The Salford Foundation Trust Limited - Data Protection Privacy Notice

The Salford Foundation Trust is a grant giving charity that helps children and young people develop their hobbies, interests, skills and talents by providing funding that would otherwise be unavailable from any other source. It does this by offering the opportunity to apply for funding and provides support for young people between the ages of 5 and 25 who live in Salford.

We (‘The Salford Foundation Trust’) respect your privacy and are committed to protecting your personal data and being transparent about how we collect and use your data. We demonstrate this through operating within the requirements of General Data Protection Regulation (GDPR) and by building in appropriate safeguards during the collection, storage, processing, sharing and disposing of personal data.

This notice contains important information about:

1.    Who collects personal information about you;
2.    What information we collect and how and why we do so;
3.    How we use the information and who we may share it with;
4.    Where we may hold your personal information;
5.    How long we keep your information;
6.    Your rights to correct and access your information and to ask for it to be erased; and
7.    Details of where you can find further information and how to complain if we get things wrong and cannot resolve them for you.

1. Who we are

The Salford Foundation Trust is a registered charity (registered in England and Wales: 1105303) and a company limited by guarantee (company number: 5138092).

The registered address is:

The Salford Foundation Trust
Heywood Hall
Pendlebury
Salford
M27 8UX

The Salford Foundation Trust’s Project Coordinator, Helen Fenton, is responsible for data protection compliance and for answering any questions you have about this privacy notice. She can be contacted at the above address, or by email: mail@salfordfoundationtrust.org.uk

2. What information we collect and how and why we do so

2.1 Grant applicants and recipients

When a grant application is made to us we ask for certain personal information about you so that we can decide whether or not we can provide grant funding to you. We also use this information to establish the long-term impact of grant giving and to evaluate our service.

If your application is successful, we use your information to administer your grant and to record and monitor the benefits that our charity is able to provide to you. We also keep records relating to unsuccessful applications.

This is the type of data we might collect from you:

Contact Data (from you and, if applicable your representative)
name, address, email address, telephone number
Other Relevant Data
date of birth, reasons for the application, family financial situation
Communications Data
emails, notes and records of conversations
Sensitive Data (you are not required to give us this)
information about your family status and your racial or ethnic background

Information is collected in a number of ways: manually when you complete an application pack or indirectly when an agency or practitioner working with you applies on your behalf.

Under the General Data Protection Regulation (GDPR), we must have a legal reason to keep your data and process it. When The Salford Foundation Trust provides you with a service we will process your data on the basis of legitimate interest. We do this because we cannot process your application without using your personal information. When processing personal information based on a legitimate interest, we will make sure that it is exercised proportionately and is always balanced against the privacy rights and other legal rights you have as an individual.

Where we process sensitive personal information, known as ‘special category data,’ we will make sure that we only do so with your permission.

2.2 Donors and fundraisers

When you support the work of The Salford Foundation Trust by taking part in a sponsored event or donating your own money through Gift Aid we will collect some personal information from you.

We use this information to keep a record of your support, to comply with HMRC requirements and to send you relevant information about our work, including our funding rounds and fundraising events.

This is the type of data we might collect from you:

Contact Data
name, residential and business address, email address, telephone number
Communications Data
emails, content submitted via website, notes and records of conversations and meetings
Financial Data
details about the donations you have made to us including information pertaining to Gift Aid
Marketing Data
information about your marketing preferences, for instance whether you have agreed to receive email updates and newsletters from us

Information is collected in a number of ways: when you submit your contact details via our website or if you make a direct donation to us. If you participate in a fundraising event or make a donation through our website you will be directed to Virgin Money Giving, a third party website that collects your personal data and passes it to us. For confirmation of how Virgin Money Giving manages your data, please click on their privacy policy here.

Under the General Data Protection Regulation (GDPR), we must have a legal reason to keep your data and process it. When you make a donation to us we will process your data on the basis of legitimate interest. We do this because we cannot process your donation and manage our relationship with you without using your personal information. When processing personal information based on a legitimate interest, we will make sure that it is exercised proportionately and is always balanced against the privacy rights and other legal rights you have as an individual.

From time to time, we will send to our donors and other interested parties, marketing communications by email about our funding rounds and events. We will only do so where you have expressly consented to receive such emails and whenever we send such a communication, we include an option for you to unsubscribe from receiving further communications.

3 How we use the information and who we may share it with?

3.1 Grant applicants and recipients

The Salford Foundation Trust collects and retains personal information about you in order to administer your grant and to record and monitor the benefits that our charity is able to provide to you. The information collected is confidentially held by the Salford Foundation Trust and will not be sold or shared with any third parties for the purpose of direct marketing or fundraising.

