Community Foundation for Leeds is a registered charity established in 2005 to connect those who care passionately about Leeds and its people. We form partnerships between community groups that are making a difference and the people who wish to invest in a better future for our city.
We take our duty to process your personal data very seriously. This policy explains how we collect, manage, use and protect any information we collect about you to ensure you remain informed and in control of your information.
In this policy references to Leeds Community Foundation, the Foundation, LCF, or to ‘we’ and ‘us’ are to Community Foundation for Leeds which is a registered charity in England and Wales (1096892) and Company Limited by guarantee (04443312).
GFS Community Enterprise (GFS) is a wholly owned subsidiary of Community Foundation for Leeds. This policy applies equally to GFS, where differences occur this will be clearly specified.
LCF is corporate trustee of the BG Campbell Charitable Trust (BGC) which is a registered charity in England and Wales (255369). This policy applies equally to BGC, where differences occur this will be clearly specified.
We may change this document from time to time to reflect the latest regulations on what we should lawfully do with your information. Please check back frequently to ensure that you are happy with any changes
2. What information we collect
LCF is what’s known as the ‘controller’ of the personal data you provide to us. We will usually collect basic personal data about you like your name, postal address, telephone number, email address if you are supporting us or if you have applied for a grant with us we collect the data given on the grant application.
We may also collect details of your interests and preferences (such as campaigns, the ways you support us or types of causes you care about). Your activities and involvement with LCF will result in personal data being created. This could include details of how you’ve helped us by volunteering or being involved with our campaigns or events.
We may collect information about certain supporters (e.g. particularly well known or influential people) from public sources. This could include public databases (such as Companies House), news or other media.
We may conduct research and analysis on the information we hold, which can in turn generate personal data. For example, by analysing your interests and involvement with our work, we may be able to build a profile which helps us decide which of our communications are likely to interest you. Our section on Research and Profiling contains more detail about how we may use information for profiling and targeted marketing.
We do not normally collect or store sensitive data (such as information relating to health, beliefs or political affiliation) about supporters or grant recipients. However there are some situations where this will occur including, but not exclusively, if:
- An accident or incident occurs on our property, at one of our events or involving one of our staff (including volunteers).
- If you are attending one of our events and have disclosed specific access or dietary needs.
- For individuals who apply for grants where data around health is directly relevant to the awarding of the grant (e.g. BGC), we will also collect and store this sensitive data.
If this does occur we will be very clear with you that we wished to collect such information, our reason for collecting such information, and that we would only do so with your specific consent and permission. We’ll also take extra care to ensure your privacy rights are protected.
3. How we collect your information
We collect information about you when you enquire about using any of our services, as part of us providing you with our services, or when you register an interest in supporting us.
We collect your personal information in a number of ways:
- When you provide it to us directly. Your activities and involvement with LCF will result in personal data being created. This could include details of how you’ve helped us by being involved with our campaigns and activities, or grants applications you have submitted.
- When we collect it as you use our website. Please see our Cookies policy for details.
- When you provide permission to other organisations to share it with us (including Facebook or Twitter)
- When you have given it to a third party. For example, if we are partnering with another organisation (e.g. you provide your information to another charity we’re collaborating with).
- From publically available sources to keep your information up to date (e.g. from Companies House, news or other media).
4. How we use your information
We will only use your information for the purpose or purposes for which it was collected for (or for closely related purposes). These purposes include:
- Where the information is needed to fulfil your request or to enable us to provide you with a more personalised service. Sometimes, with your consent, we will process your personal data to provide you with information that you have requested about our work or our activities, or that you are expecting.
- We use personal data for administrative purposes (i.e. to carry on our charity work). This can include receiving donations, processing and distributing grant applications, maintaining a database of supporters and friends and helping us respect your choices and preferences (e.g. if you ask not to receive marketing material, we’ll keep a record of this).
