Facebook Instagram X-twitter Envelope
Text BIGHEARTS

to 70085 to donate £5

Donate Now

Privacy Policy

Privacy Policy

Last updated: May 2026

Big Hearts Community Trust takes your privacy very seriously and is committed to respecting your personal information. We will ensure that any data you provide to us is stored securely, treated with confidentiality and processed in accordance with the UK Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR) and any other relevant privacy and data protection laws in force from time to time (together, “Privacy Laws”).

This Privacy Policy (“Policy”) sets out how we collect, use and share your personal data when you use our services, participate in our programmes, visit our premises, make a donation, volunteer with us, attend our events or visit our website at www.bighearts.org.uk.

Please read this Policy carefully to understand how we will use and protect your personal data and for details of your rights.

1. Who Are We?

We are Big Hearts Community Trust, a Scottish Charitable Incorporated Organisation (SCIO), Scottish Registered Charity Number SC037311 (“Big Hearts”, “we”, “us”, “our”). We are the official charity of Heart of Midlothian Football Club. Please note that Big Hearts Community Trust is a separate legal entity from Heart of Midlothian FC and this Policy applies solely to data processed by Big Hearts Community Trust.

Our registered office address is:

Big Hearts Community Trust
Tynecastle Stadium
Gorgie Road
Edinburgh EH11 2NL

We are the “data controller” of your personal data, which means we determine how and why your personal data is processed.

If you have any questions about your personal data or this Policy, please contact us by email at communications@bighearts.org.uk or by post at the address above, or by telephone on 0131 603 4926 (Monday to Friday, 10am to 4pm).

2. What Is Personal Data?

Personal data means any information relating to a living individual who can be identified, directly or indirectly, from that information. Examples include a person’s name, address, telephone number, email address and photographs.

3. When Do We Collect Your Personal Data?

We collect personal data from you in a number of ways, including when you:

  1. visit our website or provide information through it, for example by signing up to our newsletter, completing a contact form or registering for an event;
  2. participate in or register for one of our programmes or services, such as Kinship Care, Edinburgh Memories, Football Memories, The Changing Room, Switching Play or any other Big Hearts project;
  3. make a donation to our charity, whether online, by phone, by post or in person;
  4. register to volunteer with us;
  5. purchase tickets for or attend a Big Hearts event, fundraiser, or activity;
  6. sponsor us or take part in a fundraising challenge on our behalf;
  7. contact us by email, phone, letter, social media or in person with an enquiry, complaint or feedback;
  8. attend an event or activity at Tynecastle Stadium or another venue used by Big Hearts; or
  9. are captured by CCTV at premises used by Big Hearts (including Tynecastle Stadium).

We may also receive information about you from third parties, such as partner organisations, Heart of Midlothian FC, funding bodies, or other charitable organisations, where this is necessary for the delivery of our services.

4. What Personal Data Do We Collect?

Depending on how you interact with us, we may collect the following types of personal data:

  • Identification Information: Name, date of birth, gender and photographs or video recordings taken at events or on our premises.
  • Contact Information: Email address, postal address, telephone number and social media handles.
  • Participation Information: Details of the Big Hearts programmes, activities or events you have participated in or registered for.
  • Donation and Payment Information: Details of donations you have made and payment information. We do not store full credit or debit card details — these are processed securely by our payment providers.
  • Volunteer Information: Details relevant to your volunteering role, including any relevant skills, availability, emergency contact details and, where required, PVG (Protecting Vulnerable Groups) disclosure information.
  • Health and Wellbeing Information: Where relevant to ensuring your safety or to deliver our support services (for example, mental health programmes or accessibility requirements), we may collect information about your health or wellbeing. This is classified as “special category” data and is treated with additional care.
  • Website Usage Information: Information about how you use our website, including your IP address, browser type, pages visited and referring URLs. This information is collected through cookies and similar technologies.

5. How Do We Use Your Personal Data?

We use your personal data for the following purposes:

  1. to register you for and deliver our programmes, activities and services;
  2. to process donations and issue thank-you communications or receipts;
  3. to manage your volunteer relationship with us;
  4. to communicate with you about our work, events, fundraising activities and news updates, where you have opted in to receive such communications;
  5. to respond to your enquiries, complaints or feedback;
  6. to administer events, fundraising challenges and activities;
  7. to comply with our legal, regulatory and safeguarding obligations;
  8. to monitor and improve our website and services;
  9. to produce anonymised or aggregated statistical data for reporting to funders, partners and regulatory bodies (this data will not identify you personally); and
  10. to ensure the safety and security of participants, volunteers, staff and visitors at our events and premises.

6. What Is Our Legal Basis for Using Your Personal Data?

We will only use your personal data where we have a lawful basis to do so. The lawful bases we rely on are:

  • Consent: Where you have given us clear consent to process your personal data for a specific purpose, for example when you sign up to our newsletter or opt in to marketing communications.
  • Contract: Where processing is necessary to fulfil a contract with you or to take steps at your request before entering into a contract, for example when you register for an event.
  • Legal obligation: Where processing is necessary to comply with our legal obligations, for example safeguarding, financial reporting or health and safety requirements.
  • Legitimate interests: Where processing is necessary for our legitimate interests (or those of a third party) and your rights do not override those interests, for example to improve our services or administer our charity effectively.
  • Vital interests: In rare circumstances, where processing is necessary to protect your vital interests or those of another person.

