Effective from: 1st September 2026. This notice will be reviewed periodically and updated where our services, processing activities, or legal obligations change.
This privacy notice explains how Retail Trust collects, uses, stores, and shares personal information when people use our services, visit our website, contact us, support us, attend events, or receive wellbeing support.
The Retail Trust (Registered Charity 1090136/SC039684) operates three wholly owned trading subsidiaries:
• Retail Trust Events Limited (Registered Company Number 03253828)
• RT Wellbeing Services Limited (Registered Company Number 09958483)
• Cottage Homes Contracts Limited (Registered Company Number 09127894)
These subsidiaries support the efficient fundraising, income-generation and operational activities of the charity, and their activities are also covered by this privacy notice.
Retail Trust and its subsidiaries process personal information in accordance with the UK GDPR and the Data Protection Act 2018. Retail Trust is registered with the Information Commissioner’s Office under registration number Z8109661.
If you have any questions about this privacy notice or how your data is handled, please write to:
Data Protection
Retail Trust
Eborn House
Leylands Estate
Broadway
Derby
DE22 1AY
Email: dataprotection@retailtrust.org.uk
Telephone: 01332 554200 (during office hours, Monday to Friday, voicemail available for messages outside these hours)
How we handle personal information
We collect and use personal information so we can provide services, respond to enquiries, manage donations and events, meet legal and regulatory duties, keep people safe, and improve the way our services operate.
We do not sell personal information. We do not share personal information with other organisations for their own marketing unless we have told you and have a lawful basis to do so.
We only collect and use personal information where it is necessary, proportionate, and supported by a lawful basis.
This privacy notice explains what personal information we collect, how we use it, the lawful bases we rely on, who we share it with, how long we keep it, and the rights you have in relation to your personal information.
What personal information we collect
Retail Trust is the controller for personal information you provide directly to us, unless we tell you otherwise at the point of collection. In some service journeys, another organisation may act as a separate controller for the information it collects and uses.
We offer a wide range of charitable services to helpline callers, residents, beneficiaries, donors, partners, website users, event attendees, and other people who interact with us. When you interact with us, we may ask you for some or all of the following personal information:
• Basic contact details – name, address, email address, date of birth, etc.;
• Employment – name of your employer, job title and how long you’ve been employed, etc.;
• If you apply for financial aid, we will need payment details, such as your bank account number, sort code, or card details.
• If you contact us by telephone, email, live chat, WhatsApp, or another messaging channel, we may collect the information you provide during that communication and related service administration details.
• Equality information, for example disability information.
• You may be photographed or included in a video recording if you attend our events.
Personalised website experience
If you choose to do so, you may enable personalised website content. When enabled, we use information about your interactions with Retail Trust services and website activity to tailor the information, guidance, recommendations, and support resources displayed to you.
This may include:
- Recommending relevant articles, tools, and services;
- Highlighting content which may be of interest to you;
- Tailoring support materials based on your previous interactions with Retail Trust.
Personalised content is provided only with your consent. You can withdraw your consent at any time through your account settings or by contacting us. If you withdraw consent, personalised content will stop and you will continue to have access to Retail Trust services and website content.
We do not use personal information for automated decision-making that produces legal effects or similarly significant effects.
Wellbeing services
Retail Trust has appointed Spectrum.Life to deliver elements of our wellbeing service, including platform access, telephone and online access routes, counselling and therapy, wellbeing and clinical support, critical incident support, reporting, complaints handling, support with data protection rights requests, and safeguarding-related activity.
For platform access and eligibility checks, Retail Trust remains the controller and Spectrum.Life processes basic personal information on our behalf. This may include name, contact details, date of birth, employer or organisation affiliation, company ID, party ID, access route, service category, case or session dates, and similar service administration information.
When you begin counselling, therapy, clinical support, or another healthcare-related service with Spectrum.Life, Spectrum.Life acts as a separate controller for the clinical and healthcare information it collects and creates during that service. Spectrum.Life provides its own privacy information for that processing.
