Effective date: 26 June 2026 (last updated; added provisions on online forms, casework representation, and criminal-offence data)
Circle Vision Foundation (“the Foundation”, “we”) protects your personal data in accordance with the UK GDPR (Data Protection Act 2018 together with the retained EU GDPR as it applies in the UK following the UK’s withdrawal from the EU). This page explains what data we collect, why we collect it, how we use it, and what rights you have.
The Foundation is registered on the Information Commissioner’s Office (ICO) data protection register. We are registered with the Information Commissioner’s Office (Registration: ZB743793). You can verify our registration status at ico.org.uk/ESDWebPages/Entry/ZB743793.
1. Data Controller
| Item | Details |
| Name | Circle Vision Foundation |
| Nature | Charitable Incorporated Organisation (CIO), registration number 1209727 |
| Registered office | 167-169 Great Portland Street, 5th Floor, London, W1W 5PF |
| Contact | [email protected] |
| ICO data protection registration | Registration No. ZB743793 — Verify registration status |
| Supervisory authority | Information Commissioner’s Office (ICO) — the UK data protection supervisory authority |
2. What Data We Collect
We collect only the personal data necessary to fulfil our charitable purposes:
| Data type | How collected | Purpose |
| Email address | Via article unlock form / contact form | Sending newsletters, responding to enquiries |
| Source URL | Automatically recorded on form submission | Understanding which articles are most popular |
| IP address | Automatically recorded on form submission | Prevention of abuse and spam |
| Name / contact details | Provided voluntarily by email or form | Providing casework consultations and follow-up |
| Necessary cookies | Set automatically when you visit the website | “Subscribed” flag (to avoid displaying the unlock form repeatedly), login session |
Through this website, we do not collect: credit card or bank details, or location data. Donations are processed via JustGiving (an independent platform) — we do not handle your payment details.
Identity and sensitive information: when you request individual casework or advice, legal or administrative help, an eligibility check, or where required by law or regulation, we may need to collect: (1) identity or supporting documents (such as your name, date of birth, passport/BRP/eVisa, and visa or immigration status); and (2) information relevant to your case that may be special category data (UK GDPR Article 9), such as health/medical or disability information. We collect such sensitive information only with your explicit consent, or under another condition permitted by UK GDPR Article 9 (for example to provide advice to you, or to establish, exercise or defend legal claims); we collect only what is necessary, keep it strictly confidential, use it only for that purpose, and handle it in line with this policy.
Online forms and acting on your behalf: when you request help through one of our online forms (for example, the “Rail Fare SJP Conviction Set-Aside” intake form), we collect the personal data you provide, the identity and case documents you upload, and criminal-offence data (UK GDPR Article 10) directly relevant to your case (such as conviction records, fine/cost amounts, and case/URN numbers). If you expressly authorise us to act on your behalf (for example, to prepare and submit a request or application to have a conviction declared void and set aside and to seek a refund), we will correspond in your name, and only within the scope of your authority, with the courts, HMCTS and the relevant prosecutor (such as a train company). We collect only what is necessary for that purpose.
3. Our Lawful Basis for Processing
Under UK GDPR Article 6:
| Purpose | Lawful basis |
| Sending electronic newsletters | Consent (you have subscribed voluntarily) |
| Responding to your enquiries | Legitimate interest (providing charitable services) |
| Casework file management | Consent + Legitimate interest |
| Necessary cookies | Legitimate interest (proper operation of the website) |
| Compliance with legal obligations (such as anti-money laundering, ICO reporting) | Legal obligation |
| Processing criminal-offence data (e.g. set-aside / refund casework) | UK GDPR Article 10 + Data Protection Act 2018 s.10 / Schedule 1: your explicit consent, and the “legal claims” condition (processing necessary for the establishment, exercise or defence of legal claims); we maintain an Appropriate Policy Document as required |
| Acting on your behalf and corresponding with courts / HMCTS / prosecutors | Consent (your written authority) + Legitimate interest (exercising your legal rights on your behalf; providing charitable services) |
4. How We Store and Protect Your Data
- Data is stored on servers located in the UK or the EU
- Databases are password-protected and accessible only to authorised volunteers and trustees
- The website uses SSL/TLS (HTTPS) for transmission
- Email subscription data is subject to industry-standard access controls
- Casework files are destroyed 6 years after assistance concludes (in accordance with the Limitation Act 1980)
- Identity and case documents uploaded through online forms are accessible only to authorised personnel, transmitted in encrypted form, and subject to the same retention period; online forms and file uploads are processed by our forms provider (Jotform) under a Data Processing Agreement in its secure environment
- Email subscription records are retained until you unsubscribe
5. Who We Share Data With
We do not sell, rent, or trade your data.
