Effective date: 14 Jan 26

1) Who we are

This Privacy Policy explains how Alumna Ltd (trading as Charity Excellence) (“we”, “us”, “our”) collects, uses, discloses and protects personal data when you use www.charityexcellence.co.uk and our online services, including Funding Finder, Help Finder, courses and downloads. Alumna Ltd is registered in England & Wales (No. 10425563). Registered office: 14 Blackmore Gate, Buckland, Bucks, HP22 5JT, UK.

Data controller: Alumna Ltd.
Contact for privacy matters: ian@charityexcellence.co.uk
Postal: 14 Blackmore Gate, Buckland, Bucks, HP22 5JT, UK.

2) Scope

This policy covers personal data we process through our website, platform and payment pages. It does not cover third‑party websites we link to.

3) The data we collect

Depending on how you use our site/services, we collect:

• Account & profile data: name, role, organisation, email, telephone, county/postcode area, preferences.
• Platform inputs: information you enter into the CEF system (e.g., questionnaire responses, scores, uploaded text).
• Payment & billing data: name, email, billing address, postcode, purchase details, last four digits of card (where shown back to you), transaction ID, and payment method metadata. Full card numbers and security codes are collected and processed directly by Stripe—we do not see or store these.
• Marketing preferences: newsletter and campaign choices.
• Technical data: IP address, device identifiers, browser type, pages viewed, referral source, and cookie/consent choices.
• Support & correspondence: messages you send us and any information you provide during support.

4) How we collect data

• Directly from you when you register, complete forms, make a payment/donation, contact support or sign up to newsletters.
• Automatically via cookies and similar technologies when you browse our site (see “Cookies & Similar Technologies”).
• From service providers (e.g., payment status from Stripe; email delivery status from our email provider).

5) Why we use your data (purposes)

We process personal data to:

• Provide our website, tools and services; create and manage your account; deliver content you request.
• Process payments, subscriptions and donations; issue receipts and manage refunds/chargebacks.
• Send service messages (e.g., password resets, transactional emails) and—where you opt in—marketing updates.
• Improve, secure and monitor our services (analytics, troubleshooting, preventing fraud/abuse).
• Comply with legal and tax obligations and respond to lawful requests.
• Keep records, run audits and manage our relationship with you.

6) Lawful bases

We rely on one or more of the following:

• Contract (Article 6(1)(b)) – to provide the services you request and process your payments.
• Legitimate interests (Article 6(1)(f)) – to secure our platform, prevent fraud, analyse service usage, and communicate with users about similar services (you can opt out).
• Consent (Article 6(1)(a)) – for non‑essential cookies/analytics and direct marketing where required.
• Legal obligation (Article 6(1)(c)) – tax/accounting, responding to lawful requests.

7) Cookies & similar technologies

We use strictly necessary cookies for site functionality and security, and (with your consent) analytics and performance cookies to improve our services. Non‑essential cookies are not set unless you give consent. You can change or withdraw consent at any time via our cookie controls. For details (types, purposes, duration) see our Cookie Notice.

8) Payments – Stripe

We use Stripe to process card payments. When you pay, payment data is transmitted securely to Stripe via encrypted connections and tokenised; we do not store your full card number or security code. Stripe may collect identifiers (e.g., device/IP) to detect and prevent fraud and to process the transaction. You can read Stripe’s privacy information at https://stripe.com/gb/privacy. For transfers to the US, Stripe relies on recognised transfer mechanisms; see https://stripe.com/gb/legal/data-privacy-framework and https://stripe.com/legal/dta.

Information we share with Stripe: your name, email, billing address/postcode, purchase amount, currency, IP/device data and transaction metadata, to enable secure processing, fraud prevention and compliance.

Method of disclosure to Stripe: via secure APIs and Stripe‑hosted payment fields/pages over TLS; data is tokenised by Stripe and returned to us as a non‑sensitive token/identifier.

9) Who we share information with (and why)

We disclose personal data only to the extent necessary for the purposes above:

• Payment processor: Stripe (payments, fraud prevention).
• Hosting & IT/security providers: to operate and protect our platform.
• Email and communications providers: to send service messages and, with consent, marketing.
• Analytics providers (consent‑based): to understand and improve service performance.
• Professional advisors and auditors: for legal, compliance and accounting.
• Authorities and regulators: where required by law or to protect rights, safety, and security.
  We do not sell your personal data.
• Our AI bunnies are provided pro bono by Exquitech and Biomni and use your data to answer questions, which may include sharing it with GPT.  We strongly advise that you do not enter any sensitive personal or financial information into our bots. 

10) International transfers

Where our providers transfer personal data outside the UK (for example, to the US), we ensure appropriate safeguards are in place—such as participation in the UK Extension to the EU–US Data Privacy Framework, Standard Contractual Clauses with the UK Addendum (IDTA), and supplementary measures where required. You can request details of applicable safeguards.

11) Data retention

We keep personal data only as long as necessary for the purpose collected:

• Account data: for the life of the account and up to 6 years after closure (records/claims).
• Transaction records: 6 years (legal/tax).
• Support enquiries: up to 2 years after resolution.
• Marketing data: until you unsubscribe or withdraw consent.
• Cookie/analytics data: per our Cookie Notice.
  We securely delete or anonymise data once no longer needed.

12) Security

We apply technical and organisational measures to protect personal data, including SSL, Cloud Flare security and our own login security controls, with and regular backup and testing. Except for the AI Bunnies, data is stored in a high specification (Microsoft Azure) system based in the UK. For card payments we use a PCI‑validated payment processor, and we do not store sensitive card details on our systems.

13) Your rights

You have rights under UK data protection law, including to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent at any time (where consent is our basis). You also have the right to complain to the ICO (see below). Some rights are subject to limitations/exemptions.

14) Children

Our services are intended for adults. We do not knowingly collect personal data from children. If you believe a child has provided data, please contact us so we can delete it.

15) Automated decision‑making

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. If this changes, we will inform you and explain your rights.

16) How to contact us or exercise your rights

Email: ian@charityexcellence.co.uk
Post: Alumna Ltd, 14 Blackmore Gate, Buckland, Bucks, HP22 5JT, UK
We aim to respond within one month.

17) Complaints

You can raise concerns with us using the contact details above. You can also complain to the UK Information Commissioner’s Office (ICO) at www.ico.org.uk or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

18) Changes to this policy

We may update this policy to reflect changes in our services or the law. We’ll post updates here and change the “Effective date” above.