Novacroft Privacy Notice

Novacroft Privacy Notice

Version	v5
Effective date:	July 2026

Contents

1	Important information and who we are
2	Controller
3	How to contact us / Data Protection Officer
4	The types of personal data we collect about you
5	Further information about Special Category Data
6	How is your personal data collected?
7	How we use your personal data
8	Purposes for which we will use your personal data
9	Children’s data
10	Direct marketing, third-party marketing and opting-out
11	Cookies
12	Data accuracy
13	Automated Decision Making
14	Disclosures of your personal data
15	International data transfers
16	Data security
17	Third-party links
18	Data retention
19	Your legal rights
20	Complaints
21	Changes to this Notice

This privacy notice (“Notice”) sets out how Novacroft (Charles Novacroft Direct Limited) uses and protects your personal data.

This Notice gives you information about how Novacroft collects and uses your personal data through your use of our Website. 

Charles Novacroft Direct Limited “Novacroft”, “we”, “us” or “our”) is the party responsible for the following websites to which this Notice applies:

Novacroft.com

charityforum.novacroft.com (collectively, the “Website”).

Accordingly, Charles Novacroft Direct Limited is the controller and the party responsible for your personal data when using the Website. This means Charles Novacroft Direct Limited determines what data is collected, how this data is going to be used and how it will be protected, in accordance with applicable data protection laws, including (but not limited to) the UK GDPR and/or applicable ePrivacy laws, as amended by the Data (Use and Access) Act 2025.

We have appointed a data protection officer (DPO), who is responsible for overseeing questions in relation to this Notice. If you have any questions about this Notice and/or in relation to our privacy practices, you may contact our DPO as follows:

Postal address: Novacroft, Seebeck House, 1 Seebeck Place, Knowlhill, Milton Keynes, MK5 8FR

Email: governance@novacroft.com

Personal data, sometimes also referred to as “personal information”, means any information about an individual from which that person can be identified, such as their name, address, bank account details, Internet protocol (IP) address, username or another identifier.

The personal information we collect may include:

Category	Data types
Business Contact Data:	Includes business contact details, including business email address, postal address and telephone number, relevant occupation, job role, team and/or department.
Candidate Data:	Includes information you have provided to us in your curriculum vitae, covering letter and/or application form, including name, title, address, telephone number(s), personal email address, date of birth, job title, job role, location, employment history, educational background and qualifications, areas of specialisms, and registrations with professional bodies.
Clickstream Data:	The virtual breadcrumb trail that a user leaves behind while browsing. We may record paths you have taken through our Website (e.g. sections or area clicked and the order in which it is done) and use this information to provide customised content.
Communications Data:	Includes information such as records of your contact with us, including enquiries about our products and services submitted via our Website, together with any other information you voluntarily provide when contacting us.
Contact Data:	Includes email address, postal address and/or telephone number.
Identity Data:	Includes name (including first name, last name, maiden name), date of birth, username or similar identifier, marital status, title, occupation and gender.
Images:	Including profile photographs on social media or other publicly available web pages (such as LinkedIn), and photographs included on identification documentation such as passports and driving licences.
Location Data:	Including country, county, region data as part of our website analytics.
Log In Data:	Including your username and information relating to the time and frequency of logins to our Website, products and services.
Marketing Data:	Includes your preferences in receiving marketing from us, including in relation to our events, and your communication preferences.
Professional Information:	Includes information about areas of professional interest and specialism.
Publicly Available Data:	Includes information freely available on the internet and social media platforms such as LinkedIn.
References:	Includes reference information (including, but not limited to, referee name and contact details) from previous and current employers and other relevant references.
Special Category Data:	May include information relating to gender, ethnicity, health and disability status.
Technical Data:	Includes IP address, network activity across our platforms including our Website, Login Data, browser type and version, time zone setting and location, browser plugin types and versions, searches, site visit information, operating system and platform, and other technology on the devices you use to access our Website.
Transactional Data:	Information about the products and services purchased from us, or from the companies we support as a data processor.
Usage Data:	Includes statistical information about how you use our Website and/or our online products and services, your searches on the Website, and your online activity based on your engagement with our Website and interaction with us. May include information such as views of embedded video content and data relating to advertising campaigns.

