The Rosemary E. Lake Foundation
Privacy Policy
Last updated: 27 October 2026
1. Who we are
The Rosemary E. Lake Foundation ("we", "us") is a registered charity in England and Wales (No. 1215566), working under the name The 1% Club. Our mission is to remove barriers to learning by supporting children in state-funded schools with food, uniform and learning essentials.
We are the data controller for the personal data described here. For anything about your data, email privacy@theonepercentclub.uk.
2. What we collect
When you apply to join
Your title, name, email address, phone number, home address, employer, job title, annual income, the percentage you'd like to give, anything you tell us about why you'd like to join, and the invitation code you used (if any). If we approve your application, your name, contact details and address become your member profile.
We email you to confirm we've received your application and again with our decision. Your application is also emailed to the charity's own inbox so that our administrators can review it. If you applied with a member's invitation code, that member can see that you applied and, if you join, that you became a member — they are never told if an application is unsuccessful. Once at least three people who joined through that member's invitations are giving, the member also sees the combined total those people have given (one figure for all of them, never what any one person gave).
When you become a member
- Your sign-in account: your email address and name. Your password is handled by Amazon Cognito — we never see it.
- Your profile: your title, name, phone number and address, which you can change in your account at any time. We use your postcode to place you on the map in your member area.
- Your donations: the amount, date and status of each donation, and whether it's one-off or monthly. Stripe takes your payment — we never see or store your card or bank details.
- Your Gift Aid declaration (if you make one): your name, home address (house name or number and postcode) and the date you declared, as HMRC requires.
- Your member number and referral code, and the name and email address of anyone you invite.
- What we give you as a member: a note of anything the charity spends on you (such as club clothing or an invitation to an event), what it cost and when, so we can keep it within the share of your giving we set aside for members and within HMRC's Gift Aid limits on what donors receive.
If you donate through our Kindness Campaign form
The form (run on Jotform) collects your name and address if you give them, the details of the person you'd like us to write to, and your message. If you donate and choose to add Gift Aid, it also collects your title, name, house name or number and postcode for your Gift Aid declaration. We may email you a link to add Gift Aid to a donation you've already made. If you are also a member, and the first name, last name and postcode you gave on the form are exactly the same as those on your member profile, we add these donations to the total giving shown in your account. If those details fit more than one member (for example, two people with the same name at one address), we don't guess: an administrator checks whose they are before they're added to anyone's total. We don't match on anything else.
If someone invites you
The member who invited you gave us your name and email address so we could send you an invitation and, if they ask us to, up to two reminders (never more than three emails in all). We keep it with their account and won't email you again unless you apply.
When you visit the website
We use only the cookies the site needs to work (see section 7). Our emails show our logo, which your mail app loads from our website like any other picture; we don't use tracking images or track what you open or click. We don't use analytics, advertising or tracking cookies. Our hosting providers keep short-term technical logs (such as IP addresses) to run and secure the service.
3. How we use it, and our lawful basis
| Why | Lawful basis (UK GDPR) |
|---|---|
| Assessing your membership application, emailing you to confirm we've received it and to tell you our decision, and keeping an unsuccessful application on our waiting list | Taking steps at your request before you become a member; legitimate interests in admitting like-minded members |
| Running your membership account and dashboard | Contract (your membership) |
| Showing what your giving has helped provide, including your share of the club's work and any Kindness Campaign donations made in your name and postcode | Contract |
| Sending an invitation to someone a member names, and showing that member whether the person applied or joined | Legitimate interests (the member's and ours), limited to three emails |
| Taking and recording your donations, and sending receipts | Contract |
| Claiming Gift Aid from HMRC on your donations | Legal obligation (HMRC Gift Aid rules), with your declaration |
| Keeping donation records for our accounts | Legal obligation (charity law) |
| Keeping a note of what we give you as a member | Legitimate interests (running the club fairly and within HMRC's Gift Aid rules) |
| Keeping the service secure and preventing fraud | Legitimate interests |
We never sell your data or use it for marketing without your consent.