- Where we need to do this to fulfil a contract, or where we are required to do this by law or other regulations.
- When it is in our legitimate interests to do this and when these interests do not override your rights. These legitimate interests include providing you with information on our campaigns, 100 Club membership, services, fundraising, newsletter requests, feedback, and other activities. Please see section 9 on ‘Legitimate Interest’ for more information.
- We carry out research and analysis on our supporters and potential donors to determine the success of campaigns and appeals, better understand behaviour and responses, and identify patterns and trends. This helps inform our approach towards campaigning and makes LCF a stronger and more effective organisation. Understanding our supporters, their interests and what they care about also helps us provide you with a better experience (e.g. through more relevant communications).
- We evaluate, categorise and profile personal data in order to tailor materials, services and communications, and prevent unwanted material from filling up your inbox.
- We use personal data to communicate with people, to promote LCF and to help with fundraising. This includes keeping you up to date with our news, updates, campaigns and fundraising information. This includes all our marketing communications (the term marketing is broadly defined and, for instance, covers information about LCF and its work in Leeds)
- You can decide not to receive communications or change how we contact you at any time. If you wish to do so, please contact us by emailing email@example.com, writing to: LCF 51a St Paul’s Street, Leeds, LS1 2TE, or telephoning 0113 2422426 (Lines open 9am – 5pm, Mon – Fri).
- When you receive a communication, we may collect information about how you respond to or interact with that communication, and this may affect your communication preferences.
- We run events for our supporters or for those whom we believe would be interested in the work of LCF. We collect information about how you respond to or interact with our invitations, and this may affect your event processes.
- As a charity, we rely on donations and support from others to continue our work. From time to time, we will contact members and supporters with fundraising material and communications. As with other marketing communications, we’ll only contact you specifically about fundraising if you’ve opted into to receiving marketing from us (and you can, of course, unsubscribe at any time).
4b. Sharing your information
We only disclose information to third parties or individuals when obliged to by law, for purposes of national security, taxation and criminal investigations, and the following:
- If you have agreed that we may do so.
- When we use other companies to provide services on our behalf e.g. sending mail and emails, when using auditors/advisors, or processing credit/debit card payments.
- If we receive a complaint about any content you have posted or transmitted to or from one of our sites, to enforce or apply our Terms & Conditions, or if we believe that we need to do so to protect and defend the rights, property or personal safety of LCF our websites or our visitors and for other lawful purposes.
- If we merge with another organisation to form a new entity, information may be transferred to the new entity.
- If we run an event in partnership with other named organisations, your details may need to be shared. We will be very clear what will happen to your data when you register.
And we will never sell or rent your personal information to other organisations.
5. Research and Profiling
We evaluate personal data in order to tailor materials, services and communications and prevent unwanted material from filling up your inbox. Understanding our supporters, their interests and what they care about also helps us provide you with a better experience.
Research can help us target our resources more effectively through gaining an insight into the background of our potential supporters and help build relationships that are appropriate to their interests and capacity to give. This increase in efficiency helps us ensure we are maximizing the good we can do in the city.
To do this we may use additional external sources of data to increase and enhance the information we hold about you. This may include obtaining details of changes of address, telephone numbers and other contact details, and information related to your wealth. It may also include information from public registers and other publically available sources.
6. How we store and retain your information securely
We hold your information only as long as necessary for each purpose we use it. We regularly review what information we hold and delete what is no longer required. For successful grant applications, we will retain your data for up to 7 years, in line with financial best practice for our accounting purposes.
If you decide not to support LCF any longer, or request that we have no further contact with you, we will keep some basic information in order to avoid sending you unwanted materials in the future and to ensure that we don’t accidentally duplicate information.
6b. Data Security
We employ a variety of physical and technical measures to keep your data safe and to prevent unauthorised access to, or use or disclosure of, your personal information.
Electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means). Our staff receive data protection training and we have a set of detailed data protection procedures which personnel are required to follow when handling personal data.
