PRIVACY
Privacy Policy
Last updated: 28 September 2026
1. Who we are
Lavender Common ("we", "us", "our") is a charitable incorporated organisation registered in England and Wales, charity no. 1210536, funding strategic litigation to defend LGBTQ+ rights across Europe. We are the "data controller" for the personal information described in this policy — meaning we decide how and why it's used.
We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Because we work with supporters and organisations across Europe, we also apply the EU General Data Protection Regulation (EU GDPR) where it covers you.
If you have any questions about this policy or how we handle your data, email director@lavendercommon.com.
2. What we collect
We only collect what a given form or interaction actually needs.
| Where | What we collect |
|---|---|
| Support Us (donating) | Your name, email address, country, donation amount, frequency and date, and a Stripe customer reference. Card details are handled directly by Stripe — we never see or store them. |
| Gift Aid (from November 2026) | If you're a UK taxpayer and choose to add Gift Aid: your full name, home address and your Gift Aid declaration. |
| Partnerships enquiry | Organisation name, country, your name, email, organisation type, and your message |
| Join Us enquiry | Your name, email, the role you're interested in, the time you can offer, and your message |
| Fundraise for us | Your name, email, the type of fundraising you're planning, and your message |
| General contact form | Your name, email, topic, and your message |
| Visiting the website | Our web host keeps standard server logs, which include your IP address, browser type and the pages requested. When you open our homepage, your browser also contacts our database provider (Supabase) to load the live supporter count, which shares your IP address with them. |
We don't use analytics, tracking or advertising tools on this website.
3. Sensitive information
Supporting or contacting an LGBTQ+ rights organisation can reveal things about you — such as your sexual orientation, gender identity or political views — that the law treats as "special category" data. You may also choose to tell us things like this in a message.
We treat all of our supporter and enquiry records as sensitive. We process this information as a not-for-profit body with a political and philosophical aim, only in connection with our work and only about people in regular contact with us, and we never disclose it outside Lavender Common without your consent (UK and EU GDPR Article 9(2)(d)). Where that doesn't apply, we'll ask for your explicit consent first.
4. How we use it
We use the information you give us to:
- Process your donation and manage your support, including renewal reminders and receipts
- Claim Gift Aid from HMRC, where you've asked us to (from November 2026)
- Respond to enquiries about partnerships, volunteering, fundraising, or general questions
- Send you updates about our work — see Emails we send you
- Show, in aggregate only, how many supporters we have in each country — never linked to you individually
- Keep our website and systems secure
- Meet our legal and regulatory obligations as a registered charity
We will never sell your data, and we don't share it with anyone for their own marketing. We don't make decisions about you using automated processing or profiling.
5. Our legal basis
- Contract — to process your donation and provide what you've signed up for as a supporter
- Legitimate interests — to reply to enquiries, manage supporter records, send essential supporter emails, and keep our website secure. We've balanced these interests against your privacy, and you can object at any time
- Consent — for newsletters where you've opted in; you can withdraw it at any time
- Legal obligation — to keep financial and Gift Aid records required by HMRC and charity law
For sensitive information, we also rely on the not-for-profit condition or your explicit consent, as explained in section 3.
6. Emails we send you
Supporter emails. When you donate, we'll email you about your support — receipts, renewal reminders, and important changes. These are part of being a supporter.
Newsletters and updates. We'll only send these if you've said yes — for example by ticking "Confirm you'd like to stay in touch with us" when you donate. The box is never ticked for you. Every newsletter includes an unsubscribe link, and you can also email us to stop them at any time. If you unsubscribe, we keep your email address on a "do not contact" list so we don't add you back by mistake.
8. International transfers
Some of our providers may process data outside the UK and the European Economic Area — mainly in the USA. Where they do, the transfer is protected by an approved safeguard: the EU–US Data Privacy Framework and its UK Extension where the provider is certified, or the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. Data sent between the UK and the EU is covered by adequacy decisions in both directions. You can ask us for more detail on the safeguards we use.
9. How long we keep it
| Information | How long |
|---|---|
| Enquiries (contact, Join Us, Partnerships, Fundraise) | Two years after our last contact with you |
| Supporter and mailing list details | Six months after your support ends (for example, after you cancel or your payments stop), unless you ask us to delete them sooner |
| Donation and Gift Aid financial records | Six years after the end of the financial year they relate to, as required by charity accounting law and HMRC |
| "Do not contact" list | For as long as we send emails, so we can respect your choice |
| Server logs | A short period set by our web host for security purposes |
After these periods, we delete or anonymise your information.
10. Your rights
You have the right to:
- Ask what personal data we hold about you, and get a copy of it
- Ask us to correct anything that's inaccurate or out of date
- Ask us to delete your data, where we don't have a legal reason to keep it
- Ask us to restrict how we use your data
- Object to how we use your data where we rely on legitimate interests — and object to newsletters at any time, which we'll always respect
- Withdraw consent for anything you've opted into, at any time
- Receive data you've given us in a portable format
To exercise any of these rights, email director@lavendercommon.com. It's free, and we'll respond within one month.
11. Cookies
This website doesn't use tracking, analytics or advertising cookies. When you close our cookie notice, we save that choice in your browser's local storage so the notice doesn't reappear; nothing else is stored.
If you donate, you'll be taken to a payment page hosted by Stripe, which uses its own essential cookies for security and fraud prevention. See our cookie policy for more detail.
12. Children's data
Our website and services are intended for adults. We don't knowingly collect personal information from children under 16, and if we become aware that we have, we'll delete it.
13. Keeping it secure
We take appropriate technical and organisational steps to protect your data against loss, misuse or unauthorised access. These include encrypted connections to our website and forms, restricting access within the organisation to those who need it, and requiring our providers to meet equivalent standards.
14. Changes to this policy
We'll update this policy when our systems or legal obligations change. The date at the top of this page shows when it was last updated. If we make a significant change, we'll make that clear rather than updating it quietly.
15. Contact us & complaints
If you have any concerns about how we've handled your data, please contact us first at director@lavendercommon.com so we can try to put it right.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk. If you live in the EU or EEA, you can complain to the data protection authority in your country — the European Data Protection Board lists them at edpb.europa.eu.