Privacy Notice

GeckoFundraising Ltd

Privacy Notice

Last updated: 12 September 2026

1. Who we are and how to contact us

GeckoFundraising Ltd is the data controller for the personal data described in this notice, except where section 5 explains that we act as a processor on behalf of a client.

• Company name: GeckoFundraising Ltd, registered in England and Wales
• Company number: 15022555
• ICO registration number: ZB408520
• Registered office: Castledine House Business Centre, 5 Heanor Road, Ilkeston, Derbyshire, DE7 8DY
• VAT registration number: 524 1742 12
• Email: amie@geckofundraising.co.uk
• Telephone: 07862 399895
• Website: geckofundraising.co.uk

We are a small business operated by our founder and director, Amie Elliott, who is responsible for data protection. We do not have, and are not required to have, a Data Protection Officer.

2. Who this notice applies to

This notice explains how we collect and use personal data about:

• visitors to our website;
• people who contact us with an enquiry;
• learners who create an account or purchase a course through our online training Platform;
• subscribers to our newsletter, GeckoFundraising Weekly;
• clients and prospective clients of our consultancy services, and the people who work for them;
• contacts at funders, grant-making trusts, commissioners and other organisations in the charity sector;
• associate consultants, suppliers and professional advisers who work with us.

Our website and services are intended for adults and for people acting on behalf of organisations. We do not knowingly collect personal data from anyone under 18.

3. The information we collect

Website visitors

We do not run Google Analytics or any other analytics, advertising or tracking tool on our website. Our website host records standard technical information, such as IP address, browser type and the pages requested, in its server logs for security and to keep the site running. Our website also sets a small number of strictly necessary cookies, for example to keep you logged in to the Platform and to remember items in your basket. Section 14 explains more about cookies.

Enquiries

When you contact us through the website form, by email or by telephone, we collect your name, email address, telephone number (if given), your organisation and the content of your message.

Learners on our training Platform

When you create an account or purchase a course, we collect:

• your name, email address and organisation;
• your login details (your password is stored in encrypted form and we cannot see it);
• your purchase history, order confirmations and VAT invoices;
• the consent you gave at checkout to immediate access to course content;
• your course progress, knowledge check results and any certificates issued to you;
• a record of which account each Downloadable Copy of a course was issued to, and the identifying mark applied to that copy;
• any complaint, appeal, refund request or other correspondence about your course.

Payment card details are collected and processed by Stripe, our payment processor. We never see or store your full card number.

Newsletter subscribers

When you subscribe to GeckoFundraising Weekly we collect your name, email address, the date and method of your consent, and delivery and engagement information such as whether an email was delivered, opened or a link clicked. Subscribing is always optional and is never a condition of accessing a course.

Consultancy clients and prospective clients

When you enquire about or engage our consultancy services, we collect:

• the name, job title and contact details of the people we work with at your organisation;
• information about your organisation, its structure, purpose, projects, finances and fundraising needs;
• our correspondence with you, including emails, meeting notes and call records;
• contract, invoicing and payment records;
• the documents you provide to us so that we can prepare funding applications, tenders and strategies (see section 5 for how we handle personal data about your beneficiaries).

Funder and sector contacts

In the course of our work we hold business contact details for people at funders, grant-making trusts, commissioners, charities and sector bodies. We also carry out prospect research on funding organisations. This research uses publicly available information about organisations, including the names of trustees and senior staff as published on the Charity Commission register, funder websites, annual reports and similar sources. We do not carry out research on named individuals as potential major donors.

Associates, suppliers and professional advisers

Where we engage an associate consultant or a supplier, we collect the information we need to verify identity and right to work, contract with you and pay you. This includes your name, address, copies of identity documents, right to work evidence, Unique Taxpayer Reference, company and VAT details where relevant, professional indemnity insurance details, bank account details, invoices and our correspondence with you.

Information we receive from other sources

Most of the information we hold comes directly from you. We may also receive information from publicly available sources such as Companies House, the Charity Commission register and organisational websites, from clients who introduce us to their colleagues or partners, and from people who recommend our services.

4. How we use your information and our lawful basis

UK data protection law requires us to have a lawful basis for each use of personal data. The table below sets out what we do and why we are allowed to do it.

Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and freedoms, and we have concluded that they are not. You can ask us for more information about that assessment, and you have the right to object (section 11).

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible reason. If we need to use your data for an unrelated purpose, we will tell you and explain the lawful basis.

5. Personal data we handle on behalf of our clients

When a charity or other organisation engages us to write a funding application, tender or strategy, it will usually give us documents that contain personal data about its own beneficiaries, staff, volunteers and supporters. This can include case studies, quotes, impact data and, sometimes, special category data such as information about health, disability, ethnicity or religion.

For that data, the client is the data controller and GeckoFundraising Ltd is a data processor. This means that:

• we use the data only to carry out the work the client has asked us to do, and only on the client’s written instructions;
• our Contract for Services includes the data processing terms required by Article 28 of the UK GDPR, and a client can instruct us in writing not to use AI tools on its data;
• we never add to, embellish or alter case studies, quotes or statistics beyond what appears in the client’s source material;
• we share the data with a funder only when the client has approved the application or document in which it appears;
• where an associate consultant works on the assignment, they do so as a sub-processor under a written contract with us that imposes the same obligations (section 8);
• we return or securely delete the client’s materials at the end of the engagement, unless the client instructs us otherwise or the law requires us to keep them.

If you are a beneficiary, employee or volunteer of one of our clients and have a question about how your data has been used in a funding application, please contact the client in the first instance. We will assist them in responding to you.

