Privacy Policy

 

1. Important information

2. The data we collect about you.

3. Marketing

4. Disclosure of your personal information

5. International transfers

6. Data security

7. Data retention

8. Your rights

9. Changes to this Notice

 

In this Privacy Notice whenever we use the words ‘HIWCF’, ‘we’, ‘us’, or ‘our’ we are referring Hampshire and Isle of Wight Community Foundation, a charitable Private Company limited by Guarantee whose registered office is at BVA, The Orchard, White Hart Lane, Basingstoke, Hampshire, England, RG21 4AF. 

 

HIWCF is registered as a charity with the Charity Commission of England and Wales, charity number 1100417, and as a Data Controller with the Information Commissioner’s Office with the registration reference Z3328875.

This Privacy Notice aims to give you information on how HIWCF uses and protects the personal data that it collects when you:

• visit the HIWCF website; 

• complete a survey, sign-up form, give us feedback, or respond to a social media post;

• support our work by making a donation, setting up a fund, sign up for one of our events or work in partnership with us.

• Apply for a grant from us or one of our funders.

• Apply for a role, paid or voluntary, with us.

 

It is important that you read this Privacy Notice so that you are fully aware of how and why we are using your data, and the rights you have relating to that use.

 

Personal data means any information from which an individual can be identified, either directly or indirectly. It does not include data where the identity has been removed (anonymous data).

HIWCF promises to respect any personal data that you share with us, or that we receive from other organisations, and keep it safe. We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect.

 

If you have any questions about this Privacy Notice, how we use your data, or if you wish to exercise any of your legal rights (as set out in section 8), please contact us at the address above, or by telephone on 01962 798700, or by email to info@HIWCF.com

If you have a complaint about how we use your data, and we are unable to resolve it, you have the right to raise the matter with the Information Commissioner’s Office (ICO), the UK’s independent body set up to uphold information rights (www.ico.org.uk).

 

It is important that the personal data we hold about you is accurate and up to date so please keep us informed if your personal data changes during your relationship with us.

 

Our website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for the ways in which they may use your personal data. When you leave our website, we encourage you to read the privacy notice of every website/app you visit.

 

We have grouped together the different types of personal data we may collect about you as follows:

• Identity Data includes any or all of first name(s), last name(s), username or similar identifier, marital status, title, date of birth, and gender.

• Contact Data includes any or all of address, email address, and telephone number(s), each of which may be personal and/or business.

• Financial Data includes bank account and payment card details, amount of donation(s), value of grant(s) paid and similar information.

• Marketing and Communications Data includes your preferences in receiving marketing from us and your preferred method(s) of communication.

• Profile Data includes your interests, preferences (such as the ways you support us or the types of causes you care about supporting), feedback, and survey responses.

• Technical Data includes any or all of internet protocol (IP) address, your login data, device type, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our websites.

• Usage Data includes any or all of information about how you use our website, app, products, and services.

We only collect the type of data that is relevant and reasonable to the requirements of our business, and most of the information we collect is from organisations applying for grant funding for the projects, resources, and services they wish to fund and individuals signing up to receive news and updates from us. 

If you have applied for a grant from HIWCF, we collect the data given on your online grant application form. Not all information relating to a grant is personal data, however, a limited amount of personal data is collected to allow us to communicate with the primary contact at grantee organisations and to monitor the delivery of projects. 

 

The type and quantity of information we collect and how we use it depends on why you are providing it.

 

2.2.1. Supporters: If you support us, for example by making a donation, becoming a fundholder, volunteering, or signing up to receive our news and updates, we will mainly use your data to:

• Provide you with the services, products, or information you asked for

• Administer your fund or donation, or support your fundraising, reclaiming any Gift Aid

• Keep a record of your relationship with us

• Ensure we know how you prefer to be contacted

• Understand how we can improve our services, products, or information.

If you enter your details onto one of our online forms, and you don’t ‘send’ or ‘submit’ the form, we may contact you to see if we can help with any problems you may be experiencing with the form or our website.

We may also use your personal information to detect and reduce fraud and credit risk in order to ensure due diligence around processing donations to ensure the source is genuine e.g. sale of shares and to protect against money laundering.