Data is shared only in the following circumstances:
- Legal requirement: Court orders, police investigations, HMRC enquiries
- Referrals you have explicitly consented to: for example, referrals to Citizens Advice, Shelter, ACAS, and partner solicitors
- Service providers: email delivery (such as Mailchimp or MailerLite), website hosting (Hostinger), online forms and file uploads (Jotform) — these providers have each signed a Data Processing Agreement and process data only on our instructions
- Casework you have authorised us to handle: when you expressly authorise us to act on your behalf, we share the necessary data with the courts, HMCTS and the relevant prosecutor (such as a train company), within the scope of your authority and as needed for your case
6. Your Rights (UK GDPR)
Under UK GDPR Articles 12–22, you have the right to:
| Right | Meaning |
| Access | Request a copy of all data we hold about you |
| Rectification | Correct inaccurate or out-of-date data |
| Erasure (“right to be forgotten”) | Request deletion of your data (unless we are under a legal obligation to retain it) |
| Restriction of processing | Request that we pause processing of your data (for example, whilst accuracy is disputed) |
| Data portability | Obtain your data in a machine-readable format |
| Objection | Object to our processing of your data on the basis of “legitimate interest” |
| Withdraw consent | Unsubscribe from our mailing list (every email contains a one-click unsubscribe link) |
How to exercise your rights: Send an email to [email protected], stating “Data Subject Request”. We will respond within 30 days, free of charge.
7. Cookies
This website uses the following cookies:
| Cookie name | Type | Purpose | Duration |
| cvf_subscriber | Necessary | Records that you have subscribed, to avoid the unlock form displaying repeatedly | 1 year |
| cvf_cookie_consent | Necessary | Records that you have viewed the cookie notice | 1 year |
| WordPress session cookies | Necessary | Manage administrator sessions (staff only) | Session duration |
This website does not use tracking, advertising, or third-party analytics cookies. If any are added in future, your consent will be obtained first.
You may delete cookies at any time through your browser settings — however, if you delete cvf_subscriber, the unlock form will be displayed again.
8. Email Subscriptions and Unsubscribing
To subscribe to our email newsletter:
- You voluntarily subscribe through an article unlock form or website form
- You may click “Unsubscribe” in the footer of every email
- Unsubscription takes immediate effect — we will not send you any further emails, but we will retain a record of “unsubscribed” status to ensure you are not added again
9. Children (Under 16)
This website is aimed primarily at adults. Children under 16 who wish to submit a contact form or subscribe to our newsletter should do so through a parent or guardian. If we discover that data from a child under 13 has been collected inadvertently (in accordance with UK GDPR Article 8), we will delete it immediately.
10. Third-Party Links
This website may contain links to third-party organisations including the NHS, gov.uk, Citizens Advice, Shelter, ACAS, and JustGiving. Each third party has its own privacy policy — the Foundation accepts no responsibility for their content, conduct, or data processing practices. Please review their privacy notices before using their services.
11. Changes to This Policy
In the event of material changes, we will:
- Display a change notice on the website (at the top of the page or as a pop-up) for 30 days
- Send a notification to all email subscribers
- Update the “effective date” on this page
12. Complaints
If you have any concerns or complaints about the way we handle your data, please contact us in the first instance: [email protected]
If the matter cannot be resolved, you may complain to the UK data protection supervisory authority:
| Item | Details |
| Organisation | Information Commissioner’s Office (ICO) |
| Telephone | 0303 123 1113 |
| Website | ico.org.uk/concerns/ |
| Post | Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
13. Contact Us
If you have any questions about this privacy policy:
Email: [email protected]
Postal address: 5th Floor, 167-169 Great Portland Street, London, W1W 5PF
This policy was last updated: 26 June 2026. Version: v1.3.