Single Homeless Project - Privacy Policy

Last updated: 1 October 2026

1. Introduction

1.1. We are committed to safeguarding the privacy of visitors to our online shop and everyone we interact with, in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003, as amended (“PECR”).

1.2. We will ask you to consent to our use of non-essential cookies in accordance with this policy when you first visit our shop.

1.3. This policy applies where we act as a data controller, meaning we determine the purposes and means of processing personal data obtained through our online shop at shop.shp.org.uk (“our shop”) and our wider charitable activities.

1.4. In this policy, “we”, “us” and “our” refer to Single Homeless Project (“SHP”).

1.5. This policy explains how we collect, use, share and protect personal data, and sets out your rights under UK data protection law.

1.6. Our shop is built on and hosted by Shopify, an e-commerce platform. Shopify processes personal data on our behalf so that we can sell products to you, as described in Sections 2 and 5. Our main website, shp.org.uk, has its own privacy policy.

2. How we use your personal data

2.1. We are responsible for defining:

a) the categories of personal data we process;

b) the purposes for which we process personal data; and

c) the lawful basis (or bases) that applies to that processing. A full explanation of the lawful bases referred to in this policy is set out in Section 3.

2.2. Usage data

Use of our shop generates data about your visit (“usage data”). Usage data may include your IP address, browser type and version, device type, referral source, length of visit, pages and products viewed, items added to your basket, navigation paths, operating system and approximate geographical location.

We collect usage data through cookies and similar technologies set by Shopify, including Shopify’s built-in analytics. Where these are non-essential, we only set them with your consent, obtained through our cookie banner, in line with PECR (see Section 14, Cookies). The lawful basis under the UK GDPR for our subsequent processing of usage data is consent, or, in relation to strictly necessary cookies, our legitimate interest in the security and functioning of our shop.

We use usage data to analyse how our shop is used, to develop our products and services, to understand our supporters, and to improve the experience of shop visitors.

2.3. Enquiry data

We process information you submit when you contact us with an enquiry about an order, our products or services, or for any other reason (“enquiry data”). The lawful basis for this processing is our legitimate interest in responding to enquiries and communications directed to us, having balanced this interest against your rights and freedoms. Where your enquiry relates to an order, the lawful basis is also the performance of our contract with you. Enquiry data is used to respond to your query, to identify recurring issues, and to improve the information available on our shop.

2.4. Newsletter data

We may process information you provide when subscribing to our newsletters or updates, including at checkout (“newsletter data”). Where required by law, we will rely on your consent. In other circumstances, where permitted by PECR, we may rely on the charity soft opt-in (see Section 4 for further detail). You may unsubscribe at any time using the link in any email or by contacting us.

2.5. Correspondence data

We may process information contained in or relating to any correspondence you send us (“correspondence data”). The lawful basis for this processing is our legitimate interest in maintaining appropriate records of correspondence and responding to it, balanced against your data protection rights.

2.6. Order data

When you place an order on our shop, we collect your name, email address, phone number, billing address, delivery address, the gifts you buy, order value, discount codes used, order history, and any notes or gift messages you add to your order (“order data”). We use order data to process your order, send your order confirmation and gift details by email, handle refunds, provide customer service, and keep accounting records. The lawful basis for this processing is the performance of a contract with you and, for accounting and tax records, compliance with a legal obligation.

2.7. Payment data

You can pay on our shop by card, PayPal, Apple Pay, Google Pay or Klarna. Card, Apple Pay and Google Pay payments are processed by Shopify Payments (provided in the UK in partnership with Stripe). Your card details are entered into a secure payment page and are handled by our payment providers in line with the Payment Card Industry Data Security Standard (PCI DSS). We do not see or store your full card number; we may receive limited information such as the card type, the last four digits and the expiry date to help with refunds and customer service. The lawful basis for this processing is the performance of a contract with you.

If you choose to pay with PayPal or Klarna, you will share some information directly with them, and they act as independent controllers of that information under their own privacy notices. Klarna may carry out identity and credit checks before offering you its payment options. If you choose to pay using Shop Pay, Shopify acts as an independent controller of the information held in your Shop Pay account, under its own privacy policy. You can review the privacy notices of our payment providers here:

Shopify: shopify.com/legal/privacy

Stripe: stripe.com/gb/privacy

PayPal: paypal.com/uk/legalhub/privacy-full

Klarna: klarna.com/uk/privacy

2.8. Virtual gifts

Our shop sells virtual gifts, so nothing is posted to you and we do not share your details with delivery or fulfilment companies. We send your order confirmation and gift details to the email address you give us at checkout.

