connection with the prevention of fraud.

2.14. Personal data of others

Before you disclose to us personal information about another person, you must obtain that person’s consent to both the disclosure and the processing of their personal information in accordance with this policy.

2.15. Privacy settings

Where relevant, you can use the privacy controls available on our website to limit the publication of your information.

3. Lawful bases for processing

3.1. Under the UK GDPR, we must have a valid lawful basis to process your personal data. Depending on the purpose, we rely on one or more of the following:

a) Consent – you have given clear, informed and freely given agreement to the processing (for example, non-essential cookies, or certain marketing communications).

b) Contract – processing is necessary to perform a contract with you, or to take steps at your request before entering into a contract.

c) Legal obligation – processing is necessary for us to comply with the law.

d) Vital interests – processing is necessary to protect someone’s life.

e) Legitimate interests – processing is necessary for our legitimate interests, or those of a third party, provided this is not overridden by your interests or fundamental rights and freedoms.

3.2. Where we rely on legitimate interests, we carry out a balancing exercise to ensure our interests do not override your rights and freedoms.

3.3. Where we rely on consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.

3.4. The lawful bases under the UK GDPR are separate from, and additional to, the rules on electronic marketing under PECR, which are explained in Section 4.

4. Marketing communications (including the charity soft opt-in)

4.1. We may process your personal information to keep you informed about our work, services, campaigns, fundraising activities, events and other information we believe may be of interest (“marketing data”).

4.2. The lawful basis under the UK GDPR for processing your personal data for marketing purposes will normally be legitimate interests or consent, depending on the circumstances.

4.3. Where we send marketing by email or SMS, we will separately comply with the Privacy and Electronic Communications Regulations (PECR). This means we will either:

a) obtain your consent before sending electronic marketing; or

b) where permitted by law, rely on the charity soft opt-in.

4.4. We may rely on the charity soft opt-in where:

a) we obtained your contact details in the course of you expressing an interest in, offering or providing support for, or purchasing goods or services from SHP;

b) we are marketing our own similar charitable purposes, campaigns, services or fundraising;

c) you were given a clear opportunity to opt out of marketing when your details were collected; and

d) every subsequent marketing communication we send you includes a simple way to unsubscribe or opt out.

4.5. You may opt out of receiving marketing communications from us at any time by following the unsubscribe instructions included in our emails, replying STOP to SMS messages where applicable, updating your communication preferences, or contacting us directly using the details in Section 16.

4.6. We will never sell your personal information, or share it with third parties for their own direct marketing purposes, without your explicit consent.

4.7. Where we send you marketing text messages (SMS), these are covered by the same PECR rules and charity soft opt-in described above. Our SMS messages also operate under separate SMS Messaging Terms and Conditions, which cover message frequency, standard message and data charges, opting out (reply STOP), getting help (reply HELP), and re-subscribing; these are available at shp.org.uk.

5. Disclosure of personal information

5.1. We may disclose your personal information to our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors, insofar as reasonably necessary for the purposes set out in this policy. Where these parties process personal data on our behalf, they do so as our data processors, under contractual obligations to keep it secure and to act only on our instructions.

5.2. This list is non-exhaustive, but except as set out in this policy, we will not share your data with third parties unnecessarily.

5.3. We may disclose your personal information:

a) in accordance with Section 2 of this policy;

b) to the extent we are required to do so by law;

c) in connection with any ongoing or prospective legal proceedings;

d) in order to establish, exercise or defend our legal rights, including providing information to others for the purposes of fraud prevention;

e) to the purchaser (or prospective purchaser) of any business or asset that we are, or are contemplating, selling; and

f) to any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information, where, in our reasonable opinion, such court or authority would be likely to order disclosure.

6. International transfers

6.1. Some of the third parties referred to in this policy (including Mailchimp, Google, Hotjar and Stripe) may store or process personal data outside the UK, including in the United States.

6.2. Where we, or our processors, transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with Chapter V of the UK GDPR. This may include reliance on UK adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

6.3. You can contact us using the details in Section 16 for further information about the safeguards in place for a specific transfer.

7. Retention of personal information

7.1. Our data retention policies and procedures are designed to ensure that we comply with our legal obligations regarding the retention and deletion of personal information.

