top of page

Privacy Policy

Nutritious Minds Trust
Last updated: 4th October 2026

​

1. Who we are

Nutritious Minds Trust ("NMT", "we", "us", "our") is a Charitable Incorporated Organisation (CIO) registered with the Charity Commission for England and Wales, registered charity number 1206658. Our contact address is 30 Beechwood Gardens, Caterham, CR3 6NH.

We are the "data controller" for the personal data we collect through this website (www.nutritiousminds.org) and through our work. This means we decide how and why your personal data is used.

 

Contact for data protection queries:
Dr Rachel Gow, Chair of Trustees / named data protection lead
Email: drrachelvgow@nutritiousminds.org
Post: Nutritious Minds Trust, 30 Beechwood Gardens, Caterham, CR3 6NH

We handle your data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

​

2. About this policy

This policy explains what personal data we collect, why, how we use and protect it, who we share it with, and your rights. "Personal data" means any information that identifies you or can be used to identify you.

​

3. What personal data we collect

Depending on how you interact with us, we may collect:

  • Contact details: name, email address, phone number, postal address

  • Enquiries: what you tell us when you use our contact form, email, phone or message us on social media

  • Newsletter and mailing list: your name, email address and communication preferences

  • Donations: name, contact details, donation amount and payment reference. Donations are made through Stripe, PayPal and JustGiving, and we do not see or store your full card or bank details

  • Support group, events and workshops: name, contact details, attendance details, and any access or dietary requirements you tell us about

  • Services and support: where you or your child access our advice, mentoring, music or sports projects, or help with diagnostic assessments, we collect the details needed to provide that support (see "Special category data" below)

  • Volunteers, ambassadors and supporters: name, contact details, skills, experience and availability, and where relevant references and DBS check information

  • Real-life stories and photos: if you share your story, image or quotes with us, the information in them and the permissions you give us

  • Job and volunteer applicants: CV, employment history, qualifications and references

  • Technical data: IP address, browser type, device, pages visited, referring site and approximate location, collected through cookies and similar technologies (see section 10)

 

Special category data. Our work supports people with ADHD, dyslexia and other neurodivergent conditions, so we may sometimes handle information about health, disability or neurodevelopmental differences. We only collect this where it is needed to provide support, run an event or make reasonable adjustments, and only with your explicit consent or another lawful condition under Article 9 UK GDPR. We keep it confidential and share it only where necessary, and we always tell you at the time we ask. You do not need to give us this information to use our website.

 

4. How we collect your data

  • Directly from you, when you fill in a form, sign up to our newsletter, donate, attend an event or support group, apply to volunteer, or contact us

  • Automatically, through cookies and analytics tools when you use our website

  • From third parties, such as Stripe, JustGiving or PayPal where you have chosen to donate and agreed to share your details with us, or from a parent, carer, school or health professional where they refer someone to us with your or the family's consent

 

5. Why we use your data and our lawful bases

What we doLawful basis

Respond to your enquiries and messagesLegitimate interests (to run our charity and respond to you)

Send newsletters, news, event and fundraising updatesConsent (you can withdraw at any time)

Provide support groups, events, workshops and other servicesLegitimate interests / consent

Handle health or neurodevelopmental information you share to receive supportExplicit consent (Article 9(2)(a))

Process donations and send thank-you messagesLegitimate interests

Manage volunteers, ambassadors, trustees and staffContract / legitimate interests / legal obligation

Keep financial and governance records, and meet Charity Commission requirementsLegal obligation

Publish real-life stories, photos and awards contentConsent

Keep our website secure and prevent misuseLegitimate interests

Understand how our website is usedConsent (for non-essential cookies)

Safeguard children, young people and adults at riskLegal obligation / legitimate interests / substantial public interest where special category data is involved

Where we rely on legitimate interests, we have considered your rights and freedoms and are satisfied they are not overridden.

 

6. Marketing and keeping in touch

We will only email you news, events and support group updates if you have signed up to our mailing list or otherwise opted in. You can unsubscribe at any time using the link in any email or by contacting us at [email address], and we will stop promptly. We may still contact you about essential matters such as confirming an event booking.

We never sell your data or share it with other organisations for their own marketing.

