Protecting your privacy

Our privacy statement

We’re committed to protecting your privacy. This privacy statement explains how we collect, process and protect any information you give us.

This information is protected by our Data Protection Policy, including data that could identify you.

Whose data we collect

We collect and hold data on people who:

have given financial or other support to us, or might do in future
apply for funding, personally or on behalf of an organisation
apply for a job, volunteering role or trusteeship
are suppliers or potential suppliers.

We hold data for an appropriate length of time, as set out below under “How long we keep your data”.

How we obtain your data

Most of the information we hold is provided by you.

Sometimes we collect data from someone else. For example, a supporter might suggest your name to us as someone who may be interested in our work. We also collect data through the online donation platforms we use.

We collect data from publicly available sources too, such as news articles, online media, or public social media profiles (for example LinkedIn or Facebook). We may also use public sources like Companies House or the Charity Commission.

What we do with your data and why

Our supporters and volunteers

The core purpose of our data processing is to:

build financial and volunteer support through fundraising and marketing activities
send you relevant communications about us and our work
administer donations, including claiming Gift Aid on your behalf
promote our aims and objectives through other activities.

We may use data from sources other than you to:

check your contact details are up to date
plan our fundraising, which may include using publicly available information to judge someone’s ability to donate
carry out appropriate checks on donations in line with legal and regulatory responsibilities (see our Acceptance and Refusal of Donations policy).

We collect:

name(s), address, email, phone number and other contact details and preferences
occupation, skills, professional activity and connections to other organisations
financial information and interest in philanthropy
links and connections with Somerset
records of donations to SCF, including assets used to donate and Gift Aid status
records of volunteering for us
how we know you and the history of our relationship
records of interactions with us, such as events attended and e-newsletter receipt
information needed to manage funds you’ve established or supported, including successor advisors
your relationship to other supporters (spouse, children, friends).

People applying for funding

We collect this information to process applications to SCF’s funding programmes. Some of it may also be used as described above, since many people involved with the groups we fund also support us in other ways.

We collect:

name(s), address, email, phone number and other contact details and preferences
the purpose and details of a funding application
other information needed to assess an application, which may include financial, family, education, employment information, disabilities, ethnicity
details of any funding awarded by us
correspondence, meeting notes, event attendance and other records of our relationship with you.

The processing of any special category data is documented in our Data Protection Policy.

Marketing communications

We contact supporters, grant-holders and other people who are interested in our work by email and text to tell them about our work, invite them to events and ask for their support.

Since 5 February 2026, the law has allowed charities to send these messages without asking for consent first, where someone gave us their contact details while expressing an interest in our work or offering us their support — for example by donating, signing up to our newsletter, volunteering, or coming to one of our events. This is known as the “soft opt-in”, and we have decided to use it.

When we do, we will always:

give you a clear and simple way to say no at the point we collect your details
include an easy way to opt out in every message we send you
use it only for messages about our own charitable work, never to promote other organisations
stop contacting you as soon as you tell us to.

We can only use the soft opt-in for contact details given to us on or after 5 February 2026. If you were already on our mailing list before then, we will continue to rely on the consent you gave us, and you can withdraw it at any time.

Where the law still requires your consent, we will ask for it before we contact you.

How long we keep your data

We hold:

successful funding applicants’ data for 7 years from the date we received their last application, unless we’re contractually obliged to keep it longer
unsuccessful funding applicants’ data for 3 years from the date we received their last application, unless we’re contractually obliged to keep it longer
donors’ data for 7 years from the date of their last donation. Data relating to donors who’ve given a one-off gift over £10,000, or £30,000 over five years, may be kept for longer — possibly indefinitely, given the significance of that relationship
data on anyone actively engaged with the Foundation for as long as that relationship is active, within reason. This includes people who donate, attend events, or receive our newsletter.

Protecting your data

We keep your data secure in our cloud-based database, with appropriate security measures in place.

We don’t share your data with anyone else unless it’s necessary for the purpose you gave it to us for. For example:

We’re legally required to give HMRC information on Gift Aided donations.
We share information on funding applications with panel members, and sometimes donors — this can include personal data.

We share information on applications to charitable trusts managed by SCF with their trustees, including personal contact details.

We publish data online about funding awarded to groups and organisations (amounts, names, purpose). We anonymise details for individual grantees.

We may share basic details of who’s attending an event with the host, particularly for a private dinner or reception.

We may share personal information about donors to our Named Funds so Fundholders can thank them personally. These include Elliot’s Touch, Mary’s Beat and Rebecca’s Hope.

We may pass data to Data Processors who provide specific services to us — for example, a mailing house sending our Annual Report. We always have contracts with Data Processors, and only use ones certified to ISO 27001 for security management. They can’t do anything with your data beyond what we ask.

Some of our suppliers operate outside the UK and European Economic Area (EEA), and may not follow the same data protection laws as UK-based companies. We take steps to make sure they provide an adequate level of protection in line with UK data protection law, as set out in our Data Protection Policy. By giving us your personal information, you agree to it being stored or processed outside the UK/EEA on this basis.

Automated decision-making

We don’t use fully automated decision-making to decide the outcome of funding applications or to make other decisions that significantly affect you. A person is always involved in these decisions.

Our responsibilities

The law requires us to explain the basis on which we process your data:

Consent — for some activities, such as sending marketing emails, we ask for your consent before processing.
Contract — for other activities, such as holding funds under a Fund Agreement or organising a ticketed event, we process your data to do what you’ve asked.
Legitimate interests — in other cases, the law allows us to process and contact you where it’s in our legitimate interest to do so, provided this doesn’t override your own interests or fundamental rights and freedoms. We check that we’re not causing harm, that the processing isn’t overly intrusive, and that it’s done only in ways described in this notice.
Recognised legitimate interests — for certain limited purposes set out in law, a narrower basis introduced by the Data (Use and Access) Act 2025 may apply.
We keep data for as long as needed to complete the task it was collected for. Relationships between donors, people we fund and the Foundation are often long-term, so we expect to keep your data for as long as that relationship exists, or until we no longer need it.

Your rights

The law gives you rights over how we process your data:

Where we rely on consent, you can withdraw it at any time.
Where we rely on legitimate interests, you can ask us to stop.
Where we didn’t get your information directly from you, you can ask us to tell you where it came from.
You can ask us to correct or delete inaccurate information.
You can ask for a copy of the data we hold about you. This is normally free of charge.
You can change or stop how we communicate with you or process your data. Some activities — like processing Gift Aid or managing a Fund on your behalf — may mean we can’t stop entirely, but we’ll always try to meet your request.
You can complain to the Information Commissioner’s Office (ICO) if you’re unhappy with how we’ve handled your data.
You can ask us to remove you from our database at any time by contacting us.

Controlling your personal information

We won’t sell, distribute or lease your personal information to third parties unless we have your permission or are required to by law.

Have a question?

If you have any questions about privacy, please contact us.