Retail Trust may receive limited service-related and clinical governance information from Spectrum.Life where necessary for safeguarding, clinical governance, service quality monitoring, outcome measurement, service effectiveness analysis, programme management, complaints handling, regulatory obligations, or legal obligations connected with the delivery of wellbeing services. Where this includes health information, Retail Trust relies on Article 9(2)(h) UK GDPR and the relevant Data Protection Act 2018 Schedule 1 condition for healthcare service management.
Retail Trust will not share individually identifiable clinical information with employer clients. Reporting to employers will be aggregated, anonymised, or otherwise protected so individuals are not identified.
Spectrum.Life hosts service data on AWS infrastructure in the Republic of Ireland, with disaster recovery capability in Frankfurt, Germany. Some sub-processors may support the service. Where any international transfer is required, appropriate contractual and legal safeguards will apply.
We may use information about your account registration, service choices, topic preferences, wellbeing assessments, quizzes, content interactions, recommendations, and action plans to personalise support, understand service use, and improve the wellbeing services available through our website and digital platforms.
Where you apply for financial aid, debt support, financial wellbeing support, or related services, we may process information about your financial circumstances, household, employment, priority debts, income and expenditure, bank details, supporting evidence, quotes, adviser involvement, and outcome decisions. We may share or receive relevant information with approved partners, advisers, case workers, or service providers where this is necessary to assess eligibility, provide support, prevent fraud, make payments, or evaluate service effectiveness.
Where services involve children, young people, parents, carers, or household members, we may process relevant information about those individuals where necessary to assess needs, arrange support, manage referrals, handle safeguarding concerns, deliver counselling or wellbeing services, or meet legal and regulatory obligations. Where another provider delivers the service, it may provide its own privacy information and may act as a separate controller for the information it collects and uses.
Where we provide incident, trauma, abuse, violence, critical incident, safeguarding, or in-the-moment support, we may process information about the incident, the people involved, wellbeing impact, risk indicators, referrals, actions taken, and follow-up support. We will limit use and sharing of this information to what is necessary for support, safeguarding, clinical governance, legal obligations, complaints handling, service management, and risk management.
Where we provide workplace wellbeing services to employers or retail organisations, we may process personal information to manage access, deliver training, run wellbeing programmes, support engagement campaigns, administer dashboards, produce happiness or wellbeing assessments, provide aggregated insights, evaluate outcomes, and improve services. Employer reporting will be aggregated, anonymised, or otherwise protected so individuals are not identified unless there is a clear lawful basis and appropriate transparency.
Where you choose to access rewards, discounts, benefits, partner offers, or third-party tools through our website or services, we may process information needed to manage eligibility, access, referrals, communications, and service administration. Partner organisations may process your personal information separately when you choose to use their services, and they will be responsible for explaining their own processing where they act as separate controllers.
Where we provide retirement living, supported living, accommodation, or related resident services, we may process information about applications, eligibility, tenancy or occupancy administration, payments, next of kin, emergency contacts, support needs, health or accessibility needs where relevant, property maintenance, incidents, safeguarding, complaints, and service management.
Special categories of personal data
We may process special category information, including health information, where this is necessary to provide support, manage wellbeing services, meet safeguarding responsibilities, handle complaints, or comply with legal or regulatory obligations. We will only process this information where a lawful basis and a special category condition apply, and we will keep it only for as long as needed for the relevant purpose or any applicable retention requirement.
Criminal records
There are also some limited situations where we may need to ask if you have a criminal record and record details of any offences. This will only be asked for where there is a clear reason for doing so and it is lawful to do so under data protection legislation, such as where we are obliged to collect it to protect you or other people. We will only use such information for the purpose it is provided and will dispose of it securely as soon as it is no longer required.
Why we need your personal information: consent
We ask for consent where consent is the appropriate lawful basis, including for certain marketing communications and some uses of images, video, or optional service features. We do not rely on consent where another lawful basis applies, such as legal obligation, contract, legitimate interests, safeguarding, or healthcare service management.
