GDPR Compliance Policy
REdataDoctor
Effective date: [01/08/2026]
Last reviewed: [01/08/2026]
1. Our Commitment
REdataDoctor (“we”, “us”, “our”) is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains how we meet those obligations across the two distinct roles we hold when handling personal data.
2. Our Two Roles
Because of the nature of our work, we act as a data controller in some contexts and a data processor in others. It’s important our clients and website visitors understand the difference.
2.1 As Data Controller (for enquiries through our website)
We are the data controller for:
- Enquiry details submitted through our website contact form (name, school, email, role, message)
- Records we keep of our own clients, contracts, and invoicing
- Any marketing contact list we maintain with consent
For this data, we decide how and why it is processed, and our Privacy Policy governs it.
2.2 As Data Processor (for our clients’ data)
When engaged by a school to provide consultancy work — database management, campaign support, database audits, or troubleshooting within Raiser’s Edge (Blackbaud) — the school remains the data controller of all donor, alumni, parent, and prospect data held in their database. We act strictly as a data processor, working only on the school’s documented instructions.
This typically includes access to:
- Constituent records (names, contact details, relationship data)
- Giving and campaign history
- Gift Aid and financial transaction data
- Any notes or attributes the school has recorded against a constituent
We do not determine the purpose or means of processing this data — the school does. Our processing is limited to the scope of the engagement agreed with each client.
3. Data Processing Agreements (DPAs)
Before undertaking any work that involves access to a school’s Raiser’s Edge database or export of any constituent data, we put a signed Data Processing Agreement in place with the client. This sets out:
- The scope, nature, and duration of processing
- The categories of data and data subjects involved
- Our obligations regarding confidentiality, security, and sub-processing
- Assistance we will provide the school in responding to data subject requests
- Our obligations on deletion or return of data at the end of the engagement
- Breach notification timelines
We will not begin work involving access to a client’s database until a DPA has been signed by both parties.
4. How We Handle Client Data During an Engagement
- Wherever possible, we work directly within the school’s own Raiser’s Edge/Blackbaud environment, using access credentials provided by, and controlled by the school.
- We do not export constituent data outside the client’s system unless the engagement specifically requires it (for example, producing a report or an import file). Any such exports are stored securely, encrypted where practicable, and deleted once no longer needed.
- We do not use client data for any purpose beyond the agreed engagement — it is never added to marketing lists, shared with other clients, or retained for our own analysis.
- Access is limited to the individuals directly working on the engagement.
- We do not engage sub-processors to carry out work on client databases. If this ever changes, we will notify affected clients in advance and update this policy.
5. Data Retention
- Website enquiry data: retained for as long as needed to respond to the enquiry and for a reasonable follow-up period, then deleted.
- Client engagement data: any data or exports created during a project are deleted at the end of the engagement, or within 52 weeks of completion, unless the client instructs otherwise in writing.
- Contractual/invoicing records: retained in line with UK tax and accounting requirements (currently six years).
6. Security Measures
We maintain appropriate technical and organisational measures, including:
- Confidentiality agreements with anyone working on client engagements
- Secure, password-protected devices and, where applicable, two-factor authentication
- Encryption of any data backups
- Secure deletion of temporary files and exports once no longer required
- Restricted access to client systems for only what is needed for the engagement
We rely on Blackbaud’s own security and compliance measures for the underlying Raiser’s Edge platform, but clients should satisfy themselves independently of Blackbaud’s certifications, hosting location, and sub-processor arrangements as part of their own due diligence, since Blackbaud is the school’s processor, not ours.
7. International Data Transfers
We do not transfer client data outside the UK. Where a client’s Raiser’s Edge instance is hosted outside the UK/EEA by Blackbaud, this is a matter between the school (as controller) and Blackbaud (as the school’s processor), and is outside the scope of our engagement.
8. Supporting Data Subject Rights
Because schools are the data controller for their constituent data, requests from individuals (e.g. subject access requests, erasure requests) relating to that data should be directed to the school. Where we hold relevant data as part of an active or recently completed engagement, we will support the school promptly in fulfilling such requests, as required under our DPA.
For requests relating to data we control directly (see 2.1), please contact us using the details below.
9. Data Breaches
In the event of a personal data breach involving client data we are processing, we will notify the affected school without undue delay, and in any event within 48 hours of becoming aware of it, to allow them to meet their own regulatory obligations.
10. Information Commissioner’s Office
We follow the Information Commissioner’s Office’s (ICO) advice and guidance for small and medium organisations.
11. Contact
For any questions about this policy or our data protection practices, contact:
12. Changes to This Policy
We may update this policy from time to time. The “last reviewed” date at the top will reflect the most recent revision.