1.1 Wiltshire and Swindon Community Foundation (“WSCF”, “we”, “us”) is the data controller for the personal data we process. We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Wiltshire and Swindon Community Foundation promise to respect any personal data you share with us and keep it safe. We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect.

1.2 We do not ever sell personal details to third parties.

1.3 We only collect your necessary personal information when you give it to us directly. Such as:

• When you make a donation
• When you apply for a grant
• Attend an event with us
• Communicate with us
• When you subscribe or register for a WSCF newsletter

1.4 The type and amount of information we collect, and the way we use it, depends on the purpose for which you provide it and the applicable lawful basis for processing.

1.5 We may sometimes use information that is publicly available to gain a better understanding of our supporters to improve our products and services.

1.6 We use ‘cookies’ to help us make our site and the way you use it better. Please see our Cookie Policy for more information.

2.1 If you support us, for example set up a fund, make a donation, set up a regular donation or register to attend an event, we will usually collect:

• Your name
• Your contact details – address, telephone, email
• We may ask and record your preferences in terms of how you want us to communicate with you
• Where it is appropriate, we may also ask for: 
  • Your bank or credit card details
  • A gift aid declaration
  • For named funds - details of how/why you want your fund to be used

2.2 We will use your data to

• Provide you with the services, products or information you asked for
• Administer your donation or support your fundraising, including processing gift aid
• Keep a record of your relationship with us
• Ensure we know how you prefer to be contacted
• Understand how we can improve our services, products or information
• Enable us to produce complete and accurate financial records
• We may also use your personal information to detect and reduce fraud and credit risk

2.3 Our lawful bases for processing supporter data are:

• Contract – to process donations and or funds
• Legal obligation – to meet HMRC requirements for Gift Aid.
• Legitimate interests – to manage our relationship with supporters.
• Consent – where required for marketing communications.

3.1 If you apply to us for a grant on behalf of a group we will usually collect (typically for the group you are representing)

• Your name
• Your contact details – address, telephone, email

3.2 If you are an individual applying for an individual grant we might collect

• Your name
• Your contact details – address, telephone, email
• Your date of birth
• Your bank account details and proof of these
• Copy of a document which confirms the applicant’s identity
• Evidence of family income, which might include benefit statements, payslips, P60 or
• accounts
• Contact details for a referee

3.3 We will use your data to

• To assess your suitability/eligibility for the programme you have applied to and your need
• for funding
• Administer your grant application and award if made
• Keep a record of your relationship with us
• Ensure we know how you prefer to be contacted
• Understand how we can improve our services, products or information
• Enable us to produce complete and accurate financial information for our records
• We may also use your personal information to detect and reduce fraud and credit risk.

3.4 When we process special category data (such as financial hardship or health information) we do so under the lawful basis of substantial public interest (Schedule 1, Part 2, Data Protection Act 2018) and, where required, explicit consent.

4.1 If you apply to work with us as an employee, trustee or as a volunteer with us, we will collect:

• Your name
• Your contact details – address, telephone, email
• CV or job application
• Referee contact details

4.2 We will use your data to:

• Assess your initial suitability as an employee/trustee/volunteer
• Keep a record of your relationship with us
• Communicate with you

4.3 We retain recruitment information for up to 12 months after the recruitment process unless you
give consent for a longer period.

5.1 Our marketing communications include information about our organisation. Including; available funding, training opportunities, events, latest fundraising campaigns, annual reporting, philanthropy services and updates on need in Wiltshire.

With your consent, or where we have a contract with you or a legitimate interest based on a relationship (for example with our Fundholders, Friends and Professional Advisors network) we will contact you to let you know about the progress we are making, invite you to events, communicate updates about your fund, or grant and to ask for donations or other support.

We will only send you electronic marketing communications where we have your consent, or where we are permitted to do so under legitimate interests in accordance with the Privacy and Electronic Communications Regulations (PECR).

All our marketing communications include information on how to opt out. If you want to opt out at any time let us know when you provide your data or contact info@wscf.org.uk.

5.2 Some people choose to tell us about their experiences either giving to the Community Foundation or receiving a grant. This may include them sharing sensitive information related to their personal life in addition to their reasons for becoming involved with the Community Foundation and the impact of our work. If we have the explicit and informed consent of the individuals, or their parent or guardian if they are under 18, this information may be made public by us at events, in materials promoting our campaigning and fundraising work, or in documents such as our annual report. We will only use this information in new publications/places for a period of up to 3 years and will cease use sooner on request.

