1 Who We Are
Charity Tax Group (CTG)
7/8 Avon Reach
Monkton Hill
Chippenham
SN15 1EE
Email: [email protected]
CTG is the data controller for the personal data we process. The CEO acts as CTG’s data protection lead.
2 The Personal Data We Collect
a) Membership and communications
- Name
- Email address
- Job title and organisation
- Membership category and status
- Communication preferences
b) Event administration
- Name
- Email address
- Organisation represented
- Attendance information
c) Website accounts
- Login email
- Password (stored securely in hashed and salted form)
- Organisation affiliation
d) Governance
- Trustee contact details
- Register of Interests information
e) Finance and payments
- Name and email of payer
- Organisation billing details
- Payment history
f) Technical data
- IP address
- Website usage and analytics data
CTG does not routinely collect special category data.
3 How We Use Personal Data and Our Lawful Bases
a) Administering membership and providing member services
Lawful basis:
- Administering Observer Membership: Contract.
- Administering Charity Membership: Legitimate interest
b) Sending newsletters and membership updates
Lawful basis:
- Newsletters and Bulletins: Consent
- Event notifications and invitations: Legitimate interest
- Donation requests: Legitimate interest
c) Event administration
Lawful basis:
- Emailing links and details to attendees: Contract.
- Event notifications and invitations: Legitimate interest
d) Processing payments and financial administration
Lawful basis:
- Processing donations: Legal obligation
- Processing Membership fees: Contract; Legal obligation
- Processing event payments: Contract; Legal obligation
e) Governance and statutory compliance
Lawful basis:
Storage of Trustee details: Legal obligation, consent
f) Website operation and security
- Storage and processing charity membership details: Legitimate interest, consent
- Storage and processing observer membership details: Contract, consent
- Storage and processing subscriber details: Consent
4) Where We Get Personal Data From
- Directly from you
- Your organisation
- Event platforms (e.g., Ticket Tailor)
- Payment processors (e.g., Stripe)
- Website analytics tools
5) Who We Share Personal Data With
We share personal data only where necessary and with appropriate safeguards. Our main processors include:
- Website hosting provider
- Mailchimp
- Ticket Tailor
- Stripe
- External finance provider
- Microsoft 365
Where data is transferred outside the UK, we ensure appropriate safeguards such as Standard Contractual Clauses and the UK Addendum.
We do not sell personal data
6) How Long We Keep Personal Data
- Membership data: active membership + 4 years
Financial records containing personal data are retained for 6 years. - Mailing lists: until consent withdrawn + 2 years
- Event records: 2 years
- Finance and payment records: 6 years
- Governance and trustee records: tenure + 6 years
- Supplier and contractor records: contract term + 6 years
- Website analytics/IP logs: 24 months
- Email correspondence: 6 years
Full details are set out in CTG’s Data Retention Policy.
7) Your Data Protection Rights
You have the right to:
- access your personal data
- correct inaccurate information
- request deletion (in certain circumstances)
- restrict how your data is used
- object to certain uses
- request data portability
- withdraw consent at any time
To exercise your rights, contact [email protected].
8) How We Protect Your Data
We use appropriate technical and organisational measures, including:
- secure hosting and encryption
- Role-based‑ access controls
- password and MFA requirements
- secure deletion processes
- staff and trustee training
- Data Processing Agreements with all processors
9) Automated Decision ‑Making
CTG does not carry out automated decision making that has legal or significant effects on individuals. Some website functions operate automatically, such as updating membership access based on payment status, but these do not constitute automated decision making that has legal or significant effects on individuals.
10) Cookies Policy
CTG uses cookies to support core website functionality, security, and analytics. Full details of the cookies we use are set out in our separate Cookie Policy.
11) Third-Party‑ Links
Our website may contain links to external websites or resources operated by third parties. CTG is not responsible for the content, security, or privacy practices of these external sites. We encourage you to review the privacy notices of any third-party websites you visit.
How to Complain
If you have concerns about how we use your personal data, contact us at [email protected].
If you remain unhappy, you can contact the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113
www.ico.org.uk/make-a-complaint
Last Updated
23/2/26
Appendix A – Summary Privacy Notice
This summary explains the key points about how CTG uses personal data. For full details, please read the main privacy notice.
Who we are
Charity Tax Group (CTG) represents the interests of charities on tax matters. We act as the data controller for the personal information we collect.
What data we collect
We collect your name, email address, organisation details, membership information, event bookings, payment information, website account details, and technical data such as IP addresses.
How we use your data
We use your information to administer membership, provide services, manage events, send updates (where you have opted in), process payments, run our website, and meet our legal obligations.
Our lawful bases
We rely on contract, legitimate interests, consent (for marketing), and legal obligation depending on the activity.
Who we share data with
We use trusted service providers to run our website, send emails, manage events, and process payments. We do not sell personal data.
How long we keep data
We keep personal data only for as long as necessary. Key retention periods include:
- Membership data: active membership + 4 years
- Mailing lists: until consent withdrawn + 2 years
- Event records: 2 years
- Finance records: 6 years
- Trustee records: tenure + 6 years
Cookies policy
- Cookies Policy
CTG uses cookies to support core website functionality, security, and analytics. Full details of the cookies we use are set out in our separate Cookie Policy.
Your rights
You can ask to access, correct, delete, or restrict your data, object to certain uses, or withdraw consent at any time.
Contact us
[email protected]