There may be occasions when we need to share information with third parties. For example, we may have to share your personal information with certain organisations and suppliers where we order products on your behalf or to provide services that we are able to fund. We also have a legal duty to share information with relevant authorities if we believe there is a clear health and safety risk to an individual or other third party, or where there is a legal requirement to do so.

We require all third parties to respect the privacy of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

There may also be occasions when we will ask you for your consent to use your data to help us inform the public about our work via case studies or for use on social media. Consent to being filmed or photographed can be withdrawn at any time by notifying us in writing. Please note that should you withdraw your consent after the filming material or photographs have been published, we will do our best to remove them however, we will not be able to remove these from publications already in circulation and may not be able to guarantee their complete erasure.

3.2 Donors and fundraisers

The Salford Foundation Trust collects and retain personal information in order to process your donation, manage our relationship with you and to inform you of future opportunities that be of interest to you. The information collected is confidentially held by Salford Foundation and will not be sold or shared with any third parties for the purposes of direct marketing or fundraising other than with your consent.

There will be occasions when we need to share information with third parties to fulfil the purposes set out above. For example, we may need to share information with third party IT service providers.

There may be also be occasions when we will ask you for your consent to use your data to help us inform the public about our work via case studies or for use on social media. Consent to being filmed or photographed can be withdrawn at any time by notifying us in writing. Please note that should you withdraw your consent after the filming material or photographs have been published, we will do our best to remove them however, we will not be able to remove these from publications already in circulation and may not be able to guarantee their complete erasure.

4. Where information may be held

Your personal information will be stored, securely in paper and electronic forms at our offices. We have in place appropriate technical and security measures to prevent personal information from being accidentally lost, or used and accessed in an unauthorised way. We store your personal details on our secure server which is protected via a firewall.

We limit access to your personal information to those who have a genuine need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

5. How long we keep your information

The Salford Foundation Trust will only use and store personal information for as long as it is required for the purposes for which it was collected.

The criteria we use for determining retention periods for personal information is based on: legislative requirements; the purpose for which we hold the data and guidance issued by relevant regulatory authorities. We review our data retention periods for personal information on an annual basis.

Personal information that we no longer need is securely disposed of and/or anonymised so individuals can no longer be identified from it.

Examples of our retention periods are:

· For Grant applicants and recipients, we will keep relevant personal data for a period of three years following the award of a grant. Applications that are unsuccessful will be disposed of within 12 months of a decision being made by The Salford Foundation Trust.

· For Donors, as long as you are an active campaigner, donor or fundraiser for us and only up to three years after your last interaction with us.

· Up to six years in relation to Gift Aid (and in compliance with HMRC regulations).

6 Your rights to correct and access your information and to ask for it to be erased

Under the General Data Protection Regulation (GDPR), you have the following rights:

· The right to access your personal information;

· The right to edit and update your personal information;

· The right to request to have your personal information deleted;

· The right to restrict processing of your personal information;

· The right to object; and

· The right to lodge a complaint with a supervisory authority.

Please contact The Salford Foundation Trust’s Administrator, Judith Howorth by email: mail@salfordfoundationtrust.org.uk if you wish to exercise your rights, update your personal information or if you have any questions about this notice. If you wish to access your personal data by making a ‘subject access request’, please do so in writing with proof of your identity. This will be provided free of charge and we will make every effort to respond within one calendar month.

7 How to complain

We hope that we can resolve any query or concern you raise about our use of your personal information, please contact us at mail@salfordfoundationtrust.org.uk and we will provide you with a copy of our Complaints and Compliments Policy.

If you feel that we have not been able to address your concerns, please contact the Information Commissioner for further information about your rights and how to make a formal complaint:

The Office of the Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113

This version of the privacy policy was last updated on the June, 2021

8 Glossary

Anonymisation is the process of either encrypting or removing personally identifiable information from data sets, so that the people who the data describe remain unknown or anonymous.

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes.

General Data Protection Regulation (GDPR) is the 2018 legal framework that sets guidelines for the collection and processing of personal information of individuals in the European Union.

Legitimate business interest legal basis means the interests of our organisation in conducting and managing our business to enable us to give you the best service and the best and most secure experience. When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. Our legitimate business interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required to do so by law).

Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, psychological, genetic, mental, economic, cultural or social identity of that natural person.

Personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Special category data means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

Subject access request is your right to get a copy of the information that is held about you

Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor or persons who, under the direct authority of the controller or processor, are authorised to process personal data.