Kondanani UK uses personal data about individuals for the purpose of general charity administration and communication. We recognise the importance of the correct and lawful treatment of personal data. All personal data, whether it is held on paper, on computer or other media, will be subject to the appropriate legal safeguards as specified in the General Data Protection Regulation 2017 (GDPR). Kondanani UK endorses and adheres to the GDPR principles, specifying the legal conditions that must be satisfied in relation to obtaining, handling, processing, transportation and storage of personal data. Trustees who obtain, handle, process, transport and store personal data for Kondanani UK must adhere to these principles.

The Principles

We are committed to protecting your privacy and as such we will not share your information with others without your consent. We recognise that personal data shall:

  1. Be processed fairly and lawfully and shall not be processed unless certain conditions are met.
  2. Be obtained for a specified and lawful purpose and shall not be processed in any manner incompatible with that purpose.
  3. Be adequate, relevant and not excessive for those purposes.
  4. Be accurate and where necessary, kept up to date.
  5. Not be kept for longer than is necessary for that purpose.
  6. Be processed in accordance with the data subject’s rights.
  7. Be kept secure from unauthorised or unlawful processing and protected against accidental loss, destruction or damage by using the appropriate technical and organisational measures.
  8. Not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data with the exception of secure transferral to Kondanani Malawi, where all personal information is stored in a secure manner accessible only by the Executive Director. Please see the section on the Database below (section 5, point d).

Maintaining Confidentiality

Kondanani UK will treat all your personal information as private and confidential and not disclose any data about you to anyone other than another Trustee in order to facilitate administration. You control what information is shared with others and may choose to share certain information only with the Secretary (Data Controller).

Information and data stored by Kondanani U.K. will not be distributed in any form which breaches the Data Protection Act.

Your personal information will not be shared with any other person, or organisation, except where you give explicit permission to do so, e.g. to Kondanani Malawi.

There are four exceptional circumstances to the above permitted by law:

a) Where we are legally compelled to do so.
b) Where there is a duty to the public to disclose.
c) Where disclosure is required to protect your interest.
d) Where disclosure is made at your request or with your consent.

Use of Personal Information

Kondanani UK will use your data for two main purposes:

a) The administration of the charity e.g. facilitating communication with sponsors of children at Kondanani Malawi; maintaining financial records of giving for audit and tax purposes.

b) Contacting you to keep you informed of charity activities and events. In such cases all group emails will be sent as blind copies (‘bcc’) to protect your privacy.

The Database

Information contained on the database will not be used in any other ways than those set out in this section.

a) Access to the database is strictly controlled through the use of name specific passwords, which are selected by the individual.

b) The Secretary (the Controller) is the only person who will have secure and authorised access to all areas of the database. Access by the other Trustees will be overseen by the Secretary.

d) The database will NOT be accessed by any authorised users outside of the EEA, in accordance with the Data Protection Act, unless prior consent has been obtained from the individual whose data is to be viewed.

e) All individuals who are the subject of personal data held by Kondanani UK are entitled to:     
• Ask what information the charity holds about them and why.
• Ask how to gain access to it.
• Be informed how to keep it up to date.
• Be informed what Kondanani UK is doing to comply with its obligations under the 1988 Data Protection Act.

f) The need to process data for normal purposes is communicated to all users. Sensitive data, for example, about health, will not be processed without express permission.

Rights to Access Information

Those whose personal information is held by Kondanani U.K. have the right to access any such data whether it is kept electronically or on paper. This right is subject to certain exemptions, for instance if it relates to another individual. Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: –

  • The right to request a copy of your personal data which Kondanani UK holds about you.
  • The right to request that Kondanani UK corrects any personal data if it is found to be inaccurate or out of date.
  • The right to request your personal data is erased where it is no longer necessary for Kondanani UK to retain such data.
  • The right to withdraw your consent to the processing of your personal data at any time.
  • The right to request that the Data Controller provides you with your personal data and, where possible, to transmit that data directly to another data controller (the right to data portability).
  • The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.
  • The right to object to the processing of personal data.
  • The right to lodge a complaint with the Information Commissioner’s Office. Any person who wishes to exercise this right should make the request in writing to the Data Controller, using the standard letter which is available online from

    If personal details are inaccurate, they can be amended upon request. Kondanani UKaims to comply with requests for access to personal information as quickly as possible but will ensure that it is provided within 30 days of receipt of a completed form unless there is good reason for delay. In such cases, the reason for delay will be explained in writing to the individual making the request.

How long do we keep your personal data?

We will not keep personal data longer than is necessary for the purposes that it was collected for. We will comply with official guidance issued to our sector about retention periods for specific records.

Specifically, we retain relevant sponsorship/donation details while they are still current and gift aid declarations and associated paperwork for up to 6 years after the calendar year to which they relate.


Photographs taken at Kondanani UK fundraising events or activities may include individuals or groups of individuals attending these events. These photographs may be used in communications or publicity by Kondanani UK, and may thus appear on the Kondanani website, on social media, or on printed material.

If photographs are taken for official use, such as for a notice board, and these images are stored with names or other personal details, the Data Protection Act does apply. In such cases the photographer should ask permission for the photograph to be used in this way to ensure compliance with the Act.

Photographs taken at Kondanani UK events purely for personal use are, however, exempt from the Data Protection Act. This means that individuals can take photographs of those participating in charity events without coming under the Act. Such images should not, however, be shared, e.g. on social media, with the personal details of any other individuals, including names, without their express permission.

Contact Details

To exercise all relevant rights, queries or complaints please in the first instance please email: 

v2 July 2019
v1 May 2018