Privacy Policy and Terms and Conditions of Use

Version PRIV 1.2 dated 15 July 2026

1.2 — added donation and Gift Aid processing, named Stripe, Microsoft and Railway as our data processors, added the legal-obligation lawful basis, set out specific retention periods, added a complaints procedure and route to the ICO, and clarified our safeguards for transfers outside the UK.

Introduction

Welcome to SIDEfxHUB. We are committed to protecting the privacy and security of our users. This Privacy Policy outlines how we collect, use, protect, and share personal information gathered about you, in accordance with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018.

Your data is controlled by SIDEfxHUB, a Charitable Incorporated Organisation (CIO) registered with The Charity Commission (Number 1203385). The Data Protection Officer at this organisation is Gary Shields.

Consent

By using our services, you agree to the collection and use of information in relation to this policy. You actively agree to our Terms and Conditions through clear affirmative actions, such as ticking boxes to receive our newsletters, agreeing to participate in our research registry, or making a Gift Aid declaration when you donate.

Data Collection

We collect various types of information across our Research Registry, Newsletter and Donations to provide and improve our services to you. Such information includes:

• Name and e-mail address.
• Research interests for study participation.
• Demographic information such as birth year, gender, and country of residence.
• Donations: your first and last name, e-mail address (so we can send your receipt), the amount, whether it is a one-time or monthly gift, and transaction details such as the donation reference, receipt number, payment status and the payment identifiers created by Stripe. Your card details go straight to Stripe and never reach our servers. You can choose to remain anonymous.
• Gift Aid: if you are a UK taxpayer and choose to add Gift Aid, we also collect your title, home address and postcode. We only ask for these when you make a Gift Aid declaration, because HMRC requires them to identify you as a UK taxpayer and to let us reclaim the tax on your gift.

Data Usage

Newsletter: The purpose of collecting this data (your contact information) is to send you emails with information, updates about research, fundraising, awareness initiatives and our upcoming Patient Data Platform.

Research Registry: This information aids in researching and understanding PSSD and PFS. It helps build a registry of individuals interested in participating in future research studies related to PFS and PSSD. When suitable research opportunities arise, and if your profile matches the study criteria, we will contact you to obtain your additional consent before sharing your information with the relevant researcher or institution.

Donations: We use your donation information to take your donation, send your receipt, manage monthly gifts, and keep proper financial records.

Gift Aid: We keep a record of your declaration and of the donations we claim Gift Aid on, so that we can make and support our claim to HMRC.

We will use your contact information to keep you informed about updates on the Patient Data Platform, currently in development, which will also support future research projects.

Who We Share Your Data With

We never sell, rent or trade your personal data. We do share it with a small number of trusted companies who help us run our services (“processors”). They may only use your data on our written instructions, under a contract that requires them to keep it secure and confidential, and they may not use it for their own purposes. These companies are:

• Stripe — processes card payments when you donate. Your card details go straight to Stripe and never reach our servers. See Stripe’s Privacy Policy.
• Microsoft (Microsoft 365) — the email service we use to send your donation receipts and other messages. See Microsoft’s Privacy Statement.
• Railway — hosts our website and database (in the European Union). See Railway’s Privacy Policy.

We may also disclose personal data where we are legally required to do so — for example, to HMRC in connection with Gift Aid, or to another UK authority where the law requires it.

Our Lawful Basis for Using Your Data

We can only process your personal data if there are legal grounds to do so. The law calls this a “lawful basis”, and we must have a valid one for each thing we do with your data. Ours are:

• Newsletter and other marketing — your consent; or, for supporters whose details we collect when they donate or offer support, our legitimate interest in keeping you informed, with a clear opt-out in every message.
• Managing your place in our Research Registry — your consent.
• Taking and administering your donation and sending your receipt — our legitimate interest in running the charity and giving you a record of your gift.
• Handling Gift Aid declarations and keeping records of the donations we claim on — legal obligation (HMRC and the Income Tax Act 2007).
• Keeping our financial and accounting records — legal obligation (charity and tax law).

You can withdraw consent at any time where we rely on it, without needing a reason. Where we rely on legitimate interests, you can object — just contact us.

Risks Associated with Processing Your Data

The main risks to you could be:

• Your privacy is compromised.
• Your information is used for an unauthorised purpose.

Please see Data User Impact Statement for more details.

How Long We Keep Your Data

We keep personal data only for as long as we need it, and no longer:

• Gift Aid declarations, records of claimed donations, and financial records: 6 years. By law we must keep these for six years from the end of the accounting period they relate to. Where you have made an “enduring” Gift Aid declaration (covering future gifts), we keep it while it is active and for six years after the last donation we claim under it.
• Donation records that are not part of a Gift Aid claim: kept for our financial records and then securely deleted.
• Newsletter and Research Registry data: kept until you unsubscribe or ask us to remove you, after which it is deleted or anonymised.

Sending Data Outside the UK

Our database is hosted in the European Union. Some of our processors are based outside the UK — for example, Stripe and Microsoft process some data in the United States. Where your data is transferred outside the UK, we make sure it is protected to the same standard as it would be here. We rely on the safeguards approved under UK law, including the UK International Data Transfer Agreement (or the EU Standard Contractual Clauses with the UK Addendum) built into our contracts with these companies, and, for transfers to the United States, the UK Extension to the EU–US Data Privacy Framework where it applies.

Your Rights

You have the right to access, correct, delete, or transfer your personal data that we hold. You also have the right to withdraw consent at any time where we rely on consent to process your personal data. To exercise any of these rights, please contact us at contact@sidefxhub.com.

How to Complain

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. Contact our Data Protection Officer, Gary Shields, at contact@sidefxhub.com. We will acknowledge your complaint within 30 days, look into it without undue delay, and let you know the outcome.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at any time:

• Online: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would, however, appreciate the chance to deal with your concerns before you approach the ICO.

Security

We are committed to ensuring that your information is secure. We have put in place suitable physical, electronic, and managerial procedures to safeguard and secure the information we collect online.

Children’s Privacy

Our services do not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

Contact Us

If you have any questions about this Privacy Policy, please contact us:
Email: contact@sidefxhub.com