Privacy Notice

THE COTTON DISTRICTS CONVALESCENT FUND AND THE BARNES SAMARITAN CHARITY

We are required to tell you about your personal data that is being collected and used (‘processed’), how it is being collected and from who, what allows us to do this (the lawful bases), how long we are keeping it and tell you about your rights. This privacy notice meets that requirement.

Who we are

The Cotton Districts Convalescent Fund and The Barnes Samaritan Charity is a UK registered charity in the UK (Charity Number 224727). We provide grants to individuals in financial hardship and/or with medical needs, and to organisations supporting people in financial hardship and/or with medical needs. We are the ‘controller’ of the personal data we collect.

Our contact detail for questions about this privacy notice or how we process your personal data is: barnescottondistrictscharity@gmail.com

What data we collect

We will collect and process the following personal data about you. What we collect will depend on your contact with us or the applications submitted to us.

  • Contact details (such as name, address, email, phone)
  • Financial information (income, hardship details)
  • Health or medical information (where relevant to applications)
  • Application details and supporting documents
  • Organisation and project information including the organisation’s financial details and their representatives details (where applicable)

Some of this information is called Special category data, such as information about your health. We only process this where necessary and lawful, including where you have provided explicit consent or where processing is in the substantial public interest.

We collect this data from different places including:

  • Directly from you
  • From referrals
  • From applications submitted on your behalf
  • From a statutory body such as local authority Social Care
  • From health organisations include hospitals and your GP if necessary
  • From applications submitted on behalf of an organisation

We also collect some data when you use our website through the use of cookies, or the IP address if the device you have used. We have details about our use of cookies in our cookie policy.

How we collect and use your data

We use personal data to:

  • Assess grant applications
  • Make funding decisions
  • Administer and monitor grants
  • Communicate with applicants and organisations
  • Comply with legal and regulatory obligations
  • Deliver the charitable purposes – this may include stories where consent is received.

Grant Applications (Individuals)

When you apply for a grant (or an application is made on your behalf), we collect and process personal data including financial information and where relevant, health information. This is from the application made on your behalf but if we need more information we may collect this directly from you.

This information is used to assess eligibility, make funding decisions and provide support. We cannot make these assessments without processing your personal data.

Where an application is submitted by a third party (such as a professional or organisation), we expect that they have obtained permission from the you and those included on the application, to share your information.

Applications from Organisations

We collect information about organisations and their representatives to assess grant applications and manage funding. We cannot process the application and make an assessment without this information.

Other

We will use your data to respond to your queries, and to notify you of any changes associated with the grant or changes with our website or charitable support.

Internal record keeping is essential to be able to operate the charity. As part of the grant process we will record our relationship with you.

We may need to undertake fraud prevention tasks and financial checks before awarding grants.

We may need to use limited personal data to prepare reports. We will also be required to prepare reports and returns to regulators. This generally does not require specific personal data – we anonymise as much as possible.

Lawful bases

We are required by law to have a lawful bases for processing personal data. This is sometimes called the Legal bases. These are conditions or specific requirements that are set out in the UK GDPR. We rely on the following lawful bases for processing personal data :

  • Consent
    • Where you provide your personal data in an application we initially rely on your consent for this. If you withdraw our consent we will not be able to continue with the application.
  • Contract (with the individual)
    • When we approve your application, and you accept the grant, this will form a contract with us. This means that we will be able to process your personal data and will not require any further consent.
  • Legitimate interests
    • We have a legitimate interest to process certain personal data for the administration of grants; to run the charity effectively and efficiently and in line with our principles; and for contact with you or the organisation you represent.
    • We consider and balance any potential impact on you and your rights and freedoms and we will only proceed where we believe our interests are not overridden by the impact on you.
  • Legal obligation
    • We have a legal obligation to comply with charity law and laws such as financial regulations or contract law. We may refer to this as a regulatory obligation when working with the Charity Commission, Fundraising Regulator or other regulators or law enforcement agencies.
  • A public task or substantial public interest
    • This is where we are supporting individuals in need.

Data sharing

We will share personal data with:

  • Our Trustees and grant administrators
  • Referring organisations or professionals
  • Service providers supporting our website or administration including professional advisors
  • Regulators or authorities where required by law or court ordered to share
  • Our technical support (with strict processes and access restrictions and only when necessary)

We only share what is necessary and we will ensure that all appropriate safeguards are in place and there is a lawful reason to share.

We will not sell your personal data (we also do not buy personal data). Nor will we share with any others without your knowledge and consent.

Retention

We will only keep your personal data for as long as necessary taking into account the purpose that we collected it for. For specific parts of our work we will keep your data for the following length of time:

  • Successful applications:  2 years, unless an ongoing renewal then we will keep until 2 years after the last renewal was awarded
  • Unsuccessful applications: 1 year
  • Financial records: 6 years after the current financial year that the grant is awarded as required by HMRC and UK financial regulations
  • General correspondence: Until no longer of effective use. If we copy the correspondence into one of our systems such as your grant record it will be kept

for the ‘successful application’ period.

When we no longer need to keep this data, we will securely destroy it or securely and permanently delete it from our systems.

If you want to know more about how long we keep your personal data you can contact us at the email address provided earlier.

Overseas Transfers

We do not intend to transfer your personal data to third countries outside of the EU or other Third Countries. If we do have to, for example, to obtain technical support, we will ensure that we have all appropriate security and safeguards in place as required by the data protection laws in the UK and EU, and in line with our obligations as a responsible Data Processor or Controller of your personal data.

If we are required to transfer your personal data to countries outside the EU, we will only do this if that country has an adequate level of protection for personal data, or we have appropriate International Data Transfer Agreements and Clauses in place as these provide similar protections.

Automated decision making

We do not intend to undertake any automated decision making and the services do not use Artificial Intelligence (AI).

Your rights

You have the right to:

  • Access your personal data (known as a Subject Access Request)
  • Request correction of data if it is inaccurate or incomplete (formally called the Right to Rectification)
  • Request deletion or personal data unless a legal exception applies (formally called the Right to Erasure)
  • Restrict use of your personal data in certain circumstances
  • Data Portability which allows you to obtain and reuse your personal data across other services
  • Object to processing where we are processing your data based on legitimate interests and only in certain circumstances

You can withdraw consent where you have provided data to us with consent. This may impact on the service and support we can provide to you going forward.

We are obliged to comply with these rights within one month. We will tell you if we have to extend this time (by up to another two months) if there are complex issues. We will also tell you if we cannot comply with your right.

Generally, there are no charges for exercising (requesting) these rights. The exception is when you ask for further copies of your personal data that we have already provided to you. We will tell you if this applies. If you wish to exercise any of your rights, please email us.

More information on your rights can be found on the Information Commissioner’s website at www.ico.org.uk .

Complaints

If you have a concern about the way we handle your personal data or you have a complaint about what we are doing, then in the first instance you should contact us and we will investigate the matter. We have up to 30 days in which to acknowledge your complaint however, we aim to do this sooner. We will then provide you with the outcome of our investigation as soon as it is completed.

If you are not satisfied with our response, you have a right to raise a complaint with the Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, Telephone 0303 123 1113 (local rate) or by completing their online form at https://ico.org.uk/make-a-complaint/personal-information-complaint/ ​

Changes to Our Privacy Notice

We will review and update our Privacy Notice, annually or when there is a change in the legislation.

We recommend that you visit this page periodically to read any updates.