GDPR Data processing modelAssociations: managing members and donors

Sector: Associations, unions and political partiesSector: Social careOrganisation: Public

This processing relates to the management of members and donors for associations

Purposes (8)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Establishment of member directories

Legitimate interest

Alumni directory

Legitimate interest

Electronic direct marketing operations (email, SMS)

Consent

Article 6(1)(a) UK GDPR - consent, as required by PECR reg. 22(2) for direct marketing by electronic mail to individuals. Since 5 February 2026, a charity may instead use the charitable purpose soft opt-in (PECR reg. 22(3A)) for contact details collected directly from supporters on or after that date, solely to further its own charitable purposes, with a free opt-out at collection and in every message.

Prospecting operations

Legitimate interest

Member prospecting operations

Legitimate interest

Creation of statistical reports or lists of members or contacts

bulletins, notices, newspapers

Legitimate interest

Donor prospecting operations

Legitimate interest

Administrative management of members and donors

Contribution management in accordance with statutory provisions

Legitimate interest

Data categories (3)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Administrative management information

Data details

Bank identity for donation managementrequired

Information strictly related to the statutory purpose of the organizationrequired

Association positionrequired

Contribution statementrequired

Data conservation rules

Active base:

No statutory period. Member data are kept for the duration of membership and deleted or anonymised after resignation, removal or departure, unless the person agrees otherwise or a longer period is required (for example accounting records). Donor data are reviewed regularly and deleted when the donor has not given or responded to appeals over a period set by the controller. Gift Aid declaration records are kept for 6 years from the end of the accounting period they relate to; enduring declarations covering regular donations are kept while donations continue and for 6 years after the final donation.

Article 5(1)(e) UK GDPR; HMRC guidance 'Gift Aid declarations: claiming tax back on donations'.

Destruction

Association website connection data

Data details

Page viewedrequired

IP addressrequired

Date and time of connectionrequired

Data conservation rules

Active base:

No statutory period. Website connection and security logs are kept for a period set by the controller according to security needs (for example 12 months), in line with Article 5(1)(e) UK GDPR.

Article 5(1)(e) UK GDPR

Destruction

Members and donors

Data details

Email addressrequired

Fax numberrequired

Telephone numberrequired

Date of birth

required

Genderrequired

First namerequired

--Name

required

Data conservation rules

Active base:

Article 5(1)(e) UK GDPR; HMRC guidance 'Gift Aid declarations: claiming tax back on donations'.

Destruction

Data subject (3)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Other
Prospects
Visitors

Created at:07/08/2023

Updated on:10/05/2026

Nb using:12