Privacy Policy

Last updated: July 2026

At Kids Operating Room, we rely on the generosity and support of people like you to help us reach our goal that every child, everywhere, has access to safe surgery. This Privacy Notice explains what personal information we collect, why we collect it, how we use it, and the rights you have over it.

We collect and use personal data to manage our relationships with children, their families, healthcare professionals, partners, volunteers and supporters, and to better understand how we can meet and exceed expectations. This allows us to operate and fundraise ethically, lawfully and effectively so that every child can access safe surgery.

This notice applies whenever you interact with us – for example, by donating, fundraising, volunteering, applying for a role, attending an event, contacting us, or using our website. Please read it alongside our Cookie Policy, Website Terms & Conditions, and any additional privacy information provided at the point of data collection.

By providing us with personal information, you agree to it being collected and used as set out in this notice. We aim to be clear and transparent, and to use your information only in ways you would reasonably expect. We may update this notice from time to time, so please check back periodically.

Who we are
Where we collect information from
Information we collect
How we use your information
Our lawful basis for processing
Profiling and understanding our supporters
Keeping your information up to date
Who we share your information with
International transfers
How we keep your data safe
How long we keep your information
Marketing and fundraising communications
Children and vulnerable individuals
Cookies
Your rights
Changes to this notice
Further information and how to contact us

1. Who we are

Kids Operating Room is a Scottish registered charity (SC048523) working globally to provide safe surgery for children.

Our registered office is:

Kids Operating Room
107 George Street
Edinburgh, EH2 3ES

We are the “data controller” for the personal information described in this notice, meaning we decide how and why it is used.

2. Where we collect information from

Information you give us

You may provide personal information when you make a donation, register for an event or fundraising activity, apply to volunteer, sign up to our communications, complete a form on our website, or contact us directly.

Information from third parties

We may receive information about you from trusted third parties, such as fundraising platforms (for example JustGiving), event organisers, or mailing list providers. We only receive information in this way where you have consented to it being passed to us, or where lawful marketing permissions apply. Once we hold it, it is covered by this notice as well as by the originating third party's own privacy notice, which we’d encourage you to check.

Information from your use of our website

We collect information about how you use our website and services, including through cookies, email tracking (such as whether you open an email or click a link), and analytics tools.

Publicly available information

We may collect limited information from public sources such as Companies House, media articles, or professional and social networking sites (for example LinkedIn), where this is relevant and proportionate – for example, to understand a supporter‘s professional background or philanthropic interests.

3. Information we collect

Depending on how you engage with us, this may include:

Name, title, gender and date of birth
Contact details (postal address, email, phone number, social media handles)
Family or relationship details, where relevant
Employment and professional information
Donation history and Gift Aid status
Event registrations and fundraising activity
Contact preferences and engagement history
Volunteer or job application information
Financial details for secure payment processing, handled in line with payment card industry standards
Publicly available biographical or media information, and information about wealth or philanthropic interests where relevant to major gift fundraising
Website usage data such as your IP address and browser type

Where appropriate we may also ask about your interests and motivation for supporting Kids Operating Room, although we will never make this question mandatory. In limited circumstances we may also collect special category data (sometimes called “sensitive data”), such as information about health, religious belief, racial or ethnic origin, or criminal offence data – for example, health information needed for event participation, or information relevant to safeguarding or due diligence. Where we collect this type of information, we will always explain why it is needed.

If you are under 13, please ask a parent or guardian before sending us any personal information online.

4. How we use your information

We mainly use your information to:

Deliver the services, events and activities you request
Process donations and claim Gift Aid
Communicate with you in line with your preferences
Keep accurate records of our relationship and engagement with you
Carry out ethical fundraising and supporter care, including due diligence in line with our Ethical Fundraising Policy
Carry out safeguarding checks where appropriate
Improve our communications and services
Comply with our legal and regulatory obligations

Where you have chosen to receive marketing communications, we will also keep you updated about our work, campaigns, and opportunities to support Kids Operating Room. You can change your preferences or unsubscribe at any time.

5. Our lawful basis for processing

Under UK GDPR and the Data Protection Act 2018, we must have a lawful basis for using your personal information. Depending on the circumstances, we rely on:

Consent – for example, for marketing communications
Contract – to fulfil an agreement with you, such as processing a donation or event booking
Legal obligation – for example, complying with charity or financial regulation
Vital interests – in rare cases, primarily safeguarding scenarios where this is necessary to protect someone's life or wellbeing
Legitimate interests – to run Kids Operating Room effectively as a charity, including postal fundraising and supporter profiling that does not unduly impact your rights

Whenever we rely on legitimate interests, we carefully balance our interests against your rights and freedoms, and we will not use your information where those rights override our interests.

