Privacy policy

Privacy policy

Money Ready is committed to protecting your personal information and being transparent about what information we hold, whether you are a donor, volunteer, or young person who we support.

We update this policy from time to time to reflect changes in the law or in how we work. This version brings us in line with the latest UK data protection rules, including a new, more direct way for you to raise a complaint with us — see section 13 “Complaints” below.

Developing a better understanding of our supporters through their personal information allows us to fundraise more efficiently, which ultimately helps us support more young people. Information from service users helps us to improve the programmes and tailor the service to the need of the individual.

This Privacy Policy applies to visitors of our website (https://moneyready.org/) and to other individuals we interact with in the course of providing our charitable activities, including service users of Money Ready projects, programmes and events, as well as other donors, fundraisers, supporters, and volunteers (together the “Activities”). The purpose of this policy is to give you a clear explanation about how Money Ready collects and uses the personal information you provide to us.

For the purposes of this policy, “personal information” is any information that relates to you and/or information from which you can be identified, directly or indirectly, which is processed by Money Ready. Please see the section titled “What personal information do we collect about you?” for further details about the types of information we collect.

1. Who are we?

Money Ready (formerly MyBnk) is a registered charity in England and Wales (No. 1123791) and Scotland (SC050175) and a company limited by guarantee (No. 6215005). Our registered address is 40 Gracechurch Street, London EC3V 0BT, UK. All references in this policy to “our”, “us” or “we” refer to Money Ready.

2. How can I contact Money Ready?

We are a data controller, which means that we are responsible for, and control the processing of, your personal information. If you have any questions about this policy or want to exercise your rights as a data subject set out in this policy, you can send us an email at [email protected] or write to us at The Data Protection Officer, Money Ready, 40 Gracechurch Street, London EC3V 0BT, UK.

3. What personal information do we collect about you?

In the course of our Activities, we may collect and process different types of personal information about you for different processing purposes. The types of personal information we collect depend on who you are and how you interact with us. We have grouped the types of personal information which we may collect, store, transfer and use about you below:

• Identity Data includes: Legal first name and last name, title, date of birth and gender
• Contact Data includes: Email address, postal address, telephone numbers, billing address (if making a donation), and communication preferences
• Health Data includes: Information about your health and any medical conditions or disabilities you may have
• Criminal Convictions Data includes: DBS certificates (where required to volunteer with us)
• Financial Data includes: Information about whether you are a taxpayer, to help us claim Gift Aid
• Technical Data includes: Your IP address and general processing or monitoring data for performance and technical purposes
• Usage Data includes: Information about how you use our website and services
• Marketing and Communications Data includes: Your preferences in receiving marketing from us and our third parties, and your communication preferences.

We do not collect special categories of personal data about our supporters or service users unless there is a clear reason for doing so — for example, relating to your health if you are visiting The Money House or another workshop, or taking part in a challenge event to raise funds for us. We will only collect and use that sensitive personal data with consent or where we have a legal obligation, and clear notices will be provided on applications for events and other relevant forms and communications, so you know what information we need and why we need it. You can withdraw your consent at any time. Please see the section titled “Your Rights” for further details.

4. How do we collect your personal information?

We collect personal information about you:

• When you give it to us directly – This could be when you:
  • Ask about our activities, resources or training
  • Register with us for information
  • Use our services or attend our programmes, workshops or other activities
  • Sign up for publications or newsletters
  • Volunteer or fundraise for us
  • Pledge or make a donation or sign up for an event
  • Sign up to become a member of our Youth Advisory Panel
  • Give us feedback or complete a survey
  • Telephone, write, contact us online or text us or otherwise provide us with your personal information.
• When you visit our website – we and our third-party partners use cookies, web beacons, pixel tags and similar technologies (together, “Cookies”) to collect data from the devices you use to access our website and any emails you receive from us. We use Cookies to monitor how well our website is performing, including analysing which pages you visit most often and which services, events or information is of most interest to you. Some Cookies used strictly for analytics, security or functionality purposes may not require your consent under updated e-privacy rules, but any Cookies used for advertising or similar purposes will still only be set with your consent. See our Cookies Policy for full details.
• When you interact with us through third parties – this could be if you provide a donation through a third party or one of the other third parties that we work with. This is only if you consent for your personal information to be shared with us.
• When we collect it through publicly available sources – from time to time, we may collect personal information about you that is contained in publicly available sources (including open source data sets or media reports) or that you or a third party may otherwise make publicly available (for example through published articles or social media posts). This information is used to help us identify those who may be able to help us with a larger gift.