We may also collect, use and share aggregated data such as statistical or demographic data, which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals’ Usage Data to calculate the percentage of users accessing a specific feature of the Website so that we can analyse general trends in how users are interacting with our Website to help improve it and our service offering.

5. Further information about Special Category Data

Special Category Data, sometimes also referred to as “sensitive personal data”, is personal data that needs more protection because it is sensitive. 

This data may include:

• information about your race, ethnicity or nationality, religious beliefs, and/or sexual

orientation; and/or 

• information about your health, including medical conditions, disabilities, and health or sickness records.

We will only process personal data of this nature where:

• it is necessary to fulfil our legal obligations (for example, to enable us to comply with our responsibilities under applicable laws); or
• you have provided your explicit consent.

We have implemented appropriate policies and safeguards, as required by law, to ensure the secure and lawful processing of sensitive or special category data. For more information on these safeguards, or to request further details about how we handle this type of data, please contact us using the details provided in the “Contact us” section of this Notice.

We use different methods to collect data from and about you, including through:

Your direct interactions with us. 

You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you: 

apply for our products or services;

join our forum;

subscribe to our service or publications; 

request marketing to be sent to you;

enter a promotion or survey; 

give us feedback or contact us.

Indirectly through the operation of automated technologies or indirect interactions. 

As you interact with our Website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, tracking codes and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. 

Please see our novacroft.com cookie notice / charityforum.novacroft.com cookie notice for further details.

Third parties or publicly available sources. 

We will receive personal data about you from various third parties as set out below: 

Technical Data is collected from analytics providers such as Google based inside the UK. 

Identity Data and Contact Data collected from data brokers or aggregators based inside the UK.

Identity Data and Communications Data collected from publicly available social media platforms (such as Meta) based inside and outside the UK.

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases when processing your personal data:

Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.

Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to our newsletter.

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so in each case. We have also identified what our legitimate interests are where appropriate.

