Privacy Notice
Introduction
This document explains how we, the Community Foundation use data about living individuals.
Why do we need your information?
We believe that thriving communities with caring people and strong voluntary groups give everyone the chance to achieve their best. Thriving communities are built on time, money and effort that enable ambition to be achieved, potential fulfilled and ends to be met. We use personal data to help organise the giving of that time, money and effort in Calderdale
Whose data do we collect?
We hold data on those who have given financial or other support to the Community Foundation, those who might do, and those who apply to the Community Foundation for grants, whether on behalf of an organisation or personally.
How we obtain your data
The majority of the information we hold about you has been provided directly to us by you.
In some cases, we may collect data from someone else. Examples include where existing supporters feel you may be interested in supporting our work and suggest your name to us, or data collected via a service provider like LocalGiving or JustGiving.
We also collect data from publicly available sources. Examples include information gathered from a news article or on-line media, including social media like LinkedIn or Twitter. We may also use publicly available directories and similar information such as the Royal Mail’s National Change of Address database and Companies’ House.
What we do with your data and why
Supporters and Volunteers
The core purposes of our data processing are to:
- build financial and volunteer support for the Community Foundation through various fundraising and marketing activities,
- send communications to you about the Community Foundation,
- administer donations (including but not limited to funds which are subject to Philanthropy Agreements), administer volunteering opportunities and programmes where we match volunteers with community needs
- administer membership and
- promote the aims and objectives of the Community Foundation through other activities.
We may use data obtained other than from you to ensure that your contact details are up to date, to plan our fundraising (including using indicators of affluence so as to reflect the possible level of donation someone is able to make) and to ensure that appropriate due diligence is carried out to safeguard the assets and reputation of the Community Foundation.
We collect the following classes of information:
- Name(s) and address, email, phone number and other relevant contact details and preferences
- Relevant family or friend’s information including information on successor advisors
- Occupation, skills and professional activity and network(s)
- Financial information and interest in philanthropy
- Information relating to links and connections with and in Calderdale
- Records of donations including assets used to make donations, Gift Aid status etc.
- Records of volunteering for the Community Foundation
- Information about our relationship with you, correspondence, meeting notes, attendance at events etc.
- Information necessary for us to manage funds you have established or supported including information on successor advisors
- Information on membership of the Community Foundation where applicable
Information on Grantees
We collect the information described below to solicit and process applications for grants from the Community Foundation. Some of the information may also be processed in the ways described above under “Supporters and Volunteers” since many grantees also volunteer for the Community Foundation or support its work in some way.
We collect the following classes of information:
- Name(s) and address, email, phone number and other relevant contact details and preferences
- Purpose and details about an application for a grant
- Any other information needed for the assessment of a grant which may include financial, family, education and employment information
- Details about any grant which was made
- Information about our relationship with you, correspondence, meeting notes, attendance at events etc.
Protecting your data
We keep your data secure in our database with appropriate security mechanisms in place.
In principle, we do not share your data with anyone else or any other organisation unless it is necessary for the purpose for which you have given us the data. Examples are given below:
- We will provide information to HMRC on Gift Aided donations since we have a legal obligation to provide this information.
- We will share information on grant applicants with grant panel members and donors. These are volunteers working with the Community Foundation. We will also publish data on grant recipients for groups/organisations (amounts/names/purpose) but we anonymise details for any individual grantees.
- We may share basic information on the attendees at an event or function or meeting with the host or other people who has a volunteer role in the Community Foundation.
- We may pass data to other organisations, known as Data Processors, to provide specific services to us. An example would be providing data to a mailing house in order to send a newsletter. A contract is always in place with a Data Processor, and they are not allowed to do anything with your data other than that which we have requested.
Some of our suppliers run their operations outside of the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law. By submitting your personal information to us you agree to this transfer, storing or processing at a location outside of the EEA.
Our responsibilities
The law requires us to tell you the basis on which we process your data.
For the organisation to lawfully process data it must comply with Article 6 of the GDPR which lists the grounds upon which the data can be lawfully processed.
The organisation has conducted an audit into the data it holds and has determined that it holds the following data and the lawful basis for processing that data to be as follows:
(i) The organisation obtains information from those applying for grants. This is processed on the basis that the processing of the data is necessary to perform the contract to provide the grant or in anticipation of providing the grant. In addition, the provision of grants by the organisation is one of its main purposes and as such the only way of determining who to award grants to is by obtaining such data. This is therefore necessary in the legitimate interests of the organisation also
(ii) The organisation obtains marketing data from actual and potential donors. Such data may be processed with the donor or potential donor’s specific consent or where the organisation does not have consent then the obtaining of donations is one of its main purposes and as such the only way of contacting donors or potential donors is by obtaining and processing such data. This is therefore necessary in the legitimate interests of the organisation also
(iii) The organisation obtains and retains data of those who visit its website. The cookies on the organisation’s website retains information about the identifier of the website users and such other computer data. This is retained on a legitimate interest basis of the organisation to monitor and asses use of its website and is set out in the Cookie policy on the website.
(iv) The organisation holds and processes data relating to employees. There are different lawful bases for holding this data and in this respect please see the organisation’s HR Policy.
(v) The organisation’s computer system automatically retains email addresses that have been used by the organisation. This is on a legitimate interest basis to facilitate the use of email by way of a method of communication and the potential impact of the holder of the email address is minimal.
(vi) The organisation is a data processor of data on behalf of another not for profit organisation, Business for Calderdale. There is an agreement in place for the same.
(vii) The organisation processes data of its trustees and former trustees. This is specifically with the consent of the individual trustees.
We will keep data for as long as is needed to complete the task for which it was collected. Relationships between donors, grantees and the Community Foundation are often long term, and so we expect to keep your data for as long as that relationship exists, or until we no longer need it.
Your rights
The law requires us to tell you that you have a variety of rights about the way we process your data. These are as follows:
- Where our use of your data requires consent, you may withdraw this consent at any time.
- Where we rely on our legitimate interest to process data, you may ask us to stop doing so.
- You may request a copy of the data we hold about you.
- You may change or stop the way in which we communicate with you or process data about you, and if it is not required for the purpose you provided it, then we will do so. Activities like processing Gift Aid donations, or managing a Philanthropy Agreement, may mean we cannot entirely stop processing your data. We will always endeavour to comply with such a request, however.
- If you are not satisfied with the way we have processed your data then you can complain to the Office of the Information Commissioner.
Contacting us
If you have any questions about this privacy notice, about the way in which we process your data, or if you wish to change the way we use your data, including how we communicate with you, then please contact us:
Steve Duncan CEO, CFFC, 1855 Building, Discovery Road, Halifax HX1 2NG
T: 01422 349700
Website Cookies
For details of how cookies are used to understand the way our website is used please see our cookie policy.