This document explains how The Rectory Foundation (a charitable fund administered by Heart of Bucks who are acting as the data controller as defined by the UK GDPR), uses data about living individuals.
Why do we need your information?
We believe that thriving communities with caring people and strong voluntary groups give everyone the chance to achieve their best. Thriving communities are built on time, money and effort that enable ambition to be achieved, potential fulfilled and ends to be met. We use personal data to help organise the giving of that time, money and effort in Buckinghamshire and the wider South East of England.
Whose data do we collect?
We hold data on those who have given financial or other support to The Rectory Foundation, those who might do so in the future, and those who apply to us for grants or loans, whether on behalf of an organisation or personally, and about our employees and volunteers.
How we obtain your data
The majority of the information we hold about you has been provided directly to us by you, either through direct communication or collected via a service provider like TotalGiving (who will have asked your permission before sending on your details).
In some cases we may collect data from someone else. Examples include in limited cases where existing supporters have a genuine reason for believing you may be interested in supporting our work and suggest your name to us.
We also collect data from publicly available sources. Examples include information gathered from a news article or on-line media, including social media like LinkedIn or Twitter. We may also use publicly available directories and listings, and similar information such as that held by Companies’ House or the Charity Commission or lists of Dormant Trusts.
We don’t ever buy in or sell marketing or other contact lists.
What we do with your data and why –
Supporters and Donors
The core purposes of our data processing are to:
• build financial and volunteer support for The Rectory Foundation through various fundraising and marketing activities,
• send communications to you about The Rectory Foundation’s activities,
• administer donations (including, but not limited to, funds which are subject to Donor or Fund Agreements or Gift Aid)1
• administer membership and
• promote the aims and objectives of The Rectory Foundation through other activities.
We may use data obtained other than from you to ensure that your contact details are up to date, to plan our fundraising (including using indicators of affluence so as to assess the possible level of support an individual or company may be able to offer) and to ensure that appropriate due diligence is carried out to safeguard the assets and reputation of The Rectory Foundation.
We collect the following classes of information:
• Name(s) and address, email, phone number and other relevant contact details and preferences
• Relevant family or friends information including information
• Occupation, skills and professional activity and network(s)
• Financial information and interest in philanthropy
• Information relating to links and connections with and in South East England
• Records of donations including assets used to make donations, bank details, Gift Aid status etc.
• Information about our relationship with you, correspondence, meeting notes, attendance at events
• Information necessary for us to mange funds you have established or supported
• Information on membership of The Rectory Foundation as a Friend or similar scheme where applicable
Grant & Loan Applicants
We collect the information described below in order to invite and process applications for grants from The Rectory Foundation.
We collect the following classes of information:
• Name(s) and address, email, phone number and other relevant contact details and preferences inc. details of your management committee
• Purpose and details about an application for a grant including the budget and intended beneficiaries
• Any other personal information needed for the assessment of a grant for example: financial, family, education, housing and employment information and which *may* in some instances include sensitive personal data such as age or health where these are relevant to the grant decision making
• Details about the decision relating to any grant application
• Information about our relationship with you, correspondence, meeting notes, attendance at events and funding consultations.
• Details on the outcome of the grant made which may include anonymised case studies and quotes, and photographs. Note: Photographs and personal details in case studies will only be used with your explicit consent
Protecting your data
We keep your data secure in our database and IT systems with appropriate security mechanisms in place.
We do not share your data with anyone else or any other organisation unless it is necessary for the purpose for which you have given us the data. Examples are given below:
• We will provide information to HMRC on Gift Aided donations since we have a legal obligation to provide this information.
• We will share information on grant applications with grant panel members and donors, although personal data will not be shared. [These are volunteers working with The Rectory Foundation]. We will also publish data on grant recipients for groups/organisations (amounts/names/purpose) but we anonymise details for any individual grantees.
• We may pass data to other organisations, known as Data Processors, who provide specific services to us. An example would be holding your data on a database which is hosted by a third party. A contract is always in place with our Data Processors, and they are not allowed to do anything with your data other than that which we have requested.
Some of our suppliers run their operations outside of the European Economic Area (EEA). Where this is the case we will ensure they have taken steps to make sure they provide an adequate level of protection in accordance with UK data protection law. By submitting your personal information to us you agree to this transfer, storing or processing at a location outside of the EEA.
The law requires us to tell you the basis on which we process your data.
• Some activities (for example sending you emails which promote The Rectory Foundation’s interests) require your consent. If the law requires your consent to process data in a certain way then we will obtain it before carrying out that activity.
• Other activities are carried out to fulfil a contract or agreement. Examples include holding funds which are subject to Donor or Fund Agreements, organising a ticketed event or processing your application for a grant. Such activity requires us to know who you are and to process your information in order to do the thing you have asked us to do. If a contract is in place then we will process your data based on that contract.
• Certain activities are carried out to meet Legal Obligations, such as collecting Donor declarations to meet HMRC requirements on Gift Aid.
• In all other cases the law allows us to process your data if it is in our legitimate interest to do so, but only so long as we need to and your “interests or your fundamental rights and freedoms are not overriding”. Practically speaking, this means we will check that we will not cause you harm by processing your data, that the processing is not overly intrusive and that we will only do so in a way which is described in this privacy notice.
We will keep data for as long as is needed to complete the task for which it was collected. We recognise that relationships between donors, grantees and The Rectory Foundation are often long term, and so we expect to keep your data for as long as that relationship exists, or until we no longer need it .
You have a number of rights relating to the way we process your data. These are as follows:
• Where our use of your data requires consent, you may withdraw this consent at any time.
• Where we rely on our legitimate interest to process data, you may ask us to stop doing so.
• You may request a copy of the data we hold about you.
• You may change or stop the way in which we communicate with you or process data about you, and if it is not required for the purpose you provided it, then we will do so. Activities like processing Gift Aid donations, or managing a Donor or Fund Agreement, may mean we can not entirely stop processing your data. We will however always endeavour to comply with such a request to the fullest extent we can.
• If you are not satisfied with the way we have processed your data then you can complain to the Office of the Information Commissioner.
If you have any questions about this privacy notice, about the way in which we process your data, or if you wish to change the way we use your data, including how we communicate with you, then please contact us:
The Data Manager, The Rectory Foundation, New Road, Weston Turville, Aylesbury, HP22 5QT E: firstname.lastname@example.org