Last updated: 20 August 2026. This policy explains what personal information the Whitewater Valley Conservation Society collects, why we collect it, and what you can do about it. It applies to this website and to the Society’s wider work with supporters, volunteers and members of the public.
Who we are
The Whitewater Valley Conservation Society (“the Society”, “we”, “us”) is a charitable community benefit society, registration number 8596, recognised as a charity by HM Revenue & Customs under reference ZD22162. We work to protect the River Whitewater and its valley from inappropriate development and abstraction.
For the purposes of data protection law, the Society is the data controller for the information described in this policy. That means we decide what information is collected and how it is used, and we are responsible for looking after it.
If you have any question about this policy, or about the information we hold on you, please email us at [email protected]. We will also give you a postal address on request.
The law we work to
We handle personal information in line with UK data protection law: the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended from time to time, including by the Data (Use and Access) Act 2025. Electronic mail and cookies are also covered by the Privacy and Electronic Communications Regulations (PECR). Where this law is replaced or renamed in future, this policy should be read as referring to whatever succeeds it.
What we collect, and why
When you contact us
Our contact form asks for your name, your email address, the subject of your enquiry and your message. We use this only to reply to you and to deal with the matter you have raised. Messages are stored on this website and are also sent to the Society’s email inbox.
Our basis for this is legitimate interests: we cannot answer an enquiry without knowing who sent it and how to reply.
When you support the Society
If you become a supporter or member, we keep a record of your name, your contact details, the date you joined and your subscription or donation history. The committee maintains this list so that we can administer your membership, invite you to the Annual General Meeting and to Society events, and keep proper financial records.
Our basis for this is the contract between you and the Society as a supporter, together with our legitimate interests in running the charity properly. Where you make a Gift Aid declaration, we keep the records HMRC requires as a legal obligation.
When you donate
Donations are handled by Zeffy, not by this website. See Donations and the newsletter through Zeffy below.
When you subscribe to our newsletter
Newsletter sign-ups are also handled by Zeffy. We send the newsletter on the basis of your consent, which you give when you subscribe. Every newsletter carries an unsubscribe link, and you can withdraw your consent at any time without giving a reason.
When you volunteer or take part in surveys
If you volunteer with us, for example on riverfly monitoring or a work party, we keep your name and contact details so that we can organise the activity and reach you about it. Survey results themselves, such as invertebrate counts, are records about the river rather than about you, and we may publish or share them with partner bodies in that form.
When you simply visit this website
Our web server keeps standard technical records, including the IP address making the request, the pages served, the time, and the browser reported. These are used to keep the site running, to diagnose faults and to protect it against attack and abuse. Our basis is legitimate interests in the security and reliability of the site.
Donations and the newsletter through Zeffy
The Society uses Zeffy for two things: the donation form on our Get Involved page, and the newsletter sign-up form in the footer of this website. Both are embedded from Zeffy, which means that when you fill either of them in, your details go to Zeffy, not to this website.
Zeffy is operated by 9355-0861 Québec Inc., trading as Zeffy, based in Montreal, Canada. Card payments are processed by Stripe. The Society never sees or holds your card details. What we do receive from Zeffy is the information you provide with a donation or subscription, such as your name, email address and the amount given, so that we can thank you, keep our accounts, claim Gift Aid where you have authorised it, and send you the newsletter you asked for.
Zeffy is a separate organisation with its own responsibilities for the data it holds. Please read Zeffy’s privacy policy to understand how it handles your information, including its use of Stripe and its arrangements for transferring data internationally.
Zeffy’s forms are embedded from Zeffy’s own systems and may set their own cookies within that form. If you would prefer not to use them, you can donate or subscribe by contacting us directly instead.
Who else sees your information
We do not sell your personal information, and we do not share it for anyone else’s marketing. We share it only where it is necessary to run the Society:
- the companies that host this website, deliver our email and keep our backups, acting on our instructions;
- Zeffy and its payment processor, as described above;
- Google, where you have consented to analytics cookies, as described below;
- HMRC, where we claim Gift Aid on your donation;
- professional advisers, or the authorities, where the law requires it.
Where a supplier handles personal information on our behalf, we require them to act only on our instructions and to keep it secure. If we add or change a supplier in a way that affects your information, we will update this policy.
When we object to a planning application or respond to a consultation, we use the Society’s own name. We do not pass on supporters’ details to councils, developers or campaigners.
Cookies and analytics
This website sets only the cookies it needs in order to work, for example keeping a form submission secure. Those do not require your consent.
We use Google Analytics to see which pages are useful and how people find us. Google Analytics sets cookies and sends data to Google, including outside the UK. It stays switched off until you agree to it. When you first visit the site our cookie banner asks you to choose, and no analytics cookies are set unless you accept them. You can change or withdraw your choice at any time from that banner. The same rule applies to any other non-essential cookie we might add in future: we ask first.
We also use Litlyx, a privacy-focused analytics tool, to count visits. Litlyx sets no cookies, does not track you across other websites and does not build a profile of you. It records only anonymous information such as the page visited, the type of device and the site that referred you. Because no cookies are involved and nobody is identified, it runs without asking for consent.
Our cookie policy lists the individual cookies this website uses, what each one is for and how long it lasts. It is kept up to date as the site changes, so please read it alongside this policy.
You can also block or delete cookies through your browser settings, though parts of the site may then work less well.
Information sent outside the UK
Some of the services we rely on are based abroad. In particular, Zeffy is based in Canada and uses suppliers in the United States, and Google Analytics, where you have consented to it, sends data to Google in the United States. Where personal information leaves the UK, it is protected either by UK adequacy arrangements for the country concerned, or by contractual safeguards such as the International Data Transfer Agreement or Addendum, so that your information keeps a comparable level of protection.
How long we keep information
- Enquiries: normally up to two years after the matter is closed, then deleted.
- Supporter and membership records: for as long as you support the Society, and then for up to six years, which is the period we must keep financial and Gift Aid records.
- Newsletter subscriptions: until you unsubscribe.
- Volunteer contact details: until you tell us you no longer wish to take part.
- Website technical records: a short period set by our hosting provider, typically a few weeks.
Where we no longer need information, we delete it or remove anything that identifies you.
Your rights
Under UK data protection law you have the right to:
- ask what personal information we hold about you, and receive a copy;
- have inaccurate information corrected;
- ask us to delete information we no longer need;
- ask us to restrict how we use it, or object to our using it;
- receive information you gave us in a portable form, where that applies;
- withdraw your consent at any time, where consent is what we rely on, such as for the newsletter.
To exercise any of these, email [email protected]. There is no charge, and we will respond within one month. We may ask you to confirm your identity first, so that we do not disclose your information to somebody else.
We do not use your information to make automated decisions about you, and we do not use it for profiling.
Complaints
If you are unhappy with how we have handled your information, please tell us first at [email protected], so that we have the chance to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk or on 0303 123 1113.
Children
This website is intended for adults. We do not knowingly collect information from children. If you believe a child has given us their details, please contact us and we will remove them.
Changes to this policy
We review this policy from time to time and whenever we change how we handle personal information, for example if we change the services we use. The date at the top shows when it was last revised. Significant changes will be flagged on this page.