5. How do we use your personal information?

The table below sets out the ways we plan to use your personal information, and the legal bases we rely on to do so, including our legitimate interests where relevant.

6. Recognised legitimate interests

Since February 2026, UK GDPR includes a specific list of “recognised legitimate interests” – including processing necessary for the safeguarding of vulnerable individuals, and for the detection, investigation or prevention of crime – which do not require a separate balancing test against your rights. Where Money Ready processes personal information for these purposes, for example as part of our safeguarding responsibilities to young people we support, we may rely on this basis instead of, or alongside, our other legitimate interests. This does not change the other protections in this policy, including your right to object described below.

7. Automated decision-making and profiling

We may use profiling and wealth-screening techniques, described above, to help us understand who may be able to support our work. Where this or any other automated process results in a decision that has a legal or similarly significant effect on you, we put safeguards in place: we will tell you clearly when this applies, and you have the right to request human review of the decision, to express your point of view, and to contest the outcome. You can also opt out of profiling and wealth screening at any time using the contact details at the start of this policy.

8. Your debit and credit card information

If you use your credit or debit card to donate to us, buy something, or pay for a registration online or over the phone, we will ensure that this is done securely and in accordance with the Payment Card Industry Data Security Standard (PCI DSS). You can find out more at www.pcisecuritystandards.org/security_standards/index.php.

All donations we receive are currently processed by secure third-party partners such as Enthuse.com and JustGiving. In each case we do not receive your credit or debit card details at all, following completion of your transaction. Please review the privacy policies of Enthuse and JustGiving if you wish to know how they manage your personal information.

If we receive an email containing any credit or debit card details, it will be immediately deleted, no payment will be taken, and you will be notified about this.

9. Links to other websites

Money Ready’s website contains some links to other websites that we think you might find interesting. However, please bear in mind that once you leave our website we cannot be responsible for the protection and privacy of any information that you might provide elsewhere, and that other websites are not governed by this privacy notice. Always read the privacy notice of the website in question before giving out any information.

10. Children and vulnerable persons

We place great importance on the safety of vulnerable persons. See a copy of our Safeguarding Children and Vulnerable Adults policy on our website.

We are committed to protecting the privacy of young people who want to fundraise for us or who are supported by Money Ready. In designing and running our services for children, we build in privacy by default, collect only the minimum personal information necessary, and explain how we use personal information in clear, age-appropriate language rather than lengthy legal text.

Our activities and fundraising events may request specific information about the age of participants, and we take reasonable steps to verify age where appropriate. Where appropriate, we will seek the consent of a parent, guardian or carer before collecting information about young people under 16.

11. How long we keep your personal information for

We keep your personal information only for as long as required for us to operate the relevant service or carry out our Activities, in accordance with legal requirements and tax and accounting rules. Where your information is no longer required, we will ensure it is disposed of in a secure manner. If you have any questions about data retention, please contact us using the details at the start of this policy. If any personal information is only useful for a short period (for example, for a specific activity, promotion or marketing campaign), we will not retain it for longer than the period for which it is used.

If you have opted out of receiving marketing communications from us, we will need to retain certain personal data on a suppression list indefinitely, so that we know not to send you further marketing in future. We will not use this information to send you further marketing unless you subsequently opt back in.

12. Your rights

You can help us keep our records up to date by telling us when your contact details and other personal information change.

