Privacy notice

Last updated 8 November 2026. See also our terms of use.

Who we are

The What Would Mia Do Trust (registered charity 1198310) is the data controller for information collected through this website. You can contact us through our contact form or by post at 90 Western Road, Burgess Hill, West Sussex, RH15 8QN.

What we collect and why

Grant applications

We collect the young person's name, contact details, date of birth, address, sporting interests and the information you give us about your circumstances, plus any files you attach. If you apply on someone's behalf we also collect your name, email and relationship to them. We use this only to assess and respond to the application, and to administer any grant. Our lawful basis is your consent, which you can withdraw at any time by contacting us.

When you send an application, we also record how it was sent: your internet (IP) address, your approximate location as estimated from that address (usually the nearest town), the type of device and browser you used, and when and how you signed in. Trustees can see this, but it is not shown in your account. We use it to protect the Trust's funds, for example to spot the same application being sent more than once or someone applying in another person's name. To do this, the website compares each application with others we hold (the email address, young person, address, internet address and device, and bank account), and shows trustees any links and warning signs. Bank accounts are compared using a one-way code made from the account details, which cannot be turned back into them, and which we keep after the details themselves are deleted. These checks only prompt trustees to look more closely: they never decide anything. Our lawful basis for this is our legitimate interest in preventing fraud and misuse.

For our reports (for example the figures in our annual return to the Charity Commission), we find the local authority and the official deprivation level of the area your postcode is in. Only the postcode is sent to postcodes.io, a free service using Office for National Statistics data, never your name or address, and the reports contain only counts and totals, never anyone's details.

Documents you send are checked automatically for signs they have been changed or reused: we keep a one-way fingerprint of each file (so the same file sent with another application is noticed), check it really is the kind of file it says it is, and read the details saved inside it, such as the software that made it and when. A trustee may also ask the automated assistant described below to read a document and say whether it matches the application. Trustees can add notes to a document for each other. If a trustee needs someone outside the Trust to check a document (for example a club treasurer confirming a quote), they can send that person a link to that one document, which stops working after a set time of no more than seven days, can be cancelled at any time, and is recorded on the application.

If you add files from your phone, using the QR code or code shown on your computer, the phone can only add files to that application, for 30 minutes, and cannot see anything in your account.

If a grant is approved, we may ask how it should be paid. If you give us bank details, they are encrypted, only seen by trustees when making the payment, and deleted as soon as the grant has been paid (or if the application is not successful or is withdrawn). We will never ask for bank details by email or phone.

If our trustees need more assurance about an application, for example to help prevent fraud, we may ask you to complete an identity check with Didit, a verification service we use for this. On Didit's secure pages you take a short selfie video, so Didit can check you are a real person taking part at the time and estimate your age. You are asked to let it see roughly where your device is, which it compares with the address on your application, and if that does not match you may be asked to upload a recent bill or statement showing your address. An adult doing the check may also be asked to photograph a passport or driving licence. Didit tells our trustees the result: whether each step passed, your estimated age, how far your device was from the address, the general area and internet connection, the type, issuer, name and address of any proof of address, and the type, issuing country, name, date of birth and expiry date of any photo ID, with the images of it. Our trustees can view the selfie and document images in Didit's records when reviewing a check, but we do not keep copies on our website. We keep the results with your application, only our trustees can see them, and they are deleted with it. Our lawful basis is our legitimate interest in preventing fraud and making sure grants reach the families they are meant for. Didit's own privacy notice explains how it handles your information, including your selfie.

Referrals

A teacher, coach or other professional can refer a young person, once the family have agreed. We keep what they tell us (the referrer's name, role, organisation and contact details; the young person's name, age, sport and why they might benefit; and the parent or carer's name and email address), and use it only to invite the family to apply and, if they do, to show our trustees who referred them. We tell the referrer when the family has applied, but not the outcome or anything the family tells us. If the family does not apply within 60 days, we close the referral.

