Privacy policy

Our Commitment 

At Refugee Action, we’re committed to treating everyone with respect. This is why we take protecting your data seriously and are committed to being transparent about how we process your data.

The purpose of this policy is to give you a clear explanation about how we use the information that we collect from you directly, and from third parties.

This policy is written in accordance with the UK GDPR, and other applicable laws. Refugee Action is a registered data controller with the Information Commissioner’s Office (ICO) under number Z2831516.

In this notice, you can find more information on:

  • What information we may collect about you.
  • How we may use that information.
  • Wealth screening and prospect research activities.
  • Our lawful basis for using your data.
  • How long we keep your data.
  • How we keep your data secure.
  • Your rights under the data protection legislation.
  • Our use of cookies.
  • Contacting us about the information we hold on you.

You can find out more about the terms and conditions for using our website, SMS and social media channels here.

Please get in touch with us with any questions regarding this policy and our privacy practices by emailing:

The Data Protection Officer at, or by writing to:

Data Protection Team
Refugee Action
Society Building
Regent Wharf
8 All Saints Street
London, N1 9RL

If you wish to change the information we hold about you or change how we communicate with you, please get in touch with our Supporter Care team by emailing  or sending a letter to:

Supporter Care
Refugee Action
Society Building
Regent Wharf
8 All Saints Street
London, N1 9RL

Phone: 0800 141 2426

What type of information do we collect about you?

Service User Data

Refugee Action collects personal and statistical information from you when you use our services, request information from us and look at our websites or social media profiles. 

The information we collect includes (but is not limited to): 

  • Basic personal details (your name, email address, postal address, telephone or mobile number, immigration status, gender and date of birth). 
  • Contact preferences, for example, whether you’ve said you’d like to hear from us by email or by phone.
  • Your photographs and other images you provide.   
  • When you share your personal stories or experience of using our service with us.  
  • CCTV images, which are in use at our various premises. 
  • Statistical information when you visit our website and consent to our use of cookies.

Under data protection laws, information about your mental and physical health, ethnicity, sex life, sexual orientation and religion is called ‘special category data’. 

This type of information is sensitive and, therefore requires greater protection. 

We will ask for your consent to collect sensitive data about you. We will only need this type of data when there is a clear and valid reason for doing so, such as, when we support you in relation to your asylum case or in helping you to access relevant services. 

We sometimes ask people to complete surveys to learn more about their opinions on our work or issues related to our work. This includes feedback about services and the training that we have provided.

Supporter Data 

As a supporter, fundraiser, and campaigner we collect your personal information when you: 

  • Make a donation to support our work, and we need to process your Gift Aid. 
  • Sign up to support our work by fundraising for us, including via third-party sites such as JustGiving, where you give your consent for your information to be shared with us. 
  • Sign a petition or take part in a similar campaign action to support us. 
  • Sign up to receive our emails.
  • Register to attend an event, training course or workshop with us. 
  • Have shared such information with us over the phone or in writing. In such cases, we may use this information to tailor our communications as outlined in our Protecting Vulnerable People: Fundraising and Supporter Care Policy. 

Wealth Screening and Prospect Research Activities

We do prospect research to find people who may be interested in supporting us and to determine if our existing supporters might be interested in supporting us further.

We use publicly available sources such as the Giving List or Sunday Times Rich List to understand whether someone has the capacity to support with a large gift and a clear connection to Refugee Action and our cause to ensure we are only contacting people with a clear affinity to our work.

This information is used to better understand those who might support our work and tailor communications and requests appropriately. The information we collect may include demographic information associated with your address, as well as estimates of your age, interests and lifestyle.

We might occasionally wealth screen our supporter data using a third-party company, such as ‘Prospecting for Gold’, to help us identify who amongst our current supporters may have the capacity to give us larger donations. The process involves matching an extract from our database against the third-party wealth intelligence database and the million-pound property data set.

Occasionally, we may obtain postal lists of potential customers from external companies for charity appeals. We will only deal with reputable companies that take privacy and data protection as seriously as we do, and we will always let you choose not to receive further communications from us. 


