Privacy Policy


Commuity Resource is the operating name of the Community Council of Shropshire. We are a registered charity (1096779) and a company limited by guarantee incorporated in England and Wales under company number 4652487. Our registered office is 4 The Creative Quarter, Shrewsbury Business Park, Shrewsbury, Shropshire. SY2 6LG.


We are a ‘data controller’ for the purposes of the EU General Data Protection Regulation 2016/679 (‘Data Protection Law’). This means that we are responsible for, and control the processing of your personal information.


We want everyone who supports us, or who comes to us for support, to feel confident and comfortable with how any personal information you share with us will be used and looked after. We are committed to providing transparent information on the types of personal data we may collect about you, what we do with that data, how we will store and handle that data, and keep it safe.

Why do we use your personal data?

We collect and use personal data for a number of purposes:


  • To process and record your membership if you are a member of our charity.
  • To enable us to provide a safe and professional service if you are a service user.
  • To provide the services or goods that you have requested from us.
  • To process your donations or other payments, to claim Gift Aid on your donations and verify any financial transactions.
  • To update you with important administrative messages about your grant application, job application, volunteer application, membership, an event, or services or goods you have requested.
  • To keep a record of your relationship with us.


We may also use your personal information to:


  • Contact you about our work and how you can support Community Resource (see section 6 on ‘Direct Marketing’ below for further information).
  • To invite you to participate in surveys or research.
  • To respond to your queries and complaints.


Community Resource will not share your information with third parties for marketing purposes.


In some circumstances we may use your personal data to carry out research using publicly available information to determine whether an individual could be a potential major donor, high net worth individual, or philanthropist that shares charitable mission. This research will enable us to target communications in a more focused, efficient, and cost-effective way, helping us reduce the chances of supporters and potential supporters receiving inappropriate or irrelevant communications. Please be assured that donors can ‘opt out’ of this research process at any time by contacting Community Resource and making that request.

Explaining the legal bases we rely on

The law on data protection sets out a number of different reasons for which an organisation may collect and process your personal data. When collecting your personal data, we will always make clear to you which data is necessary and what legal basis we are using it in connection with a particular service.



In specific situations we can collect and process your data with your consent. For example, when you sign up to our website to receive email newsletters from us.


Contractual obligations

In certain circumstances, we need your personal data to comply with our contractual obligations. For example, if you have placed an order on our website, we will collect your address details to deliver your purchase.


Legal compliance

If the law requires us to, we may need to collect and process your data. For example, in order to claim gift aid on a donation, HMRC requires us to retain your gift aid declaration which includes personal details such as your name, home address, and UK tax-payer status.


Legitimate interest

In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our charity and which does not materially impact your rights, freedom or interests. For example, to inform you about services you have told us you are interested, such as our training programmes.


Vital interests

In very limited cases we may need to use your data to protect your vital interests, or those of another person. For example, we may share personal information with agencies, including local authority services and the police, where it is necessary to safeguard the welfare of an adult at risk.

What sort of personal data do we collect?

Personal data is any information that can be used to identify you.


We only collect personal data relevant to the type of service or interaction you have with Commuity Resource. So for example, if you are a service user, volunteer, donate money, register for our training or an event, sign up to any of activities or online content (such as newsletters), or contact us by telephone, email, social media, post or text message, we may need to collect and process the personal information that you’ve provided.


This personal information may include:


  • Personal details (name, date of birth).
  • Contact details (email, address, telephone etc.)
  • Financial details to process your donations or other payments.
  • Volunteer CRB checks for safeguarding purposes.
  • UK tax payer information (for Gift Aid).
  • Details of your interactions with us.
  • Details of your visits to our websites, and which website you came from to ours.
  • Information gathered by the use of cookies in your web browser. See our Cookie Policy.


When collecting your personal data we will always make clear to you which data is necessary in connection to a particular service and why we need it.


For some of our services users, for example hearing support service users, we may also record information about your mental or physical health which is classified as “sensitive personal information”.


