1. Who is responsible
Lodestar Networks Ltd is the controller of personal information used for this campaign. It is registered in England and Wales under company number 17431367, with its registered office at 66 Paul Street, London EC2A 4NA.
Privacy enquiries can be sent to hello@lodestarnetworks.co.uk.
2. Information we receive
When you send a bank transfer, our bank may provide the account-holder or payer name, payment reference, amount, date and time, payment status and other transaction identifiers. Depending on the banks involved, it may also provide some originating-account information.
If you used the contribution registration form while the appeal was open, you provided your email address, payment reference, amount and transfer date. The form sent those details to our campaign mailbox. It did not ask for a bank-account number, sort code, card number, password, PIN or security code.
If you contact us separately, we receive your name, email address, message and any campaign payment information you choose to provide. Please send only the amount, date and payment reference unless we give you a secure way to provide something else. Do not email full bank or card details.
The payment information comes from you, your bank, our bank and the UK payment system. Form and correspondence information comes directly from you.
3. Why and how we use it
We use transaction, form and contact information to reconcile contributions, acknowledge them, answer questions, operate the public totals, detect mistakes or fraud, deal with recalls and contact contributors to arrange refunds. Our lawful basis is our legitimate interests in administering a transparent and secure campaign. Those interests are balanced against the limited and expected use of payment information, restricted access and public anonymisation.
We use financial records to meet company, accounting, tax, anti-fraud and other legal duties. Our lawful basis is compliance with a legal obligation.
We do not use campaign payment information for unrelated advertising or sell it.
4. What is made public
Any public funding or refund update will be aggregated. It will not show contributor names, bank details, individual bank references, email addresses or messages. We will not maintain a public supporter list.
Supplier receipts and invoices will be permanently redacted before publication. Redactions will cover personal names and contact details where appropriate, home and delivery addresses, bank and card information, account, order and tracking identifiers, signatures, QR codes, barcodes, serial numbers and hidden metadata that could expose a person, payment, private site or network.
5. Who receives it
Information may be handled by our bank and payment-system participants; accountants, auditors, insurers and professional advisers; our 123 Reg website hosting and mail services; other email, security and record-storage providers; and public authorities, courts or law-enforcement bodies where disclosure is required or lawfully necessary.
Service providers acting on our instructions may use information only to deliver their service to us and must protect it. Banks and payment-system participants may act as separate controllers under their own privacy notices and legal duties. We do not give the public raw bank statements or unredacted receipts.
6. International transfers
Some service providers may process information outside the United Kingdom. Where UK data-protection law treats that destination as not providing an adequate level of protection, we will use a legally recognised safeguard, such as the UK International Data Transfer Agreement or UK Addendum, and any required risk assessment. You can ask us for information about the relevant safeguard.
7. How long we keep it
Campaign transaction and accounting records will normally be kept for six years from the end of the financial year to which they relate, and longer where law, an investigation, a dispute or an outstanding refund requires it.
Routine campaign correspondence that is not needed as an accounting record will normally be deleted two years after the campaign closes. We may keep a smaller record for longer where necessary to show how a complaint, refund or legal claim was resolved.
Aggregate public totals and permanently redacted supplier evidence may remain online as part of Lodestar's transparency record.
8. Your rights
Depending on the circumstances, you can ask for access to your personal information, correction, erasure, restriction, or transfer to you or another provider.
Your right to object: you can object to our use of your information based on legitimate interests. Email hello@lodestarnetworks.co.uk with “Campaign privacy objection” in the subject. We will stop unless we have compelling legitimate grounds to continue or need the information for legal claims.
Some rights are limited where information must be retained for accounting, legal claims, fraud prevention or another legal duty. We may need to verify your identity before acting on a request. There is normally no charge.
9. Security and automated decisions
We restrict access to campaign records, keep originals separate from public reporting and permanently redact documents before publication. No internet or email system is completely secure, so do not send full bank or card details by ordinary email.
While open, the registration page used a temporary, strictly necessary session cookie to protect the form against forged and repeated submissions. The closed page no longer collects registration details or uses that form session.
We do not make decisions about contributors using solely automated processing that has a legal or similarly significant effect.
10. Contact and complaints
Contact Lodestar first at hello@lodestarnetworks.co.uk or write to Lodestar Networks Ltd, 66 Paul Street, London EC2A 4NA.
You can also complain to the Information Commissioner's Office. Its current contact routes are published at ico.org.uk/make-a-complaint. You may also have the right to go to court.