We will always respect your right to object to us processing your information any further.  

You can object to any profiling and screening activities by emailing  or sending a letter to: 

Supporter Care,
Refugee Action,
Society Building, Regent Wharf, 8 All Saints Street, London, N1 9RL 

You can also ring us on 0800 141 2426

How do we use the information we collect?

We use the personal information you provide to us in a number of ways:

  • To support your asylum and refugee resettlement process. 
  • In the administration of any training we provide. 
  • To send you updates about our work, including information about our services and campaigns that we think might be of interest. 
  • To send you information about how you can donate, campaign, volunteer or fundraise for us. 
  • To process donations we receive from you 
  • To process gift aid where you have indicated you would like us to do so. 
  • To process campaign actions, such as petitions or actions asking you to email your MP. 
  • To process any changes to your details as requested by you. 
  • For record keeping and administrative purposes relating to donations, feedback or complaints. 
  • To contact representatives of an organisation or company who has expressed interest in working with us. 
  • To understand how people support us and the patterns that help inform our work. For example, we might look at the information we have about the ways you’ve supported us in the past through donations or signing petitions to help us understand what kind of support people are most interested in providing to us and to help us plan future content and communications. 
  • To tailor advertising to people on the internet based on their interests, preferences and their similarity to people who already support us. We do this on Facebook using the Facebook ads audience function, including custom audiences. 
  • To exclude people who already support us from internet advertising where possible.

Read more about the data protocols governing the sharing of information with Facebook in the last two points above.

Read more about how to manage your privacy settings and what marketing/ ad information Facebook stores for you.

We use the statistical data we collect in a number of ways:

  • To understand what information and content is of interest to you. 
  • To analyse how our communications are doing and to help us change things that aren’t working. 
  • To help us prioritise our communications so we can focus on the channels and methods of communication that are most effective for engaging you and others in our work.

We also use Google Analytics cookies (__utma, __utmb, __utmc, __utmz), which are used to measure how people use our website. We look at reports to ensure that our website provides the best possible service for our users. Google Analytics does not identify you personally – it just collects data about your visit to our website.

Our lawful basis for using your personal data

Data protection laws require us to meet certain conditions before we’re allowed to use your personal information in the way we describe in this privacy policy. We take these responsibilities extremely seriously. To use your personal information, we’ll rely on the following conditions, depending on the activities we’re carrying out:

Legitimate Interests

We process your information to achieve our legitimate interests, but we will only use your information fairly and ensure it doesn’t impact on your rights.

We rely on our legitimate interests as a charitable organisation to achieve our aims and ideals. For example, to:

  • Profile our audience using platforms such as Experian and Mosaic. This helps us create better and more targeted campaigns that are more likely to align with our audience’s interests. 
  • Understand how people choose/use our services.  
  • Send postal communications which we think will be of interest to you. 
  • Conduct research to understand our supporters better and to improve the relevance of our fundraising. 
  • Determine the effectiveness of our services, promotional campaigns and advertising. 
  • Monitor who we are in contact with to protect the charity against fraud, money laundering and other risks. 
  • Improve and personalise our services /communications for the benefit of all those in contact with us and better understand how people interact with our website. 
  • Collect and process information to deliver appropriate services to you. 
  • Thank you for supporting us with a donation. 
  • Contact our supporters to partake in a survey.

Whilst processing your personal information in this way, we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We will not use your personal information if our interests override the impact on you (unless, for instance, we are otherwise required or permitted to by law).

When we use sensitive personal information, we require an additional legal basis to do so under data protection laws, so will either do so on the basis of having your explicit consent or another route available to us by data protection laws.


When we have discussed it with you, we will only add certain information about you to our secured databases (SharePoint, Raiser’s Edge, AdvicePro and Apricot). This is where you have provided specific consent to us using your personal information in a clearly defined way, such as email or telephone marketing. We will also seek your consent when we process information about your health, ethnicity and religion. This is usually when you are accessing our services.