6. Profiling and understanding our supporters

To help us tailor what type and level of support we ask you for, we may analyse personal information we collect about you, including how you have engaged with us previously, demographic information, measures of affluence, and philanthropic interests and networks.

We may also use information in the public domain, for example listed directorships or typical earnings in a given area. In some instances we work with third-party wealth screening or insight companies to provide general information of this kind (see Section 8 for more on how we share data with third parties). This helps us avoid asking for the wrong level, or type, of support, and helps ensure our fundraising approaches are appropriate and respectful.

You can opt out of your data being used for profiling or wealth screening at any time, with no effect on any other services we provide to you, by contacting our Data Protection Lead (see Section 17).

7. Keeping your information up to date

We review records of our supporters and volunteers to keep them as accurate as possible, and always appreciate you letting us know if your contact details change. Where possible, we use publicly available sources to help keep records up to date, such as the Post Office’s National Change of Address database.

8. Who we share your information with

We do not sell personal data. We may share information with trusted service providers acting as data processors on our behalf, including:

Mailing and communications providers
Event management platforms
Secure payment processors
Insight and wealth screening providers
Professional advisers (for example, auditors or legal counsel)

All providers are subject to contracts and due diligence checks before we work with them.

9. International transfers

Some organisations we work with may process information outside the UK – for example, to support an event taking place abroad, or where a supplier’s systems are hosted overseas. Transfers within the European Economic Area (EEA) are recognised under UK law as offering an adequate level of protection. Where we transfer data outside the UK or EEA, we put appropriate safeguards in place in line with UK data protection law, such as approved standard contractual clauses.

10. How we keep your data safe

We use appropriate technical, physical and organisational measures to protect your information against unauthorised access, loss, misuse or disclosure – for example, encrypted online forms and a monitored network. All our staff receive regular training on handling data securely, and we carry out due diligence on any external company before they process data on our behalf.

No transmission of data over the internet can ever be guaranteed completely secure. While we work hard to protect your information, we cannot guarantee the security of information you send to us.

11. How long we keep your information

We only keep personal information for as long as necessary for the purpose it was collected, including to meet legal, accounting or regulatory requirements. If you ask us to stop contacting you, we will keep a minimal record of your details so we can honour that request, and won’t keep information we don’t need.

12. Marketing and fundraising communications

We comply with UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

Electronic communications

We will only send emails, SMS or other digital messages where you have given consent, or where the charitable soft opt-in applies. Every message includes a way to opt out, and we do not use purchased email lists.

Telephone and postal marketing

We screen against the Telephone Preference Service and Corporate Telephone Preference Service before any telephone marketing, and we do not make automated marketing calls without explicit consent. Postal marketing is carried out under legitimate interests, with clear opt-out options provided.

13. Children and vulnerable individuals

Given the nature of our work, we apply additional safeguards when processing data relating to children and adults in vulnerable circumstances. This includes providing age-appropriate privacy information, involving a parent or guardian where required, and a strict prohibition on using children's data for fundraising profiling or wealth screening purposes.

14. Cookies

Our website uses cookies and similar technologies to help it function and to understand how it is used. For details of the cookies we use and how to manage your preferences, please see our separate Cookie Policy.

15. Your rights

Under UK data protection law, you have the right to:

Access a copy of the personal information we hold about you, including what we use it for, who we share it with, how long we keep it, and whether it’s used for automated decision-making
Correct inaccurate or incomplete information
Ask us to erase your information, where we no longer need it or you withdraw consent
Restrict how we use your information
Object to processing based on legitimate interests, or to direct marketing at any time
Withdraw consent at any time, where consent is our lawful basis
Receive your information in a structured, portable, electronic format
Complain to the Information Commissioner’s Office (ICO)

To exercise any of these rights, please contact us using the details in Section 17, ideally in writing, along with evidence of your identity so we can verify your request. If a particular right does not apply in your circumstances, we will explain why.

16. Changes to this notice

Any changes to this notice will be flagged by displaying the word “NEW” next to the Privacy Notice link on our website, at least 30 days before the changes take effect. The latest version will always be available on this page.

17. Further information and how to contact us

This notice operates alongside the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003.

If you have any questions about this notice, wish to exercise any of your rights, or want to opt out of profiling or wealth screening, please contact our Data Protection Lead: