Privacy Policy

1. Introduction

1.1 We are The Bowerman Charitable Trust (referred to as “the Trust”, “we”, “us” and “our” in this Privacy Policy), a charity in England with registered charity number 289446.

1.2 Please read this Privacy Policy in conjunction with our general Terms and Conditions, which cover your access to our website as well as online orders and donations.

1.3 The information set out in this Privacy Policy is provided to individuals whose personal data we process (“you” or “your”), in compliance with our obligations under Articles 13 and 14 of the General Data Protection Regulation 2016/679 (GDPR).

1.4 To make this information clear, we have divided the data we receive into the following groups and corresponding Schedules, each of which refers to: the particular category of information we collect and retain; from where we obtain the information; the purpose and legal basis of processing and to whom we will (if applicable) disclose the information:

Schedule 1 Data about our patrons, donors and all individuals in respect of whom we have acquired personal information in connection with any products or services offered by us or events staged by us

Schedule 2 Data about our suppliers and supplier personnel

Schedule 3 Data about individuals who apply for employment or volunteer roles with us

Schedule 4 Data about trustees and staff of the Trust, and former trustees and staff and other individuals who spend time at the Trust (such as consultants)

1.5 In addition to the above, individuals who interact with us in any of the above capacities should also refer to the following:

Schedule 5 Data collected about visitors to our facilities

2. Data controller details

2.1 We are the data controller in relation to the processing of the personal information that you provide to us. Our contact details are as follows:

2.1.1 Address: Champs Hill, Waltham Park Road, Coldwaltham, Pulborough RH2O 1LY.

2.1.2 Email address: info@thebct.org.uk (please include “Personal Data Request” in your subject heading to ensure it receives the correct attention).

3. Retention of personal data

Our retention and deletion policy can be found here – please see Schedule 6.

4. Your rights in respect of your personal data

4.1 You have certain rights under existing data protection laws, including the right to (upon written request) access a copy of your personal data that we are processing. From 25 May 2018, if you are based within the UK or the EEA or within another jurisdiction having similar data protection laws:

4.1.1 you will have the following rights:

4.1.1.1 right to access: the right to request certain information about, access to and copies of the personal information about you that we are holding (please note that you are entitled to request one copy of the personal information that we hold about you at no cost, but for any further copies, we reserve the right to charge a reasonable fee based on administration costs); and

4.1.1.2 right to rectification: the right to have your personal information rectified if it is inaccurate or incomplete; and

4.1.2 in certain circumstances, you will also have the following rights:

4.1.2.1 right to erasure/“right to be forgotten”: the right to withdraw your consent to our processing of the data (if the legal basis for processing is based on your consent) and the right to request that we delete or erase your personal information from our systems (however, this will not apply if we are required to hold on to the information for compliance with any legal obligation or if we require the information to establish or defend any legal claim);

4.1.2.2 right to restriction of use of your information: the right to stop us from using your personal information or limit the way in which we can use it;

4.1.2.3 right to data portability: the right to request that we return any information you have provided in a structured, commonly used and machine-readable format, or that we send it directly to another company, where technically feasible; and

4.1.2.4 right to object: the right to object to our use of your personal information including where we use it for our legitimate interests or for marketing purposes.

4.2 Please note that if you withdraw your consent to the use of your personal information for purposes set out in our Privacy Policy, we may not be able to carry out our contractual obligations to you or provide you with access to all or parts of our services.

4.3 If you consider our use of your personal information to be unlawful, you have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office. Please see further information on their website: www.ico.org.uk

5. Security

5.1 We keep your information protected by taking appropriate technical and organisational measures to guard against unauthorised or unlawful processing, accidental loss, destruction or damage. For example:

5.1.1 where appropriate, data is encrypted when transiting on our system or stored on our databases;

5.1.2 we have implemented safeguards in relation to access and confidentiality in order to protect the information held within our systems; and

5.1.3 we frequently carry out risk assessments and audits to monitor and review threats and vulnerabilities to our systems to prevent fraud.

5.2 However, whilst we will do our best to protect your personal information, we cannot guarantee the security of your information which is transmitted via an internet or similar connection. It is important that all details of any username, password and/or other identification information created to access our servers are kept confidential by you and should not be disclosed to or shared with anyone.

6. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time, for example to keep it up to date, to implement minor technical adjustments and improvements or to comply with legal requirements. We will always update this Privacy Policy on our website, so please try to read it when you visit the website (the “last updated” reference tells you when we last updated our Privacy Policy).