We will always ask for your consent to use your photograph for our purposes and when we share your story on our platforms.

Legal Obligation

This is where we process your data to carry out our legal obligations under employment, social security or social protection law.

Vital Interests

We can process data to protect life or health or a safeguarding concern which requires us to share your information with the emergency services. This will apply if someone needs medical treatment whilst attending one of our events or using our services. 

How long do we keep your personal information?

We only keep your information for as long as necessary to use it for the reasons given in this privacy policy.  

We review our supporter data annually and delete it if we no longer see any legitimate reason for retaining your information. 

We are currently developing a records retention schedule for service users’ data, and we will update this policy as soon as this is agreed.

How do we protect your personal information?

We keep the information you give us (your ‘data’) safe and secure on our computer systems. Our team members use your information carefully to support the work they do for you. Our staff are trained and understand the need to protect your privacy.

Our data management team takes all appropriate measures to keep your data safe both physically and electronically. We keep your data up to date and will only hold your details for as long as is reasonable and necessary. We aim to review the data we hold every year.

If you have expressed an interest in volunteering with us, we will keep your personal data for a year from the date you submitted your application if your application was not progressed.

On our website, all of our donations and campaign pages (petitions, email your MP actions and similar) are managed through a third-party platform called Engaging Networks. Our WordPress website including those pages hosted in Engaging Networks use Transport Layer Security (TLS) encryption. TLS is an encryption protocol that protects data while it is travelling from one server to another. TLS provides the most up to date security for the transmission of data. Our website is regularly updated with the latest security upgrades.

Handling of your donations

All donations made to us online via Engaging Networks pages are processed using PayPal and Stripe. Any credit or debit card donations made to us via post or over the telephone are processed using PayPal Virtual Terminal.

Please note that while we have taken every appropriate measure to secure your data, transmission of information over the Internet is never one hundred per cent secure so while we take all possible precautions, we can’t guarantee the security of any information you submit to us via our website.

We do not keep the card payment details of any donations from our website (via Engaging Networks), SMS or our profiles on the JustGiving, Virgin Giving or CAF fundraising platforms.

We do keep a record of how much you donated, the date it was donated, your name and contact details so that we can send you a receipt and make sure we have your correct donation amount, in case you have an enquiry about your donations at a later date. We also keep a record of the PayPal and Stripe authorisation code for your payment.

If you make a regular gift to us via Direct Debit, we store your bank account number and sort code to process your gift monthly. You will receive a receipt confirming the information we have collected for this when you set up your Direct Debit.

We keep physical details of donations where Gift Aid has been included, in line with HMRC requirements. All credit card information for these donations is redacted, scanned, and saved securely on our database.  

What information does Refugee Action share with third parties?

We will never share your data with anyone for marketing purposes. However, we will share your data:

  • If required to do so by law or in response to a court order or law enforcement agency 
  • In an emergency, for example, where we think someone is at serious risk of being harmed or in immediate danger, we may contact the police, or a local health or relevant safeguarding team to intervene. 
  • With third party partners who supply our donation, registration and campaign pages (engaging networks)
  • With third-party partners who process our offline donation appeal responses (Telebank) 
  • With Experian/mosaic for supporter insight and profiling 
  • With some social media companies to either exclude you from receiving ads related to our work (suppression) or to tailor ads to people who have similar interests to you i.e., for Facebook custom audiences. 
  • With third-party partners who provide acquisition services to help us recruit new supporters, such as care2, who we share your data with so that you are not included in the communications they send about our work even if you’re signed up to receive communications from them (suppression). 
  • With third-party partners, such as, prospecting for gold, who are undertaking research for us in relation to our audiences and supporting the development of our marketing communications. 
  • With government or policymakers where you have added your name to a petition or sent an email to your MP in relation to one of our campaigns.

When we share your data with third-party partners, we use the File Transfer Protocol Secure (FTPS) and WeTransfer to transfer data securely or we may use encryption wherever possible.

Using these data-sharing methods, the data is encrypted, password protected, and the files are zipped.

We stipulate the protection of your data in our contracts with third-party partners.

