← Back to homepage

Privacy policy

Your data, plainly explained.

The Worman Foundation Ltd takes your privacy seriously. This notice explains what information we collect when you use this website, how we use it, and the rights you have over it.

Last updated: 19 May 2026

1. Who we are

The Worman Foundation Ltd (“we”, “us”, “the Foundation”) is a UK charitable company limited by guarantee, registered in England and Wales under company number 16326267. Our registered office is 4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London, W1T 6EB. The Foundation is currently in the pre-registration phase and is not yet registered with the Charity Commission for England and Wales.

For any privacy matter, please email hello@thewf.uk.

2. What information we collect

We collect information in the following ways:

  • When you donate. We collect the name and email address you provide on the donate form. Card details are entered directly with Stripe and we never see, store, or process them. Stripe shares the resulting payment status, payment intent identifier, and subscription identifier (for recurring donations) with us.
  • When you contact us. If you email us, we'll keep your message and our reply.
  • Automatically, when you visit the site. Our hosting provider (Google Cloud Run, region europe-west2) and our edge network (Cloudflare) record request logs containing your IP address, user agent, the path you requested, and a timestamp. These logs are used to operate the service and to detect abuse.

We do not use cookies for advertising or analytics. We do not run third-party trackers. See our cookies notice for more.

3. How we use your information

  • To process your donation and the associated record of it (legal basis: performance of a contract).
  • To send you a receipt for the donation, via Stripe (legal basis: performance of a contract; also our legitimate interest in good record-keeping).
  • To list your name on the public donor roll, if and only if you tick the optional “Show my name on the donor roll” box on the donate form (legal basis: your consent, which you may withdraw at any time by emailing hello@thewf.uk).
  • To detect and prevent fraud, abuse, and unauthorised access to the site (legal basis: our legitimate interest in protecting the Foundation and its supporters).
  • To meet our legal and financial-reporting obligations (legal basis: legal obligation, e.g. HMRC record-keeping).

We do not use your information for marketing, do not build profiles of donors for advertising, and do not sell, rent, or trade donor information.

4. Who we share information with

We use a small number of carefully chosen sub-processors to run the site:

  • Stripe Payments Europe Ltd / Stripe Inc. processes donations. Payment data is governed by Stripe's privacy policy. Stripe may transfer some data to the United States under the UK Extension to the EU–US Data Privacy Framework and standard contractual clauses.
  • Google Cloud (Google LLC). Hosts our application on Cloud Run and stores donation records and content in Firestore, both in the europe-west2 (London) region. Operational logs are retained for thirty days by default.
  • Cloudflare, Inc. provides edge security, DNS, and TLS termination in front of our site. Cloudflare may set strictly-necessary cookies on your browser for bot protection.
  • Google Cloud AI (Vertex AI). Used solely to rewrite news articles published by our beneficiary partner charities for the “What's happening” section. No donor information is ever sent to Vertex AI.

We may disclose information where required by law — for example, to comply with a court order, request from a regulator, or to HMRC for tax purposes.

5. How long we keep information

  • Donation records: seven years from the date of the donation, to meet UK financial record-keeping requirements.
  • Donor-roll consent: until you ask us to remove your name, at which point we will stop displaying it within a working week.
  • Email correspondence: typically up to three years, then deleted unless we are required to retain it.
  • Server access logs: thirty days.

6. Your rights

Under the UK General Data Protection Regulation, you have the right to:

  • Be informed about how we process your data (this notice).
  • Request a copy of the personal data we hold about you.
  • Have inaccurate data corrected.
  • Ask us to erase your data, subject to obligations that legally require us to keep donation records.
  • Restrict or object to certain processing.
  • Ask for a portable copy of the data you have provided to us.
  • Withdraw your consent to the donor-roll listing at any time, without affecting your donation itself.

To exercise any of these rights, email hello@thewf.uk. We'll respond within one calendar month.

7. Children

This site is not directed at children under sixteen. If you believe a child has provided us with personal information, please email us and we'll remove it.

8. International transfers

Most of your data stays within the UK / European Economic Area. Stripe and certain Cloudflare and Google services may transfer data to the United States or other countries; these transfers are governed by the UK Extension to the EU–US Data Privacy Framework, standard contractual clauses, or other adequate safeguards under UK GDPR.

9. Complaints

We'd rather hear from you first, but if you're not satisfied with how we've handled your data you can complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
ico.org.uk

10. Changes to this notice

We may update this notice from time to time. The “Last updated” date at the top of the page tells you when it last changed. Material changes will be highlighted on the homepage when they take effect.