Our Shopify checkout still asks for a delivery address, because the checkout requires one. We do not use it to send you anything. We use it only:

a) to help verify payments and prevent fraud (see 2.9), on the basis of our legitimate interest in protecting our charity’s funds and those of our customers; and

b) for Gift Aid and accounting records, where applicable, to comply with our legal obligations to HMRC.

We will not use your delivery address to send you marketing by post.

2.9. Fraud prevention

We and Shopify use order data, payment data and technical information such as your IP address and device information to detect and prevent fraudulent transactions. Shopify’s fraud analysis tools may automatically assess the risk of an order and flag it for review (see Section 10.1(h)). The lawful basis for this processing is our legitimate interest in preventing fraud and protecting our charity’s funds, and those of our customers.

2.10. Customer accounts

If you create a customer account on our shop, we process the information in your account, such as your name, email address, saved addresses and order history, so that you can manage your orders and check out more quickly. The lawful basis for this processing is the performance of a contract with you. You can ask us to close your account at any time.

2.11. Data processed via third-party platforms

We use a number of software platforms to run our shop and to assist and streamline our operations, including Shopify (including Shopify Email and Shopify’s WhatsApp messaging tools), Mailchimp (including for sending SMS messages), Pandectes GDPR Compliance (which manages our cookie banner and consent records), and other apps installed on our Shopify store. WhatsApp messages are delivered through WhatsApp, which is owned by Meta Platforms, Inc. (“Meta”). The lawful basis for this processing is our legitimate interest in the efficient administration of the charity and the effective use of charitable resources, or the performance of a contract with you where the platform is needed to fulfil your order.

These organisations act as our data processors: they process personal data only on our documented instructions, for our purposes, and are contractually required to protect that data. Shopify processes personal data on our behalf under the Shopify Data Processing Addendum. These organisations are not joint controllers of your personal data. This is separate from the payment providers described in 2.7: where you pay using PayPal, Klarna or Shop Pay, that provider acts as an independent controller of the information you give it. We encourage you to review their privacy notices if you have any concerns about how they handle data on our behalf.

2.12. Marketing data

We process personal data to keep you informed about our work, campaigns, products, services, fundraising activities and events (“marketing data”). Full details of how we use marketing data, including our reliance on consent or the charity soft opt-in under PECR, are set out in Section 4 (Marketing communications).

2.13. Public data

We may process publicly available data to assess potential and existing audiences and to inform our engagement strategy (“public data”). The lawful basis for this processing is our legitimate interest in reaching those who may be interested in supporting our work, in a manner that makes efficient use of our charitable resources.

2.14. Legal claims

Where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure, we may process any personal data identified in this policy. The lawful basis for this processing is our legitimate interest in protecting our legal rights and, where applicable, compliance with a legal obligation.

2.15. Insurance and risk management

Where necessary for obtaining or maintaining insurance cover, obtaining professional advice, or managing organisational risk, we may process personal data identified in this policy. The lawful basis for this processing is our legitimate interest in protecting our organisation against relevant risks.

2.16. Non-identifiable information

We may process non-personally identifiable information for a variety of purposes, including sharing it with third parties; doing so will not affect your data protection rights.

2.16.1. We will not, without your explicit consent, supply your personal information to any third party for that third party’s own direct marketing purposes.

2.17. Legal obligations and vital interests

In addition to the purposes at 2.2 to 2.11, we may process your data where necessary to comply with a legal obligation, or to protect the vital interests of an individual or our organisation’s assets, for example in connection with the prevention of fraud.

2.18. Personal data of others

If you give us another person’s name or contact details, for example in a gift message, you must make sure they are happy for you to share them. We will use their details only for that purpose and in accordance with this policy.

3. Lawful bases for processing

3.1. Under the UK GDPR, we must have a valid lawful basis to process your personal data. Depending on the purpose, we rely on one or more of the following:

a) Consent – you have given clear, informed and freely given agreement to the processing (for example, non-essential cookies, or certain marketing communications).

b) Contract – processing is necessary to perform a contract with you, or to take steps at your request before entering into a contract (for example, processing your order, taking payment and sending your virtual gift).

c) Legal obligation – processing is necessary for us to comply with the law (for example, keeping accounting and tax records).

d) Vital interests – processing is necessary to protect someone’s life.

e) Legitimate interests – processing is necessary for our legitimate interests, or those of a third party, provided this is not overridden by your interests or fundamental rights and freedoms.

