Privacy notice

Last updated: 15 October 2026

Who is responsible for your data

Grant Sorted is run by Antonijo Cale, Zagreb, Croatia. Contact: hello@grantsorted.uk. I am the controller for the data described below, under UK GDPR and EU GDPR.

What data we use

• Business contact details of charities (organisation name, charity number, address, business email address), taken from the public Register of Charities of the Charity Commission for England and Wales (Open Government Licence v3.0).
• Materials you send us as a client: drafts, project descriptions, budgets, attachments and correspondence, plus the contact details you give us.
• Payment information. Card payments are handled by Stripe; we do not see or store your card number. We keep the transaction record.

Why we use it, and our legal basis

• Contacting charities by email: legitimate interests (Article 6(1)(f)): offering a relevant business service to charities. Where the address belongs to a corporate subscriber (an organisation), PECR regulation 22 permits such marketing email, provided we identify ourselves and offer an easy way to opt out. Every email includes this.
• Providing the services you buy: contract (Article 6(1)(b)).
• Accounts and legal obligations: legal obligation (Article 6(1)(c)).

Who receives data

• Zoho Mail (email hosting)
• Stripe (payments)
• Cloudflare (website hosting and email routing)
• AI text-processing tools, used to prepare drafts and reviews. Your materials may be sent to them for this purpose. We choose services whose terms do not allow your content to be used to train their models, where such terms are available, but we cannot guarantee this for every provider, and we do not control their terms.

We do not sell personal data.

Transfers outside the UK and EU

I am based in Croatia (EU). Some providers above are in the United States or elsewhere; transfers rely on adequacy decisions (such as the UK-US data bridge or the EU-US Data Privacy Framework) or standard contractual clauses, as offered by the provider.

How long we keep it

• Contact details from the register: until you object or the register no longer lists you.
• Client materials: up to 12 months after delivery, then deleted (earlier on request).
• Payment and accounting records: as long as the law requires.
• Opt-out list: kept so that we respect your request.

Your rights

You can ask for access, correction, deletion, restriction or portability of your data, and you have the right to object to processing based on legitimate interests, including direct marketing. Objections to marketing are applied immediately. Reply UNSUBSCRIBE to any email, or write to hello@grantsorted.uk.

You can complain to the UK Information Commissioner's Office (ico.org.uk) or to the Croatian data protection authority (AZOP).