Our electronic data is stored within secure cloud servers in the United States. Paper copies of any personal data that are stored in secure locked cabinets.
6c. Payment security
LCF specific – if you wish to make donations to LCF, we would never request your bank details directly. BACS payments can be made directly to our business bank account (details of which are available upon request), or via our secure online donation pages (provided by BT Donate).
GFS specific – If you use a credit card to pay for room hire or donate in person or over the phone, we will input your credit card details securely into our card terminal operated by our payment provider (Worldpay). GFS complies with the payment card industry data security standard (PCI-DSS) published by the PCI Security Standards Council, and will never store card details.
Of course, we cannot guarantee the security of your home computer or the internet, and any online communications (e.g. information provided by email or our website) are at the user’s own risk.
Some of our premises have CCTV and you may be recorded when you visit them. CCTV is there to help provide security and to protect both you and LCF/GFS. CCTV will only be viewed when necessary (e.g. to detect or prevent crime) and footage is only stored temporarily. Unless it is flagged for review, CCTV will be recorded over.
LCF complies with the Information Commissioner’s Office CCTV Code of Practice, and we put up notices so you know when CCTV is in use.
7. Keeping you in control
We want to ensure you remain in control of your personal data. The new General Data Protection Regulations (GDPR), which are being brought into force in May 2018, give everyone a number of very important rights. These include
- the right to ask us to remove your personal data from our records (though this will not apply where it is necessary for us to continue to use the data for a lawful reason)
- the right to have inaccurate data rectified
- the right to request a copy of the information we hold about you
- the right to ask us to stop using your information for marketing or profiling, and
- where technically feasible, the right to obtain and reuse your personal data for your own purposes
Remember, you can change the way you hear from us or withdraw your permission for us to process your personal data at any time by using the contact details in section 11.
8. Cookies and website
9. Legitimate interest
Under the new GDPR laws starting in May 2018, we have a number of lawful reasons that we can use (or ‘process’) your personal information. One of these lawful reasons is called ‘legitimate interests’.
Broadly speaking, ‘legitimate interests’ means that we can process your personal information if:
We have a genuine and legitimate reason and we are not harming any of your rights and interests.
So, what does this mean? When you provide your personal details to us we use your information for our legitimate business interests to carry out our work to make Leeds a city of opportunity for all. Before doing this, though, we will also carefully consider and balance any potential impact on you and your rights.
Some typical examples of when we might use this approach are for preventing fraud; direct marketing; maintaining the security of our system; data analytics; enhancing, modifying or improving our services; identifying usage trends; and determining the effectiveness of our campaigns and fundraising.
LCF will use various ways to achieve our mission and to support our objectives; we believe that people who share our values would love to know how to support us. We will process the personal information you have supplied to us to conduct and manage our business to enable us to give you the most appropriate marketing, information, service and products and provide the best and most secure experience. These are what we consider to be our ‘legitimate interests’ for holding and processing your data.
When we process your personal information for our ‘legitimate interests’, we will consider and balance any potential impact on you and your rights under data protection and any other relevant law. Our legitimate business interests do not automatically override your interests – we will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent, or are otherwise required or permitted to by law).
Remember, you can change the way you hear from us or withdraw your permission for us to process your personal details at any time by contacting us. For our contact details, please see section 11.
10. Changes to the policy
11. How to contact us
If you have any questions about the policy or how we use your data, please get in touch using the details below.
Phone: 0113 242 2426
Leeds Community Foundation
First Floor, 51a St Paul’s Street
Leeds, LS1 2TE
Making a complaint or giving positive feedback
If you are dissatisfied with our organisation or our work and would like to raise a concern or make a complaint, or if you would like to leave some positive feedback about any aspect of our work, please view our compliments and complaints form here.
This policy and procedure document was accepted by the trustees at its meeting on 23rd November 2017.
It will be reviewed every three years.