4. Who processes it for us
- Amazon Web Services (AWS) — our database, member sign-in (Amazon Cognito) and the emails we send you. Your data is stored in AWS's London region.
- Google (Google Workspace) — the charity's email. Emails you send us, and the notice our administrators receive when someone applies (which includes the application), are held there. Google may process them outside the UK (see section 8).
- Netlify — hosts the website. Netlify is based in the United States (see section 8).
- postcodes.io — checks that a postcode is a real one and turns it into a map location. Only the postcode is sent.
- Stripe — takes card and Direct Debit payments and manages monthly giving. Stripe receives your name, email and payment details directly.
- Jotform — runs the Kindness Campaign form and stores what you enter on it.
- CARTO — supplies the map images on member pages. Your browser requests them directly, so CARTO receives your IP address.
- GitHub — stores our website code and page content. It holds no member data.
Each of these acts only on our instructions under a data processing agreement. When we claim Gift Aid we send HMRC each donor's title, name, house name or number, postcode, and the date and amount of each donation. We may also share data with HMRC, the Charity Commission or the Information Commission where the law requires it.
5. How long we keep it
- Applications that don't lead to membership: kept on our waiting list, so that we can look at them again if a place comes up, and deleted automatically 12 months after you apply.
- Your member account and everything linked to it: until you delete your account.
- Donation records, Gift Aid declarations and what we gave you as a member: charity law and HMRC require us to keep these for 6 years after the end of the financial year they relate to. If you delete your account, they're moved to a locked archive that only the charity's administrators can reach. Your Gift Aid declaration and the note of what we gave you are deleted automatically after 7 years. The amount, date and kind of each donation are kept after that, so that what you gave still counts in the club's totals, but with nothing that names you. Nothing else about you is kept.
- Backups: our database keeps encrypted backups for 35 days, so deleted data disappears from backups within 35 days.
6. How we protect it
All data is encrypted in transit (HTTPS) and at rest. Sign-in uses Amazon Cognito with optional two-factor authentication, and member pages check your identity on every request. Only the charity's administrators and the administrative support working on their instructions can see members' and applicants' details, and administrator accounts are protected by two-factor authentication.
7. Cookies
We only use cookies that are strictly necessary, so we don't need to ask for consent. (When you pay, Stripe's own pages set their own cookies, covered by Stripe's privacy policy.)
| Cookie | Purpose | Lasts |
|---|---|---|
| id_token, access_token | Keep you signed in | 1 hour |
| refresh_token | Keep you signed in without re-entering your password | 30 days |
| code_verifier, auth_state | Protect sign-in while it's in progress | 10 minutes |
| redirect_sequence | Return you to the right page after signing in | 30 minutes |
| individual_application_data | Remember your application between steps | Up to 7 days, deleted when you submit |
8. International transfers
Netlify may process website requests, Stripe may process payment data, and Google may process the charity's inbox, in the United States. These transfers are protected by the UK Extension to the EU-US Data Privacy Framework and each provider's data processing agreement. Our member database stays in the UK.
9. Your rights
You have the right to access, correct or delete your data, to object to or restrict how we use it, to data portability, and to withdraw any consent you've given.
- Download your data: Account → Settings → Download my data.
- Correct your details: Account → Account details.
- Delete your account and data: Account → Settings → Delete account (donation and Gift Aid records, and what we gave you, are kept as described in section 5).
- Cancel Gift Aid: Donate → Gift Aid → Cancel Gift Aid.
- Anything else: email privacy@theonepercentclub.uk. We'll reply within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
10. Children
We don't collect personal data from children. The school and pupil figures on member dashboards are totals the charity records for each school it supports, not information about individual children.
11. Changes to this policy
If we change this policy, we'll update the date at the top of this page and tell members about significant changes.