DATA PROTECTION AND PRIVACY POLICY
This policy statement describes the way The Craven Trust (“CT”) manages the personal and grant applicant information it holds.
Personal Information
CT holds the following categories of personal information.
- Names, postal addresses, phone numbers, and email addresses of friends and donors.
- A record of friends’ and donors’ donations.
- A list of non-friends and donors’ names, postal addresses, phone numbers, and email addresses, who have expressed an interest in our activities and have agreed to Opt In.
The information is securely stored and managed in by our administrator.
Personal data is used for the following purposes:
- To produce postal mailing lists (name/address labels) for annual reports.
- To contact on administrative matters, events being organised by CT or ways to further support CT.
- Contact is principally by mail, however where we have email addresses and consider it appropriate we will use email.
- To generate annual Gift Aid returns for HMRC.
CT does not share any of the information with other organisations.
Use of information is based on Legitimate Interest: that is, its use is part of the natural process of running CT and serving its friends and donors, and consent to use the data in this way is implicit in its provision. The personal data of non-friends and donors is used only with their explicit consent.
Friends’ and Donors’ personal information is retained as long as they continue to contribute to the Trust and in line with Companies Act/Charities Act, HMRC and GDPR regulations. Personal data is deleted immediately unless there is a request to continue to receive information from CT, in which case the data is transferred to the list of non-friends and donors. Non-friends’ and Donors’ personal information is held until CT is requested to delete it.
Grant Applicants’ Data
Craven Trust
Grant applicants’ data is received via application form either on paper or in email format. Emails are saved on a secure email server and paperwork is kept in locked filing cabinets for a period of five years. Application forms are shared with Trustees via secure cloud-based storage.
The Online Yorkshire Common Application Form uses the Jotform Platform and in conjunction with Jotform’s GDPR the following applies:
What data do we need?
Accessibility requirements regarding documentation or support with communications.
Why do we need this data?
The Craven Trust has a legal duty to comply with the Equality Act (2010). This means that when we process your data to meet your accessibility requirements our lawful basis is legal obligation under article 6(1)(c) of UK GDPR. Our processing of special category data, such as any health information you give us will be based on consent, article 9(2)(a).
Do we use any data processors?
Your data will be held externally on cloud-based services or on the systems of partners who process information on our behalf.
We use Jotform to collect information on our behalf. Any data collected by Jotform is stored on UK servers. You can read their Privacy Policy here https://www.jotform.com/privacy/
We are committed to storing data securely wherever it is held, and ensuring it is only accessible to authorised personnel. Where data is stored on partner systems we expect them to adopt security practices aligned with our own.
Beamsley Trust
Group grant applicants’ data is received via application form either on paper or in email format. Emails are saved on a secure email server and paperwork is kept in locked filing cabinets for a period of five years. Application forms are shared with Trustees via secure cloud-based storage and email.
Applications from individuals are only shared by email and cloud-based storage once name and address details have been redacted by the Administrator. In further correspondence regarding the individual, that individual is referred to only by surname initial and referring organisation.
The policy is the responsibility of the CT Trustees, with the Treasurer charged with owning and monitoring its implementation. Trustees and delegated individuals have access to the data in accordance with this policy.
July 2023