PRIVACY POLICY

The Whirlwind Charitable Trust

PRIVACY POLICY

The Whirlwind Charitable Trust (“we”, “our”, “us”) (registered charity number 1119576 and registered company number 6261868) is committed to protecting and respecting your privacy. This policy explains how we collect and use your personal information (including via our website www.whirlwindcharitabletrust.org.uk/) and your rights in relation to it.

If you have any questions about this policy or the ways in which we use personal information please contact mail@whirlwindcharitabletrust.org.uk.

This policy contains important information about your personal rights to privacy so please read it carefully.

The provision of your personal information to us is voluntary. However, without providing us with your personal information, your interaction with us may be impaired. For example, if we do not have your contact details we will be unable to liaise with you regarding your grant application.

We would remind you that you should never provide us with the personal details of those your charity seeks to assist and help, all application information and feedback forms should be anonymous

Contents of this policy:

1. How we collect personal information

We obtain personal information:

When you give it to us directly, e.g. personal information you submit through our website or by email, for instance in a grant application.
When we obtain it indirectly, e.g. if your organisation is a supported charity one of your colleagues may provide us with your contact information so we can liaise regarding your grant and/or project. Your personal information may also be shared with us by third party service providers. To the extent we have not done so already, we will notify you when we receive personal information about you from them and tell you how and why we intend to use that personal information.
When you visit our website, we may automatically collect technical information about your device/computer such as your IP address. [We also use cookies and you can find more information in our cookies policy.]

In general, we may combine your personal information from these different sources set out above, for the purposes set out in this policy.

2. Personal information we may collect

We may collect, store and otherwise use the following kinds of personal information:

Information about your identity and your contact details;
your position in an organisation, and information related to the work that you do there;
financial information in relation to any transactions or the administration of a grant including its payment;
a record of your correspondence and interactions with us;
your responses to any surveys that we use for research purposes (and to which you are not obligated to respond);
technical details of your visits to our website for example, your IP address and geographical location; and/ or
any other personal information which we obtain as per section 1 of this policy.

Do we process special categories of data?

The UK General Data Protection Regulation (“GDPR”) recognises certain categories of personal information as sensitive and therefore requiring more protection, for example information about your health, ethnicity and political opinions.

We do not generally collect such information and, if we do, we will only process these special categories of data if there is a valid reason for doing so and where the law allows us to do so.

3. Uses made of your personal information

Your personal information, however provided to us, will be used for the purposes specified in this policy. In particular, we may use your personal information:

to provide you with services or information you have requested;
to provide further information about our work, services or activities;
to administer grant applications and then grants (including payment, monitoring and reporting);
to answer your questions/ requests and communicate with you in general;
to manage relationships with our charity partners and service providers;
for research purposes;
to report on the impact/effectiveness of our work;
to run/administer our operations (including our website), keep our websites safe and secure and ensure that content is presented in the most effective manner for you and for your device;
for publicity purposes (for example where we list examples of our work on our website); generally we anonymise this information and if not we would ask your permission first;
to audit and/ or administer our accounts;
to satisfy legal obligations which are binding on us, for example in relation to regulatory, government and/ or law enforcement bodies with whom we may work (for example requirements relating to the payment of tax or anti-money laundering);
for the prevention of fraud or misuse of services; and/or
for the establishment, defence and/ or enforcement of legal claims.

4. Our lawful grounds for collecting and using personal information

The law requires us to rely on one or more lawful basis to process your personal information. The following are relevant to us:

Where there is a legitimate interest in us doing so, provided our use is fair, balanced and does not unduly impact on your rights and freedoms (see further below).
We have entered into a contract with you or taken steps at your request prior to entering into one.
Where necessary to comply with a legal obligation to which we are subject.
Where you give consent (for example, for us to hold sensitive personal information).

Our legitimate interests

Depending on the activity, we may be relying on our legitimate interests or those of our partner organisations (or yours). Those legitimate interests include the following:

In broad terms, our “legitimate interests” are the interests of running the Trust as a grant-giving charity and pursuing its charitable mission (see more here); for example considering grant applications and then administering grants.

5. Communicating with you

We may contact you using the details you have provided in order to administer the grant application process and then to administer any grant provided to your organisation, on the basis it is in ours (and your) legitimate interests for us to do so.

6. How long we keep your personal information

In general, we will keep your personal information for as long as it is required in connection with the purposes for which it was collected and/or used. However, if before that date (i) your personal information is no longer required in connection with such purpose(s), (ii) we are no longer lawfully entitled to process it or (iii) you validly exercise your right of deletion, we will remove it from our records at the relevant time.

