Privacy Policy
Last updated: 24 Sept 2026
1. Who we are
The Hidden 20% is a UK charity.
We are the data controller responsible for your personal data.
Organisation details:
The Hidden 20%
Charity number: 1203348
7 Bell Yard
London
WC2A 2JR
United Kingdom
Contact:
Email: hello@hidden20.org
2. How we use your data (in short)
We only collect the data we need to:
Run our website and services
Communicate with you
Improve understanding of neurodiversity through content and research
Deliver relevant updates and marketing (where permitted)
We do not sell your personal data.
3. The data we collect
We may collect:
Identity and contact data (name, email, address, phone)
Transaction data (donations, purchases)
Technical data (IP address, browser, device info)
Profile and usage data (preferences, feedback, usage)
Marketing preferences
4. Special category data
Some information is treated as more sensitive under data protection law. This includes information about your health e.g. information about neurodiversity or neurodivergence.
We can only use this information where a specific condition applies. The conditions we rely on are:
Your explicit consent, Article 9(2)(a) UK GDPR. This is what we rely on when you share your story with us, or take part in our podcast. See section 9.
Employment, social security and social protection, Article 9(2)(b) UK GDPR, together with paragraph 1 of Part 1 of Schedule 1 to the Data Protection Act 2018. This is what we rely on for health or disability information provided by job applicants and staff in connection with adjustments. See section 8.
Legal claims, Article 9(2)(f) UK GDPR, where it is necessary to keep this information in connection with a claim.
5. How we collect your data
We collect data:
Directly from you (forms, donations, signups)
Automatically (cookies, analytics)
From trusted third parties (payment providers, analytics tools)
6. How we use your data
We need a lawful basis for everything we do with your personal data. This section sets out what we do and which basis applies.
Running the website and understanding how it is used. Consent for non-essential cookies. Legitimate interests, Article 6(1)(f), for the resulting analytics. Our interest is improving the website.
Sending newsletters and updates. Consent, Article 6(1)(a). You opt in and can opt out at any time.
Processing donations and claiming Gift Aid. Contract, Article 6(1)(b), to process your donation. Legal obligation, Article 6(1)(c), for Gift Aid and financial records.
Selling and dispatching merchandise. Contract, Article 6(1)(b), to fulfil your order. Legal obligation, Article 6(1)(c), for financial records.
Responding to enquiries. Legitimate interests, Article 6(1)(f). Our interest is answering people who contact us.
Recruitment. Set out in section 8.
Story submissions for films, campaigns and research. Set out in section 9.
Podcast contributors. Consent, Article 6(1)(a), and explicit consent, Article 9(2)(a), where a guest discusses their own health.
Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect anything we did before you withdrew.
We do not make decisions about you using automated processing alone, and we do not use your data for profiling.
7. Marketing
You may receive updates about our work.
You can opt out at any time via:
Unsubscribe links
Contacting us
We do not share your data for third-party marketing.
8. Job applicants
This explains how we use your personal data if you apply for a role with us.
Who we are. The Hidden 20% is the data controller. Contact us at hello@hidden20.org.
What we collect and why. Depending on the recruitment process for the role, we may collect your name and contact details, your CV and covering letter, your work and education history, qualifications, salary expectations, any adjustments you ask for, notes we make during interview, references, information to verify your qualifications and right to work information if we offer you the role.
How we use it. We use this information to administer the recruitment process; assess your suitability; communicate with you; arrange and conduct interviews; verify information you have provided; make reasonable adjustments; check the successful candidate’s right to work, select and appoint a candidate; document our recruitment decisions; and respond to queries, complaints or legal claims.
Our lawful bases. For receiving and reviewing applications, shortlisting and interviewing candidates, we rely on Article 6(1)(f) UK GDPR. Our legitimate interests are running a fair and effective recruitment process and identifying suitable candidates. If you accept a conditional or unconditional offer, we rely on Article 6(1)(b) UK GDPR where processing is necessary to take steps to enter into an employment contract with you. We rely on Article 6(1)(c) UK GDPR where processing is necessary to comply with our legal obligations, including right to work requirements and our obligations to make reasonable adjustments. We rely on Article 6(1)(f) UK GDPR to retain limited recruitment records in order to deal with queries or complaints and to establish, exercise or defend legal claims.
Special category information and adjustments. If you provide health or disability information needed for an adjustment, we also rely on Article 9(2)(b) UK GDPR and paragraph 1 of Part 1 of Schedule 1 to the Data Protection Act 2018. Where it is necessary to retain special category information in connection with a legal claim, we may rely on Article 9(2)(f). We restrict access to adjustment information and do not use it to assess your suitability for the role. Please do not include health, disability or other special category information in your CV unless it is relevant to an adjustment or we specifically ask for it. If we receive information which we have not requested and do not need, we will not use it in the selection process and will delete or redact it where practicable.
Where we get it. From you, from any job board (or recruitment agency through which) you apply through and from referees you name. We will tell you in advance if we intend to obtain information from public sources.
Who we share it with. We share information only where necessary with staff and trustees involved in the recruitment process; our email and file storage providers; any job board (or recruitment agency) we advertise through; referees you name; our professional advisers; and regulators or law enforcement bodies where required by law. We do not sell your data or use it for marketing.
How long we keep it. If you are unsuccessful, six months from the date we tell you. If you are appointed, only the information needed for the employment relationship will be transferred to your employment record which will be kept for your employment plus six years. Right to work information is kept for two years after employment ends, as required by law.
Giving us this information. You need to provide the basic application information required for us to assess you for the role. Information about adjustments is voluntary, and choosing not to provide it will not count against you. We ask only the successful candidate for right to work evidence and any other information needed to satisfy conditions of an offer. If that information is not provided, we may be unable to confirm the appointment or employ you.
