Last updated: 6 November 2026
This policy explains what personal information Ashes to Gold collects through this website, why we collect it, who sees it and how long we keep it. We have tried to keep it plain and short. If anything is unclear, email us at hello@ashestogold.uk or ring our office on 028 7044 0386.
Who we are
Ashes to Gold is a registered charity in Northern Ireland (charity number NIC101209). We run Oasis, Grow, the Workshop, the Garden Kitchen, Moorbrook and Blossom, working to restore a life’s purpose across the Causeway Coast and Glens.
We are the “data controller” for the information described here, which means we decide how and why it is used. Our registered office is Unit 32, Loughanhill Industrial Estate, Gateside Road, Coleraine, BT52 2NR. It is an office only and isn’t open to visitors.
Ashes to Gold is the charity’s full legal name. It is registered with the Charity Commission for Northern Ireland (charity number NIC101209). We are registered with the Information Commissioner’s Office (ICO) as a data controller, registration number ZC281196.
What we collect, and why
Enquiries
General enquiries. On the Contact page we ask for your name, email address and your message, and a phone number if you choose to give one. We use these to reply to you. We rely on our legitimate interest in answering people who get in touch.
Oasis enquiries. We ask for your name, email address, a phone number if you choose to give one, what you would like help with (counselling, addiction support, drop-in support, Women of Worth or something else) and, if you wish, a message. We use these only to get back to you and to point you to the right service.
Some of this may reveal something about your health. That is “special category” information, so we only use it with your consent, which you give by choosing to send the form. Please keep your message short and leave out anything you don’t want us to hold. You can say more when we speak to you.
Moorbrook enquiries. We ask for your name, phone number, email, what your enquiry is about (a fishing day ticket, an archery group booking or something else) and, where it applies, a preferred date, the number of people, whether you would like fishing tuition, and your school or group name. We use these to reply and to arrange your visit.
Community group visits. On the Grow, Workshop and Garden Kitchen pages we ask for your name, your group or organisation, your email, a phone number if you choose, and what you have in mind. We use these to plan a visit with you, relying on our legitimate interest.
Workshop item enquiries. If you ask about an item from the Workshop, we ask for the item, your name, email, a phone number if you choose, and your question. We use these to answer you and, if you would like the item, to arrange it with you.
Blossom enquiries. On the Blossom page we ask for your name, email address, a phone number if you choose to give one, and your message. We use these to reply to you, relying on our legitimate interest.
Partnership enquiries. On the Donate page, businesses and organisations can ask about working with us. We ask for your name, organisation, email, a phone number if you choose, what you are interested in and your message. We rely on our legitimate interest in replying.
Event bookings and payments
Booking a place. We ask for your name, email address, phone number, the date you want (if there is a choice), how many of each ticket you need, and (optionally) any access or dietary needs. Access or dietary needs can reveal health information, so we ask you to tell us only what we need to make the event work for you, and we use it only for that.
We use your details to confirm your booking, send you a reminder the day before, send joining information (including the address for events held at private sites), contact you, or everyone booked on that date, if something changes or the event is cancelled, and keep a register on the day. For all bookings, paid or free, the legal basis is that we need your details to carry out your booking (contract). For access and dietary information, it is your consent.
Paying for an event. Payments are taken by Stripe, on Stripe’s own secure page. We never see or store your card number. Stripe tells us whether the payment worked and gives us your name, email and billing details so we can match them to your booking. Stripe also uses some of your information for its own purposes, such as fraud prevention, and explains this in its privacy policy at stripe.com/gb/privacy.
We pass your email address to Stripe so it can fill in the payment page. If you leave without paying, your place is released. If a booking is cancelled, we refund you through Stripe to the card you paid with.
Donations
Donations are made through JustGiving, not on this website. JustGiving collects your details and payment, and its own privacy policy applies to that. JustGiving claims Gift Aid on our behalf. We see only the information JustGiving passes to us through our charity account, which includes any details you choose to share with us. We keep that information, including Gift Aid records, for as long as HMRC requires.