You have the following rights under data protection law in relation to your personal information:

• Right of access – you can ask us for a copy of your personal information, confirmation of whether it is being used by us, and details about how and why.
• Right to update your information – you have a right to request an update to any of your personal information which is out of date or incorrect.
• Right to delete your information – you have a right to ask us to delete any personal information we hold about you in certain specific circumstances. Contact us using the details below for further information.
• Right to restrict use of your information – you have a right to ask us to restrict the way we process your personal information in certain specific circumstances. Contact us using the details below for further information.
• Right to data portability – you have a right to ask us to provide your personal information to a third-party provider of services.
• Right to object – you have a right to ask us to consider any valid objections to our use of your personal information where we rely on legitimate interests, including recognised legitimate interests. You also have the right to object where we process your personal information for direct marketing purposes.
• Right to withdraw consent – if you have given us your consent (or explicit consent) to use personal information, for example for marketing or the collection of health data, you can withdraw your consent at any time by contacting us using the details below.
• Right to be informed about complaints – if we are unable to act on a request you have made under any of the above rights, or in responding to a request for access to your information, we will tell you both about your right to complain to us directly and about your right to complain to the Information Commissioner’s Office (ICO). See “Complaints” below for how to do this.

Should you wish to exercise these rights, we may require you to prove your identity with a copy of valid identification, in order to comply with our security obligations and prevent unauthorised disclosure of data. Please address requests using the contact details at the start of this policy.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer if your request is particularly complex or you have made a number of requests. Please provide as much information as possible about the nature of your contact with us to help us locate your records.

13. Complaints

We take any concerns about how we handle your personal information seriously, and we want to make it as easy as possible for you to raise them with us. Since 19 June 2026, you have a specific statutory right to complain to us directly about our handling of your personal information, under section 164A of the Data Protection Act 2018, as well as your existing right to complain to the ICO.

14. How to raise a data protection complaint

You can raise a data protection complaint with us in any of the following ways:

• By email to: [email protected]
• By post to: The Data Protection Officer, Money Ready, 40 Gracechurch Street, London EC3V 0BT
• By telephone on: 020 3581 9920
• What happens after you raise a complaint

• • Acknowledgement – We will acknowledge receipt of your complaint within 30 days.
  • Investigation – We will investigate your complaint without undue delay, making appropriate enquiries and keeping you informed of our progress.
  • Outcome – We will write to you to explain the outcome of our investigation without undue delay once it is complete, including the reasoning behind our decision, and remind you of your right to also complain to the ICO.
• Your right to complain to the ICO

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues — either instead of, or after, contacting us. This right is unaffected by the introduction of our own complaints process above. The ICO can be contacted at: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or by telephone at: 0303 123 1113. You can read more about your rights on the ICO website at https://ico.org.uk/.

15. Sharing your personal information

We promise to make all reasonable efforts to keep your details secure and will only share them with:

• Third parties where we have a duty or are permitted to disclose your personal information by law, for example to comply with applicable laws, regulations and codes of practice, or in response to a valid request from a competent authority.
• Third-party fulfilment partners with whom we have a data sharing agreement, to help deliver our services, for example partners who help create and send information regarding platforms we use to process donations and claim Gift Aid.
• Payment processing platforms such as Enthuse and JustGiving.
• Third-party service providers, for example legal advisors, accountants, and information security advisors.
• Any person you have asked us to share information with.
• Third-party service providers assisting with the operation and administration of events. If we run an event in partnership with other organisations, we will share your personal data with those organisations for use in relation to the event.

16. Where we may transfer your personal information

Your personal information may be used, stored and/or accessed by staff operating outside the UK or the EEA working for our suppliers.

Where we transfer personal information about you to recipients outside the UK and EEA, we take appropriate measures to ensure the recipient protects your personal information adequately in accordance with this privacy policy. These measures may include:

• Relying on the UK’s data protection test for international transfers – for example, where the UK Government has made regulations recognising that a country provides protection that meets this test, in the case of transfers out of the UK, or an equivalent European Commission adequacy decision for transfers out of the EEA. For further details see: https://www.gov.uk/government/publications/uk-approach-to-international-data-transfers/international-data-transfers-building-trust-delivering-growth-and-firing-up-innovation.
• Putting in place standard contractual arrangements with the recipient, approved by the UK Government for transfers out of the UK, or the European Commission for transfers out of the EEA, which include safeguards to protect the personal data. For further details see: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-data-transfer-agreement-and-guidance/.

If you have any questions about international transfers of your personal data, please contact us using the details at the start of this policy.

17. Changes to this privacy policy

We may update the terms of this policy at any time, so please do check it from time to time. We will notify you about significant changes in how we treat personal information by sending a notice to the primary email address you have provided to us, or by placing a prominent notice on our website.