Strathnairn Community Benefit Fund Privacy Notice
The Strathnairn Community Benefit Fund (SCBF) is committed to protecting any personal information shared with it by individuals, or that it receives from other organisations, and keeping it safe.
This Privacy Notice explains how SCBF will use any personal information (data) it collects from you or others to comply with data protection law.
This Privacy Notice applies to all data held by the Strathnairn Community Benefit Fund and pages hosted at www.strathnairncbf.com. It does not apply to pages hosted by other organisations or individuals, to which we may link and or be linked from, whose privacy notices may differ.
In legal terms, for the purpose of the Data Protection Act 1998 (DPA) and the General Data Protection Register 2018 (GDPR), the data controller for this information is Strathnairn Community Benefit Fund Limited.
1. Why SCBF needs your data?
SCBF is committed to working with the Strathnairn community to meet the needs of residents. SCBF believes that thriving communities with caring people and strong voluntary groups gives everyone the opportunity to achieve their best. Thriving communities are built on time, money and effort that enable ambition to be achieved, potential to be fulfilled and ends to be met.
SCBF uses personal data to help organise the giving of that time, money and effort in the Strathnairn Community Council area.
2. Whose personal data does SCBF collect and how it is collected?
Personal data means any information capable of identifying an individual. It does not include anonymised data.
SCBF holds personal data on those who have given financial or other support to SCBF. SCBF holds data on individuals (representing themselves or organisations): who enquire about SCBF; who attend SCBF meetings; apply to SCBF for grants or who are the recipients of payments. SCBF holds data on those who have given their consent for SCBF to use it to contact them about the things they have declared an interest in.
The majority of personal data SCBF holds about you has been provided directly by you.
SCBF may also receive information about you from third parties, for example: via a quote or bill supplied by you with an application; by an individual copying you in to an e-mail. We may receive data from third parties such as carers, relatives, family members or others who have a power of attorney or your written permission, who are acting on your behalf.
SCBF may collect information available in the public domain including social media such as Facebook. SCBF may also use publicly available directories, electoral registers and similar information such as the British Telecom’s telephone number database; Companies’ House or your organisation’s website.
SCBF may receive data from analytics providers such as Google based outside the EU, advertising networks such as Facebook based outside the EU, search information providers such as Google based outside the EU, providers of technical, payment and delivery services, such as data brokers or aggregators.
3. What Personal Data do we collect about you, for what purpose and on what ground SCBF processes it.
We may process the following categories of personal data about you:
- Communication Data that includes any communication that you send to SCBF whether that be through the contact form on the website, through letter, e-mail, text, social media messaging, social media posting or any other communication that you send SCBF. SCBF processes this data for the purposes of communicating with you, for record keeping and for the establishment, pursuance or defence of legal claims. SCBF’s lawful ground for this processing is its legitimate interests, which in this case are to reply to communications sent to it, to keep records and to establish, pursue or defend legal claims.
- Applicant Data that includes data relating to any grant you apply for (electronically and in paper format), such as your name, title, postal address, email address, phone number/s, grant related attachments or follow up communications. Some applications require that SCBF sees certain documentation or is informed of your income and expenditure to demonstrate your eligibility. SCBF processes this data to consider grant applications, award grants and to keep records of such transactions. When a grant has been awarded SCBF may use your name in publically available media listing individual grant recipients (amounts/name/purpose) to promote SCBF and ensure wider community accountability. SCBF may also seek your permission to use your name with a quote as a beneficiary/organisation representative of an award on promotional material. However, SCBF anonymises the details of recipients of awards categorised by the SCBF Board as vulnerable groups. For example, Supplementary Home Heating Grants, Respite Grants, and Hardship Grants. Our lawful ground for this processing is the performance of a contract between you and SCBF and/or taking steps at your request to enter into such a contract, and legitimate interests in promoting the Fund.
- User Data that includes data about how you use our website and any online services together with any data that you post on online services. We process this data to operate our website and ensure relevant content is provided to you, to ensure the security of our website, to maintain back- ups of our website and/or databases and to enable publication and administration of our website, other online services and business. It includes listing your name on publically available minutes as attendees of SCBF meetings. SCBF’s lawful ground for this processing is its legitimate interests which in this case are to enable SCBF to properly administer its website and its business.