7.2. We do not keep personal data for any purpose for longer than is necessary for that purpose.

7.3. We determine appropriate retention periods for each category of personal data based on the purpose of processing, any applicable legal or regulatory requirement, and relevant guidance from the Information Commissioner’s Office (ICO). As a guide:

a) enquiry and correspondence data is generally retained for up to 2 years from the date of last contact, unless a longer period is needed to resolve the matter;

b) newsletter and marketing data is retained until you unsubscribe, or reviewed periodically (generally every 24 months) to confirm continued interest;

c) transaction and financial data, including donation and Gift Aid records, is retained for a minimum of 6 years from the end of the relevant financial year, to meet HMRC and charity accounting requirements;

d) usage and analytics data is retained in accordance with the default retention settings of the relevant analytics platform (see Section 14, Cookies); and

e) records relevant to actual or potential legal claims are retained for the duration of the applicable limitation period, generally up to 6 years, or longer where legal proceedings are ongoing.

7.4. Notwithstanding the above, we will retain documents (including electronic documents) containing personal data:

a) to the extent required by law;

b) if we believe the documents may be relevant to any ongoing or prospective legal proceedings; and

c) in order to establish, exercise or defend our legal rights.

7.5. Further details of our retention periods are available on request from our Data Protection Officer (see Section 16).

8. Security of personal information

8.1. We take reasonable technical and organisational measures to prevent the unauthorised or unlawful loss, misuse, alteration or destruction of your personal information.

8.2. We store personal information you provide on secure servers protected by appropriate technical controls, including firewalls and access restrictions.

8.3. Data sent between your browser and our servers, including enquiry and financial data, is protected using encryption technology (such as TLS/HTTPS).

8.4. All electronic financial transactions made through our website are protected using encryption technology.

8.5. The transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet; any such transmission is at your own risk.

8.6. You are responsible for keeping any password used to access restricted areas of our website (such as the Knowledge Hub) confidential. We will never ask you for your password, other than when you log in to the relevant part of our website.

9. Changes to this policy

9.1. We may update this policy from time to time by publishing a new version on our website. We will not always separately notify you of minor changes.

9.2. We encourage you to check this page periodically to keep informed of how we use and protect your data, and to review your cookie settings from time to time.

9.3. Where we make significant changes to this policy, we may notify you by email where we consider it appropriate to do so.

9.4. If you are unhappy with an updated version of this policy, you can update your marketing and cookie preferences at any time using the details in this policy.

10. Your rights

10.1. Under the UK GDPR, subject to certain exemptions and conditions, you have the following rights in relation to your personal data:

a) the right to be informed about how we collect and use your personal data (which this policy is intended to address);

b) the right of access to the personal data we hold about you;

c) the right to rectification, if any personal data we hold about you is inaccurate or incomplete;

d) the right to erasure (the “right to be forgotten”) in certain circumstances;

e) the right to restrict our processing of your personal data in certain circumstances;

f) the right to data portability, allowing you to obtain and reuse your data for your own purposes;

g) the right to object to our processing of your personal data, including processing carried out for direct marketing purposes or on the basis of legitimate interests;

h) rights in relation to automated decision-making and profiling, where applicable; and

i) the right to withdraw consent at any time, where we rely on consent as our lawful basis.

10.2. To exercise any of these rights, please contact us using the details in Section 16. We may ask you to provide appropriate evidence of your identity before responding to your request.

10.3. We may withhold personal information you request to the extent permitted by law.

10.4. You have the right to object to the processing of your personal data for direct marketing at any time. You can unsubscribe from electronic marketing by using the unsubscribe link in our emails, replying STOP to SMS messages where applicable, updating your communication preferences, or contacting us. We will action your request promptly.

10.5. If you have concerns about how we process your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk, or by calling 0303 123 1113. We would, however, welcome the opportunity to address your concerns directly – please contact our Data Protection Officer using the details in Section 16 before doing so.

11. Personal data of children

11.1. Our website is primarily intended for use by persons aged 18 or over.

11.2. The services we provide include support for young people, which may involve processing personal data of individuals aged 16 and over.

11.3. If we become aware that we hold personal data relating to a child under the age of 16 without an appropriate lawful basis (for example, parental consent where required), we will take steps to delete that data.