6. How we use artificial intelligence tools

We use AI-assisted research tools in our work. Specifically:

• we use AI tools to research publicly available information about funding organisations and their published priorities;
• client documents containing personal data about beneficiaries are not entered into any AI tool unless the provider is contractually bound not to use that data to train its models and appropriate international transfer safeguards are in place, and where possible we anonymise the data first;
• we do not use free or consumer-tier AI accounts for client work, and our associates are contractually bound by the same rule;
• we do not use AI tools to make decisions about you.

Our current AI provider is Anthropic (section 8). We will tell clients on request which tools have been used in preparing their work, and a client may instruct us not to use AI tools in relation to its data.

7. How we share your information

We do not sell, rent or trade personal data. We share it only in the ways described below.

• Service providers who process data on our behalf under written contracts, listed in section 8.
• Associate consultants who help us deliver client work, under a written contract with confidentiality, data protection and security obligations equivalent to our own.
• Funders and commissioners, when we submit an application, tender or report on a client’s behalf and with the client’s approval.
• Professional advisers such as our accountant, solicitors, bankers and insurers, where necessary.
• Regulators and authorities, including HMRC, the ICO and the courts, where we are required to do so by law.
• A successor business, if we sell or transfer the business or the Platform. We would tell you if this happens and the successor would be bound by this notice.

8. The service providers we use

The organisations below process personal data on our behalf. Each is bound by a written contract or data processing terms that require it to process data only on our instructions and to keep it secure.

An up to date list is available on request.

9. International transfers

Several of the providers in section 8 are based in, or hold data in, the United States. This means that some of your personal data is transferred outside the United Kingdom. Where that happens we make sure that one of the safeguards recognised under UK law is in place:

• the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge); or
• the provider’s data processing terms incorporate the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses approved by the ICO; or
• the data is held in a country covered by UK adequacy regulations, such as the European Economic Area.

Associates are not permitted to transfer client data outside the United Kingdom without our written consent. You can ask us for more information about the safeguard that applies to a particular provider.

10. How long we keep your information

We keep personal data only for as long as we need it for the purpose we collected it, including to meet legal, accounting and insurance requirements. Our standard retention periods are set out below. When a period ends we securely delete or anonymise the data.

The 6 year periods reflect the record-keeping requirements of HM Revenue and Customs and the limitation period for contractual claims under the Limitation Act 1980.

11. Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Access the personal data we hold about you and receive a copy (a Subject Access Request).
• Rectification of inaccurate or incomplete data.
• Erasure of your data in certain circumstances, for example where it is no longer needed or you have withdrawn consent.
• Restriction of processing in certain circumstances, for example while we check the accuracy of data you have challenged.
• Object to processing based on legitimate interests, and to object at any time to direct marketing.
• Data portability, meaning you can receive data you gave us in a machine-readable format, where we process it by automated means on the basis of consent or contract.
• Withdraw consent at any time where consent is our lawful basis. This does not affect the lawfulness of anything we did before you withdrew it, and it does not affect your access to any course you have purchased.

To exercise any of these rights, email amie@geckofundraising.co.uk or write to us at the address in section 1. We do not charge a fee unless a request is clearly unfounded or excessive. We may ask you to confirm your identity before we respond. We will respond within one month of receiving your request; if a request is complex we may extend this by up to two further months, and we will tell you if that is the case.

Some of these rights are subject to conditions. For example, we cannot erase records that we are legally required to keep, such as invoices. If we cannot comply with a request in full, we will explain why.

12. Marketing

We send GeckoFundraising Weekly, and information about our courses, only to people who have actively opted in. The opt-in box is never pre-ticked and is always separate from account creation or purchase. Every marketing email contains a one-click unsubscribe link, and you can also unsubscribe by emailing us. Unsubscribing takes effect promptly and does not affect your access to any course you have purchased.

We may occasionally email existing clients, and people we already work with at other organisations, about services directly relevant to their work, relying on legitimate interests. You can ask us to stop at any time and we will.

We do not share personal data with any third party for their own marketing purposes.

13. How we keep your information secure

We have put in place appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration or disclosure. These include password protection and two-factor authentication on our systems, encryption of devices, use of reputable providers with their own security certifications, restricting access to those who need it, and written confidentiality and data protection obligations on our associates. We have a procedure for handling suspected personal data breaches and will notify you and the ICO where the law requires us to do so.

14. Cookies

Our website uses only strictly necessary cookies. These are set by our website software to keep you logged in to the Platform, remember items in your basket, allow the checkout to work and protect the site from misuse. They do not track you across other websites and do not require your consent under the Privacy and Electronic Communications Regulations 2003. We do not use analytics, advertising or social media cookies. You can block cookies in your browser settings, but some parts of the Platform may then not work. If we introduce any non-essential cookies in future, we will update this notice and ask for your consent first.

15. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Knowledge checks on our Platform are marked automatically, but a certificate of completion is simply a record that you met the completion requirements stated in the course, and any concern about a result can be raised under our Appeals Policy.

16. Changes to this notice

We may update this notice from time to time. The most recent version, with its date, is always available on our website. If we make a significant change to how we use your data, we will tell you by email or by a notice on the Platform.

17. Complaints

If you have a concern about how we have handled your personal data, please contact us first at amie@geckofundraising.co.uk. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Website: www.ico.org.uk
• Telephone: 0303 123 1113

This notice should be read alongside our Terms and Conditions for the Purchase of Online Training, our Complaints Policy and our Appeals Policy, all of which are available on our website.