Last updated June 2018

Schedule 1

Schedule 2

Schedule 3

Schedule 4

Schedule 5

Schedule 6

What we collect:	We may use your information for the following purposes, based on the following legal grounds:	Recipients:
Contact details such as your name, home/work addresses, email address, landline/mobile phone or fax numbers. Employment information such as your position/title, employment history, professional specialisms and qualifications.	If it is necessary for the performance of our contract or for the purposes of entering into a contract: for the purpose of negotiating and entering into contractual agreements with you, in the course of providing our services. If it is in our legitimate business interests to do so: for internal record keeping for administration purposes, for the purpose of communications in relation to establishing a relationship with patrons and donors, obtaining evidence of identity of our patrons and donors, communications regarding our services and events and sending information to you about products, services and events which we think may be of interest to you for marketing purposes. If we use electronic methods to communicate with you in relation to products, services and events which we think may be of interest to you, we will obtain your written consent and rely on that consent as the legal ground for such processing. Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.	How we share information with third parties Please note that personal information we are holding about you may be shared with and processed by: 1. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 2. credit reference and fraud prevention agencies; 3. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order); 4. other parties and/or their professional advisers involved in a matter where required as part of the conduct of the services; 5. our own professional advisers and auditors for the purpose of seeking professional advice or to meet our audit responsibilities; 6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, our bank, payment processing providers and those organisations we engage to help us send communications to you) so that they may help us to provide you with applications, products, services and information; 7. third parties as part of the arrangements for any event for which you have expressed an interest in attending.
Payment information such as bank details and transaction history.	If it is necessary for the performance of our contract: for the purpose of making or receiving payments in the course of providing our services. If it is in our legitimate business interests to do so: for internal record keeping for administration purposes, for the purpose of retaining evidence of payment transactions and to develop the service which we offer to you or other individuals in the future). Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.
Identity information contained in or provided to us as part of our ID checks. This includes details included in copy personal photo and residential ID documents we receive.	If it is in our legitimate business interests to do so: for the purposes of obtaining evidence of identity of our patrons and donors, and internal record keeping for administration purposes. Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements. Consent: if disclosing to other organisations where we cannot rely on any legal obligation to do so

What we collect:	We may use your information for the following purposes, based on the following legal grounds:	Recipients:
Contact details such as your name, home/work addresses, email address, landline/mobile phone or fax numbers. Employment information such as your position/title, employment history, professional specialisms and qualifications.	If it is necessary for the performance of our contract or for the purposes of entering into a contract: for the purpose of negotiating and entering into contractual agreements with you, in the course of receiving services from you e.g. contacting individuals where we need to do so to provide instructions and discuss work involved. If it is in our legitimate business interests to do so: for internal record keeping for administration purposes, for the purpose of communications in relation to establishing a customer/supplier relationship and communications regarding services and fees. Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.	How we share information with third parties Please note that personal information we are holding about you may be shared with and processed by: 1. our customers, patrons and donors, in the course of providing services for and/or performing our contractual obligations to customers, patrons and donors; 2. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 3. credit reference and fraud prevention agencies; 4. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order); 5. our own professional advisors and auditors for the purpose of seeking professional advice or to meet our audit responsibilities; 6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, our bank, payment processing providers).
Payment information such as bank details and transaction history.	If it is necessary for the performance of our contract: for the purpose of making or receiving payments in the course of the supplier’s services If it is in our legitimate business interests to do so: for the purpose of enquiring, requesting or purchasing goods or services, for internal record keeping for administration purposes, for the purpose of retaining evidence of payment transactions. Compliance with a legal obligation: in order to prevent fraud or money laundering or to comply with any other legal or regulatory requirements.

What we collect:	We may use your information for the following purposes, based on the following legal grounds:	Recipients:
Contact details such as names, home and work addresses, landline/mobile phone or fax numbers, email addresses, previous addresses.	Our legitimate interest in processing such information for contacting individuals where we need to do so and for obtaining/verifying evidence of identity.	How we share information Please note that personal information we are holding about you may be shared with and processed by: 1. UK regulatory and law enforcement bodies, where required of us under UK law or regulation; and 2. our service providers (such as data storage, typing, administrative support and audit)
Employment related history and qualifications such as position/title, date of birth, employment history and CV, references from previous employees, professional specialisms, education and qualifications, salary and benefits, disciplinary record.	Our legitimate interest in processing such information for assessing their suitability for the role, or considering potential packages and offers.	How we share information Please note that personal information we are holding about you may be shared with and processed by our service providers (such as data storage, typing, administrative support and audit).
Personal information such as professional and personal interests and languages spoken	Our legitimate interest in processing such information for assessing their suitability for the role.	How we share information Please note that personal information we are holding about you may be shared with and processed by our service providers (such as data storage, typing, administrative support and audit).
Information contained in or provided to us as part of our recruitment or take on process such as details included in copy personal photographs and residential ID documents we receive. Visa documentation (right to work in the UK)	Our legitimate interest in processing such information for obtaining/verifying evidence of identity Compliance with a legal obligation in order to confirm that the individual is entitled to work in the UK and for the purpose of security and prevention of crime.	How we share information Please note that personal information we are holding about you may be shared with and processed by: 1. UK regulatory and law enforcement bodies, where required of us under UK law or regulation; and 2. our service providers (such as data storage, typing, administrative support and audit).