Purpose	Types of Information Collected	Lawful Basis	Explanation of Legitimate Interest
To register new customers, including setting up customer accounts for supply of our services and to determine your requirements to tailor service provision as required.	Business Contact Data; Contact Data; Communications Data; Identity Data; Payment Data	Performance of a contract	N/A
To provide our services, including management of user accounts and fulfilment of transactions as part of performance of a contract with you at your request.	Business Contact Data;  Contact Data; Identity Data;  Transactional Data Technical Data	Performance of a contract	N/A
To prospect potential new supplier relationships, including to analyse and discuss the suitability of the offering before entering into a transactional relationship.	Business Contact Data	Performance of a contract	N/A
To manage, provide and improve our Website,  including monitoring, troubleshooting, carrying out data analysis and network security, and system testing.	Clickstream Data Location Data; Log In Data; Technical Data;  Usage Data	Legitimate interest (Website effectiveness and integrity)	Necessary to maintain the useability, security and integrity of our Website and networks as well as to inform areas of improvement to that.
To manage and monitor our business and services, including (but not limited to) the provision of administration and IT services, network security, fraud prevention, and/or in the context of a business reorganisation or group restructuring exercise.	Business Contact Data;  Clickstream Data; Contact Data;  Identity Data; Technical Data	Legitimate interest  (service improvement)	Managing, protecting and administering our business to enable us to maintain, monitor and improve the services we offer to our customers and users.  Maintaining the integrity of our service provision.
To assess the quality of our services, and their delivery.	Business Contact Data; Clickstream Data; Contact Data; Identity Data; Marketing Data; Transactional Data;  Usage Data	Legitimate interest (service delivery)	Ensuring the provision of high-quality services. Necessary to inform the making of changes and improvements to our services and service delivery processes as appropriate. Moderating the appropriate use of our community forum.
To provide service updates and support:  Contacting our customers regarding services, updates (including updates to purchased products, services and software) and client support.	Business Contact Data;  Contact Data: Communication Data; Location Data; Transactional Data	Legitimate interest (communication and support)	Processing is necessary to maintain communication and provide assistance to users and clients to ensure efficient and responsive service, continuity of service, and fulfilment of customer expectations.
Recruitment and job applications, including registering job applicants and processing applications, scheduling interviews, and assessing candidate suitability for roles.	Candidate data Communication data  Contact data  Identity data  Images Location data  Publicly available information  References	Legitimate interest (recruitment)	Processing is necessary to assess and manage job applications and recruit suitable candidates for organisational needs.
Recruitment and job applications, including the  collection and processing of sensitive data related to background checks.	Special Category Data (inclusive, as required by legal requirement, of criminal convictions data)	Compliance with a legal obligation	Processing is necessary to enable compliance with applicable laws for certain roles where a DBS is required.
Recruitment and job applications, including the  collection and processing sensitive data for voluntary diversity monitoring.	Special Category Data (inclusive of data relating to sexual orientation, gender, race and ethnicity)	Consent Explicit consent is obtained for voluntary participation in diversity monitoring initiatives.	N/A
Service enquiries: Receiving and managing service enquiries submitted via the Website.	Business Contact Details Communications Data Contact Details Professional Information	Consent	N/A
Cookies:  Collection and analysis of information about Website usage to improve user experience and functionality.  (Non-essential cookies)	Technical Data;  Usage Data	Consent. Obtained where required by law for non-essential cookies via appropriate cookie opt-in mechanism.	N/A
Cookies:  Collection and analysis of information about Website usage to improve user experience and functionality.  (Essential cookies)	Technical Data;  Usage Data	Legitimate interest (website analytics)	Processing is necessary to analyse website performance, improve user experience and maintain functionality.
Data analytics, including to improve our Website, client relationships and experiences through research, statistical analysis and behavioural analysis.	Clickstream Data Communications Data;  Location Data Technical Data Usage Data	Legitimate interest	Ensuring the provision of a high-quality online offering and services. Necessary to inform the making of changes and improvements to our services and service delivery processes as appropriate and to ensure the quality of the customer experience.
Rights and claims	Business Contact Data; Clickstream Data Contact Data; Communications Data; Identity Data; Location Data; Transaction Data;  Technical Data;  Usage Data	Legitimate interest (enforcement of legal rights)	Processing is necessary to allow us to enforce or apply our Website terms of use, our terms and conditions of business, or other contract, and to enable us to exercise our rights, to defend ourselves from claims, and to keep to laws and regulations that apply to us and the third parties we work with.
Data transfers:  Transfers of personal data across jurisdictions to support our operations and services, for example use of our survey provider.	Business Contact Data; Location Data;  Technical Data.	Legitimate interest (global operations)	Processing is necessary to facilitate our operations and to enable us to comply with applicable international transfer mechanisms, including Standard Contractual Clauses or other approved safeguards.
Marketing:  Provision of promotional information about services and updates (general marketing).	Business Contact Data;  Contact Data; Identity Data; Marketing Data Professional Information	Consent	N/A
Marketing:  Promotion of services and news updates to existing customers or users.	Business Contact Data;  Contact Data;  Identity Data; Marketing Data Photographs	Legitimate interest (marketing)	Necessary to promote services to existing customers or users who have a reasonable expectation of receiving such communications.
Data subject rights: Processing and verifying identity of the requester.	Business Contact Data; Candidate Data; Contact Data; Identity Data;	Legal obligation	N/A
Data subject rights: Processing and responding to the exercise of a Data Subjects Rights Request.	All data types are potentially in scope.	Legal obligation	N/A
Record keeping:  Keeping appropriate internal records about our business and services.	Business Contact Data Contact Data  Transactional Data Usage Data	Legal obligation	N/A
Legal requirements: Processing as necessary for compliance with legal obligations, such as, but not limited to, security requirements and/or applicable law, for example in response to a request from a court or regulatory body, where such request is made in accordance with the law, and/or to detect fraudulent or criminal activity. In such instances, we may share information with law enforcement organisations such as the police.	All data types are potentially in scope.	Legal obligation Legitimate interest	Necessary for the purposes of detecting unusual activity including (but not limited to) fraud.