- Technical Data that includes data about your use of our website and online services such as your IP address, your login data, details about your browser, length of visit to pages on our website, page views and navigation paths, details about the number of times you use our website, time zone settings and other technology on the devices you use to access our website. The source of this data is from analytics tracking systems. SCBF may process this data to analyse your use of its website and other online services, to administer and protect its business and website, to deliver relevant website content and advertisements to you and to understand the effectiveness of its advertising. SCBF’s lawful ground for this processing is its legitimate interests which in this case are to enable it to properly administer its website and business and to grow the business and to decide its marketing strategy.
- Membership Data that includes data relating to your application to become a member of SCBF, your membership of SCBF and renewal of your membership submitted (electronically and in paper format). Such as your name, title, age, postal address, email address, and phone number/s. SCBF processes this data to consider applications for membership, send correspondence on member related processes and to keep records of such transactions. SCBF lawful ground for this processing is the performance of a contract between you and SCBF and/or taking steps to enter into or end such a contract and to comply with its legal agreements and obligations.
- Board Membership Data that includes data relating to your application (electronically and in paper format) to become a Board Member (Trustee and Director) of SCBF and processing your Board Membership of SCBF. Such as your name, title, age, postal address, email address, and phone number/s, biography for election and/or publicity purposes and eligibility to serve as a Trustee and Director. If you become a Board Member, SCBF may also collect further data such as: former name; nationality; date of birth; occupation; consent to act as a Trustee and Director; eligibility to act as a Trustee/Director, sample signature; photo identification and bank account details and other means as requested to verify your identity. SCBF processes this data to send Board related correspondence and to keep business records and to administer the governance of the organisation. SCBF’s lawful ground for this processing is the performance of a contract between you and SCBF and/or taking steps to enter into or end such a contract; to establish, pursue or defend legal claims and to comply with its legal agreements and obligations; and its legitimate interests to manage the governance of the organisation and promote the Fund.
- Marketing and consultation Data that includes data about your preferences in receiving marketing and consultations from SCBF and your communication preferences. SCBF processes this data to deliver relevant website and social media content, to consult you on SCBF related and wider community development related activity. Our lawful ground for this processing is either consent our legitimate interests which in this case are to study how residents use and benefit from our services and grant making activities, to develop them, to grow our business and to decide our marketing/consultation strategy.
4. Who has access to SCBF held data?
The SCBF Board has access to your data.
SCBF will not sell or rent your data to third parties.
SCBF will not share your data with third parties for marketing purposes.
SCBF may pass data to other organisations, businesses and professional advisers, known as Data Processors, to provide specific services. An example would be providing data to Foundation Scotland which provides secretariat services to community funds; a mailing house in order to send out a newsletter; an organisation providing electoral services to conduct a vote; the organiser of an event or function that a SCBF representative is attending or SCBF has commissioned to organise, lawyers, insurers.
SCBF will also provide your data to establish and defend its legal rights, and to prevent and detect crimes such as fraud. It may need to share your personal data with other people for this reason, such as courts and law enforcement agencies.
Applicant data is provided to SCBF’s appointed accountants/auditors because it has a legal obligation to provide this information.
SCBF provides the necessary Board Member data to Companies House, Office of the Scottish Charity Regulator (OSCR), Donors and SCBF’s appointed accountants, bankers and investment managers because it has a legal obligation to provide this information.
SCBF requires all third parties to whom your data is transferred to, to respect the security of your personal data and to treat it in accordance with the law. SCBF only allows such third parties to process your personal data for specified purposes and in accordance with its instructions.
5. International Transfers
Countries outside of the European Economic Area (EEA) do not always offer the same levels of protection to your personal data; so European law has prohibited transfers of personal data outside of the EEA unless the transfer meets certain criteria.
If any of SCBF third parties service providers are based outside the EEA their processing of your personal data will involve a transfer of data outside the EEA.
If SCBF ever transfers your personal data out of the EEA, it will do its best to ensure a similar degree of security of data by ensuring at least one of the following safeguards is in place:
- SCBF will only transfer your personal data to countries that the European Commission have approved as providing an adequate level of protection for personal data by; or
- Where SCBF uses certain service providers, it may use specific contracts or codes of conduct or certification mechanisms approved by the European Commission which give personal data the same protection it has in Europe; or
- If SCBF uses US-based providers that are part of EU-US Privacy Shield, it may transfer data to them, as they have equivalent safeguards in place.
