Privacy policy
Last updated 6 October 2026
Green Wings Project (“we”, “us”) is a registered charity in England and Wales (No. 1207209). We are the data controller for the personal information described in this policy. This policy explains what we collect when you donate, buy from our shop, register a collection point or use our online services at greenwingsproject.org, donate.greenwingsproject.org, shop.greenwingsproject.org and my.greenwingsproject.org, why we collect it and what rights you have under UK data protection law (UK GDPR and the Data Protection Act 2018).
1. Contact us
Green Wings Project, GS05, Barley Mow Centre, 10 Barley Mow Passage, London W4 4PH
Email: [email protected] · Telephone: 020 4572 0880
2. What we collect
- Donations — your name, email address, optional phone number and message, the amount and date of your donation, and a payment reference.
- Shop orders — your name, email, phone number, delivery address, the items you ordered, payment reference and delivery tracking details.
- Gift Aid — if you choose to add Gift Aid: your full name, house name or number and postcode, and the date and wording of your declaration.
- Collection point and account holders — your name, email, phone number, business name and address, and the records of collections, weights and rewards linked to your account.
- Technical information — IP address and basic server logs, kept for security and fraud prevention.
- Website usage (only if you accept analytics cookies) — the pages you visit, how you arrived (for example from a search engine), your approximate location (town or region), device and browser type, collected by Google Analytics. Google Analytics does not store full IP addresses, and we do not use it to identify you.
Card details: payments are taken by our payment provider, Viva.com. You enter your card details directly on Viva.com's secure checkout; we never see or store your full card number. We receive only a transaction reference, the masked card number (for example 5239 XXXX XXXX 0168) and the payment status.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Processing your donation, sending your receipt and dealing with refunds or queries | Contract / taking steps at your request |
| Processing and delivering shop orders, returns and refunds | Contract |
| Keeping sales and VAT records required by HMRC | Legal obligation |
| Claiming Gift Aid from HM Revenue & Customs and keeping the records HMRC requires | Legal obligation |
| Running collection points, arranging collections, recording weights and awarding rewards | Contract |
| Keeping waste-movement and consignment records required by the Environment Agency | Legal obligation |
| Preventing fraud and keeping our systems secure | Legitimate interests |
| Sending you news about our work by email | Consent — only if you tick the box, and you can withdraw at any time |
| Measuring how our websites are used (Google Analytics) so we can improve them | Consent — only if you click “Accept” on our cookie banner; you can change your choice at any time with “Cookie settings” |
4. Who we share it with
- Viva.com (Vivabank S.A. and its group companies) — to process your payment. Viva.com handles your card details under its own privacy notice.
- Our fulfilment partner and delivery companies — your name, delivery address, email and phone number, so shop orders can be packed and delivered.
- HM Revenue & Customs — the details needed to claim Gift Aid on your donation.
- Our service providers — hosting (Amazon Web Services, London region) and email (Microsoft 365), who act on our instructions.
- Google (Google Ireland Limited and Google LLC) — provides Google Analytics and processes website usage data on our behalf, only if you accept analytics cookies. We have not enabled advertising features or data sharing for advertising.
- Authorised recycling partners — business details of collection points where needed to arrange collections.
- Regulators or law enforcement where the law requires it.
We never sell or rent your personal information.
5. International transfers
Our systems are hosted in the United Kingdom. Where a provider processes data outside the UK — for example Google, which may process Google Analytics data in the United States — we rely on UK adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Agreement / Addendum to protect it.
6. How long we keep it
- Shop order and VAT records: 6 years after the end of the financial year of the order.
- Donation and Gift Aid records: 6 years after the end of the financial year of the donation, as required by HMRC.
- Collection and waste-movement records: at least 3 years, as required by environmental regulations.
- Account information: while your account is active, then up to 2 years after it closes.
- Marketing preferences: until you unsubscribe.
- Google Analytics usage data: 14 months, then deleted automatically by Google.
- Your cookie choice: 12 months, after which we ask again.
7. Your rights
You have the right to access your personal information, to have it corrected or erased, to restrict or object to its use, to data portability, and to withdraw consent at any time. To exercise any of these rights, email [email protected]. We will reply within one month.
If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
8. Cookies
Strictly necessary cookies are always on: a session cookie that keeps the donation form, your shopping basket and your sign-in secure, and a cookie (gwp_consent, 12 months) that remembers your cookie choice across our websites.
Analytics cookies are only set if you click “Accept” on our cookie banner. They are Google Analytics cookies (_ga and _ga_7076Y77M3J, up to 2 years) that tell us how many people visit our websites and which pages they use. If you click “Reject” or make no choice, no analytics cookies are set; Google receives only basic, cookieless signals (such as that a page was viewed) that cannot be linked to you. You can change your choice at any time with the “Cookie settings” link at the bottom of our pages.
We do not use advertising cookies. Viva.com's checkout and Google Maps (on our collection point map) may set their own cookies under their own policies.
9. Changes
We may update this policy from time to time. The date at the top shows when it was last changed.