Our Website is not directed at individuals under the age of 16 years (Minors), and we do not knowingly collect or process personal data from Minors. 

If we become aware that we have collected personal information from a Minor without appropriate parental or guardian consent, we will take steps to delete the information as soon as possible. If you believe we may have inadvertently collected data from a Minor, please contact us using the details set out in the “How to contact us” section of this Notice.

Where you have agreed, we may contact you for marketing purposes concerning our services and/or to send you our newsletter. This may include information concerning promotions that could benefit you. We will only contact you using the methods that you agree to when you provide your information to us. We will only contact you by post, email, phone or SMS about our products and services if you have asked us to do so. 

You can ask us to stop sending you marketing communications at any time. If you have changed your mind and would prefer us not to contact you, then you can opt out at any time by contacting us at getmore@novacroft.com or by accessing the unsubscribe link on the email sent to you and updating your preferences. We will process any such request promptly in accordance with applicable data protection laws. Please note that opting out of marketing communications does not affect transactional or service-related communications necessary for the performance of a contract or other legitimate purposes.

We will not provide your information to third parties other than as set out in this Notice. 

Each time you interact with our Website, we may, depending on the consent provided, automatically collect personal information, including technical data about your device, your browsing actions and patterns, content and usage data. We collect this data using cookies, and other identifiers to remember your preferences and to understand how our Website is used. You can access additional information about our use of cookies and other tracking technologies by accessing our novacroft.com cookie notice or charityforum.novacroft.com cookie notice as appropriate.

We are committed to maintaining the accuracy and relevance of the personal data we hold and process. Accordingly, it is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example if you have a new address or change your contact email address.

Under applicable privacy laws, you have the right to request that we correct or update inaccurate or incomplete personal data we hold about you. Accordingly, if you need to request that we update or correct the personal information we hold about you, please contact us at governance@novacroft.com

We do not use automated decision-making or profiling in our service provision or recruitment procedures. 

We may share your personal data with the parties set out below where reasonably necessary to enable us to carry out and deliver our products and services to you, and for the purposes set out in this Notice:

• Other companies within the Novacroft Group: for recruitment and employment purposes.
• Service providers: including providers of services in relation to order processing and management and those providing ancillary services to support our business operations, including those offering IT, system administration, cloud, software services and customer call centre services.
• Marketing services partners: including parties engaged in managing our marketing activities and forwarding marketing materials to you.
• Analytics providers, such as Google Analytics, to assist us with insight analytics.
• Suppliers and administrative support: third parties, employees, agents, subcontractors and professionals who provide products, services and administrative or other business support to us.
• Professional advisers, including lawyers, auditors, accountants and insurers who provide services to us in the normal course of business.
• Other parties (with your permission): other third parties explicitly authorised by you.

This list is non-exhaustive, and there may be other situations where we need to share your personal data with further third parties to effectively provide our products and services to you. 

We only allow those parties/organisations to handle your personal data if we are satisfied they take appropriate measures to protect it. We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and, where applicable, to you.

We or the third parties mentioned above may occasionally also share personal data with:

• our and/or their external auditors, e.g. in relation to the audit of our or their accounts, in which case the recipient of the information will be bound by confidentiality obligations;
• our and/or their professional advisors, in which case the recipient of the information will be bound by confidentiality obligations, for example (but not limited to circumstances) where reasonably necessary for the establishment, exercise or defence of a legal claim;
• law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal and regulatory obligations, for example where we are required to disclose information under a subpoena, court order or other mandatory reporting requirements; and
• other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, an acquisition, an asset sale, an initial public offering or in the event of our insolvency. In such circumstances, information will usually be anonymised, but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations.

We will not share your personal data with any other third party without your consent.

The specific kind of information we share will depend on your activities with us and only to the extent as required or permitted by law, and/or with your consent.

