Commuity Resource is the operating name of the Community Council of Shropshire. We are a registered charity (1096779) and a company limited by guarantee incorporated in England and Wales under company number 4652487. Our registered office is 4 The Creative Quarter, Shrewsbury Business Park, Shrewsbury, Shropshire. SY2 6LG.

We are a ‘data controller’ for the purposes of the EU General Data Protection Regulation 2016/679 (‘Data Protection Law’). This means that we are responsible for, and control the processing of your personal information.

We want everyone who supports us, or who comes to us for support, to feel confident and comfortable with how any personal information you share with us will be used and looked after. We are committed to providing transparent information on the types of personal data we may collect about you, what we do with that data, how we will store and handle that data, and keep it safe.

We collect and use personal data for a number of purposes:

• To process and record your membership if you are a member of our charity.
• To enable us to provide a safe and professional service if you are a service user.
• To provide the services or goods that you have requested from us.
• To process your donations or other payments, to claim Gift Aid on your donations and verify any financial transactions.
• To update you with important administrative messages about your grant application, job application, volunteer application, membership, an event, or services or goods you have requested.
• To keep a record of your relationship with us.

We may also use your personal information to:

• Contact you about our work and how you can support Community Resource (see section 6 on ‘Direct Marketing’ below for further information).
• To invite you to participate in surveys or research.
• To respond to your queries and complaints.

Community Resource will not share your information with third parties for marketing purposes.

In some circumstances we may use your personal data to carry out research using publicly available information to determine whether an individual could be a potential major donor, high net worth individual, or philanthropist that shares charitable mission. This research will enable us to target communications in a more focused, efficient, and cost-effective way, helping us reduce the chances of supporters and potential supporters receiving inappropriate or irrelevant communications. Please be assured that donors can ‘opt out’ of this research process at any time by contacting Community Resource and making that request.

The law on data protection sets out a number of different reasons for which an organisation may collect and process your personal data. When collecting your personal data, we will always make clear to you which data is necessary and what legal basis we are using it in connection with a particular service.

Consent

In specific situations we can collect and process your data with your consent. For example, when you sign up to our website to receive email newsletters from us.

Contractual obligations

In certain circumstances, we need your personal data to comply with our contractual obligations. For example, if you have placed an order on our website, we will collect your address details to deliver your purchase.

Legal compliance

If the law requires us to, we may need to collect and process your data. For example, in order to claim gift aid on a donation, HMRC requires us to retain your gift aid declaration which includes personal details such as your name, home address, and UK tax-payer status.

Legitimate interest

In specific situations, we require your data to pursue our legitimate interests in a way which might reasonably be expected as part of running our charity and which does not materially impact your rights, freedom or interests. For example, to inform you about services you have told us you are interested, such as our training programmes.

Vital interests

In very limited cases we may need to use your data to protect your vital interests, or those of another person. For example, we may share personal information with agencies, including local authority services and the police, where it is necessary to safeguard the welfare of an adult at risk.

Personal data is any information that can be used to identify you.

We only collect personal data relevant to the type of service or interaction you have with Commuity Resource. So for example, if you are a service user, volunteer, donate money, register for our training or an event, sign up to any of activities or online content (such as newsletters), or contact us by telephone, email, social media, post or text message, we may need to collect and process the personal information that you’ve provided.

This personal information may include:

• Personal details (name, date of birth).
• Contact details (email, address, telephone etc.)
• Financial details to process your donations or other payments.
• Volunteer CRB checks for safeguarding purposes.
• UK tax payer information (for Gift Aid).
• Details of your interactions with us.
• Details of your visits to our websites, and which website you came from to ours.
• Information gathered by the use of cookies in your web browser. See our Cookie Policy.

When collecting your personal data we will always make clear to you which data is necessary in connection to a particular service and why we need it.

For some of our services users, for example hearing support service users, we may also record information about your mental or physical health which is classified as “sensitive personal information”.

We will only use this information for the purposes of dealing with your enquiry or providing the individual service that you require.

We will not pass on your details to anyone else without your express permission.

In the majority of times, we will only contact you about our work and how you can support Community Resource by phone, email, post, or text message, if you have agreed for us to contact you in this manner.

However, the law allows personal data to be legally collected and used if it is necessary for a legitimate business interest of the organisation – as long as its use is fair and balanced and does not unduly impact the rights of the individual concerned. There are times when it is just not practical to ask a person for consent. In some situations, the best approach is to process personal data because of our legitimate interests, rather than consent.

Reasons legitimate interest could be used are as follows:

• Researching and creating profiles on potential major donors, high net worth individuals, and philanthropists for the purpose of direct marketing.
• Unsolicited commercial or non-commercial messages, including campaigns, income generation or charitable fundraising.
• Analysis, targeting, and segmentation to develop corporate strategy and improve communication efficiency

To stop receiving direct marketing communications from us:

Email – marketing@community-resource.org.uk or write to us at Marketing Manager, Community Resource, 4 The Creative Quarter, Shrewsbury Business Park, Shrewsbury, Shropshire. SY2 6LG.

We treat your data with the utmost care. We employ appropriate administrative, technical, organisational, and physical security measures to protect your information and data against accidental or unlawful destruction, loss, or alteration, and against unauthorised disclosure and access.

We use standard industry practices to protect user information, including firewalls and SSL encryption. Our staff and volunteers follow detailed data protection procedures when handling personal data.

Unfortunately, no data transmission or storage can be guaranteed to be 100% secure. While we strive to protect your personal information, we cannot guarantee security of the information you transmit to us via email or through our websites.

Whenever we collect or process your personal data, we will only keep it for as long as is necessary for the purpose for which it was collected. This will be based on either a legal requirement (where a law says we have to keep information for a specific period of time) or in line with the the Information Governance Alliance’s guidelines.

At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning. Paper records are confidentially shredded.

Some examples of personal data retention periods:

Donations subject to Gift Aid

We will keep a record of your Gift Aid donation for seven years to comply with HMRC rules.

Individual Grant Applications

If you are successful in receiving an individual grant award from Commuity Resource we will retain your grant application for 7 years. If you are not successful the information will be retained for 2 years.

If you request that we stop sending you marketing materials we will keep a record of your contact details and the minimum appropriate information to enable us to comply with your request not to be contacted by us.

The personal information we collect about you will be used by our staff (and volunteers) at Community Resource so that we can support you.

We will never sell or share your personal information with organisations so that they can contact you for any marketing activities. Nor do we sell any information about your web browsing activity.

Examples of the kind of third parties we work with are IT companies who support our websites and other business systems. They are required to comply with all relevant Data Protection Laws and to ensure that your privacy is respected and protected at all times.

We will only share your data with third parties for their own purposes in very specific circumstances, for example if you are a Wheels to Work client and you have an accident on one of our mopeds we may be required to disclosure your personal data to the police or other enforcement body, upon a valid request to do so.

The data that we keep about you is your data and we ensure that we keep it confidential and it is used appropriately. You have the following rights when it comes to your data.

• You have the right to request a copy of all of the data we keep about you. Generally, we will not charge for this service;
• You have the right to ask us to correct any data we have which you believe to be inaccurate. You can also request that we restrict all processing of your data while we consider your rectification request;
• You have the right to request that we erase any of your personal data which is no longer necessary for the purpose we originally collected it for.
• You may also request that we restrict processing if we no longer require your personal data for the purpose we originally collected it for, but you do not wish for it to be erased.
• You can ask for your data to be erased if we have asked for your consent to process your data. You can withdraw consent at any time – please contact us to do so.
• If we are processing your data as part of our legitimate interests as an organisation or in order to complete a task in the public interest, you have the right to object to that processing. We will restrict all processing of this data while we look into your objection.
• Ask us to stop using your personal data for direct marketing (either through specific channels, or all channels). We must always comply with your request.

Checking your identity

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this Privacy Notice. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act. You may need to provide adequate information for our staff to be able to identify you, for example, a passport or driver’s licence. This is to make sure that data is not shared with the wrong person inappropriately. We will always respond to your request as soon as possible and at the latest within one month.

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.

You can contact them by calling 0303 123 1113 (local rate) or 01625 545745 (national rate). Or go online to www.ico.org.uk/concerns (opens in a new window; please note we can’t be responsible for the content of external websites). Or write to them at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Before contacting potential major donors, high net worth individuals, and philanthropists we may want to undertake research to better understand their engagement with Community Resource and their potential interest in supporting our work.

This research will help us target communications in a more focused, efficient and cost-effective way and help us to understand what type of charitable project prospective donors may find interesting, the level of support that would be appropriate, and how to personalise our initial contact.

In researching potential major donors, high net worth individuals, and philanthropists we may consider business and family networks, publicly available information relating to residential location, wealth and assets, career, and donations to other organisations, along with their hobbies and interests. The purpose of this research is to help identify new supporters, create a profile of their interests and financial capacity, and to evaluate their ability to support our work.

To aid us in this research we may use information the donor has already provided and combine it with additional information from publicly available sources such as Google, newspaper and magazines articles, Companies House records, other charities, and any other information they have chosen to make public, for example on LinkedIn, public social media profiles, or corporate websites. We may also use additional information such as geographical information for measures of affluence where available.

When hosting an engagement or fundraising event, we may also produce short biographies of guests who are due to meet with our CEO, Trustees or Patron. This helps us to understand more about those we engage with, and their interests or connection to us.

Before seeking or accepting major donations we are required to conduct a minimum level of due diligence. This is in accordance with our legal and regulatory obligations and our internal risk management policies and procedures.

We hope this Privacy Notice has been helpful in setting out the way we handle your personal data and your rights to control it.

To exercise any of your rights, or ask us any questions about our data protection practices, please either speak to your Commuity Resource contact (if you have one) or telephone 01743 360641 and ask to speak to a member of the Senior Management Team. You can also write to us at:

Information Governance, Commuity Resource, 4 The Creative Quarter, Shrewsbury Business Park, Shrewsbury, Shropshire. SY2 6LG.

This notice was last updated on 25/10/2021