Privacy Policy
Last updated: 13 October 2026
This policy explains what personal information Derby Mountain Rescue Team collects through www.derbymrt.org.uk, why we collect it, who we share it with and how long we keep it. It also sets out your rights.
Who we are
Derby Mountain Rescue Team ("Derby MRT", "we", "us") is a registered charity (No. 1089237) and a company limited by guarantee registered in England and Wales (No. 4229996). Our registered office is Ashbourne Road, Mackworth, Derby, DE22 4NB.
We are the controller of the personal information described here. For anything about your personal information, email [email protected] or write to us at the address above.
Our website runs on the Badger Commerce platform. Badger Commerce Limited hosts the site and processes data for us on our instructions, as our processor.
What we collect and why
When you buy something or donate
- Your name, email address and phone number. We use them to process your order or donation, send your confirmation and contact you about your order.
- Your delivery and billing addresses, and any delivery instructions you give, so we can deliver your order.
- Payment. Card payments, Apple Pay and Google Pay are handled by Stripe. We never see or store your full card number. We keep the card type and last four digits so you and we can recognise the payment.
- What you ordered or gave, and when.
Lawful basis: contract (to supply what you asked for) and legal obligation (we must keep financial records).
When you enter a postcode at checkout, your browser checks it is valid with postcodes.io, a free public postcode service. Only the postcode is sent.
Donation messages and the donation wall
When you donate, you can choose to show any of the following on our website's recent donations list:
- your name
- the amount
- a message of support
Each is your choice, and nothing is shown unless you choose it. A donation shown without a name appears as "A kind supporter". If you'd like something removed later, email us.
Lawful basis: consent. You can withdraw it at any time.
Gift Aid
If you choose Gift Aid, we record a Gift Aid declaration with:
- your title, first name and surname
- your house name or number and postcode, taken from your billing address
These details are sent to HM Revenue & Customs (HMRC) with our Gift Aid claims. HMRC needs them to pay the tax back to us. Your declaration covers that donation and any you make in the future or have made in the past four years, until you cancel it. You can cancel it at any time by emailing us. If you have an account, your Gift Aid statement is on your account page.
Lawful basis: legal obligation (HMRC requires these records).
Regular giving (Friends and Supporters)
If you set up a regular donation, Stripe holds your card so it can be charged on your chosen schedule, usually monthly. Stripe also keeps a customer record with your name and email.
You can pause, change the amount or cancel at any time from My Account. To update your card, use the secure Stripe page linked from there.
Lawful basis: contract.
Your account
If you create an account, we store:
- your email address and name
- your password, stored securely
Your account shows your orders, donations, Gift Aid statement and regular giving.
Sign-in, registration and password reset are protected by Google reCAPTCHA, which checks that you are a person and not a bot.
Lawful basis: contract; legitimate interests (keeping accounts secure).
Fundraising pages
If you set up a fundraising page for us, we store the page details:
- your name
- the title, your story, target, end date, photos, updates and thank-you message
Your page, including your name, story and photos, is public. We check every page, and every photo, before it goes live. We can edit or remove a page that breaks our Terms and Conditions. Donations to your page appear on it in the same way as on the donation wall above.
Lawful basis: contract (to run the page you asked for).
Contact and talk request forms
When you use our contact or talk request forms, we send your name, email address, phone number and message to the team's mailbox so we can reply. Your name, email and phone number are also saved against your visitor record on the website. The forms are protected by Google reCAPTCHA.
Lawful basis: legitimate interests (answering your enquiry).
Newsletter
Friends and Supporters receive our quarterly e-newsletter, Derby Rescuer. You can stop receiving it at any time by emailing us.
We do not sell or rent your personal information, and the website does not send marketing emails.
Information collected automatically
When you visit the site, our platform records:
- A visitor ID in a cookie, which links your visit to your basket.
- Your IP address and approximate location. The location (town, region, country and approximate postcode area) comes from our network provider, Cloudflare, based on your IP address. We keep the last ten locations.
- The pages you view on our site, with your browser type. We use this for the "recently viewed" and "trending" features and to understand which pages are used.
- Search terms, counted per day without any link to you, for 90 days.
If you don't sign in, place an order or give us your email, all of this is deleted after 30 days of inactivity.
Lawful basis: legitimate interests (running and securing the site, and improving it).
Cookies
We use cookies that the site needs to work, such as the one that remembers your basket and the one that keeps you signed in. We also use Google Analytics and Hotjar cookies to understand how visitors use the site, for example which pages are popular and where people click, so we can improve it. Neither tells us who you are. Some pages include YouTube videos, which may set Google cookies.
You can block or delete cookies in your browser settings. If you block all cookies, your basket and sign-in won't work.
Who we share it with
We share personal information only as needed to run the site and our charity:
| Who | What for |
|---|---|
| Badger Commerce Limited | Hosts and runs our website and its database, on our instructions |
| Hetzner | Servers that run the website (EU) |
| Amazon Web Services | Storage for images and uploaded photos (EU) |
| Cloudflare | Network security and delivery; sees your IP address |
| Stripe | Card payments, regular giving and fraud prevention |
| Mailtrap | Sends our order, receipt and account emails |
| HMRC | Gift Aid claims |
| Our clothing supplier | Makes and posts clothing orders; receives your name, email, delivery address and the items ordered |
| reCAPTCHA on forms, Analytics, and YouTube videos | |
| Hotjar | Visitor behaviour analytics |
| postcodes.io | Checks a postcode is valid (postcode only) |
We will also share information when the law requires it, for example with HMRC or the police.
Some of these providers process data outside the UK. When they do, it is protected by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
How long we keep it
| Information | How long |
|---|---|
| Orders, donations, regular giving and Gift Aid declarations | As long as charity, company and tax law require: normally six years after the end of the financial year they relate to, because HMRC can audit Gift Aid claims |
| Your account | Until you ask us to close it. Order and donation records are then kept as above, with your account details anonymised. |
| Visitors who never sign in, order or give an email | 30 days after their last visit |
| Fundraising pages | While the page is live, and for as long as needed afterwards to account for the money raised |
| Contact and talk enquiries | In the team mailbox for as long as needed to deal with them |
| Search statistics | 90 days, with no link to you |
Your rights
You have the right to:
- access the personal information we hold about you
- correct anything that's wrong
- erase your information, where we don't have to keep it by law
- restrict or object to how we use it
- withdraw consent at any time, for example for the donation wall or Gift Aid
- data portability, for information you gave us under contract or consent
To use any of these rights, email [email protected]. We'll reply within one month.
If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
Security
The whole site is served over an encrypted connection (HTTPS). Payments are handled by Stripe, which is certified to the PCI-DSS standard. Passwords are stored securely. Access to customer records is limited to the team members who need it.
Children
Our shop and donations are intended for adults. If you're under 18, please ask a parent or guardian to help.
Other websites
Our site links to other sites, such as social media, OS Maps and our partners. Their own privacy policies apply when you visit them.
Changes to this policy
When we change this policy, we'll update the date at the top of this page.