What we collect:	We may use your information for the following purposes, based on the following legal grounds:	Recipients:
Contact details (work) such as name, work address, landline/mobile phone or fax numbers, email address. Contact details (personal) and other personal information such as home address, landline/mobile phone number, email address, previous addresses, emergency contact details, date of birth, marital status, next of kin, spouse, beneficiaries’ names and contact details.	Necessary for the performance of our contract in our capacity as your employer. Necessary to protect the vital interests of the individual concerned for the purposes of security and prevention of crime. Our legitimate interest in processing such information (work contact details) for contacting individuals where we need to do so in the individual’s capacity as employee, trustee or other member of staff. Our legitimate interest in processing such information (personal contact details) for the purpose of contacting individuals where we need to do so in the individual’s capacity as employee, trustee or other member of staff, in order to keep appropriate employment records, for obtaining/verifying evidence of identity or for contacting next of kin, spouses and beneficiaries if the circumstances require (such as in an emergency). Compliance with a legal obligation to comply with right to work legislation.	How we share information with third parties Please note that personal information we are holding about you may be shared with and processed by: 1. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 2. credit reference and fraud prevention agencies; 3. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order); 4. other parties and/or their professional advisers involved in a matter where required as part of the conduct of the services; 5. our own professional advisers and auditors for the purpose of seeking professional advice or to meet our audit responsibilities; 6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, data storage providers, typing service providers, administrative support, third party payroll processors, audit providers and our bank); 7. third party providers of benefits (such as childcare vouchers, life insurers, pension providers).
Information about your health including any medical condition, health and sickness records such as details of any absences (other than holidays) from work including time on statutory parental leave and sick leave.	Compliance with a legal obligation: We will use information relating to leaves of absence, which may include sickness absence or family related leaves, to comply with employment and other laws Consent: we do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights in the field of employment law. In certain limited circumstances we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.	How we share information with third parties Please note that personal information we are holding about you may be shared with and processed by: 1. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 2. credit reference and fraud prevention agencies; 3. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order); 4. other parties and/or their professional advisers involved in a matter where required as part of the conduct of the services; 5. our own professional advisers and auditors for the purpose of seeking professional advice or to meet our audit responsibilities; 6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, data storage providers, typing service providers, administrative support, third party payroll processors, audit providers and our bank); 7. third party providers of benefits (such as childcare vouchers, life insurers, pension providers).
Employment and performance related information such as position/title, date of references from previous employees, professional specialisms, education and qualifications, salary and benefits, disciplinary records, performance records, appraisals, performance feedback, interview notes, languages spoken, practising certificate details and caveats, professional indemnity information, working patterns (days worked and nonwork days).	Necessary for the performance of the employment contract in order to keep appropriate employment records and carry out our contractual obligations as employer. Our legitimate interest in processing such information in order to keep appropriate employment records, for assessing their continued suitability for their role and for planning progression.	How we share information with third parties Please note that personal information we are holding about you may be shared with and processed by: 1. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 2. credit reference and fraud prevention agencies; 3. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order); 4. other parties and/or their professional advisers involved in a matter where required as part of the conduct of the services; 5. our own professional advisers and auditors for the purpose of seeking professional advice or to meet our audit responsibilities; 6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, data storage providers, typing service providers, administrative support, third party payroll processors, audit providers and our bank); 7. third party providers of benefits (such as childcare vouchers, life insurers, pension providers).
Payment and financial information such as bank details, transaction history, salary and benefits, life insurance, pension related information, tax-related information, National Insurance number, payroll documentation (P45 / P60 / P11D).	Necessary for the performance of the employment contract to pay or compensate the individual. Our legitimate interest in processing such information in order to keep appropriate employment records and to allow the individual to receive pension and other benefits. Consent in order to allow nominated family members or beneficiaries to receive benefits or insurance funds.	How we share information with third parties Please note that personal information we are holding about you may be shared with and processed by: 1. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 2. credit reference and fraud prevention agencies; 3. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order); 4. other parties and/or their professional advisers involved in a matter where required as part of the conduct of the services; 5. our own professional advisers and auditors for the purpose of seeking professional advice or to meet our audit responsibilities; 6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, data storage providers, typing service providers, administrative support, third party payroll processors, audit providers and our bank); 7. third party providers of benefits (such as childcare vouchers, life insurers, pension providers).
Information contained in or provided to us as part of our recruitment or take on process such as details included in copy personal photographs and residential ID documents we receive Visa documentation (right to work in the UK).	Our legitimate interest in processing such information for obtaining/verifying evidence of identity. Compliance with a legal obligation in order to confirm that the individual is entitled to work in the UK and for the purpose of security and prevention of crime.	How we share information with third parties Please note that personal information we are holding about you may be shared with and processed by: 1. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 2. credit reference and fraud prevention agencies; 3. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order); 4. other parties and/or their professional advisers involved in a matter where required as part of the conduct of the services; 5. our own professional advisers and auditors for the purpose of seeking professional advice or to meet our audit responsibilities; 6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, data storage providers, typing service providers, administrative support, third party payroll processors, audit providers and our bank); 7. third party providers of benefits (such as childcare vouchers, life insurers, pension providers).
DBS check (basic disclosure).	Compliance with a legal obligation pursuant to Schedule 1, Part 1(1)(1)(a) of the Data Protection Act 2018 to satisfy our legal obligations as their employer and for security and prevention of crime purposes.).	How we share information with third parties Please note that personal information we are holding about you may be shared with and processed by: 1. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 2. credit reference and fraud prevention agencies; 3. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order); 4. other parties and/or their professional advisers involved in a matter where required as part of the conduct of the services; 5. our own professional advisers and auditors for the purpose of seeking professional advice or to meet our audit responsibilities; 6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, data storage providers, typing service providers, administrative support, third party payroll processors, audit providers and our bank); 7. third party providers of benefits (such as childcare vouchers, life insurers, pension providers).
Images via CCTV	Our legitimate interest in processing such information in order to maintain a safe environment and prevent and detect crime. Necessary to protect the vital interests of the individual concerned: for security purposes and in order to maintain a safe environment.	How we share information with third parties Please note that personal information we are holding about you may be shared with and processed by: 1. regulators or other third parties for the purposes of monitoring and/or enforcing our compliance with any legal and regulatory obligations, including statutory or regulatory reporting or the detection or prevention of unlawful acts; 2. credit reference and fraud prevention agencies; 3. any third party in the context of actual or threatened legal proceedings, provided we can do so lawfully (for example in response to a court order); 4. other parties and/or their professional advisers involved in a matter where required as part of the conduct of the services; 5. our own professional advisers and auditors for the purpose of seeking professional advice or to meet our audit responsibilities; 6. our service providers and agents (including their subcontractors) or third parties which process information on our behalf (e.g. internet service and platform providers, data storage providers, typing service providers, administrative support, third party payroll processors, audit providers and our bank); 7. third party providers of benefits (such as childcare vouchers, life insurers, pension providers).