3.2. Where we rely on legitimate interests, we carry out a balancing exercise to ensure our interests do not override your rights and freedoms.

3.3. Where we rely on consent, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.

3.4. The lawful bases under the UK GDPR are separate from, and additional to, the rules on electronic marketing under PECR, which are explained in Section 4.

4. Marketing communications (including the charity soft opt-in)

4.1. We may process your personal information to keep you informed about our work, products, services, campaigns, fundraising activities, events and other information we believe may be of interest (“marketing data”).

4.2. The lawful basis under the UK GDPR for processing your personal data for marketing purposes will normally be legitimate interests or consent, depending on the circumstances.

4.3. Where we send marketing by email, SMS or WhatsApp, we will separately comply with PECR. At checkout, and through other sign-up options on our shop, we can ask whether you would like to receive marketing from us by email, SMS and/or WhatsApp. We will either:

a) obtain your consent before sending electronic marketing, for example where you choose at checkout to hear from us by email, SMS or WhatsApp, or sign up to our newsletter; or

b) where permitted by law, rely on the charity soft opt-in.

4.4. We may rely on the charity soft opt-in where:

a) we obtained your contact details in the course of you expressing an interest in, offering or providing support for, or purchasing goods or services from SHP, including buying from our shop;

b) we are marketing our own similar charitable purposes, campaigns, products, services or fundraising;

c) you were given a clear opportunity to opt out of marketing when your details were collected, including at checkout; and

d) every subsequent marketing communication we send you includes a simple way to unsubscribe or opt out.

4.5. You may opt out of receiving marketing communications from us at any time by following the unsubscribe instructions included in our emails, replying STOP to SMS or WhatsApp messages, using the opt-out option in WhatsApp, updating your communication preferences in your shop account, or contacting us directly using the details in Section 16.

4.6. We will never sell your personal information, or share it with third parties for their own direct marketing purposes, without your explicit consent.

4.7. Where we send you marketing text messages (SMS), these are covered by the same PECR rules and charity soft opt-in described above. Our SMS messages also operate under separate SMS Messaging Terms and Conditions, which cover message frequency, standard message and data charges, opting out (reply STOP), getting help (reply HELP), and re-subscribing; these are available at shp.org.uk. Our SMS messages are sent using Mailchimp.

4.8. We can also send you marketing by WhatsApp. We will only send you WhatsApp marketing messages if you have opted in to receive them, for example at checkout. Our WhatsApp messages are sent using Shopify and delivered through WhatsApp, which is owned by Meta. Meta processes the information needed to deliver these messages, such as your mobile number and the content of the message, and may do so outside the UK, including in the United States (see Section 6). You can opt out at any time by replying STOP, using the opt-out option in WhatsApp, or contacting us using the details in Section 16. Opting out of WhatsApp marketing will not change any other marketing preferences you have set.

4.9. Opting out of marketing will not stop us sending you service messages about your orders, such as order confirmations, gift details and refund notifications.

5. Disclosure of personal information

5.1. We may disclose your personal information to our employees, officers, insurers, professional advisers, agents, suppliers or subcontractors, insofar as reasonably necessary for the purposes set out in this policy. For our shop, this includes Shopify (our e-commerce platform), our payment providers, and the apps and platforms listed in Section 2.11. Where these parties process personal data on our behalf, they do so as our data processors, under contractual obligations to keep it secure and to act only on our instructions.

5.2. This list is non-exhaustive, but except as set out in this policy, we will not share your data with third parties unnecessarily.

5.3. We may disclose your personal information:

a) in accordance with Section 2 of this policy;

b) to the extent we are required to do so by law;

c) in connection with any ongoing or prospective legal proceedings;

d) in order to establish, exercise or defend our legal rights, including providing information to others for the purposes of fraud prevention;

e) to the purchaser (or prospective purchaser) of any business or asset that we are, or are contemplating, selling; and

f) to any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal information, where, in our reasonable opinion, such court or authority would be likely to order disclosure.

6. International transfers

6.1. We do not ourselves transfer your personal data outside the UK. However, some of the service providers referred to in this policy (including Shopify, Stripe, PayPal, Klarna, Mailchimp and Meta, which delivers our WhatsApp messages) may store or process personal data outside the UK, including in Canada, the United States, Ireland and other countries where they or their sub-processors operate. Mailchimp, which we use to send SMS messages, and Meta are based in the United States.