We will also ask for your consent if your personal data is included in any video content that we create. We use such video content to develop material for helping other people and promoting our services and share this through YouTube, our website and other online and offline platforms. The request for consent will include clear details of how we will use your personal data in our video content including any security settings we use on YouTube and other sites to ensure your personal data remains safe.
Where you give us consent to process your data, we will always keep a clear record of how and when this consent was obtained, and you can withdraw this consent for all channels and activities at any time by contacting us.
Why we need your personal information: contractual purposes
In some cases, we may need to collect your personal information so that we can carry out our obligations under a contract with you. In each instance we will only use your personal information to fulfil our obligations under the contract. If you do not provide us with all of the personal information that we need to collect then this may affect our ability to provide training or other services.
Why we need your personal information: legal obligations
We are under a legal obligation to process certain personal information relating to our trustees and volunteers for the purposes of complying with our obligations under:
• the Companies Act 2006, Charities Act 2011 and Charities and Trustee Investment (Scotland) Act 2005 to maintain a register of our board members and members, which includes our board members’ and members’ name, address, the date they were admitted to membership and the date on which they ceased to be our board member and/or member, and hold general meetings, including issuing notices and voting arrangements; and
• the Protection of Vulnerable Groups (Scotland) Act 2007 to check that our volunteers are able to undertake regulated work with children and vulnerable adults; and
• any other legislation that places an obligation upon us to process personal data.
Why we need your personal information: equality monitoring requirements
In some cases, our commitment to giving everybody fair and equal treatment requires us to use your personal information relating to your racial or ethnic origin, etc. for equality monitoring purposes.
We will process such personal information to identify and keep under review the existence or absence of equality of opportunity or treatment between groups of people within the same categories to promote or maintain equality across our services.
Why we need your personal information: legitimate interests
The data protection legislation allows personal data to be legally collected and used by an organisation if it is necessary for a legitimate interest of the organisation - as long as its use is fair and balanced and does not unduly impact the rights of the individual concerned.
Where we process your personal information in pursuit of our legitimate interests, you have the right to object to us using your personal information for the above purposes. If you wish to object to any of the above processing, please contact us. If we agree and comply with your objection, this may affect our ability to undertake the tasks below for the benefit of our beneficiaries and the funders who financially support the services we provide.
We process your personal information in pursuit of our legitimate interests to:
Governance
• The delivery of our charitable mission, as set out in our charitable priorities
• Internal and external audit for financial or for regulatory compliance purposes
• Statutory reporting
Marketing and income generation
• Conventional marketing, publicity, advertising and fundraising
• Analysis, targeting, and segmentation of data to help develop organisational strategy, and improve marketing and fundraising communications as well as improving operational efficiency
• Sharing the business contact details of attendees at our events with event sponsors
• Processing for research purposes, such as marketing or fundraising research
• Using publicly available information to profile potentially important supporters
Operational management
• Physical security, IT and network security
• Anonymising data so it can be shared with third parties without compromising confidentiality
• Processing data for historical, scientific or statistical purposes
Administrative purposes
• Responding to any solicited enquiry from any of our visitors
• Providing products, information and/or fundraising packs requested by visitors
• Communications designed to administer existing services that an individual has asked or registered for
• Communications designed to administer our health and wellbeing services and events
• Collating anonymous statistical information about our users which may be shared with third parties
• Administering Gift Aid
• Ensuring we respond properly to complaints
• Thank you communications and receipts
• Regular service, content and event updates
• Maintenance of “Do not contact lists”
Why we need your personal information: public interest
We may also process your personal data when it is required to perform a task in the public interest that is set out in law. We consider our financial management and control to be tasks we carry out in the public interest. This includes:
• Processing of financial transactions and the maintenance of financial controls
• Preventing fraud, the misuse of our services, or money laundering
• Enforcing legal claims, including debt collection via out-of-court procedures.