Applications made on our old website

If you applied before this website opened, we have moved your application, its answers, our replies and the outcome across from our old systems, so trustees have a complete record and you can see it in your account. It appears there when you sign in with the same email address you used before. Notes trustees kept for themselves are not shown to you. Nobody is emailed about these old applications, and they are not checked by the automated assistant.

Automated checks on applications

When you send an application, and again when you answer a request from us, an automated assistant (Claude, an AI model made by Anthropic, which we run through Amazon Bedrock in our own Amazon Web Services account, in data centres in the UK and the European Union) reads it, with any documents you attached, and checks it against our grant criteria. It writes a short summary for trustees and may ask you for anything that seems to be missing. Requests that come from the assistant are marked as such. Your contact details are removed before it reads the application.

Trustees may also score applications against the Trust's criteria and ask the assistant for suggested scores to compare with their own; these are never counted. The assistant never decides whether a grant is approved or declined: trustees make every decision, and read every application themselves. No decision about you is made solely by automated means. The information is not used to train AI models. If you would rather your application was not checked this way, tell us and a trustee will review it without the assistant.

Your account

To apply you create an account with your email address. We keep your email, any details you choose to save, and your draft and sent applications, so you can come back to them. Draft applications are not seen by trustees. Only the Trust's administrators can look at a draft, for example to help if you tell us you are stuck or to sort out a problem with the website; they cannot change it, and each time one is opened it is recorded. You can delete a draft at any time, and ask us to delete your account.

If you are also a trustee, the website shows you a link to the trustee area. The trustee area has its own sign-in, with a second step such as an authenticator app.

Applications are seen only by the Trust's trustees. We keep them for six years after a decision, for our accounts and the Charity Commission, and then delete them. Unsuccessful applications are deleted after two years.

Donations

Card payments are processed by Square, and Direct Debits and one-off payments from your bank (pay by bank) by GoCardless. They handle your card and bank details; we never see or store them. We keep your name, email, the amount and date of your donation, any name you give it in memory of, and, if you choose Gift Aid, your home address and declaration. HMRC requires us to keep Gift Aid records for six years after the last donation they cover. We email you a receipt for each payment.

If you have an account with the same email address, your donations, monthly Direct Debits and Gift Aid declaration appear in it, so you can see them, print a statement, and change, pause or cancel a Direct Debit yourself. When you do, we ask GoCardless to make the change. If you set up a Direct Debit on our old website, we link it to your email address when its next payment arrives, using the details GoCardless holds.

If you give by cheque, we keep the reference we gave you and the date your cheque arrived, alongside the rest of your donation record.

If you email us, or reply to one of our emails, your email (and anything attached to it) is kept with your enquiry or application in the same way as a message sent through our website, and deleted on the same schedule. Our email provider, Amazon Web Services, checks incoming email for spam and viruses in the UK.

You can download a copy of what we hold about you, including your applications, messages, giving and the files you sent us, from Your details in your account. You can also ask us for a full copy at any time.

We delete things on a schedule our trustees set and review: for example, draft applications that are never sent, applications that were declined or withdrawn, and messages two years after the last one. For grants we paid, we keep a record without names, contact details or anything else that identifies anyone, so that we can report on our work. We keep donation and Gift Aid records for six years, as HMRC requires.

If you tick the box to hear what gifts like yours have done, we keep your email address, first name, the date of your first gift and when we last wrote, and send you an occasional email (never more than twice a year). Every email has a link to stop them, and stopping them does not affect your receipts. The stories in them are anonymous: our trustees write and check each one, with no names, and include a family's own words only if they agreed we could share them.

If an application names a coach or club contact and says we may contact them, we may email them a private link to confirm they know the young person. They see only the young person's first name (and, if our trustees choose, surname), age, sport and club, never the family's circumstances, address or what the grant is for. We keep their answer, their name and role, and any word of support with the application; only trustees see it, and it is deleted with the application.

