Privacy notice.

1. Who we are

The Cornwall Stork Project ("we", "us", "our") is a charity registered in England and Wales (charity number 1211474). We are the data controller for personal information you provide through this website and our related activities.

You can contact us about anything in this notice by email at info@thecornwallstorkproject.org, or by post to the registered address listed in the footer of this site.

2. The personal data we collect

We only collect what we need to run the charity. Specifically:

Donations

When you donate, our payment provider (Stripe) collects your name, email address, billing address, and card details. Card details are handled directly by Stripe and never reach our servers. We receive a record of the donation amount, date, your name and email, and (if you opted in) your Gift Aid declaration including your home address.

Volunteer sign-ups

When you offer to volunteer we collect your name, email address, phone number, postcode or rough location, availability, and any relevant skills or experience you choose to share.

Stork sighting reports

When you report a sighting we collect the date, time and location of the sighting, any notes or ring details you provide, optional photographs, and (optionally) your name and email so we can credit you and follow up. Photographs may contain location metadata (EXIF) which we use to verify the sighting.

Contact form messages

When you contact us we collect your name, email address, and the content of your message.

Newsletter sign-ups

When you subscribe to our newsletter we collect your email address and the date you signed up.

Landowner enquiries

When you enquire about hosting storks on your land we collect your name, contact details, and information about the site you are offering.

Technical data

Our hosting provider records standard server logs (IP address, browser type, page requested, timestamp) for security and troubleshooting. We do not use third-party advertising trackers.

3. Why we use your data, and our lawful basis

• Donations and Gift Aid. To process your donation, issue a receipt, and (if you opted in) reclaim Gift Aid from HMRC. Lawful basis: contract, and legal obligation for tax and accounting records.
• Volunteer coordination. To match you to opportunities, contact you about events, and meet our safeguarding obligations. Lawful basis: legitimate interests (running the charity), and consent for marketing.
• Sighting records. To verify and publish sightings, monitor the population, and improve conservation decisions. Lawful basis: legitimate interests (conservation research and public engagement).
• Contact and newsletter. To reply to your message and (with your consent) send you updates about the project. Lawful basis: consent, withdrawable at any time.
• Site security and analytics. To keep the site running and protect it from abuse. Lawful basis: legitimate interests.

4. Who we share your data with

We do not sell your data and we do not share it with anyone for marketing purposes. We do share it with carefully chosen processors who help us run the charity:

• Stripe for payment processing.
• Lovable Cloud (which uses Supabase infrastructure hosted in the EU) for our database, file storage and authentication.
• Our email provider for sending transactional and newsletter emails.
• HMRC, where you have made a Gift Aid declaration.
• The Charity Commission and our auditors, where required by law.

Where any processor stores data outside the UK, transfers are protected by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or an adequacy decision.

5. How long we keep your data

• Donation and Gift Aid records: 7 years from the end of the financial year, as required by HMRC.
• Volunteer records: while you are an active volunteer and for 2 years after your last activity, then deleted.
• Sighting reports: indefinitely as part of the conservation record. Personal contact details attached to a sighting are deleted after 3 years; the anonymised sighting itself is retained.
• Contact form messages: up to 2 years, then deleted.
• Newsletter subscribers: until you unsubscribe. Every email includes a one-click unsubscribe link.
• Server logs: up to 30 days.

6. Your rights

Under the UK GDPR you have the right to:

• be informed about how we use your data (this notice),
• request a copy of the data we hold about you,
• have inaccurate data corrected,
• have your data deleted where there is no overriding legal reason to keep it,
• restrict or object to certain processing,
• data portability for data you provided to us,
• withdraw consent at any time, where consent is the lawful basis.

To exercise any of these rights, email info@thecornwallstorkproject.org. We will respond within one month.

7. Cookies

This site uses only the strictly necessary cookies needed to keep you signed in to admin areas and to remember your preferences. We do not set advertising or cross-site tracking cookies. If we ever introduce analytics cookies we will ask for your consent first via a banner.

8. Children

Our services are not aimed at children under 13. If you are under 13, please ask a parent or guardian to submit sightings or sign up on your behalf. We will delete any data we discover has been provided by a child under 13 without parental consent.

9. Security

We use HTTPS across the site, encrypted databases, role-based access controls, and reputable processors. No system is ever completely secure, but we take reasonable steps to protect your data and we will notify the ICO and (where required) you within 72 hours of becoming aware of any personal data breach that is likely to result in a risk to your rights.

10. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. ico.org.uk. Helpline: 0303 123 1113.

11. Changes to this notice

We review this notice annually and whenever our processing changes. The date at the top of the page tells you when it was last updated. Material changes will be flagged on the homepage for at least 14 days.