Privacy notice.

1. Who we are

The Cornwall Stork Project ("we", "us", "our") is a charity registered in England and Wales (charity number 1211474). We are the data controller for personal information you provide through this website and our related activities.

You can contact us about anything in this notice by email at info@thecornwallstorkproject.org.

2. The personal data we collect

We only collect what we need to run the charity. Specifically:

Donations and Gift Aid

When you donate, our payment provider (Stripe) collects your name, email address, billing address, and card details. Card details are handled directly by Stripe and never reach our servers. We receive a record of the donation amount, date, your name and email. If you opt in to Gift Aid we also record your title (optional), first and last name, home address, postcode, the version of the declaration text you agreed to, and the timestamp of your consent. We send you a written confirmation of your Gift Aid declaration by email, as required by HMRC. You can cancel a Gift Aid declaration at any time by emailing us; cancellation applies to future donations and to claims not yet submitted to HMRC.

Volunteer sign-ups

When you offer to volunteer we collect your name, email address, phone number, postcode or rough location, availability, and any relevant skills or experience you choose to share.

Stork sighting reports

When you report a sighting we collect the date, time and location of the sighting, any notes or ring details you provide, optional photographs, and (optionally) your name and email so we can credit you and follow up. Photographs may contain location metadata (EXIF) which we use to verify the sighting.

Contact form messages

When you contact us we collect your name, email address, and the content of your message.

Newsletter sign-ups

When you subscribe to our newsletter we collect your email address and the date you signed up.

Landowner enquiries

When you enquire about hosting storks on your land we collect your name, contact details, and information about the site you are offering.

Technical data

Our hosting provider records standard server logs (IP address, browser type, page requested, timestamp) for security and troubleshooting. We do not use third-party advertising trackers.

3. Why we use your data, and our lawful basis

• Donations and Gift Aid. To process your donation, issue a receipt, and (if you opted in) reclaim Gift Aid from HMRC. Lawful basis: contract, and legal obligation for tax and accounting records.
• Volunteer coordination. To match you to opportunities, contact you about events, and meet our safeguarding obligations. Lawful basis: legitimate interests (running the charity), and consent for marketing.
• Sighting records. To verify and publish sightings, monitor the population, and improve conservation decisions. Lawful basis: legitimate interests (conservation research and public engagement).
• Contact and newsletter. To reply to your message and (with your consent) send you updates about the project. Lawful basis: consent, withdrawable at any time.
• Site security and analytics. To keep the site running and protect it from abuse. Lawful basis: legitimate interests.

4. Who we share your data with

We do not sell your data and we do not share it with anyone for marketing purposes. We do share it with carefully chosen processors who help us run the charity:

• Stripe for payment processing. Stripe acts as an independent data controller for fraud prevention and may set its own cookies when you start a donation.
• Lovable Cloud (which uses Supabase infrastructure hosted in the EU) for our database, file storage and authentication.
• OpenStreetMap and CARTO deliver the map tiles you see on pages with a map. Loading a map page sends your IP address to these providers so they can serve the tiles.
• HMRC, where you have made a Gift Aid declaration.
• The Charity Commission and our auditors, where required by law.

We do not currently use a third-party email service for the newsletter. Newsletter sign-ups are stored in our database only. If we adopt a third-party email provider in future we will update this notice and name the provider here before any sending begins.

Where any processor stores data outside the UK, transfers are protected by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or an adequacy decision.

5. How long we keep your data

• Donation and Gift Aid records: 7 years from the end of the financial year, as required by HMRC.
• Volunteer records: while you are an active volunteer and for 2 years after your last activity, then deleted.
• Sighting reports: indefinitely as part of the conservation record. Personal contact details attached to a sighting are deleted after 3 years; the anonymised sighting itself is retained.
• Contact form messages: up to 2 years, then deleted.
• Newsletter subscribers: until you unsubscribe. Every email includes a one-click unsubscribe link.
• Server logs: up to 30 days.

6. Your rights

Under the UK GDPR you have the right to:

• be informed about how we use your data (this notice),
• request a copy of the data we hold about you,
• have inaccurate data corrected,
• have your data deleted where there is no overriding legal reason to keep it,
• restrict or object to certain processing,
• data portability for data you provided to us,
• withdraw consent at any time, where consent is the lawful basis.

To exercise any of these rights, email info@thecornwallstorkproject.org. We will respond within one month.

7. Cookies and browser storage

We use only strictly-necessary cookies and a small amount of user-initiated functional storage. We do not use any advertising, cross-site tracking or analytics cookies on this site. The full list of what we set is:

• Sign-in session (localStorage, set by our authentication provider when an admin signs in). Strictly necessary. Cleared when you sign out.
• Newsletter popup preference (csp_newsletter_popup_dismissed_at and csp_newsletter_popup_subscribed in localStorage). Functional. Set when you dismiss or subscribe so we don't show the popup again. Kept for 30 days, or until you subscribe.
• Stripe payment cookies, set by Stripe only when you start a donation on the donate page. Strictly necessary for fraud prevention and to complete the payment. Governed by Stripe's own privacy policy.
• Admin sidebar layout (a small cookie remembering whether the admin sidebar is open). Functional, set only for signed-in admins.

Under the UK Privacy and Electronic Communications Regulations (PECR), strictly-necessary cookies and storage set in response to a user action do not require a consent banner. If we ever introduce analytics, advertising or other non-essential cookies, we will ask for your consent first via a banner and update this notice before any such cookies are set.

8. Children

Our services are not aimed at children under 13. If you are under 13, please ask a parent or guardian to submit sightings or sign up on your behalf. We will delete any data we discover has been provided by a child under 13 without parental consent.

9. Security

We use HTTPS across the site, encrypted databases, role-based access controls, and reputable processors. No system is ever completely secure, but we take reasonable steps to protect your data and we will notify the ICO and (where required) you within 72 hours of becoming aware of any personal data breach that is likely to result in a risk to your rights.

10. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. ico.org.uk. Helpline: 0303 123 1113.

11. Changes to this notice

We review this notice annually and whenever our processing changes. The date at the top of the page tells you when it was last updated. Material changes will be flagged on the homepage for at least 14 days.