Category of personal data	Period for which personal data will be stored
Data about our patrons, donors and all individuals in respect of whom we have acquired personal information in connection with any products or services offered by us or events staged by us.	Contracts and general correspondence (emails, post and other communications) obtained in the course of providing our services: Such information will be stored for 7 years following completion of the services or termination or expiry of the contract with our client (whichever is later). Contact details for marketing purposes: Contact information relating to clients and contacts will be held for so long as we believe the information to remain accurate and the individual concerned remains a genuine connection of the firm, or of one of our directors and staff. We have a programme for reviewing our contacts regularly, and removing any information which is considered to be out of date or no longer relevant.
Data about our suppliers and supplier personnel.	Contracts and general correspondence (emails, post and other communications) obtained in the course of providing your services: Such information will be stored for 7 years following completion of the services or termination or expiry of your contract (whichever is later).
Data about individuals who apply for employment or volunteer roles with us.	Personal data obtained from employment or volunteer applicants will be deleted after 7 years
Data about trustees and staff of the Trust, consultants, secondees, temporary staff, volunteers, former trustees and staff, next of kin, spouses, beneficiaries.	Human resources (HR) records will be destroyed 7 years following employment/engagement. For the purposes of administration this will be actioned annually in December of each year. Personal data stored in private workspaces created for members of HR (including for appraisals, promotion and probation reviews) will be deleted 7 years after creation.
Data about visitors to our facilities.	Information about dietary preferences will be destroyed after 7 years.
CCTV.	CCTV information is destroyed after 7 days.