6.2. Where we, or our processors, transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with Chapter V of the UK GDPR. This may include reliance on UK adequacy regulations (for example, for transfers to Canada and countries in the European Economic Area), the UK Extension to the EU–US Data Privacy Framework, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. Shopify’s safeguards are set out in its Data Processing Addendum.

6.3. You can contact us using the details in Section 16 for further information about the safeguards in place for a specific transfer.

7. Retention of personal information

7.1. Our data retention policies and procedures are designed to ensure that we comply with our legal obligations regarding the retention and deletion of personal information.

7.2. We do not keep personal data for any purpose for longer than is necessary for that purpose.

7.3. We determine appropriate retention periods for each category of personal data based on the purpose of processing, any applicable legal or regulatory requirement, and relevant guidance from the Information Commissioner’s Office (ICO). As a guide:

a) enquiry and correspondence data is generally retained for up to 2 years from the date of last contact, unless a longer period is needed to resolve the matter;

b) newsletter and marketing data is retained until you unsubscribe, or reviewed periodically (generally every 24 months) to confirm continued interest;

c) order, transaction and financial data is retained for a minimum of 6 years from the end of the relevant financial year, to meet HMRC and charity accounting requirements;

d) customer account data is retained while your account is open, and deleted or anonymised within 5 years of your last activity or when you ask us to close your account, except for order records we must keep under 7.3(c);

e) usage and analytics data is retained in accordance with the default retention settings of the relevant platform (see Section 14, Cookies); and

f) records relevant to actual or potential legal claims are retained for the duration of the applicable limitation period, generally up to 6 years, or longer where legal proceedings are ongoing.

7.4. Notwithstanding the above, we will retain documents (including electronic documents) containing personal data:

a) to the extent required by law;

b) if we believe the documents may be relevant to any ongoing or prospective legal proceedings; and

c) in order to establish, exercise or defend our legal rights.

7.5. When we delete your customer data from our shop, Shopify also removes or anonymises it from its systems in line with its own data retention processes.

7.6. Further details of our retention periods are available on request from our Data Protection Officer (see Section 16).

8. Security of personal information

8.1. We take reasonable technical and organisational measures to prevent the unauthorised or unlawful loss, misuse, alteration or destruction of your personal information.

8.2. Personal information you provide through our shop is stored on Shopify’s secure servers, which are protected by appropriate technical controls, including firewalls and access restrictions. Access to customer data in our Shopify account is limited to staff who need it, and is protected by individual logins and two-step authentication.

8.3. Data sent between your browser and our shop, including order and payment data, is protected using encryption technology (such as TLS/HTTPS).

8.4. All payments made through our shop are processed by PCI DSS-compliant payment providers using encryption technology. We do not store your full card details.

8.5. The transmission of information over the internet is inherently insecure, and we cannot guarantee the security of data sent over the internet; any such transmission is at your own risk.

8.6. You are responsible for keeping access to your shop customer account secure, including any password or the email account used to receive login codes. We will never ask you for your password or login code, other than when you sign in to your account on our shop.

9. Changes to this policy

9.1. We may update this policy from time to time by publishing a new version on our shop. We will not always separately notify you of minor changes.

9.2. We encourage you to check this page periodically to keep informed of how we use and protect your data, and to review your cookie settings from time to time.

9.3. Where we make significant changes to this policy, we may notify you by email where we consider it appropriate to do so.

9.4. If you are unhappy with an updated version of this policy, you can update your marketing and cookie preferences at any time using the details in this policy.

10. Your rights

10.1. Under the UK GDPR, subject to certain exemptions and conditions, you have the following rights in relation to your personal data:

a) the right to be informed about how we collect and use your personal data (which this policy is intended to address);

b) the right of access to the personal data we hold about you;

c) the right to rectification, if any personal data we hold about you is inaccurate or incomplete;

d) the right to erasure (the “right to be forgotten”) in certain circumstances;

e) the right to restrict our processing of your personal data in certain circumstances;

f) the right to data portability, allowing you to obtain and reuse your data for your own purposes;

g) the right to object to our processing of your personal data, including processing carried out for direct marketing purposes or on the basis of legitimate interests;

h) rights in relation to automated decision-making and profiling. Our shop uses Shopify’s automated fraud analysis, which may flag an order as high risk. We review flagged orders before cancelling them, and if you think an order has been cancelled in error you can ask us to review it; and

i) the right to withdraw consent at any time, where we rely on consent as our lawful basis.

10.2. To exercise any of these rights, please contact us using the details in Section 16. We may ask you to provide appropriate evidence of your identity before responding to your request.

