This notice explains how we use your personal data in relation to Bedford Giving. Personal data is information about you from which you can be identified (either directly or indirectly).
It also explains the decisions that you can make about your personal data. This notice applies to the following services:
- Mentoring opportunities
- Work experience programme
- Other projects being run by Bedford Giving
These activities are referred to in this notice as the “services“.
Bedford Giving is hosted by The Harpur Trust (the “Trust“) so the Trust is ultimately responsible for your personal data, or to use data protection terminology, the Trust is a “controller” or “data controller” of your personal data.
The purpose of this notice is to help you understand how and why your personal data is collected in relation to the services and what we do with that information. It also explains the decisions that you can make about your personal data.
If you have any questions about this notice please contact the Trust’s Data Controller, whose contact details are firstname.lastname@example.org. If the Data Controller is not available, you can contact the Trust on 01234 369500 in relation to any of the matters set out in this notice.
How we use your personal data
Our main reason for using your personal data is to enable Bedford Giving to provide its services to you and others.
We collect personal data direct from you when you enquire about the services. If you enquire about supporting Bedford Giving then we will collect and use your name, email address, telephone number, address, payment details and information you have provided so that Bedford Giving can provide the services.
Using your personal data in this way is necessary for the performance of the services between you and Bedford Giving.
We also use personal data for other purposes related to your use of the services. These other purposes are as follows:
- To enable Bedford Giving to provide the services. For example, we will keep a record of your enquiry, and any specific information that you share with us.
- To improve the services for you and other users. For example, we may keep a record of your preferences and interests to enable us to deliver a better service. If you give us feedback we will use that in order to improve. This is necessary for our legitimate interest in managing what we offer and improving the services.
- To make any adjustments, for example, if you ask us to change how you access the services because of a disability you have. We also use personal data in order to help make sure that the services are used in an appropriate way and to reduce and manage the risks to you and other users. As part of this we will use information concerning your health e.g. any disability you may have. We, and the other users of our services, have a legitimate interest in ensuring that the services are used appropriately and safely. In addition, we have a legal obligation under health and safety laws to make sure that our services are used appropriately.
- To take care of you if you are hurt or unwell. We may use health information about you for these purposes and we have a legitimate interest in making sure that you are well.
- To accommodate your dietary requirements. We have a legitimate interest in complying with your requirements and we have a legal obligation under health and safety laws to make sure that you are safe.
- To make sure that you are complying with our rules and using the services appropriately. If we stop you using any services (for example, because of your bad behaviour) we will keep a record of that and we may prevent you from using the services in future. As with the above, we, and the other users of our services, have a legitimate interest in ensuring that the services are used appropriately and safely.
- If you attend one of our events or panels, we have a legitimate interest in processing information concerning your participation.
- If there is a problem, for example, if you or someone else has made a complaint then we have a legitimate interest in using personal data in connection with that complaint, for example, so that we can find out what happened and put things right.
- Less commonly, we may use information relating to criminal convictions and offences, for example, where it is necessary in relation to legal claims. We may also use this information if it is necessary to carry out our obligations or to exercise our rights. We have a legitimate interest in using this personal data to protect the Trust.
- We may also take photos of you when you take part in our activities or use our services. The photos will be used in connection with our publicity, for example, they may appear on our websites, promotional material and on social media. We have a legitimate interest in publicising our activities. We may ask for your consent before taking or using some photos and videos e.g. if the photo or video is more intrusive and we cannot rely on legitimate interests. If we ask for your consent to use your personal data you can take back this consent at any time. Please speak to the Data Controller if you would like to withdraw any consent that you have given.
We also have a legitimate interest in using your personal data in other ways as follows:
- Regardless of the relationship we have with you, we may need to use your personal data for legal reasons such as fraud prevention and to check that you are complying with our rules or terms and conditions and to enforce our legal rights. In addition to this being in our legitimate interests, if we have a contract with you such use is necessary for the performance of that contract.