 

2.2.2. Grant Applicants: We may use personal information to discuss a grant application where you are an authorised named contact in the following ways:

• contact or inform you about the progress of an application where you are either the primary or secondary contact,

• contact you about an enquiry you have made

• to send you information you have requested

• monitor the delivery of projects

 

2.2.3. Direct marketing: With your consent, we will contact you to let you know about the progress we are making, to ask for donations or other support, and to publicise funding opportunities. Occasionally, we may include information from partner organisations or organisations that support us in these communications. We make it easy for you to tell us how you want us to communicate, in a way that suits you. Our forms have clear marketing preference questions, and we include information on how to opt out when we send you marketing. If you don’t want to hear from HIWCF, that’s fine. Just let us know when you provide your data, or contact us on 01962 798700 or email us at info@HIWCF.com.

If we run an event in partnership with another named organisation, your details may need to be shared. We will be clear what will happen to your data when you register.

 

2.2.4. Sharing your story: Some people choose to tell us about their experiences as donors or grant recipients to help further our work. They may take on a role as a patron or volunteer, attend our events, or sit on our committees. This may include sharing sensitive information related to their personal life, in addition to their biographical and contact information. If we have the explicit and informed consent of the individuals (or their parent or guardian if they are under 18) this information may be made public by us at events, in materials promoting our work, or in documents such as our annual report.

 

2.2.5. Feedback/Complaints: We may collect and retain your information if you send feedback about our services or make a complaint.

 

We collect, use, and share ‘aggregated data’ such as data relating to your use of the HIWCF website and pages visited; aggregated data is not considered personal data as it does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data, which will be used in accordance with the terms of this privacy notice.

 

We do not normally collect or store any ‘special categories’ of personal data (i.e. details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data) about supporters or grant recipients. However, there are some situations where this will occur including, but not exclusively, if:

• An accident or incident occurs on our property, at one of our events or involving one of our staff (including volunteers)

• You are attending one of our events and have disclosed specific access or dietary needs.

• Data around an individual’s health is directly relevant to the awarding of a grant.

• You are in receipt of a grant award to support further education, and your place of education may be recorded.

If this does occur, we will be clear with you that we wish to collect such information, our reason for collecting such information, and that we will only do so with your explicit consent. We will also take particular care to ensure your privacy rights are protected.

 

Where we need to collect personal data by law, or under the terms of an agreement we have entered into or are negotiating with you, then if you fail to provide that data when requested, we may not be able to perform the agreement (for example, to provide you with information or funding). 

 

We use different methods to collect data from and about you, including through:

• Direct interactions: You may give us your Identity, Contact, Profile, and/or Financial Data by filling in forms or by corresponding with us by post, telephone, email, or otherwise. This includes personal data you provide when you:

• Apply for funding from HIWCF.

• Complete a form on our website.

• Request marketing to be sent to you.

• Give us feedback, complete a survey, or contact us in any other way.

• Automated technologies or interactions: As you interact with our website we may automatically collect Technical Data about your equipment, browsing actions, and patterns. We do this to help us make our sites – and the way you use it– better and like most websites we may collect this personal data by using cookies and other similar technologies. For more details about the cookies we use, how we use them, and how you can control them, see our Cookie Policy.

 

• Third parties or publicly available sources: We will receive personal data about you from various third parties and public sources as set out below:

• Analytics providers (such as Google).

• Third-party fundraising platforms such as Raisely, or one of our funding partners (where you have consented to them sharing your information).

• Advertising networks and search information providers.

• Contact, Financial, and Transaction Data from providers of technical, payment, and delivery services.

• Identity and Contact Data from publicly available sources such as Companies House and the Electoral Register.

 

We may combine information you provide to us with information available from external sources in order to gain a better understanding of our supporters to improve our services and any fundraising activities. We may conduct research and analysis on the information we hold, which can in turn generate personal data. For example, by analysing your interests and involvement with our work, we may be able to build a profile that helps us decide which of our communications are likely to interest you. 

 

From time to time, we may engage specialist agencies to gather information from publicly available sources to identify individuals who may have an affinity to our cause but with whom we are not already in touch. For example, company websites, ‘rich lists’, social networks such as LinkedIn, political and property registers, and news archives.

This research helps us to understand more about you as an individual so we can focus conversations we have with you about fundraising in the most effective way, and ensure that we provide you with an experience as a donor or potential donor which is appropriate for you.

 

You will always have the right to opt out of this processing (see Section 8 on ‘Your Rights’ below).