When we cannot provide a service to you, we will make referrals to other providers only with your consent.

Your rights under the data protection legislation

The UK data protection law gives you rights over the personal information that we hold about you. Under this legislation you have the right to: 

  • Be given clear, transparent and free information about how your data will be used. (right to be informed). 
  • Access your personal data so that you can see how we are using your personal information. The right to access is commonly called a subject access request (SAR)
  • Update or amend the information we hold about you (right to rectification)
  • Obtain and reuse the personal data you have given to us for your own purposes (right to data portability) 
  • Request that we permanently delete or remove your information where there is no “compelling” reason for us to keep it (right to erasure) 
  • Object to the processing of your information for marketing purposes (right to object)

If you wish to exercise any of the above rights, please contact: 

The Data Protection Officer,
Refugee Action,
Society Building, Regent Wharf, 8 All Saints Street, London, N1 9RL

Cookies policy

Like most websites, Refugee Action uses cookies on our website. A cookie is a small file of letters and numbers that is downloaded on to your computer when you visit a website. Many websites use cookies and can do a number of things, e.g. remembering your preferences, recording what you have put in your shopping basket, and counting the number of people looking at a website. Read more about cookies on the ICO website.

We use the following cookies on and related subdomains:

Google Analytics

We use Google Analytics on our WordPress website (including our Engaging Networks pages). It allows us to review information such as which pages were the most visited on our site, how long users stayed on a page or how many pages they visited in one session. The data is anonymous and helps to give us an overall picture of how our website performs. 

Google Analytics also collects information such as:

  • Which countries or cities people who visited our site are in. 
  • The age ranges and gender of people who visit our site. 
  • The type of browser or device you used to access our site. 

Read more about what data Google collects, how they use it and how to change your privacy settings on Google.

If you want to know more about protecting your browser, the ICO website has instructions on changing your cookie settings across different browsers. 

You can also find out more about safeguarding your data on Google.

Civic UK Cookie Control

We use Civic UK Cookie Control on our website to help you better understand and manage your cookie preferences and settings. Read more about how this works.

Other tracking

We use what’s known as tagged, or tracked, links which is code or text added to an internet address (URL) to show us whether someone has come to our website from a link that we sent or provided to a referring website. For example, we add tracking information to the links in our emails to tell us if an email resulted in people taking a campaign action, donating or reading a specific page on our website. This data helps gives us an insight into the effectiveness of our marketing and whether what we send out is of interest to people.

How to update the information we hold on you

If you are a Refugee Action Supporter, you can update your information about how you would like us to contact you.

You can also unsubscribe from our email updates by selecting the unsubscribe link at the bottom of all our emails.

You can also unsubscribe from our text messages by replying STOP to any SMS we send you.

You can also contact our Supporter Care team on 0800 141 2426, or email:  

You can also write to us at:

Supporter Care, Refugee Action, Society Building, Regent Wharf, 8 All Saints Street, London, N1 9RL

You can also register with the Fundraising Preference Service (FPS). This service is run by the Fundraising Regulator and allows you to stop email, telephone, addressed post, and/or text messages from us or any other selected charities. Or call them on 0300 303 3517. Once you have made a request through the FPS, we will ensure that your new preferences take effect within 28 days.

If you want to use this service to stop receiving communication from Refugee Action, you will need our charity number: 283660.

Please note: If you donate, take part in a campaign activity or request information you will receive a once-off transactional email about that activity for your records. 

Making a complaint

If you have any complaints about the way in which we have used your personal information, we will be happy to discuss your concerns first. Please send an email to the Data Protection Officer at

You also have the right to contact the Information Commissioner’s Office (ICO) if you have any concerns about how your information has been handled. You can call them on 0303 123 1113 or contact them via their website – 

Updates and changes to the privacy policy

We keep this policy under regular review, particularly when we make any significant changes to how we process your information. We will notify you so that you can raise any concerns or objections with us.

When making less impactful changes, we’ll update this notice and post a summary of the changes on our website.

This policy was last updated in November 2023.