Legal

Privacy notice

Last updated 26 August 2026

The short version. We run no analytics, set no cookies of our own, and have no advertising trackers. We do not sell or share your data for marketing. We do not run a mailing list. The only personal data we hold is what you give us when you donate, buy something, or email us — and most of it sits with Stripe and Fourthwall rather than with us.

Who we are

THE BONES FUND is the trading name of THE BONES PROJECT LTD, a company limited by guarantee registered in England and Wales, company number 17410208. We are the data controller for the personal data described here.

THE BONES PROJECT LTD
128 City Road
London, EC1V 2NX
United Kingdom

Questions about this notice or your data: info@thebonesfund.org

The Bones Project Ltd is not a registered charity. We will apply for charitable status as soon as we are able to.

What we collect, and why

If you donate

Donations are taken by Stripe. You are redirected to Stripe's own hosted checkout page to pay, so your card details never touch this website and we never see or store them.

Stripe passes us a record of the payment — the amount, the date, the last four digits and card type, and the email address you gave for your receipt. We use this to account for money in the fund, to send you a receipt, and to answer you if you get in touch about your donation.

Lawful basis: performing our agreement with you in taking and acknowledging your donation, and our legitimate interest in keeping accurate records of money held for the causes we support. Where the law requires us to keep financial records, our basis is legal obligation.

If you buy merchandise

Merchandise is sold and fulfilled by Fourthwall. Checkout happens on Fourthwall's own pages, and the name, delivery address, email address and payment details you enter there are collected and processed by Fourthwall, not by us. We can see order records in our Fourthwall dashboard so that we can help if something goes wrong.

Lawful basis: performing the contract for the item you bought.

If you email us

Our email is hosted by Zoho. If you write to us we keep the message and your address for as long as we need to deal with it and to keep a record of what was said.

Lawful basis: our legitimate interest in responding to people who contact us.

When you just visit the site

We do not run analytics, we do not set advertising or tracking cookies, and we do not build a profile of you. This site is hosted on Cloudflare, which may set essential cookies to protect the site from attack and abuse. Those are security cookies, not tracking cookies, and we cannot use them to identify you.

The site stores one small preference in your browser's session storage — whether you have collapsed a section — so the page behaves consistently while you read it. It is not personal data, it never leaves your device, and it is discarded when you close the tab.

The shop section loads product information from Fourthwall's storefront API as the page opens. Links to Spotify and to the causes we support are ordinary links — those sites have their own privacy policies, and we have no control over them.

Who your data is shared with

We do not sell your personal data, and we do not share it for anyone else's marketing. We use these providers to run the fund:

We may also share information where we are legally required to, for example with HMRC, our accountants, or a regulator.

Transfers outside the UK

Stripe and Fourthwall are United States companies and may process your data outside the UK. Where that happens, transfers are covered by the safeguards those providers have in place for international transfers, such as the UK extension to the EU-US Data Privacy Framework or standard contractual clauses.

How long we keep it

Financial records, including donation and order records, are kept for six years after the end of the financial year they relate to, which is what UK company and tax law requires. Emails are kept for as long as they are useful and then deleted. Where a provider holds the data rather than us, their retention policy applies as well as ours.

Your rights

Under UK data protection law you have the right to ask us for a copy of the personal data we hold about you, to have it corrected if it is wrong, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on legitimate interests, you can object and we will stop unless we have compelling grounds to continue.

To exercise any of these, email info@thebonesfund.org. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would rather you came to us first so we can put it right.

Changes to this notice

If we change how we handle personal data we will update this page and the date at the top. The fund is new, and this notice will be revisited when we apply for charitable status.

← Back to THE BONES FUND