If you make a fundraising page, we keep what you put on it (your title, story, photo, date, target and design), the updates you add, and your account email, which is never shown on the page. If you ask us to pay any of your costs, we keep what you tell us about them and the trustees' decision; this is not shown on the page. While you design a new page, we save your draft (and any photo you add) to your account as you go, so you can carry on from any device. Trustees do not see it until you send it, though the Trust's administrators can look at it to help you, and each time they do it is recorded. If you do not touch a draft for 90 days, we delete it and its photo. Trustees check each page before it goes live, and the page shows what has been raised. If you sponsor someone through a page, the page shows the name you chose (or "Anonymous"), your message and, unless you ask us not to, the amount; your email and address are never shown. We email the fundraiser your name, message and amount (or say someone anonymous gave), so they can thank you. If you ask for a fundraising pack, a trustee makes one with your name and challenge, and may have our AI assistant (Claude, run by Amazon Bedrock in the UK and EU) draft the covering letter from your message, seeing only your first name, with email addresses and phone numbers removed; a trustee reads it before it is sent, and the pack is kept in your conversation with us. If we pay some of the fundraiser's costs, we ask whether you are connected to them, because HMRC does not then allow Gift Aid on gifts from family or connected companies; we keep that answer with your gift.

Signing in with another account

If you choose to sign in with Google, Microsoft, Apple or Facebook, that company tells us your name and email address, and that you are signed in. We use them only to sign you in and to link to your existing account with us. We do not get your password or anything else from that account.

Keeping in touch

We only send news about the Trust to people who have asked for it, by ticking the box in their account. You can stop at any time in Your details. We always email you about your own applications and donations.

If we help a young person, we only share their story if they (or their parent or carer) have said we may, and then only with their first name. You can change your mind at any time by contacting us.

Records of sign-ins and of what people do

To keep personal information safe, we keep a record of each time someone signs in, of changes people make while signed in (such as sending an application or changing a donation), and of when trustees look at applications, bank details or exports. Each record says who, what and when, with the internet (IP) address, the approximate location estimated from it (usually the nearest town), the type of device and browser, and a short code for the sign-in session. It never includes what was typed, or any password. Only the Trust's administrators can see it, and it is deleted after two years. Our lawful basis is our legitimate interest in keeping the website and your information secure.

Our emails

We email you about your account, applications, messages and donations. Our emails include the Trust's logo, loaded from our website, but no tracking: we do not record whether you open them or click their links. Please reply through your account or the link in the email rather than by replying to the email itself, so your message is kept safely with the rest of your application or conversation.

Messages through Get in touch

When you get in touch, we keep your name, email address and message (and any documents or photos you send with it), and our replies, under a reference, so trustees can answer and you can follow the conversation. If you have an account with the same email address, the conversation appears in it; otherwise you can see it with the reference and a code we email you. Only the Trust's trustees can see your messages, and they may add private notes for each other, which you do not see. We note when you open our replies, and show you when a trustee has read your message, so both sides know a message has been seen. A trustee may ask the same automated assistant we use for applications (Claude, through Amazon Bedrock in our own Amazon Web Services account) to summarise your message or suggest a reply. Email addresses and phone numbers are removed first, it only sees your first name, nothing is sent to you without a trustee reading and approving it, and it is not used to train AI models. We delete messages two years after the last one.

Who we share it with

We do not sell or share your information for marketing. We use these service providers to run the website: Amazon Web Services (hosting, storage, sign-in and email, in the UK, and the automated checks described above, in the UK and the European Union), Cloudflare (spam protection on our forms), Square (card payments), GoCardless (Direct Debit and pay by bank) and Didit (identity checks, when our trustees ask for one). If our trustees choose to send email through another email provider instead of Amazon Web Services, that provider handles our emails in the same way. We share Gift Aid information with HMRC when we make a claim.

Cookies and storage in your browser

This website does not use advertising, analytics or tracking cookies, and we do not ask for consent because everything it keeps in your browser is strictly necessary for something you have asked for:

When you pay, you go to Square or GoCardless, who have their own cookie policies. If we ever add anything that is not strictly necessary, such as visitor statistics, we will ask you first.

Your rights

You can ask to see, correct or delete the information we hold about you, or withdraw your consent, by contacting us. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office.