Your rights. The rights in section 15 below apply. If you are unhappy, contact us first. You can also complain to the Information Commissioner’s Office at www.ico.org.uk.
9. Sharing your story with us
This explains how we use your personal data if you submit your story to us, for example to take part in a film, campaign or piece of research.
What we collect and why. What we ask for varies by project. It usually includes your name, a way to contact you, your age, information about your neurodiversity, and your answers about your own experiences. Depending on the project we may also ask about other things e.g. if you can travel to a filming location. We use this to decide who to invite to a short research call, to shortlist contributors, and to plan the project.
Our lawful bases. We rely on your consent under Article 6(1)(a) UK GDPR. Because information about your neurodiversity is data concerning health, we also rely on your explicit consent under Article 9(2)(a) UK GDPR. We ask for this separately at the point you submit your story.
Withdrawing consent. You can withdraw at any time by emailing hello@hidden20.org. We will stop using your information and delete your submission. Withdrawing does not affect anything we did with your information before you withdrew. If there is anything we are not able to remove, for example material you agreed to appear in that has already been published, we will tell you what it is and why.
Who we share it with. Staff and trustees working on the project, the production crew for contributors we take forward, and our form, email and file storage providers. We do not sell your data or use it for marketing.
Where it is held. We collect story submissions using Google Forms and hold them in our Google and Microsoft accounts. This involves a transfer of data outside the UK. The safeguards we rely on are set out in section 12.
How long we keep it. If we do not take your submission forward, we delete it within six months of the project's filming date, or sooner if you ask us to. If you take part, we keep your contact details and submission for three years after the project ends, so that we can answer questions about the material. We keep the signed release, and the film itself, for as long as the film remains published.
Giving us this information. Sharing your story with us is entirely voluntary. Some questions on our forms are required, because we cannot assess a submission without them, but you choose whether to submit at all. Submitting is not a guarantee of taking part. Please only tell us what you are comfortable for us to read.
Filming and publication. If we invite you to take part, we will ask you to sign a separate release covering how your contribution can be used. That is a different agreement from the consent described here, and we will explain it before you sign anything.
Your rights. The rights in section 15 apply. If you are unhappy, contact us first. You can also complain to the Information Commissioner's Office at www.ico.org.uk.
10. Cookies
We use cookies to:
Run the website
Analyse usage
Improve experience
See our Cookie Policy: /cookie-policy
11. Sharing your data
We may share data with:
Our website hosting provider
Stripe, payment provider
JustGiving, donation platform
MailerLite, our email and newsletter provider
Google, our analytics and file storage provider
Professional advisers (e.g. accountants, legal advisers)
Regulators and law enforcement where required by law
All third parties must protect your data.
12. International transfers
Some of the organisations that process data on our behalf are based outside the UK, mainly in the United States. This includes our form, email, analytics and payment providers.
When data leaves the UK, the law requires us to make sure it is still protected. We rely on one or both of the following.
A UK government decision that a country or scheme offers adequate protection. Google LLC, which provides the forms, analytics and file storage we use, is certified under the UK Extension to the EU-US Data Privacy Framework. The UK government has recognised this as offering an adequate level of protection, which means the transfer is covered without us needing anything further.
A contract with terms approved for use in the UK. Where that recognition does not apply, or as an extra safeguard, our agreements with providers include standard clauses approved by the UK government. These are set wordings that legally require the provider to protect your data to UK standards, and to let you enforce that. Our agreements with Google, Stripe and MailerLite include them.
MailerLite, which we use for our newsletter, holds data on servers in the European Union.
We check our providers' certifications once a year. If you want to know which safeguards apply to a particular provider, or to see a copy of the clauses, email hello@hidden20.org and we will send them to you.
13. Data security
We take appropriate measures to protect your data from loss, misuse, or unauthorised access.
14. Data retention
We retain data only as long as necessary.
Typical retention:
Financial records: up to 6 years
Merchandise orders and customer details: for as long as needed to manage the order and any refund, and financial records for up to 6 years
Marketing data: until you opt out
Enquiries: up to 12 months
Job applicants: see section 8
Story submissions: see section 9
Podcast contributors: contact details and recordings for as long as episodes remain published
We may retain anonymised data for research.
15. Your rights
You have the right to:
Access your data
Correct it
Delete it
Restrict or object to processing
Transfer your data
Withdraw consent
You can contact us at hello@hidden20.org.
If you have concerns about how we have handled your personal data, please contact us first so that we can investigate and try to resolve the issue.
You also have the right to complain to the Information Commissioner's Office (ICO) at www.ico.org.uk.
16. Data Protection Complaints
If you have concerns about how The Hidden 20% has collected, used, stored or shared your personal data, you may make a data protection complaint by contacting us at:
Email: hello@hidden20.org
Post:
The Hidden 20%
7 Bell Yard
London
WC2A 2JR
United Kingdom
Please provide as much information as you can about your concern so that we can investigate it appropriately. You do not need to use any specific form.
We will:
Acknowledge receipt of your complaint within 30 days
Investigate your complaint fairly and thoroughly
Keep you informed if our investigation is likely to take longer than expected
Provide you with a written response setting out the outcome of our investigation
If you remain dissatisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).
Further information about making a complaint is available at www.ico.org.uk.
17. Children’s data
Our website, services and forms are intended for adults. We do not knowingly collect personal data from anyone under 18. If we become aware that we have, we will delete it.
18. Third-party links
We are not responsible for third-party websites linked from our site.
19. Changes to this policy
We may update this policy. The latest version will always be available on our website.
20. Contact
Email: hello@hidden20.org