Privacy Policy

We only collect information that helps us provide support, process referrals, manage donations, or communicate with you.

We may collect:

• Contact details: Name, email address, phone number and postal address
• Referral information: Basic details about the individual or family referred for support (as supplied by a referring organisation)
• Volunteer and donor details: Information needed for coordination, acknowledgment, and record-keeping
• Website data: IP address, browser type, and general usage information (via analytics and cookies)
• Messages and forms: Information you share when contacting us directly or through our online forms

We do not collect sensitive personal data unless it is voluntarily provided for referral or safeguarding purposes — and only where necessary and appropriate.

Monthly Pantry

If you collect a Monthly Pantry parcel in person, we record your name, date of birth, address (or that you have no fixed address), household size, food needs including any allergies, and, if you wish, a phone number.

We also take a photo of your photo ID and proof of address. If you have no fixed address, we take a photo of you instead, with your agreement.

To save typing, the photos of your photo ID and proof of address can be read automatically by Microsoft Azure OpenAI (UK South region, under Microsoft's data processing terms, with Microsoft as our processor), which fills in the details; our staff always check and correct them, no decisions are made automatically, there is no face recognition, and your images are not used to train models. Microsoft may keep content flagged by its automatic abuse monitoring for up to about 30 days, in the UK, for review, and we can switch this feature off.

If you have no fixed address, a photo of your ID may be read automatically in the same way, only to fill in your name and date of birth; that photo is deleted at the end of the visit and is not kept. The photo of you is never read automatically. Any photos we do not need are deleted at the end of the visit.

When you come back, our staff may read a photo of your ID in the same way to find your record by your name and date of birth; that photo is deleted straight away unless it becomes your ID on file. We may also give you a pantry card (an image you can keep on your phone, or later a printed card). It shows your name (with your title, if you gave one) and your address (or "No fixed address"), and a QR code holding only a random code, which only our pantry staff can use to find your record.

We do this to make sure parcels are shared fairly (one parcel per address every 4 weeks) and that your parcel is safe for you.

Only our staff and volunteers who run the pantry can see this information. It is stored securely in Microsoft Azure in the UK.

Our lawful basis is set out under Legal Basis for Processing, and how long we keep this information under Data Retention, below.

We use personal information to:

• Process and manage referrals for support
• Coordinate deliveries and communicate with referrers or recipients
• Manage volunteer activity and training
• Process and acknowledge donations
• Respond to messages, questions, or requests
• Improve our website and communications
• Keep accurate records for transparency, compliance, and safeguarding

We never sell or rent your personal information to anyone.

We process personal data under one or more of the following lawful bases:

• Consent – when you agree to share information (e.g. forms, newsletters)
• Legitimate interest – to manage referrals, volunteer coordination, or community engagement
• Monthly Pantry – legitimate interests, to share parcels fairly; allergy information is used only with your explicit consent, to give you a safe parcel
• Legal obligation – to comply with financial or safeguarding record requirements

We only share information when necessary and with trusted partners who help us operate safely and efficiently, such as:

• Referral partners (e.g. schools or agencies) – to confirm details or coordinate support
• Payment processors – to handle donations securely
• Email and hosting providers – to maintain our website and communication systems
• Microsoft Azure OpenAI (UK South) – to read photos of ID and proof of address for the Monthly Pantry, with staff checking the results

All third parties we work with must comply with UK data protection law and maintain appropriate security standards.

Our website may use cookies to understand how visitors use the site and to improve content and usability.

Cookies are small text files stored on your device; they help us analyse anonymous usage data.

You can manage or disable cookies in your browser settings.

We may use Google Analytics or similar tools to understand overall visitor patterns — these do not identify individuals.

We keep personal data only for as long as it's needed to fulfil its purpose or meet legal obligations.

• Referral records: Up to 12 months after completion, unless required longer for safeguarding review
• Donation and financial records: Up to 7 years for accounting compliance
• Volunteer and contact data: Reviewed annually and removed when no longer needed
• Monthly Pantry records: Photos of ID, proof of address and people are deleted automatically 12 months after the last visit; other pantry records 3 years after the last visit

You can request deletion of your data at any time (see Your Rights section below).

We take reasonable and proportionate steps to protect personal information from loss, misuse, or unauthorised access.

• Our website uses SSL encryption
• Data access is limited to authorised trustees and volunteers
• Digital files are stored securely and regularly reviewed
• We do not store payment card information directly

Our website and referral forms are not designed for direct use by children.

Information about children may only be provided by authorised referrers or guardians with proper consent.

If you believe we have collected data in error, please contact us and we will remove it.

Under UK data protection law (UK GDPR), you have the right to:

• Access your personal information
• Request correction or deletion
• Withdraw consent at any time
• Object to processing
• Request data portability
• Complain to the Information Commissioner's Office (ICO) if you believe your data has been mishandled

To exercise these rights, please contact us at:
support@afiyya.org.uk