 

Data protection law requires that wherever we process personal data there must be a ‘legal basis’ for doing so. The legal basis we rely on will depend on the nature of our relationship, most commonly it will be either;

• Consent – you have agreed to our use of your data for the associated purpose(s), or

• Contract – it is necessary to perform a ‘contract’ (or similar legally binding agreement), or to take steps at your request to enter into such a contract or agreement, or

• Legal obligation – the processing is necessary to ensure we comply with a legal obligation we are subject to (e.g. we may use your data to conduct anti-money laundering checks), or

• Legitimate Interests – where we have a genuine and legitimate reason to use your data and our use does not infringe any of your rights and interests.

We will ensure we identify the most appropriate legal basis prior to using your personal data for any purpose.

 

We strive to provide you with choices regarding certain personal data uses, particularly around marketing communications. We will only send marketing emails or text messages after we have obtained your specific consent. Our marketing communications include information and updates about HIWCF, our grant-making, funds, events, insights, and strategic programmes. If you would like to receive such communications but have not opted in, please contact us on 01962 798700 or email us at info@HIWCF.com.

You have the right to withdraw your consent at any time. You can do this by clicking the ‘unsubscribe’ link which will be in every marketing email we send or by contacting us using the details in Section 1.4 above.

 

We may need to disclose your details if required to the police, regulatory bodies, or legal advisors. We will only ever share your data in other circumstances if we have your explicit and informed consent. Your details will never be sold, leased, or rented to third parties, or shared with third parties for marketing purposes. Your data will not be passed to anyone other than those working on behalf of HIWCF.

 

We may transfer your personal data outside the UK. Whenever we do this, to ensure that your data is adequately protected and your personal data rights are maintained, we will ensure that either:

• It is to a country where the laws provide an equivalent level of protection for personal data; or

• We put in place appropriate safeguards, such as binding contracts which incorporate terms approved by the Information Commissioner’s Office.

 

We ensure that there are appropriate technical and organisational controls in place to protect your personal details and prevent accidental or unauthorised loss, use, access, alteration, or disclosure. 

Personal data and online grant application forms are managed through the reputable Salesforce CRM system and stored on secure servers and encrypted during transmission using industry standard Transport Layer Security. Personal data may also be stored in documents such as email, letters, and other correspondence, which is stored on our secure network.

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff, trustees and volunteers who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you if a breach occurs which presents a risk to your rights and freedoms.

 

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for and, where relevant, for the purpose of satisfying any legal, regulatory, tax, accounting, or reporting. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

To determine the appropriate retention period for personal data, we consider the purposes for which we process your personal data (and whether we can achieve those purposes through other means), the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, and the applicable legal, regulatory, tax, accounting, or other requirements.

Relationships between us and our fundholders, donors, supporters, and/or grantees are often long-term, and so we expect to keep your data for as long as that relationship exists, or until we no longer need it.

 

You have a number of rights under data protection laws in relation to your personal data, which are set out below. You will not have to pay a fee to exercise any of these rights, although we may charge a reasonable fee or refuse to comply if your request is clearly unfounded, repetitive, or excessive. We try to respond to all legitimate requests within one month. Occasionally, it could take us longer than a month if your request is particularly complex or you have made a number of requests; if this is the case, we will notify you and keep you updated.

 

The rights you have in relation to your personal data are:

• Right of access: Obtain confirmation as to whether or not we are processing your personal data and receive a copy of the personal data we hold.

• Right to rectification: Request correction of inaccurate or incomplete data.

• Right to erasure: Request deletion of your data in certain circumstances.

• Right to restrict processing: Request a restriction on how your data is used in specific scenarios.

• Right to data portability: Request transfer of your data to you or a third party in a structured, commonly used, machine-readable format.

• Right to object: Object to the processing of your personal data where we are relying on legitimate interests, or for direct marketing purposes, including profiling.

• Right not to be subject to automated decision making: Prevent decisions made solely based on automated processing that affect you.

 

Where we are relying on consent to process your personal data, you also have the right to withdraw consent at any time. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us using the details in Section 1.4. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights); this is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

 

If you have any complaints about the way we use your data, please contact us using the details given above. 

If we are unable to resolve your complaint to your satisfaction you have the right to you’re your complaint to the Information Commissioner’s Office (ico.org.uk), the independent regulator of the UK privacy laws, however you must first give us the opportunity to address your issues.

 

We may change this Privacy Notice from time to time. If we make any significant changes in the way we treat your personal information, we will make this clear by posting details on our website, or by contacting you directly.