We will only use this information for the purposes of dealing with your enquiry or providing the individual service that you require.


We will not pass on your details to anyone else without your express permission.

How and when do we collect your personal data?

We may collect information from you face to face, via phone, via email, via our website, via post, via fax or via application forms or via a referral from one of our partners. We collect information from you in the following ways:


When you interact with us directly


This could be:


  • When you access any of our services.
  • When you ask a member of our staff to send you information about a service or product.
  • When you register with us for training or an event,
  • When you make a donation to us.
  • When you contact us by any means with queries, complaints etc.
  • When you purchase something from our website or in person.
  • When you fill out any forms. For example, if an accident happens on our premises, a member of our staff may collect your personal information as part of the investigation.
  • When you choose to respond to one of our surveys.
  • When you apply for a job with us.
  • When you apply for a volunteering opportunity with us.
  • Employee data is governed by a separate privacy notice.
  • When you interact with us through partners. For example, this could be when you are referred to one of our services by another organisation such as hospital audiology services.
  • When you interact with us through third parties. For example, if you provide a donation through a third party such as Just Giving or one of the other third parties that we work with and provide your consent for your personal information to be shared with us.
  • When you visit our website. In order to provide you with the best experience while using our website we use cookies to help our site run effectively. For more information, please see our ‘Cookie Policy‘.
  • When you access Commuity Resource social media. We might also obtain your personal data through your use of social media such as Facebook, Twitter, LinkedIn or YouTube, depending on your settings or the privacy notices of these social media and messaging services. To change your settings on these services, please refer to their individual privacy notices, which will tell you how to do this (all links open in a new window; please note we can’t be responsible for the content of external websites):

Direct Marketing

In the majority of times, we will only contact you about our work and how you can support Community Resource by phone, email, post, or text message, if you have agreed for us to contact you in this manner.


However, the law allows personal data to be legally collected and used if it is necessary for a legitimate business interest of the organisation – as long as its use is fair and balanced and does not unduly impact the rights of the individual concerned. There are times when it is just not practical to ask a person for consent. In some situations, the best approach is to process personal data because of our legitimate interests, rather than consent.


Reasons legitimate interest could be used are as follows:


  • Researching and creating profiles on potential major donors, high net worth individuals, and philanthropists for the purpose of direct marketing.
  • Unsolicited commercial or non-commercial messages, including campaigns, income generation or charitable fundraising.
  • Analysis, targeting, and segmentation to develop corporate strategy and improve communication efficiency


To stop receiving direct marketing communications from us:


Email – or write to us at Marketing Manager, Community Resource, 4 The Creative Quarter, Shrewsbury Business Park, Shrewsbury, Shropshire. SY2 6LG.

How we protect your personal data

We treat your data with the utmost care. We employ appropriate administrative, technical, organisational, and physical security measures to protect your information and data against accidental or unlawful destruction, loss, or alteration, and against unauthorised disclosure and access.


We use standard industry practices to protect user information, including firewalls and SSL encryption. Our staff and volunteers follow detailed data protection procedures when handling personal data.


Unfortunately, no data transmission or storage can be guaranteed to be 100% secure. While we strive to protect your personal information, we cannot guarantee security of the information you transmit to us via email or through our websites.

How long will we keep your personal data?

Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose for which it was collected. This will be based on either a legal requirement (where a law says we have to keep information for a specific period of time) or in line with the the Information Governance Alliance’s guidelines.


At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning. Paper records are confidentially shredded.


Some examples of personal data retention periods:


Donations subject to Gift Aid

We will keep a record of your Gift Aid donation for seven years to comply with HMRC rules.


Individual Grant Applications

If you are successful in receiving an individual grant award from Commuity Resource we will retain your grant application for 7 years. If you are not successful the information will be retained for 2 years.


If you request that we stop sending you marketing materials we will keep a record of your contact details and the minimum appropriate information to enable us to comply with your request not to be contacted by us.

