“We” and “us” refers to Kidney Research UK, a registered charity in England and Wales (no. 252892) and in Scotland (no. SC039245). We are committed to protecting your personal data and ensuring it is handled securely and transparently.

Kidney Research UK operates across several functions, including research funding, fundraising, marketing, events, human resources, legacy programmes, and trust fund management. This notice applies to all personal data processed by Kidney Research UK, including activities carried out under the Robert Dangoor Partnership, for Living Kidney Donation which operates within the same legal entity. Any data processed by this Partnership is held separately.

We collect and process personal data to deliver our services, support research, engage with supporters, manage staff and volunteers, and meet legal obligations. This notice explains:

• What data we collect
• Why we collect it
• Our lawful basis for processing
• Who we share it with
• How long we keep it
• Your rights under UK GDPR

• We collect personal data when you:
• Contact us directly
• Register for events
• Apply for research funding
• Respond to job adverts
• Donate or engage with fundraising
• Interact with us via social media or online platforms
• Participate in legacy programmes or trust fund activities
• Visit our website or use our digital services

We may also receive data from third parties (e.g. employment agencies, referees, donation platforms).

We process your personal data for specific purposes, which may include:

• Fundraising and campaigns
• Event organisation
• Financial transactions

We strive to keep all the information accurate and up to date, ensuring that we only collect data relevant to our interactions with you.

1. We might contact you by phone for marketing purposes if we have an existing relationship with you, you can opt-out of this at anytime and we will stop, we will make sure opting out is a clear and easy process to follow.
2. We might email you or send you an SMS in relation to admin or information regarding something you are already involved in with us.
3. We might contact you by email or SMS for marketing purposes if we have consent from you to do so.

Depending on your interaction with us, we may collect:

• Name, contact details, job title, education and professional background
• Health and dietary information (with consent)
• Images, biographies, and event footage
• Donation details and Gift Aid declarations
• Employment and HR data (e.g. NI number, bank details, performance records)
• Data about colleagues involved in research applications
• Profiling data from public sources (e.g. Charity Commission, NHS Trusts)
• Legacy-related information, including donor intentions and correspondence
• Website usage data via cookies and analytics tools

We may process health-related data, such as medical conditions or dietary requirements, where relevant to your engagement with us. This is treated as special category data and processed only with your explicit consent or where necessary for legal or safeguarding purposes.

We may process health-related data, such as medical conditions or dietary requirements, where relevant to your engagement with us. This is treated as special category data and processed only with your explicit consent or where necessary for legal or safeguarding purposes.

We only share personal data when necessary and with appropriate safeguards in place. This includes:

• Funders: Only anonymised data is shared
• Authorities: In safeguarding cases, under relevant lawful basis
• Third-party service providers: For functions such as payroll, pensions, HR systems, and donation platforms — all under compliant data sharing or processing agreements
• Zapier: We use Zapier, a US-based automation platform, to streamline internal workflows. Zapier may process limited personal data (e.g. name, email) and may transfer it outside the UK/EEA. We ensure appropriate safeguards are in place for these transfers (see below)

Where personal data is transferred outside the UK or the European Economic Area (EEA), we apply appropriate safeguards to ensure your data remains protected. These may include:

• The UK Addendum to the EU Standard Contractual Clauses (SCCs)
• The UK International Data Transfer Agreement (IDTA)
• Transfer Risk Assessments (TRAs) to evaluate and manage risks

For example, we use Zapier, which may transfer data to the United States and engage sub-processors such as Meta. These transfers are subject to the safeguards listed above. Only limited, non-sensitive data is processed through this platform, and we monitor its use to ensure compliance.

Our website uses cookies to enhance user experience, monitor performance, and support marketing efforts. Cookies may collect information such as IP address, browser type, and pages visited.

• Essential cookies: Necessary for website functionality; processed under legitimate interest
• Analytics and marketing cookies: Used to improve services and personalise content; processed under consent

You can manage your cookie preferences via your browser settings or our website’s cookie banner.

Change your cookie preferences:

Consent Preferences

This table sets out the cookies used on this website and what they are used for:

We retain personal data only as long as necessary:

• Patients/Case study subjects
• Employees and volunteers: Duration of engagement plus 6 years
• Unsuccessful job applicants: 12 months
• Research applicants and donors: As per our retention schedule
• Legacy and trust fund records: Retained in line with legal and operational requirements
• Website analytics: Retention periods vary by cookie type and provider

Data is securely deleted or destroyed once retention periods expire. For more details, contact us using the details below.

We may contact you if:

• You’ve previously attended an event or donated
• You’ve signed up for marketing communications We use:
• Consent for emails and newsletters
• Legitimate interest for calls and postal outreach (screened via TPS)

You can change your preferences or unsubscribe at any time via the link in our emails or by contacting us.

You have the right to:

• Be informed about how your data is used
• Access your personal data
• Rectify inaccurate data
• Restrict or object to processing
• Request erasure (“right to be forgotten”)
• Data portability
• Not be subject to automated decision-making
• Lodge a complaint with the ICO or Fundraising Regulator

If you have concerns about how we process your data, please contact our Data Protection Lead at:

Email: niyati@hope-may.com Phone (ICO): 0303 123 1113

Post: Information Commissioner’s Office,

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF