Stepping Stones (Luton)  is committed to protecting your privacy.   We understand that your trust is essential, especially when you reach out for help or support. This policy explains how we handle your personal information, how we keep it safe, and your rights under UK data protection laws.  If you have any questions about this statement or how your data is used, you can contact us at:

📧 privacy@steppingstonesluton.org.uk]

📍 Stepping Stones (Luton) 9a George Street West Luton, Bedfordshire LU1 2BJ 

📞 01582 341343

1. Who We Are

Stepping Stones (Luton)  is a registered charity in England and Wales (Charity No: 1162349).  We provide support, advocacy, and information to individuals and families affected by domestic abuse.  We are the data controller for the information we collect about you.

2. The Information We Collect

We may collect the following types of personal data:

a. When you contact us for help

• Your name (if you choose to provide it)
• Safe contact details (phone number, email address, or other preferred method)
• Information you share about your situation or safety needs
• Any communication notes needed to support you safely and appropriately

b. When you use our website

• IP address, browser type, and usage data (via cookies and analytics)
• Form submissions (for contact, donations, volunteering or newsletter sign-up)

c. When you donate or volunteer

• Name, contact details, and payment/donation information
• Gift Aid details (if applicable)
• Records of volunteering, training, or events attended

We only collect the minimum information we need to provide our services safely and effectively.

3. How We Use Your Information

We use your personal data to:

• Provide you with advice, information and support services
• Keep you safe and respond appropriately to your requests for help
• Manage donations, Gift Aid claims and supporter relationships
• Communicate with you about events, volunteering, or campaigns (if you have consented)
• Improve our website and services
• Comply with legal or regulatory obligations

We never sell or trade your data and we only share information where necessary and lawful (see section 4).

4. Who We Share Information With

We may share information only when it is safe and appropriate, and only with:

• Partner agencies or services (such as social services, police or refuges) — only with your consent, unless we believe you or someone else is at serious risk of harm
• Our trusted service providers who help run our website, IT or donation systems
• HMRC (for Gift Aid purposes)
• Regulators (if required by law, e.g., Charity Commission or ICO)

All partners must comply with strict confidentiality and data protection requirements.

5. Legal Basis for Processing

We process personal data under one or more of the following lawful bases:

• Consent – when you choose to share information with us or sign up for updates
• Legitimate interests – to manage our operations, support services, or website safely
• Legal obligation – when required by law (e.g. safeguarding or financial reporting)
• Vital interests – if we believe someone’s life or safety is at risk

6. How We Keep Your Information Safe

We take your privacy and safety extremely seriously.  Your data is stored securely on encrypted systems with access restricted to authorised staff only.  We use secure communication methods and do not record information that could compromise your safety unless necessary.

If we become aware of any data breach that may affect your rights or safety, we will notify you and the Information Commissioner’s Office (ICO) as required by law.

7. How Long We Keep Your Data

We only keep personal data for as long as necessary for the purpose it was collected.
For example:

• Helpline or support case notes: up to 7 years (or sooner, if requested)
• Donor or financial records: 6 years (to comply with financial regulations)
• Volunteer or HR records: as required by employment law

We safely delete or anonymise data once it’s no longer needed.

8. Your Rights

You have the right to:

• Access a copy of your personal data
• Correct inaccurate or incomplete information
• Request erasure of your data (in most cases)
• Withdraw consent (where processing is based on consent)
• Object to or restrict how your data is used
• Lodge a complaint with the Information Commissioner’s Office (ICO) if you’re unhappy with how we’ve handled your data

You can learn more about your rights at: https://ico.org.uk/your-data-matters/

9. Cookies and Website Analytics

Our website uses cookies to help us improve user experience.  Cookies do not identify you personally but help us understand how visitors use our site.  You can control cookies through your browser settings, see our Cookie Policy for details.

10. Updates to This Policy

We review this Privacy Policy regularly to keep it up to date.  The latest version will always be available on our website and will show the date of last revision.

Last updated: October 2025

11. Contact Us

If you have any concerns or questions about your data, or wish to exercise your rights, please contact:

Data Protection Lead
📧 privacy@steppingstonesluton.org.uk
📍 9a George Street West Luton, Bedfordshire LU1 2BJ 

📞 01582 341343

If you remain dissatisfied, you can contact:
Information Commissioner’s Office (ICO) https://www.ico.org.uk/concerns
📞 0303 123 1113