Who do we share your personal data with?

The personal information we collect about you will be used by our staff (and volunteers) at Community Resource so that we can support you.


We will never sell or share your personal information with organisations so that they can contact you for any marketing activities. Nor do we sell any information about your web browsing activity.


Examples of the kind of third parties we work with are IT companies who support our websites and other business systems. They are required to comply with all relevant Data Protection Laws and to ensure that your privacy is respected and protected at all times.


We will only share your data with third parties for their own purposes in very specific circumstances, for example if you are a Wheels to Work client and you have an accident on one of our mopeds we may be required to disclosure your personal data to the police or other enforcement body, upon a valid request to do so.

What are your rights over your personal data?

The data that we keep about you is your data and we ensure that we keep it confidential and it is used appropriately. You have the following rights when it comes to your data.


  • You have the right to request a copy of all of the data we keep about you. Generally, we will not charge for this service;
  • You have the right to ask us to correct any data we have which you believe to be inaccurate. You can also request that we restrict all processing of your data while we consider your rectification request;
  • You have the right to request that we erase any of your personal data which is no longer necessary for the purpose we originally collected it for.
  • You may also request that we restrict processing if we no longer require your personal data for the purpose we originally collected it for, but you do not wish for it to be erased.
  • You can ask for your data to be erased if we have asked for your consent to process your data. You can withdraw consent at any time – please contact us to do so.
  • If we are processing your data as part of our legitimate interests as an organisation or in order to complete a task in the public interest, you have the right to object to that processing. We will restrict all processing of this data while we look into your objection.
  • Ask us to stop using your personal data for direct marketing (either through specific channels, or all channels). We must always comply with your request.

Checking your identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act. You may need to provide adequate information for our staff to be able to identify you, for example, a passport or driver’s licence. This is to make sure that data is not shared with the wrong person inappropriately. We will always respond to your request as soon as possible and at the latest within one month.

Contacting the regulator

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.


You can contact them by calling 0303 123 1113 (local rate) or 01625 545745 (national rate). Or go online to (opens in a new window; please note we can’t be responsible for the content of external websites). Or write to them at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Wealth screening and financial planning

Before contacting potential major donors, high net worth individuals, and philanthropists we may want to undertake research to better understand their engagement with Community Resource and their potential interest in supporting our work.

This research will help us target communications in a more focused, efficient and cost-effective way and help us to understand what type of charitable project prospective donors may find interesting, the level of support that would be appropriate, and how to personalise our initial contact.


In researching potential major donors, high net worth individuals, and philanthropists we may consider business and family networks, publicly available information relating to residential location, wealth and assets, career, and donations to other organisations, along with their hobbies and interests. The purpose of this research is to help identify new supporters, create a profile of their interests and financial capacity, and to evaluate their ability to support our work.


To aid us in this research we may use information the donor has already provided and combine it with additional information from publicly available sources such as Google, newspaper and magazines articles, Companies House records, other charities, and any other information they have chosen to make public, for example on LinkedIn, public social media profiles, or corporate websites. We may also use additional information such as geographical information for measures of affluence where available.


When hosting an engagement or fundraising event, we may also produce short biographies of guests who are due to meet with our CEO, Trustees or Patron. This helps us to understand more about those we engage with, and their interests or connection to us.


Before seeking or accepting major donations we are required to conduct a minimum level of due diligence. This is in accordance with our legal and regulatory obligations and our internal risk management policies and procedures.

Any questions?

We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it.


To exercise any of your rights, or ask us any questions about our data protection practices, please either speak to your Commuity Resource contact (if you have one) or telephone 01743 360641 and ask to speak to a member of the Senior Management Team. You can also write to us at:


Information Governance, Commuity Resource, 4 The Creative Quarter, Shrewsbury Business Park, Shrewsbury, Shropshire. SY2 6LG.


This notice was last updated on 25/10/2021