We take your privacy seriously and treat all the personal data you give us with great care.
Our Privacy Notice explains how we collect, store and use the personal data you give to us. We’ll keep this document updated so that you can be confident when sharing your data with us that it will only be used in accordance with this statement. If you have any questions concerning your personal data and how we look after it or you would like to update how you would prefer to hear from us, then please contact our Data Protection Officer.
1. Who is the controller of your data?
Gloucestershire Historic Churches Trust is the controller of your personal data.
2. What personal data do we process?
We process personal data about you that you give to us when you make a donation, apply for a grant, sign up to our e-newsletter, sign up as a friend of GHCT or take part in our Ride+Stride fundraising event as a local organiser, participant or sponsor, or make any enquiry about our activities. This data may include your name, address, email address, age range (for Ride+Stride prizes), telephone number and if applicable, your bank account details. When you visit our website we also automatically receive your IP address which is a unique identifier for your computer or other device you are using to access our site.
3. Visitors to our website
When someone visits ghct.org.uk we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. If we do want to collect personally identifiable information through our website, we will be clear about this and will explain what we intend to do with it.
We use a third-party provider, MailChimp, to deliver our occasional e-newsletters. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our e-newsletter. Mailchimp has certified to the EU-U.S Privacy Shield Framework, so that information held in the US, for example on computer servers, is treated with the same privacy protection as that in the EU. For more information, please see Mailchimp’s privacy notice. https://mailchimp.com/legal/privacy/
6. How do we use your data?
Personal data collected and processed by us may be used for the following key purposes:
• Administration of our supporter database;
• Administration of donations, legacies and event ticket sales;
• Administration/payment of our grants;
• Responding to requests for support;
• Research and statistical analysis;
• Communication about our grants, help for churches, ways to support us, fundraising and other activities that we think may be of interest to you;
• Distribution of our e-newsletter;
• Organisation of our Ride+Stride event;
Personal data provided to us will be used for the purposes outlined at the time of collection or registration in accordance with the preferences you express.
If you are a supporter of GHCT this will include sending you confirmation of your donation, an annual review, regular e-newsletters from which you may unsubscribe at any time, and details of our events and offers.
If you are a Local Organiser for Ride+Stride this will include sending you a newsletter, event packs, and other necessary communications relating to the event.
If you are enquiring about a grant, or looking for advice around a church project, and request or agree to being sent grant support or fundraising information via email, we will consider that you are interested in hearing from us and therefore may, from time to time, send you relevant information about our work.
Wherever possible and appropriate we will seek consent from a parent or guardian before collecting or using information about children or adults at risk.
We do not make fundraising phone calls and would only telephone you if we had a specific query.
7. Where does your personal data come from?
The data we process about you comes from you, for example, information you provide to us when making a donation, signing up to our e-newsletter online, registering as a local organiser or completing participant or sponsor forms for Ride+Stride, enquiring about a purchase or during the process of applying for a grant.
Other information is gathered during your use of our website (e.g. IP addresses or information obtained via cookies).
8. Do you have to provide your personal data?
In most cases, providing your personal data to us is optional, however, in some circumstances if you do not provide it, we will probably not be able to fulfil your donation, keep you up to date with news or events or e-newsletters, or our website may not work properly for you. For example:
• you can turn off cookies on your browser and we will not place any cookies on your device or computer. However, this is likely to mean that you may not be able to use all parts of our website.
9. What are the grounds for processing your personal data?
Data protection laws require us to tell you what legal basis we use for processing your personal data. These bases are set out in the applicable data protection law. We use the following:
• the processing is in GHCT’s legitimate interests, and these interests are not overridden by your interests or rights in the protection of your personal data; for example, when determining grant applications, occasionally communicating with supporters by post, determining the prize winners for Ride+Stride or resolving Ride+Stride issues.
• Consent, where you have consented to our processing of your personal data, for example if you are a Local Organiser, if you have agreed to receive our email newsletter, offered to feature in our publicity. If you have consented, you can withdraw your consent at any time by contacting us.
• Contract, for example where you are buying a product from us or we issue a Ride+Stride refund to you by cheque
• Legal obligation, for example where we use your details to process a Gift Aid claim, or where we record your consent, or withdrawal of consent in which case we retain a suppression list recording that you have withdrawn consent.
10. Use of data processors
Data processors are third parties who provide services for us, for example by organising Ride+Stride and managing our publicity. We have contracts in place with our data processors, for example Mailchimp, printing companies and trophy engravers. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.
11. Data retention
We will hold your personal information on our systems for as long as is necessary for the relevant activity for which your data was originally obtained. For example, we will keep a record of donations for at least seven years.
The nature of our work is such that we may have lifelong relationships with donors, beneficiaries and supporters, which is vital to the running of the charity.
You can withdraw your consent to us holding your data, or object to us doing so where we are using legitimate interest as a lawful basis, at any time.
If you do so, we will keep a record of your contact details and information necessary to ensure that we can comply with your request not to be contacted by us.
12. What are your rights?
Under the EU General Data Protection Regulations (GDPR) 2018, you have rights as an individual which you can exercise in relation to the information we hold about you. These include the right to access data we hold about you, to correct any mistakes and to have your data erased.
You can read more about these rights here: https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
If you wish to get access to personal information we hold about you, we will:
• Tell you what data we hold
• Tell you why we are holding it
• Tell you who it could be disclosed to; and
• Let you have a copy of the information in an intelligible form.
You can also request access to any information we hold about you at any time by contacting us. If your personal details change, please help us to keep your information up to date by notifying us.
13. Contact and complaints
If you have any questions about this policy or about how we use your personal data please contact our Data Protection Officer, or write to us at the address shown for the Data Protection Officer on our Contact us page.
If you are unhappy about how we are processing your data or how we have responded to a request or complaint, you have the right to make a complaint to the UK’s data protection regulator, the Information Commissioner’s Office (ICO). You can find more details about how to contact the ICO at: https://ico.org.uk/.
14. Links to other websites
This privacy notice does not cover the links on our website. We encourage you to read the privacy statements on the other websites you visit.
15. Changes to this policy
We may change or update this policy from time to time so please check this document periodically.
This policy was last reviewed on 02.05.2018.