Privacy and cookie policy

CAFFE (Computers Are Free For Everyone) is a registered charity in England and Wales, charity number 1147000, company number 7978453. Our registered office is 4 The Pyghtle, Westoning, MK45 5LJ.

This policy explains what personal information we collect through caffebd.org, why we collect it, who we share it with, and what you can do about it. We are the data controller for that information.

We are registered with the Information Commissioner's Office, registration number ZA293757.

If you have a question about anything here, contact us at luke@caffebd.org.

The short version

• We only collect personal information when you donate. Browsing the site collects nothing about you.
• We never see your bank details. They are entered directly on GoCardless's own pages and never reach us.
• We store donation and Gift Aid records on servers in London.
• We do not sell, rent or share your information for marketing, by anyone, ever.
• We only use one cookie unless you tell us otherwise, and it holds no personal information.

What we collect, and when

If you donate

To set up a Direct Debit or a one-off payment we ask for:

• your title, if you choose to give one
• your first name and last name
• your email address
• your house name or number, street, town or city, and postcode
• the amount you want to give and how often
• whether you want to add Gift Aid

We use this to set up your donation, to keep a record of it, and — if you choose Gift Aid — to make a valid claim to HMRC.

Your bank details

We do not collect, see or store your bank account number or sort code. When you press "Continue to secure payment" you are handed over to GoCardless, who collect those details on their own secure pages. They tell us only that a mandate or payment was set up, and give us reference numbers for it.

If you add Gift Aid

HMRC requires a Gift Aid declaration to record your name, your full home address including postcode, the amount and date of each donation, and the date you made the declaration. We store the exact wording you agreed to alongside it, so that what you consented to can always be checked.

We also record whether the address GoCardless holds still matches the one you declared. If it stops matching, we hold the declaration back and check it with you rather than making a claim against an address that may no longer be right.

If you browse the site

Nothing. We do not run advertising, tracking pixels, social media trackers or profiling of any kind. Our hosting provider keeps short-lived technical logs — see "Who we share information with" below.

Why we are allowed to use it

Under UK GDPR we rely on:

• Contract — to set up and manage the donation you asked for.
• Legal obligation — to keep the Gift Aid and accounting records that HMRC and the Charity Commission require.
• Legitimate interests — to keep proper records of our income, to detect and prevent fraud, and to keep the website running and secure. We have considered your rights and do not think any of this is intrusive.
• Consent — for optional cookies, and for loading embedded video. You can withdraw consent at any time from the link in our footer.

Who we share information with

We use a small number of providers who process information on our behalf. We do not sell your information, and none of these providers may use it for their own purposes.

We may also disclose information if the law requires it, or to our auditors or the Charity Commission where they are entitled to see it.

GoCardless will send you emails about your Direct Debit — confirming it, and giving advance notice before each payment. Those are required by the Direct Debit scheme and are not marketing.

Where your information is held

Our donation and Gift Aid database is hosted in London (europe-west2), so those records stay in the UK. Some of our providers are international companies and may access data from outside the UK for support purposes; where they do, they are required to protect it to UK standards.

How long we keep it

• Gift Aid declarations and the donations they cover: kept while your declaration is active and for six years after the last donation it covers, because HMRC can ask us to support a claim for that long.
• Donation and payment records: kept for six years after the end of the financial year they fall in, as charity accounting rules require.
• Records for donations that were never completed: deleted after 12 months.

After those periods we delete the records or remove anything that identifies you.

Your rights

You can ask us to:

• give you a copy of the information we hold about you
• correct anything that is wrong
• delete it, or restrict what we do with it
• stop using it where we rely on legitimate interests
• send it to you or another organisation in a portable format

You can also withdraw consent for cookies or embedded video at any time.

There is one limit worth being upfront about: where we are legally required to keep Gift Aid or accounting records, we cannot delete them on request until that period has passed.

To exercise any of these, email luke@caffebd.org. We will respond within one month.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113.

Cancelling a donation

You can cancel your Direct Debit at any time through your bank, or by emailing us. The Direct Debit Guarantee applies to every payment. Cancelling stops future payments; we still keep the records described above.

Cookies

A cookie is a small file a website stores on your device. We use as few as we can, and none of them track you across other websites.

Essential — always on

These are needed for the site to work, so they do not require consent.

GoCardless set their own cookies on their payment pages, which are necessary to process your payment securely. Those are covered by GoCardless's privacy notice.

Analytics — currently not used

We do not run any analytics, measurement or tracking tools on this website. We do not know which pages you visited or how you found us. If that ever changes we will update this policy and ask for your consent before setting anything.

Embedded video — off unless you allow it

Some pages include videos from YouTube. They do not load until you allow them. Until you do, you see a placeholder and no request is made to YouTube at all, so YouTube cannot set cookies or see that you visited.

If you allow video, we load it from youtube-nocookie.com, which limits what Google collects — but Google may still set cookies and receive your IP address once a video loads. See Google's privacy policy.

Changing your mind

Use the Cookie preferences link in the footer of any page. You can also delete cookies in your browser settings at any time.

Children

CAFFE teaches young people in Bangladesh, but this website is aimed at donors in the UK and we do not knowingly collect information from children through it. We have a separate safeguarding and photo consent policy covering the students we photograph.

Changes to this policy

If we change how we use personal information we will update this page and change the date below. Significant changes will be flagged on the site.

Last updated: 27 July 2026.