How GiftAidManager collects, uses, stores, and protects personal data under UK GDPR and related UK data protection law.
Last updated: 29 April 2026
GiftAidManager is operated by SENAPTIX LIMITED (Company No: 16687527). This notice explains how we process personal data under the UK GDPR, the Data Protection Act 2018, and related UK privacy law.
Privacy contact: info@giftaidmanager.com
Depending on context, we may act as:
| Purpose | Lawful basis |
|---|---|
| Create and manage accounts, authentication, and service access | Contract (UK GDPR Article 6(1)(b)) |
| Maintain platform security, prevent abuse, and keep audit trails | Legitimate interests (UK GDPR Article 6(1)(f)) |
| Comply with legal obligations linked to tax and record keeping | Legal obligation (UK GDPR Article 6(1)(c)) |
| Send service and operational communications | Contract and legitimate interests (UK GDPR Article 6(1)(b)/(f)) |
| Use of non-essential cookies and similar technologies | Consent (PECR and UK GDPR Article 6(1)(a)) |
Some records can reveal sensitive context (for example, donations associated with a mosque). We do not require donors to provide special category data in standard declaration flows. Where special category data is processed by a charity customer, that charity is responsible for identifying an appropriate UK GDPR Article 9 condition as controller, and we process data under their documented instructions. We apply controls including data minimisation, role-based access controls, and logging to reduce misuse risk.
We do not sell personal data. We share data only where necessary to run the service, meet legal obligations, or protect rights and security.
Where personal data is accessed or transferred outside the UK, we use appropriate safeguards such as UK adequacy regulations or approved transfer mechanisms and, where relevant, transfer risk assessments.
| Data category | Retention approach |
|---|---|
| Account and organisation profile data | For the active service period and a limited period afterwards for security, support, and dispute handling. |
| Gift Aid declarations, donor records, and donation logs | As at 29 April 2026, HMRC guidance requires Gift Aid declaration records to be retained for at least 6 years after the most recent donation covered by the declaration. We may retain longer where required for legal enquiries, disputes, or statutory obligations. |
| Gift Aid and GASDS claim records | As at 29 April 2026, HMRC guidance states Gift Aid claims must generally be made within 4 years of the end of the relevant financial period, and GASDS claims within 2 years of the end of the tax year collected. HMRC guidance also states records should then be retained for a further period, including at least a further 2 years after relevant claim deadlines. |
| Security, access, and operational logs | Kept for a limited, proportionate period for fraud prevention, incident response, and service integrity. |
| Cookie consent records | Stored according to cookie lifetimes and refreshed when preferences are updated. |
We respond without undue delay and normally within one calendar month. We may ask for identity verification and may extend by up to two further months where a request is complex or numerous, as permitted by law.
If you have concerns about how we handle personal data, contact us at info@giftaidmanager.com. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.
We may update this notice to reflect legal, operational, or product changes. The latest version is published on this page with an updated revision date.