- We may need to use your personal data in order to protect our interests, for example, if you post a comment on a review website then we may provide a response to that comment or contact you directly to discuss your feedback. This is necessary for our legitimate interest in protecting our reputation and in order to help us improve.
- We may share your personal data with our legal advisors or insurers. This is necessary for our legitimate interest in protecting our interests and seeking legal advice.
- In limited circumstances we may use your personal data to protect your vital interests or the vital interests of someone else (for example, if you or they are seriously hurt).
- We may perform due diligence on those we contract with. This can include in the form of credit checks on companies, including checking photographic identification and proof of address of directors and, in some cases, your shareholders, and verification of the company registration details. We do this to comply with our legal obligations, and as necessary for our legitimate interests of checking that the entities we contract with are financially viable and would not cause us reputational damage.
Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.
If you have any questions about any of the above, please speak to the Data Controller.
Sharing your personal data
We may share your personal data with third parties as follows:
- Following review of the information you provide via our website regarding mentoring and our work experience programme, we may pass your details onto a third party in connection with the running of these schemes, with your permission.
- We will share your personal data with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.
- If ever in the future, we are considering restructuring Bedford Giving we may share your personal data with the other parties involved and with the relevant professional advisors. This is for our legitimate interest in ensuring that the charity continues to fulfil its objects.
- If we have a legal obligation to do so or for the purposes of fraud protection and credit risk reduction.
- We use service providers to handle personal data on our behalf for the following purposes:
- if we use outside caterers we may share information about dietary needs and requirements;
- we use a CRM system which is provided to us by a third party; and
- we also use a service provider for processing online payments and donations.
Keeping you updated
We may contact you with marketing material by email, telephone, post or by text message but we will only do this where we are allowed to do so under data protection law. Sometimes we will need your consent first.
For example, we may send you information about conferences, events, and activities that you may be interested in.
If you tell us that you do not want to be contacted for any of these purposes then we will of course respect that. Any use of your personal data before you withdraw your consent remains valid. Please speak to the Data Controller if you would like to withdraw any consent that you have given.
How long will we use your personal data for?
We only retain your personal data for as long as is necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Further information on our retention periods can be found in the Trust’s Information and Records Retention Policy.
Your rights in relation to our processing of your personal data
You have the following rights:
- Correction: if information we hold about you is incorrect or incomplete you can ask us to correct it.
- Access: you can also ask what information we hold about you and be provided with a copy. This is commonly known as making a subject access request. We will also give you extra information, such as why we use this information about you, where it came from and who we have sent it to.
- Deletion: you can ask us to delete the information that we hold about you in certain circumstances. For example, where we no longer need the information.
- Portability: you can request the transfer of your personal data to you or to a third party in a format that can be read by computer. This applies where (a) the information has been provided by you; (b) the basis that we are relying on to process your personal data is consent or contract; and (c) the information is being processed by us on computer or other automated device such as a mobile phone.
- Restriction: you can request that we restrict how we use your personal data.
- Object: you may object to us using your personal data where:
- we are using it for direct marketing purposes (for example, to send you marketing information about our services);
- the lawful basis on which we are relying is either legitimate interests or public task; and
- if we ever use your personal data for scientific or historical research purposes or statistical purposes.
If you fail to provide certain information when requested, we may not be able to perform our obligations with you. We may also not be able to provide the services or be prevented from complying with our legal obligations.
You have a right to lodge a complaint with the Information Commissioner’s Office – ico.org.uk. If you do have any concerns about how we have handled your personal data we would kindly ask that you contact us in the first instance before you speak to the ICO so that we have an opportunity to put things right.
If we delete your personal data or restrict our use of it, we may not be able to provide our services to you.
If you want to exercise any of your rights please contact us, the best way to do this is by email email@example.com. We may need to request specific information from you to help us confirm your identity.
Bedford Giving is hosted by The Harpur Trust which is a company Registered in England and Wales: Company Number: 3475202, Princeton Court, Pilgrim Centre, Brickhill Drive, Bedford, MK41 7PZ.