Where we process special category data (such as health information), we will only do so with your explicit consent, or where it is necessary for reasons of substantial public interest, safeguarding, or to protect vital interests.

7. Children’s Personal Data

Many of our programmes work with children and young people. We are committed to protecting children’s personal data and take additional care when processing it.

Where a child is under 13 years of age, we will obtain consent from a parent or legal guardian before collecting or processing their personal data. We do not knowingly market to children under 13.

We recommend that parents and guardians supervise their children when using our website.

8. Who Do We Share Your Personal Data With?

We may share your personal data with the following third parties where necessary:

  1. service providers who process data on our behalf, such as IT providers, website hosting providers, email marketing platforms and payment processors;
  2. funding bodies, grant-making organisations and statutory partners, where we are required to provide anonymised or aggregated data as part of our reporting obligations (we will not share data that identifies you individually unless we have your consent or are required to by law);
  3. Heart of Midlothian FC, where necessary for the joint delivery of programmes or events;
  4. professional advisors, including legal, financial and insurance advisors;
  5. law enforcement agencies, regulatory bodies and statutory authorities, where required by law or necessary for the prevention or detection of crime or safeguarding purposes; and
  6. any other third party where we have your consent or are otherwise legally permitted to do so.

We will never sell your personal data to third parties. We will not pass your personal data to any third party for their own marketing purposes without your explicit consent.

9. Where Do We Store Your Personal Data?

Our systems and those of our principal service providers are based in the UK or within the European Economic Area (EEA). Where it is necessary to transfer your personal data outside the UK or EEA, we will only do so where adequate safeguards are in place, in accordance with Privacy Laws.

10. How Long Do We Keep Your Personal Data?

We will not retain your personal data for longer than is necessary for the purposes for which it was collected. Retention periods will vary depending on the nature of your relationship with us and the type of data involved.

For example, we will retain donation records for seven years to comply with financial and tax reporting obligations. Programme participation data will generally be retained for two years after your last engagement with us, unless a longer period is required for safeguarding or legal reasons.

Where you unsubscribe from our communications, we will retain a record of your email address to ensure we do not contact you again. If you would like further information about our retention practices, please contact us using the details in Section 1.

11. Your Rights

Under Privacy Laws, you have a number of rights in relation to your personal data. You may exercise any of these rights by contacting us using the details in Section 1.

  • Right to access: You may request a copy of the personal data we hold about you, free of charge.
  • Right to rectification: You may ask us to correct any inaccurate or incomplete personal data we hold about you.
  • Right to erasure: You may ask us to delete your personal data where it is no longer necessary for us to use it, where you have withdrawn consent, or where we have no lawful basis for keeping it.
  • Right to restrict processing: You may ask us to restrict our use of your personal data in certain circumstances, for example while we are considering a request from you to correct or delete it.
  • Right to data portability: You may ask us to provide you with the personal data we hold about you in a structured, commonly used, machine-readable format, or ask us to transfer it to another organisation.
  • Right to object: You may object to our processing of your personal data. Where you object to processing for direct marketing purposes, we will stop immediately.
  • Right to withdraw consent: Where we rely on your consent to process your personal data, you may withdraw that consent at any time. This will not affect the lawfulness of processing carried out before the withdrawal.

Right to make a complaint: If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). You can contact the ICO at www.ico.org.uk, by telephone on 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. However, we would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.

12. Cookies

Our website uses cookies to help us understand how you use the site and to improve your experience. A cookie is a small text file placed on your device when you visit a website.

We use cookies for the following purposes:

  • Strictly necessary cookies that are essential for the website to function;
  • Analytics cookies that help us understand how visitors use our website, so we can improve it; and
  • Functionality cookies that remember your preferences.

Where cookies are not strictly necessary, we will ask for your consent before placing them. You can manage your cookie preferences through our cookie consent banner or through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

13. How Do We Keep Your Personal Data Secure?

We take the security of your personal data seriously. We have appropriate technical and organisational measures in place to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include secure hosting, encryption of data in transit, access controls and staff training.

While we take all reasonable steps to protect your data, please note that no method of transmission over the internet or electronic storage is completely secure. Where you have a password for any area of our website, you are responsible for keeping it confidential.

14. Links to Third Party Websites

Our website may contain links to other websites that are not operated by us. We have no control over and accept no responsibility for the content or privacy practices of third party websites. We recommend that you read the privacy policy of any website you visit.

15. Social Media

Big Hearts is active on social media platforms including Facebook, X (formerly Twitter) and Instagram. If you interact with us through social media, the relevant platform’s privacy policy will also apply to your data.

If you upload content such as photographs or comments to our social media pages, please be aware that this information may be publicly visible. If your content identifies a third party, you should ensure you have their consent before sharing.

16. Updates to This Policy

We may update this Policy from time to time to reflect changes in our practices or in the law. Any changes will be posted on our website. We encourage you to review this Policy periodically. This Policy was last updated in May 2026.

17. How to Contact Us

If you have any questions about this Policy, about how we handle your personal data, or if you wish to exercise any of your rights, please contact us:

Email: communications@bighearts.org.uk
Post: Big Hearts Community Trust, Tynecastle Stadium, Gorgie Road, Edinburgh EH11 2NL
Telephone: 0131 603 4926 (Monday to Friday, 10am to 4pm)

Big Hearts Community Trust is a Scottish Registered Charity, Number SC037311.