EALING SANCTUARY HUB
Privacy Notice
How we use the information we keep about you
Ealing Sanctuary Hub keeps a record of the people we support. This notice explains what we record, why we record it, who we share it with and what you can ask us to do about it.
It also explains the lawful basis we collect your information, and where we collect it, and how long we keep your information and who we share it with.
We have written this as simply as we can. If anything is unclear, please ask the registration team at the Hub or contact us using the details at the end.
Who we are
Ealing Sanctuary Hub is a charity supporting refugees and people seeking asylum in Ealing.
We are registered as a charity (Charitable Incorporated Organisation) with the UK Charity Commission
Registered charity number: 1203945
Registered address: Address being changed as of 15/09/26
We are the data controller for the information we hold about you. That means we are responsible for looking after it.
What information we collect
When you register with us
- Your name and date of birth
- Your address and postcode
- Your phone number and email address, if you have them
- Your country of origin and the languages you speak
- Your immigration status
- The kind of accommodation you are living in
- Whether you have a disability
- Whether you have children or family with you
- If you are under 18, the name of your parent or guardian
We may collect or use the following special category information to provide services and goods, including delivery and third party referrals, or particularly if our donors request this . This information is subject to additional protection due to its sensitive nature:
- Racial or ethnic origin
- Health (and/or disability related) information
- Sexual orientation information
Each time you visit us
- The date you attended and which activities you took part in
- Any Tesco voucher, SIM card or equipment we give you, and the date
- Your signature when you receive a voucher, SIM card or equipment
- A note from a volunteer if there is something we need to follow up
- If you get help from us, we may also record the type of support you have received from us, so that we can help you with your issue and report back to you.
- You may volunteer information
We also collect some information to deliver third party referrals or goods, but we will ask you to agree that we do this. We only used anonymised information in reporting,
We also record which of our volunteers or staff dealt with you, so we know who to ask if there is a question about your record later.
If you are donating to us
We collect or use the following information to receive donations or funding and organise fundraising activities:
- Names and contact details
- Addresses
- Donation history
- Tax payer information (for Gift Aid purposes)
We also collect or use the following special category information to receive donations or funding and organise fundraising activities. This information is subject to additional protection due to its sensitive nature:
- Racial or ethnic origin
- Health information
- Sexual orientation information
Why we record this information
To give you the right support. Knowing your circumstances, the languages you speak and what you have already received means we can help you properly, and avoid asking you the same questions every visit.
To run our services fairly. We use attendance records to manage how many people come on a given day, and to make sure things like vouchers and SIM cards are shared out fairly.
To show funders and regulators what we do. We report totals — how many people we supported, and broad breakdowns by things like age group or nationality. We never share your name or your individual details in these reports.
When we record the information
We record your information:
(a) when you apply to us online
(b) when you visit the hub in person and give us new information or receive services from us
(c) if we need to leave a note on your records or update them with new information that we have received.
(d) Charities or voluntary sector organisations – that may pass on information to us to deliver you services
(e) Councils and other public sector organisations – that may pass on information to us to deliver you services
Our legal basis
We record and use your information because
(i) you have given us your consent. We have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
(ii) Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
- We collect your personal information so that we can provide our services to you fairly and appropriately and to comply with the purposes of our organisation, as approved by the UK Charity Commission. We collect information about the services you have accessed so that we can ensure that you can receive fair and equitable access to our services We also collect your information so that we can improve the services that we provide to you and ensure we are providing you with appropriate services.
You do not have to give us your information. If you choose not to, we will still help you where we can, but we may not be able to offer everything.
Some of what we record is treated as more sensitive under data protection law — information about your health or disability, and information that could indicate your ethnic origin. We record this only for (anonymous) reporting purposes and because it helps us support you properly.
Information about lawful basis and data protection rights in the UK
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
- Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
- Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
- Your right to erasure – You have the right to ask us to delete your personal information. Read more about the right to erasure.
- Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
- Your right to object to processing – You have the right to object to the processing of your personal data. Read more about the right to object to processing.
- Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
- Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.
If you make a request, we must respond to you without undue delay and in any event within one month. If we need more time to provide the information we must still respond to you within one calendar month but we may have up to an additional two months to provide you with the information.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Who sees your information
Our volunteers and staff. Volunteers see only what they need for the desk they are working on. They cannot browse our records or export them.
Our database provider. Our records are held in a system called Softr, which stores data securely on our behalf. Softr does not use your information for its own purposes.
With your consent, we may share your information with third party service providers, such as charities and organisations, if this is to provide you with services and referrals that you have requested.
Nobody else, unless we have to. We do not sell your information, share it for marketing, or pass it to any other organisation without your agreement — unless the law requires us to, for example to protect someone from serious harm.
How long we keep it
We keep your record for as long as you are using our services, and until you request in writing that you are no longer using our services, and for 5 years afterwards. After that we delete it, unless you request that we do otherwise. After this time, we may retain aggregate, anonymised information which could not be linked to your personally, for our reporting processes.
Your rights
You can ask us to:
- Show you what we hold about you
- Correct anything that is wrong
- Delete your record
- Stop using your information in a particular way
- Give you a copy in a form you can take elsewhere
You can also withdraw your consent at any time. That will not affect anything we have already done, and it will not affect your right to come to our sessions.
To do any of these, speak to the registration desk, or contact us at welcome@ealingsanctuaryhub.org.uk. We will respond within one month.
Children
If you are under 18, we record your details and link them to your parent or guardian, so we know who is responsible for you. Your parent or guardian can exercise the rights above on your behalf.
We are required to inform social services if you are a child under 18 years old but have no parent or guardian accompanying you.
If you are not happy
Please tell us first — welcome@ealingsanctuaryhub.org.uk — and we will try to put it right.
You can also complain to the Information Commissioner’s Office, the UK’s data protection regulator:
ico.org.uk/make-a-complaint · 0303 123 1113
Changes to this notice
We will update this notice if how we use your information changes. The current version is always available at www.ealingsanctuaryhub.org.uk
Last updated: 15th September 2026
Interim Data Protection Policy, awaiting trustee board approval 28th September 2026