Other uses of your personal information
We may ask you if we can process your personal information for additional purposes. For example, where a new technology could allow us to offer improved services to our visitors. Where we do so, we will provide you with an additional privacy notice that explains how we will use your information for these additional purposes.
Who we share your personal information with
We may share your personal information with our wholly owned trading subsidiaries to assist us with the efficient fundraising, income-generation and operational activities of the charity, and their activities are also covered by this privacy notice.
We may be required to share personal information with statutory or regulatory authorities and other organisations to comply with statutory obligations. Such organisations may include the Health and Safety Executive, HMRC, safeguarding authorities, regulators, or law enforcement bodies where this is necessary and lawful.
We may also share personal information with our professional and legal advisors for the purposes of taking advice.
We use trusted suppliers and delivery partners, including Spectrum.Life, to provide services on our behalf or alongside us. Depending on the service, these organisations may act as our processor, as a separate controller, or under a controller-to-controller sharing arrangement. We put appropriate written agreements in place to define responsibilities, permitted uses, security requirements, rights request support, breach reporting, retention, deletion, and exit arrangements.
We only share the personal information needed for the relevant purpose, and we apply controls such as data minimisation, access restrictions, contractual safeguards, retention limits, and aggregation or anonymisation where appropriate.
How we protect your personal information
We protect personal information using appropriate technical and organisational measures, including role-based access, least-privilege permissions, multi-factor authentication, encryption, audit logging, access reviews, vulnerability management, supplier assurance, incident response procedures, and secure deletion controls.
• We may encrypt, anonymise, or pseudonymise personal information where appropriate.
• We ensure the ongoing confidentiality, integrity, availability, and resilience of our data processing systems.
• We restore the availability of, and access to, personal information in a timely manner in the event of a physical or technical incident.
We also store some personal information in paper files. Where we do this, those files are kept in secure locations in locked cabinets that only authorised staff have access to.
In addition, we regularly test, assess and evaluate the effectiveness of all our technical and organisational measures for ensuring the security of the personal information we process.
How long we keep your personal information
We only keep your personal information as long as is reasonable and necessary for the relevant activity. We may extend this period after the relevant activity has completed to comply with statutory restrictions or industry best practice, for example, the collection of Gift Aid on donations or best practice on retaining records of helpline calls.
We have a retention schedule that explains how long we keep different types of personal information. You can request further information by contacting us at dataprotection@retailtrust.org.uk.
Monitoring
Your communications with us, including by telephone, email, live chat, WhatsApp, or another messaging channel, may be monitored, reviewed, or recorded where necessary for service delivery, safeguarding, quality control, training, complaints handling, and compliance purposes.
Your rights
Your rights in relation to your personal information are:
• You have a right to request access to the personal information that we hold about you by making a “subject access request”;
• If you believe that any of the personal information that we hold about you is inaccurate or incomplete, you have a right to request that we correct or complete it;
• You have a right to object to and/or request that we restrict the processing of your personal information for specific purposes;
• If you wish us to delete the personal information that we hold about you, you may request that we do so;
• If you would like to obtain the personal information that we hold about you to reuse it for your own purposes, you may request that we do so; and
• If we undertake any automated decision-making and profiling, you have a right to object to your personal information being used in this manner.
You can exercise any of these rights by completing this form.
Any requests received by Retail Trust will be considered under applicable data protection legislation. If you remain dissatisfied, you have the right to raise a complaint with the Information Commissioner’s Office at ico.org.uk.
How to raise a concern about your data
If you are concerned about how we handle your personal data, you can raise this with us directly. We have a formal process for handling data protection complaints, which ensures concerns are reviewed, investigated, and responded to in a fair and timely way. You can contact us using any of the routes listed at the top of this page. We encourage you to raise concerns with us first so we can address them. However, you also have the right to raise a complaint with the Information Commissioner’s Office (ICO), the UK regulator for data protection.
We will inform you of the outcome of any complaint and any actions taken where appropriate.