Generally, this means that we keep personal information pertaining to any ongoing grant relationship for the grant period plus six years thereafter. After a period of six years we will retain details of your charity, the grant amount, purpose etc but securely remove any personal data from our records. For unsuccessful grant applications we keep the application documents, including any personal information, for three years at which point it is securely deleted if there has been no further relevant application.

Where required, in some cases we will keep personal information at least as long as necessary to comply with relevant regulatory or statutory requirements. We will also retain personal information, when and as long as necessary, where we have a contractual obligation or to resolve legal disputes.

7. Disclosure of your personal information

We may disclose your personal information to third parties in some cases in order to achieve the purposes set out in this policy, including:

suppliers and sub-contractors, for example IT service providers such as website hosts;
insurers;
financial companies that collect or process payments on our behalf;
news media outlets (with your permission);
regulatory authorities, such as tax authorities; and/or
analytics and search engine providers (certain online identifiers, such as IP address, only – for example Google Analytics).

In particular, we reserve the right to disclose your personal information to third parties:

if we were to merge or undergo a reorganisation, in doing so we may acquire or transfer personal information as part of that transaction but your personal information would continue to be used for the same purposes.
if we are under any legal or regulatory duty to do so; and/or
to protect the rights, property or safety of the Trust, its partner charities or others.

8. Security of your personal information

We are committed to keeping your personal information safe and secure and we have appropriate and proportionate security policies and organisational and technical measures in place to help protect your information. For operational reasons your information may be stored in both electronic formats, and hard copy, across several locations to enable us best to assess your application.

Your personal information is only accessible by appropriately trained staff, volunteers and contractors, and stored on secure servers which have features to prevent unauthorised access.

9. International data transfers

We are based in the UK and in general the personal information we collect is stored within the UK. However, we may use suppliers and partners to process personal information on our behalf that are internationally based and if so your personal information may be stored or otherwise processed outside the European Economic Area (“EEA”).

Some countries outside of the EEA have a lower standard of protection for personal information, including lower security requirements and fewer rights for individuals. In these cases we will take all reasonable steps necessary to ensure that there are appropriate safeguards in place (such as European Commission-approved contracts). If you have any questions about the transfer of your personal information, please contact us.

Unfortunately, no transmission of your personal information over the internet can be guaranteed to be 100% secure.

10. Your privacy rights

We generally do not rely on consent to use your personal information as there are more appropriate lawful grounds in relation to the activities we undertake. If we do, however, you can withdraw your consent at any time. This includes the right to ask us to stop using your personal information for marketing purposes or to unsubscribe from such communications – though currently our communications are limited to our grant making activities and not in the nature of marketing. You also have the right to:

Request access including a copy of your personal information. To make a request online please see our personal data request form here.
Object to the use where we are (i) relying on legitimate interests as our legal basis, (ii) using it for direct marketing or (iii) using it for statistical purposes.
Request erasure in some cases (or to anonymise it). We may retain some limited personal information so we can ensure you are not contacted by us in the future.
Request correction if you believe our records concerning you are inaccurate. If you are unsure you can ask us to check the information we hold about you.
Request us to restrict processing (i.e. held but not further used) if there is disagreement about its accuracy or legitimate usage.
Request the transfer in limited circumstances of your personal information to you or another party.

Some additional rights apply in respect of what is known as ‘automated decision making’ but we do not currently use your personal information in this way.

Please note that these are legal rights which only apply in limited circumstances. For more information, or to exercise these rights, please contact us using the details below.

We may ask you for additional information, to confirm your identity, and for security purposes, before disclosing personal information requested to you.

11. Changes to our privacy policy

This policy was last updated on 21st September 2020.

We may update this policy from time to time. If we make any material changes to this policy, we will notify you either through the email address you have provided to us, or by placing a prominent notice on our website.

12. Contact us (including complaints)

Please let us know if you have any questions or concerns about this policy or about the way in which we use your personal information by contacting us:

By email at:mail@whirlwindcharitabletrust.org.uk

By post at:The Whirlwind Charitable Trust, Coganhayes, Buckerell, Honiton EX14 3ER

You are entitled to make a complaint at any time to the Information Commissioner’s Office, the UK data privacy regulator (https://ico.org.uk/global/contact-us/). We always appreciate the opportunity to resolve your concerns before you feel it is necessary to approach the ICO.

POLICIES