5.3 We collect and use information throughout our website only as disclosed in this privacy policy. The information we collect via this website may include:

• Any personal details you type in and submit, such as name, email address, etc in order for us to provide a response to your enquiry.
• Your IP address (this is your computer’s individual identification number), and other technical information, which is automatically logged by our server. This is used to note your
• interest in our website and to ensure any changes that are made to the site are for your benefit.
• Session information stored in cookies. These do not include any personal information and are used to ensure that the correct data is extracted from the database (such as language preference).
• We utilise a third party, currently Google, to track the usage and volume of users on our site. The information they collect is not in any way associated with the details we hold about you online.

6.1 As part of our education grant programmes, we collect information about children and young people through the application process. This might include sensitive personal data. We only collect this information when necessary for assessing and administering a grant. When the applicant is under 18, we obtain consent from a parent or guardian before gathering or using any personal information about the child or young person.

6.2 Our Safeguarding Policy sets out the steps we take to keep personal information secure, how we limit access to it, and the responsibilities of staff and volunteers. Our approach is designed to protect children and young people’s privacy, uphold their rights, and ensure their information is always handled in their best interests

7.1 We ensure that there are appropriate controls (process and technical) in place to protect your personal details. We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriate staff and volunteers.

7.2 Our policy is not to share your data with anyone else or any other organisation unless it is necessary for the purpose for which you have given us the data. Examples are given below:

• We will provide information to HMRC on Gift Aided donations since we have a legal obligation to provide this information.
• We may need to disclose your details if required to the police, regulatory bodies or legal advisors
• For grant applications, personal data is shared only with those who need it for assessment purposes. External assessors contracted by WSCF may access full applicant information via secure login to our systems. Panel members and donors do not receive personal data or contact details for group or individual applications; their panel view excludes this information. The only exception is programmes with specific data-sharing agreements in place (such as SWEF).
• We will also publish data on our website and in our annual review on grant recipients for groups/organisations (amounts/organisation names/purpose) but we anonymise details for any individual grantees, as agreed in the terms and conditions of each grant.
• We may share basic information on the attendees at an event or function or meeting with the host or other person who has a volunteer role within the Foundation.

7.3 We use some applications to support our processes and therefore data is either processed through these applications or stored:

• Microsoft Systems & SharePoint – this is our main operating system across our organisation
• Salesforce - our data management system:
  • In order to develop and maintain this system, we are supported by an external agency who has access to the data stored. Our contract outlines our commitment to protect our data and the agency is also compliant to their own policies, regulations and law.

• Form Assembly – our application system
•  Mailchimp – marketing newsletters
• Eventbrite – event management
• Local Insights – need and impact mapping tool
• Our chosen banking provider, EVouchers and Global Payments – financial systems we use to
  process awarded grant funds or bank card donations.

7.4 We have 2 funding programmes where we work with partners (Surviving Winter and SWEF) that require data sharing, these programmes are managed with their own data sharing policies and agreements.

7.5 In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect. We have internal data protection policies and procedures to ensure not only compliance but best practice.

7.6 We will not retain your information for longer than is necessary. This will normally be for a maximum of seven years after our relationship with you has ceased although we are occasionally required to hold data for longer periods for specific programmes.
7.7 We endeavour to keep all our records up to date and accurate. If your contact details change you can let us know at info@wscf.org.uk

8.1 You have a right to ask us to stop processing your personal data, and if it’s not necessary for the purpose you provided it to us for (eg processing your donation or registering you for an event) we will do so. Contact us on 01380 729 284 or info@wscf.org.uk if you have any concerns.

8.2 You have a right to ask for a copy of the information we hold about you. If there are any discrepancies in the information we provide, please let us know and we will correct them.

8.3 You also have the right to:

• Request the deletion of your personal data (right to erasure)
• Ask us to restrict how your data is used (right to restriction)
• Object to processing carried out under legitimate interests or for marketing (right to object)
• Request your data in a usable electronic format (right to data portability)
• Withdraw your consent at any time, where processing is based on consent
• Complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

If you want to access your information, send a description of the information you want to see, in writing, enclosing proof of your identity, to Wiltshire and Swindon Community Foundation, Sandcliff House, 21 Northgate Street, Devizes, SN10 1JT. 

If you have any questions please send these to info@wscf.org.uk. For further information see the Information Commissioner’s website.

9.1 Along with any improvements made to this policy through monitoring we may need to make significant changes should any processes or legislation change. If we make any significant changes in the way we treat your personal information we will make this clear in this policy or by contacting you directly.

10.1 Cookies Policy: www.wscf.org.uk/cookies-policy

10.2 Complaints Procedure: www.wscf.org.uk/complaints-procedure

10.3 Terms and Conditions: www.wscf.org.uk/terms-and-conditions

10.4 Internal only:

• Safeguarding Policy
• Data Protection Policy
• Secure Storage, Handling, Use, Retention and Disposal of information Policy
• Employee Privacy Policy
• Surviving Winter Data Sharing Policy
• SWEF Data Sharing Agreement Wiltshire