If none of the above safeguards is available, SCBF may request your explicit consent to the specific transfer. You will have the right to withdraw this consent at any time.
6. Security of your data
Non-sensitive details (your email address etc), when transmitted normally over the internet cannot be guaranteed to be 100% secure. Whilst SCBF takes all possible means to protect your personal data, it cannot guarantee the security of any information you transmit electronically to SCBF, and you do so at your own risk.
SCBF has put in place security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed without authorisation.
SCBF also allows access to your personal data only to those Board Members and partners who have a business need to know such data. They will only process your personal data on SCBF instructions and they must keep it confidential.
If you are a SCBF Board Member, where SCBF has given you a password to access its website, social media accounts, and/or other online accounts and tools you are responsible for keeping this password confidential and must not share it with others.
Where SCBF has set up a dedicated firstname.lastname@example.org e-mail address for Board Members to send and receive SCBF related correspondence through, the person allocated this e-mail address is responsible for password protecting it, keeping this password confidential and must not share it with others. When a Board Member ceases to be a Board Member, and is not immediately re-elected, they will delete all SCBF e-mails they still hold.
SCBF keeps your data secure on its IT system with appropriate security mechanisms in place.
SCBF does not share your data with anyone else or any other organisation unless it is necessary for the purposes outlined above listing why SCBF collects your data.
7. SCBF’s responsibilities and how long your data will be kept for.
The law requires SCBF to tell you the basis on which it processes your data.
- Some activities require your consent. If the law requires your consent to process data in a certain way then SCBF will obtain it before carrying out that activity.
- Other activities are carried out to fulfil a contract or agreement. Examples include distributing funds which are subject to a Fund Agreement. Each requires SCBF to know who you are and to process your data in order to do the thing you have asked us to do. If a contract is in place then SCBF will process your data based on that contract.
- In all other cases the law allows SCBF to process your data if it is in its legitimate interest to do so, but only so long as it needs to, and your “interests or your fundamental rights and freedoms are not overriding”. Practically speaking this means carrying out an exercise to check that SCBF will not cause you harm by processing your data, that the processing is not overly intrusive and that it will only do so in a way which is described in this Privacy Notice.
SCBF will only retain your personal data for as long as necessary to fulfil the purposes it was collected for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Relationships between donors, grantees and SCBF are often long term, and so SCBF expects to keep your data for as long as that relationship exists, or until it is no longer needed.
When deciding what the correct time is to keep the data for SCBF looks at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means and legal requirements.
For tax purposes the law requires SCBF to keep basic information about awardees (including Contact, Identity, Financial and Transaction Data) for six years after they stop being awardees.
In some circumstances SCBF may anonymise your personal data for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
8. Your Legal Rights
Under data protection laws you have rights in relation to your personal data that include the right to request access, correction, erasure, restriction, transfer, to object to processing, to portability of data and (where the lawful ground of processing is consent) to withdraw consent.
You can see more about these rights at: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/
If you wish to exercise any of the rights set out above, please email SCBF at email@example.com
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, SCBF may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive or refuse to comply with your request in these circumstances.
SCBF may need to request specific information from you to help it confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. SCBF may also contact you to ask you for further information in relation to your request to speed up its response.
SCBF will try to respond to all legitimate requests within one month. Occasionally it may take longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you.
If you are not happy with any aspect of how SCBF collects and uses your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). SCBF would be grateful if you would contact it first if you do have a complaint so that SCBF can try to resolve it for you.
9. Contacting us
If you have any questions about this Privacy Notice, about the way in which SCBF processes your data, or if you wish to change the way SCBF uses your data, including how it communicates with you, then please contact the SCBF Secretariat.
SCBF, Po Box 5783, Inverness, IV1 9EW.
Tel 07858 688 355
10. Changes to this Privacy Notice.
This Privacy Notice was approved by the SCBF Board at its meeting held on 24 May 2018. The Board may make amendments to this Privacy Notice from time to time to keep it up to date or to comply with legal requirements. If you have access to the internet you should regularly check this privacy notice for updates on the SCBF website at www.strathnairncbf.com.