A JustGiving script loads on our Donate page to run the donation pop-up, so JustGiving receives your IP address and browser details when you open that page.
Running the website
Protecting our forms from spam. Our forms use Cloudflare Turnstile, a check that runs in your browser to tell people from automated bots. It looks at information such as your IP address and some browser details. We use Turnstile because we have a legitimate interest in keeping the forms working and free of abuse.
Photos. Photos on this website are of people who have given their consent for the charity to use them online. If you appear in a photo and would like it removed, email us and we will take it down.
Visiting the website. We do not use analytics, advertising or tracking tools on this website. Our web host, Krystal, runs the website from its London data centre and keeps ordinary server logs (for example, IP addresses and the pages requested) for security and fault-finding. Our website is delivered through Cloudflare, which protects it from attacks and helps pages load quickly. Cloudflare handles the IP address and browser details of every visit to do this. See our Cookie Policy for the few cookies and similar technologies involved.
Our fonts are stored on our own server, and we don’t embed maps, videos or social media feeds. Get directions (Google Maps) and the share buttons on news stories are plain links: those sites only hear from you if you click them.
Email. When you email us, your message goes to our mailbox, which is hosted by Microsoft 365.
The automatic emails this website sends, such as booking confirmations and the notices our staff receive about enquiries, are sent through SMTP2GO, using its data centre in the European Union. These emails are not tracked: we do not use open or click tracking. A short delivery log of them is kept on the website for 30 days, and SMTP2GO also keeps its own delivery record (date, event, recipient and subject) for 35 days.
How long we keep your information
| What | How long |
|---|---|
| All enquiry forms on the website: general, Oasis, Moorbrook, community group, Workshop item, Blossom and partnership | Deleted automatically after 90 days. Staff reply by email, so any record of an ongoing service is held in line with that service’s own records. |
| Paid booking form records (the copy our payment system keeps) | Your details, and the name, email and billing address Stripe sends back, are wiped 180 days after the event ends. A payment reference and the amount remain. Free bookings don’t create this record. |
| Booking records (the staff list of who booked) | Name, email, phone and needs are removed one year after the event ends. We keep only the event, number of places, status and amount, so we can report to funders. This includes bookings that were cancelled or never paid for. We keep details for longer only if there has been an incident or complaint, and only for as long as that needs. |
| Copies of the website’s automatic emails | A delivery log on the website for 30 days; SMTP2GO’s own record for 35 days. |
| Payment records | Held by Stripe, under its own retention rules and the legal duty to keep financial records. |
| Gift Aid declarations | As long as HMRC requires. |
Who sees your information
Only the staff and trustees who need it to do their jobs. We never sell your information or use it for marketing without your agreement.
We share information only with the companies that help us run the website and take payments, and only what they need:
- Stripe (payments for events)
- JustGiving (donations)
- Cloudflare (delivering and protecting the website, and the Turnstile spam check)
- Microsoft 365 (our staff mailbox)
- SMTP2GO (the website’s automatic emails)
- Our web host: Krystal
If we are legally required to share information, for example with the police or a regulator, or where someone’s safety is at serious risk, we may do so.
Some of these companies are based outside the UK, for example in the United States. Where that happens, they must protect your information with approved safeguards, such as the UK’s international data transfer rules.
Your rights
You can ask us to:
- tell you what information we hold about you and give you a copy;
- correct anything that is wrong;
- delete your information, where we don’t have to keep it;
- stop or limit how we use it;
- move your information to someone else, where that applies;
- stop using your information where we rely on our legitimate interest;
- withdraw consent you have given us, at any time (this won’t affect what we did before).
Email hello@ashestogold.uk or ring our office on 028 7044 0386 and we will reply within one month.
If you are unhappy with how we have used your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy
If we change how we use your information, we will update this page and the date at the top.