Please note that this Notice does not apply to sharing of personal information by third parties that may collect personal information from you and may share it with us. In these situations, we strongly advise you to review the relevant third party’s privacy notice before submitting your personal information to them.

The majority of our data is held in the UK and EU. On occasion, we may transfer and process your personal data outside the UK, including to jurisdictions that may not provide the same level of data protection. 

To safeguard your personal information, we ensure that all international transfers comply with applicable data protection laws and ensure that the standard of protection afforded to personal data in the destination country is not materially lower than that applicable within the UK. We undertake thorough due diligence and risk assessments before any data transfer takes place to ensure that your information has an appropriate level of protection. Where required, we implement legal safeguards, such as the specific standard contractual terms approved for use in the UK (such as the International Data Transfer Agreement or, as applicable, the International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers), or other approved mechanisms to ensure your data is handled securely and lawfully. 

For further details about the protection given to your information when it is transferred overseas, contact us using the details set out in the “How to contact us” section of this Notice.

The security of your personal data is important to us. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal data to those of our employees, agents, contractors and other third parties that have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. 

Please be aware that the transmission of information via the Internet is not completely secure. While we strive to use commercially acceptable means to protect your personal data, we do not have any control over what happens between your device and the boundary of our information infrastructure and therefore cannot guarantee its absolute security. You should be aware of the many information security risks that exist (including, but not limited to, when you contact us by email) and take appropriate steps to safeguard your own information. 

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Our Website may include links to third-party websites, plugins and applications. Clicking those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Website, we encourage you to read the privacy policy of every website you visit.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.  

The factors we will take into account when determining the retention period to be applied to personal data may include:

• The amount, nature and sensitivity of the personal data.
• The risk of harm from unauthorised use or disclosure.
• The purposes for which we process the personal data and whether these purposes can be achieved through other means.
• Any applicable legal, regulatory or contractual requirements.
• Any applicable requirements and guidance under the Data (Use and Access) Act 2025, including rules on minimising retention of special category data and retaining only what is necessary for recognised purposes.

In some circumstances, you can ask us to delete your data: see the “Your legal rights” section of this Notice for further information.

In some circumstances, such as our customer surveys, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

You have a number of rights under data protection laws in relation to your personal data. 

You have the right to:

Request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons, which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information that override your right to object.

You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes (see the “Direct marketing, third-party marketing and opting-out” section of this Notice for details of how to object to receiving direct marketing communications). 

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information that you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:

• If you want us to establish the data’s accuracy.
• Where our use of the data is unlawful but you do not want us to erase it.
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
• You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

If you wish to exercise any of the rights set out above, please contact us using governance@novacroft.com

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your valid right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. 

We try to respond to all legitimate requests within one month. We will carry out reasonable and proportionate searches to respond to access requests. We may pause the response time while we wait for additional information.

Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated. 

If you have concerns about how your personal data has been handled or believe your privacy rights have been infringed, please contact us first at governance@novacroft.com. We are committed to addressing and resolving privacy-related concerns promptly and fairly.

Under the Data (Use and Access) Act 2025, we are required to acknowledge complaints within 30 days and respond without undue delay. We will also keep you informed of progress and any actions taken to address your concern.

If you remain dissatisfied, you have the right to make a complaint to the Information Commission (IC), the UK regulator for data protection issues. The IC can be contacted using the following details:

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

Telephone: 0303 123 1113 

Website: https://ico.org.uk/make-a-complaint/data-protection-complaints/ 

We keep this Notice under regular review. 

We may modify or amend this Notice from time to time at our discretion to reflect changes in our practices, legal requirements, or for other operational reasons.

When we make material changes to this Notice, we will post the updated Notice on our Website. The effective date will always be shown at the top of this Notice. If required by applicable law, we will also notify you directly or request your consent before the changes take effect. The modified or amended Notice will be effective as to the personal information governed by it as of the revision date. 

We encourage periodic review of this Notice to view any updates so that you may stay informed about how we protect your personal information.

Version no.	Description of change	Approved by	Date of version
5	Updates to current sections and addition of new information.	Karen Hodkinson, Lisa Mahoney	July 2026