10.3. We may withhold personal information you request to the extent permitted by law.

10.4. You have the right to object to the processing of your personal data for direct marketing at any time. You can unsubscribe from electronic marketing by using the unsubscribe link in our emails, replying STOP to SMS or WhatsApp messages, updating your communication preferences, or contacting us. We will action your request promptly.

10.5. Where you ask us to access or erase the personal data we hold about you through our shop, we will use Shopify’s data request tools to do so. Some order data may need to be kept for legal or accounting reasons (see Section 7).

10.6. If you have concerns about how we process your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk, or by calling 0303 123 1113. We would, however, welcome the opportunity to address your concerns directly – please contact our Data Protection Officer using the details in Section 16 before doing so.

11. Personal data of children

11.1. Our shop is open to customers of all ages. If you are under 13, please ask a parent or guardian to place your order or sign up to our emails for you.

11.2. We will only send marketing emails to a child under 13 with the consent of their parent or guardian.

12. Third-party websites

12.1. Our shop includes hyperlinks to, and details of, third-party websites, including our payment providers’ checkout pages.

12.2. We have no control over, and are not responsible for, the privacy policies and practices of third parties.

12.3. We periodically review our relationships with third parties to help ensure they are compatible with our standards of data protection.

13. Updating your information

13.1. You can update your name, email address and saved addresses by signing in to your customer account on our shop. Please let us know if any other personal information we hold about you needs to be corrected or updated, by contacting fundraising@shp.org.uk.

14. Cookies

14.1. Our shop uses cookies and similar tracking technologies.

14.2. A cookie is a small file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and stored by the browser. The identifier is then sent back to the server each time the browser requests a page from that server.

14.3. Cookies may be “persistent” or “session” cookies. A persistent cookie is stored by a web browser and remains valid until its set expiry date, unless deleted earlier by the user. A session cookie expires at the end of the browsing session, when the browser is closed.

14.4. Cookies do not usually contain information that personally identifies a user, but personal information we hold about you may be linked to information stored in, or obtained from, cookies.

14.5. In accordance with PECR, we only set non-essential (for example, analytics and marketing) cookies with your consent. We ask for your consent through a pop-up cookie banner when you first visit our shop, managed by the Pandectes GDPR Compliance app. Strictly necessary cookies, required for the shop to function, do not require consent. We keep a record of your cookie choices as evidence of your consent, and you can change your choices at any time using the cookie settings option on our shop.

14.6. Most cookies on our shop are set by Shopify. They fall into the following categories:

Category	What the cookies do	Consent needed?
Strictly necessary	Keep your basket, run checkout, keep your account signed in, protect against fraud and security threats, and remember your cookie choices	No
Preferences	Remember settings such as your country, currency and language	Yes
Analytics	Shopify Analytics helps us understand how visitors use our shop, for example pages viewed and gifts added to the basket	Yes
Marketing	Measure the effectiveness of our campaigns and, where enabled, show relevant adverts on other platforms	Yes

A full, current list of the cookies Shopify sets, with their names and expiry periods, is available at shopify.com/legal/cookies.

14.7. Most browsers allow you to manage or refuse cookies through their settings. Guidance for common browsers is available at:

Chrome: support.google.com/chrome/answer/95647

Firefox: support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop

Safari: support.apple.com/en-gb/guide/safari/sfri11471/mac

Microsoft Edge: support.microsoft.com/en-us/microsoft-edge

14.8. Please be aware that blocking or deleting strictly necessary cookies will stop parts of our shop working, including your basket and checkout.

14.9. You can delete cookies already stored on your device through your browser’s settings; the links at 14.7 provide guidance on how to do this for common browsers.

15. Data protection registration

15.1. We are registered as a data controller with the UK Information Commissioner’s Office.

15.2. Our data protection registration number is Z8447316.

16. Contact details

16.1. Our shop at shop.shp.org.uk is owned and operated by Single Homeless Project, and hosted by Shopify.

16.2. We are registered in England and Wales, Charity Number 287779, and our registered office is at 245 Gray’s Inn Road, London WC1X 8QY.

16.3. Our principal place of business is 245 Gray’s Inn Road, London WC1X 8QY.

16.4. Our Data Protection Officer is Doug Becker, who can be contacted at dbecker@shp.org.uk.

16.5. You can contact us:

a) by post, using the postal address given above;

b) by using the contact form on our shop;

c) by telephone, on the contact number published on our shop; or

d) by email, at fundraising@shp.org.uk for questions about orders, or by contacting our Data Protection Officer directly using the details above.