12. Third-party websites

12.1. Our website includes hyperlinks to, and details of, third-party websites.

12.2. We have no control over, and are not responsible for, the privacy policies and practices of third parties.

12.3. We periodically review our relationships with third parties to help ensure they are compatible with our standards of data protection.

13. Updating your information

13.1. Please let us know if the personal information we hold about you needs to be corrected or updated, by contacting complaints@shp.org.uk.

14. Cookies

14.1. Our website uses cookies and similar tracking technologies.

14.2. A cookie is a small file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and stored by the browser. The identifier is then sent back to the server each time the browser requests a page from that server.

14.3. Cookies may be “persistent” or “session” cookies. A persistent cookie is stored by a web browser and remains valid until its set expiry date, unless deleted earlier by the user. A session cookie expires at the end of the browsing session, when the browser is closed.

14.4. Cookies do not usually contain information that personally identifies a user, but personal information we hold about you may be linked to information stored in, or obtained from, cookies.

14.5. In accordance with PECR, we only set non-essential (e.g. analytics) cookies with your consent, obtained via the cookie banner on our website. Strictly necessary cookies, required for the website to function, do not require consent.

14.6. We use both session and persistent cookies on our website. The names of the cookies we use, and the purposes for which they are used, are set out below:

a) _cookie_accept – to recognise whether you have accepted our cookie message;

b) ToggleStatus – to show whether you have hidden or shown the contacts filter search;

c) ASP.NET_SessionId – to authenticate your session after logging in; this expires when you close your browser;

d) ARRAffinity – tells our infrastructure which server should handle your request;

e) MemberLoggedIn – a flag that records whether you are logged in;

f) ai_session and ai_user – used to track users as they navigate the website, predominantly for infrastructure performance monitoring;

g) DisplayName – records a donor’s preference as to whether their name is shown during a Direct Debit; and

h) __unam (set by ShareThis) – monitors click-stream activity such as pages viewed, navigation between pages, and time spent on each page, for analytical purposes. This cookie does not itself contain personal information; ShareThis will only identify you if you have separately signed up for a ShareThis account and given your consent to that service.

14.7. We use Google Analytics to analyse use of this website.

14.7.1. Google Analytics generates statistical information about website use through cookies stored on your device.

14.7.2. This information is used to produce reports on website usage. Google acts as our processor for this purpose; its own use of the data is governed by its privacy policy, available at policies.google.com/privacy.

14.7.3. The core Google Analytics cookies used on this website are _ga and _gid. We keep our list of active analytics cookies under review as our analytics tools are updated; the current list is available on request.

14.8. We use Hotjar to better understand our users’ needs and to optimise our website and services.

14.8.1. This may include a device’s IP address (processed during your session and then stored in a de-identified form), device screen size and type, browser information, country-level location, and preferred display language.

14.8.2. Hotjar stores this information on our behalf in a pseudonymised user profile, and is contractually prohibited from selling any data collected on our behalf.

14.9. Most browsers allow you to manage or refuse cookies through their settings. Guidance for common browsers is available at:

Chrome: support.google.com/chrome/answer/95647

Firefox: support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop

Safari: support.apple.com/en-gb/guide/safari/sfri11471/mac

Microsoft Edge: support.microsoft.com/en-us/microsoft-edge

14.10. Please be aware that blocking or deleting cookies may negatively affect the usability of our website, and you may not be able to use all of its features.

14.11. You can delete cookies already stored on your device through your browser’s settings; the links at 14.9 provide guidance on how to do this for common browsers.

15. Data protection registration

15.1. We are registered as a data controller with the UK Information Commissioner’s Office.

15.2. Our data protection registration number is Z8447316.

16. Contact details

16.1. This website is owned and operated by Single Homeless Project.

16.2. We are registered in England and Wales, Charity Number 287779, and our registered office is at 245 Gray’s Inn Road, London WC1X 8QY.

16.3. Our principal place of business is 245 Gray’s Inn Road, London WC1X 8QY.

16.4. Our Data Protection Officer is Doug Becker, who can be contacted at dbecker@shp.org.uk.

16.5. You can contact us:

a) by post, using the postal address given above;

b) by using our website contact form;

c) by telephone, on the contact number published on our website; or

d) by email, using the email address published on our website, or by contacting our Data Protection Officer directly using the details above.