 

7. Who we share your data with

We only share personal data where necessary, and only with organisations that have agreed to protect it. These may include:

  • Website host: Wix.com Ltd and its group companies, who host and operate our website

  • Email and newsletter provider: [e.g. Wix Email Marketing]

  • Donation and payment providers: PayPal, Stripe and JustGiving. They act as independent controllers for the payment data they collect, so please read their privacy notices

  • Analytics providers: [e.g. Wix Analytics / Google Analytics]

  • Professional advisers: such as accountants, independent examiners or auditors, insurers and legal advisers

  • Social media platforms: Facebook, Instagram and X, if you interact with us there (their privacy policies apply)

  • Regulators and public bodies, such as the Charity Commission, the ICO, the police, local authority safeguarding teams or other authorities, where we are legally required to or need to protect someone from harm

Our providers act on our instructions under a written contract, except where stated above.

 

8. International transfers

Some of our providers (including Wix, Stripe and PayPal and social media platforms) may process data outside the UK, including in the European Economic Area, Israel and the United States. Where this happens, we make sure appropriate safeguards are in place, such as a UK adequacy decision, the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.

​

9. Cookies and similar technologies

Our website uses cookies, which are small files placed on your device. They help the site work, keep it secure and, with your consent, help us understand how it is used.

  • Essential cookies: needed for the site to work and stay secure. These do not need consent.

  • Functional cookies: remember your settings and preferences

  • Analytics cookies: tell us how visitors use the site. We only use these with your consent.

When you first visit, a cookie banner lets you accept, reject or customise non-essential cookies. You can change your choice at any time using [cookie settings link in the footer]. You can also block or delete cookies in your browser settings, though parts of the site may not work as intended. Wix lists its standard cookies at wix.com/about/cookies.

 

10. How we keep your data safe

We take appropriate technical and organisational measures to protect your personal data from loss, misuse, unauthorised access, disclosure or alteration. These include a secure (HTTPS) website, restricting access to people who need it, strong passwords and two-factor authentication where available, training for trustees, staff and volunteers, and contracts with our suppliers. We take particular care with any health or children's information.

If a personal data breach is likely to put your rights and freedoms at risk, we will report it to the ICO within 72 hours and tell you without undue delay where required.

 

11. Your rights

Under UK data protection law you have the right to:

  • Be informed about how your data is used (this policy)

  • Access the personal data we hold about you

  • Rectify inaccurate or incomplete data

  • Erasure of your data in certain circumstances

  • Restrict how we use your data in certain circumstances

  • Data portability, where applicable

  • Object to processing based on legitimate interests, and to direct marketing at any time

  • Withdraw consent at any time where we rely on consent. This won't affect processing before you withdrew it.

  • Not be subject to solely automated decisions with legal or similarly significant effects. We do not make decisions in this way.

To use any of these rights, contact us using the details in section 1. We will respond within one month (extendable by up to two further months for complex requests, and we will tell you if so). There is normally no charge. We may need to verify your identity first.

 

12. Complaints

If you are unhappy with how we have handled your data, please contact us first at [email address] so we can try to put things right.

You also have the right to complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

 

13. Children and young people

We support children and young people, so we take extra care with their data. Where a child is under 13, we ask for a parent's or guardian's consent before collecting their personal data, and we ask for a parent or carer's involvement for any support involving health information. We only collect what is needed and keep it secure and confidential, in line with our safeguarding arrangements. If you believe a child has given us personal data without the right consent, please contact us and we will delete it.

 

14. Stories, photos and publicity

Our website features real-life stories and event photos. We only publish a person's story, name, image or quotes with their consent (and a parent or guardian's consent for under-18s). You can withdraw consent at any time by contacting us, and we will remove the content from our website and our social media accounts as soon as reasonably possible. We cannot control copies shared by others before removal.

 

15. Links to other websites

Our website links to other sites, including PayPal, Stripe JustGiving and social media platforms. We are not responsible for their privacy practices, so please read their notices before sharing your data.

 

16. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page with the "last updated" date at the top.

 

17. Contact us

Nutritious Minds Trust (Registered Charity No. 1206658)
Email: drrachelvgow@nutritiousminds.org

bottom of page