Introduction
This privacy statement sets out how we at Somerset Community Foundation collect, process and protect any information that you give us. SCF is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified, you can be assured that it will only be used in accordance with our Data Protection Policy.
Whose data we collect
We hold data on those who have given financial or other support to the Foundation or might do in the future. We hold data on those who apply to SCF for funding whether on behalf of an organisation or personally. We collect and hold data on those who apply for employment, volunteering roles and trusteeships for an appropriate length of time. In addition, we hold details of suppliers and potential suppliers.
How we obtain your data
Most of the information we hold about you has been provided directly to us by you.
In some cases, we may collect data from someone else. For example, an existing supporter might feel you may be interested in supporting our work and suggest your name to us. We also collect data via service providers like JustGiving or CAF Donate. And, fund holders might give us your data if you have approached them directly inquiring about funding.
We also collect data from publicly available sources. Examples include information gathered from a news article or online media, including social media like LinkedIn or Twitter. We may also use publicly available directories and similar information such as Companies House.
What we do with your data and why
Supporters and volunteers
The core purpose of our data processing is to:
- Build financial and volunteer support for the Foundation through various fundraising and marketing activities
- Send relevant communications to you about the Foundation
- Administer donations (including, but not limited to, funds which are subject to Fund Agreements)
- Promote the aims and objectives of the Foundation through other activities.
We may use data obtained other than from you to ensure that your contact details are up to date, to plan our fundraising (including using indicators of affluence so as to reflect the possible level of donation someone is able to make) and to ensure that appropriate due diligence is carried out to safeguard the assets and reputation of the Foundation in accordance with our Gift Acceptance Policy.
We collect the following classes of information:
- Name(s) and address, email, phone number and other relevant contact details and preferences
- Occupation, skills and professional activity and connections to other organisations
- Financial information and interest in philanthropy
- Information relating to links and connections with and in Somerset
- Records of donations including assets used to make donations, Gift Aid status, etc.
- Records of volunteering for the Foundation
- Information about our relationship with you and how we met you
- Records of your interactions with SCF, such as attending events and receiving the e-newsletter
- Information necessary for us to manage funds you have established or supported, including information on successor advisors
- Information about your relationship to other supporters (spouse, children, friends, etc).
Information on beneficiaries
We collect the information described below to solicit and process applications for funding issued by SCF. Some of the information may also be processed in the ways described above under “Supporters and volunteers” since many beneficiaries also support the Foundation’s work in some way.
We collect the following classes of information:
- Name(s) and address, email, phone number and other relevant contact details and preferences
- Purpose and details about an application for a grant
- Any other information needed for the assessment of a grant which may include financial, family, education and employment information
- Details about any grant which was made by us
- Information about our relationship with you, correspondence, meeting notes, attendance at events, etc.
How long we keep your data
- Grants applicants’ data will be held for 7 years from the date the last grant application was received if the application is successful, unless we are contractually obliged to retain the data for longer than this.
- Grant applicants’ data will be held for 3 years from the date the last grant application was received if the application is rejected, unless we are contractually obliged to retain the data for longer than this.
- Donors’ data will be held for 7 years from the date the last donation was received. Data relating to donors who have given a gift over £10k as a one-off, or £30k over a five year period, will be retained for longer and possibly indefinitely.
- The data of anyone engaged with the Foundation, for example continuing to donate to the Foundation, attending events or reading the newsletter, will be retained for as long as our relationship with that person remains active and within reason.
Protecting your data
We keep your data secure in our cloud-based database with appropriate security mechanisms in place.
In principle we do not share your data with anyone else or any other organisation unless it is necessary for the purpose for which you have given us the data. Examples are given below:
- We will provide information to HMRC on Gift Aided donations since we have a legal obligation to provide this information.
- We will share information on grant applications with grant panel members and possibly donors, this can include personal data.
- We will share information on grant applications made to the Somerset Crimebeat Trust with the trustees of the Somerset Crimebeat Trust, including personal contact details.
- We will publish data online about grants to groups/organisations (amounts/names/purpose), but we anonymise details for any individual grantees.
- We may share basic information about the attendees at an event with the host, particularly at a private dinner party or reception.
- We may share personal information about donors who have contributed to our Named Funds such as Elliot’s Touch, Hidden Needs Trust, Mary’s Beat and Somerset Crimebeat Trust with the fundholders so that they may thank donors personally.
- We may pass data to other organisations, known as Data Processors, to provide specific services to us. An example would be providing data to a mailing house to send an Annual Report or general fundraising letter. A contract is always in place with a Data Processor, and they are not allowed to do anything with your data other than that which we have requested. SCF is committed to only using Data Processors that are ISO 27001 certified for security management.
Some of our suppliers run their operations outside of the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law, as outlined in our Data Protection Policy. By submitting your personal information to us you agree to this transfer, storing or processing at a location outside of the EEA.
Our responsibilities
The law requires us to tell you the basis on which we process your data.
- Some activities (for example sending you emails which promote the Foundation’s interests) require your consent. If the law requires your consent to process data in a certain way, then we will obtain it before carrying out that activity.
- Other activities are carried out to fulfil a contract or agreement. Examples include holding funds which are subject to Fund Agreements or organising a ticketed event. Each requires us to know who you are and to process your information to do the thing you have asked us to do. If a contract is in place, then we will process your data based on that contract.
- In all other cases the law allows us to process your data if it is in our legitimate interest to do so, but only so long as we need to and your “interests or your fundamental rights and freedoms are not overriding”. Practically speaking this means we carry out an exercise to check that we will not cause you harm by processing your data, that the processing is not overly intrusive and that we will only do so in a way which is described in this privacy notice.
We will keep data for as long as is needed to complete the task for which it was collected. Relationships between donors, grantees and the Foundation are often long term, and so we expect to keep your data for as long as that relationship exists, or until we no longer need it.
Your rights
The law requires us to tell you that you have a variety of rights about the way we process your data. These are as follows:
- Where our use of your data requires consent, you may withdraw this consent at any time.
- Where we rely on our legitimate interest to process data, you may ask us to stop doing so.
- Where you have not given us your personal information directly, you may request to be told the source of the information.
- You may request to have inaccurate information amended or destroyed.
- You may request a copy of the data we hold about you. A small fee may be payable.
- You may change or stop the way in which we communicate with you or process data about you. Activities like processing Gift Aid donations, or managing a Fund Agreement, may mean we cannot entirely stop processing your data. We will always endeavour to comply with such a request, however.
- If you are not satisfied with the way we have processed your data, then you can complain to the Office of the Information Commissioner.
- You can ask us to remove you from our database at any time by e-mailing forgetme@somersetcf.org.uk or by writing to us at the address below.
Controlling your personal information
We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so.
If you have any questions about this privacy notice, about the way in which we process your data, or if you wish to change the way we use your data, including how we communicate with you, then please contact us:
Operations Director, Somerset Community Foundation, Yeoman House, Bath and West Showground, Shepton Mallet, BA4 6QN
T: 01749 344949