Hillfields Community Garden – Privacy Policy
HILLFIELDS COMMUNITY GARDEN (HCG)
HC27 - Privacy Notice
Date adopted: January 2025
Date for review: July 2027
1. Your Privacy is Important
Your privacy is important to Hillfields Community Garden (referred to as ‘the charity’ in this document). We may need to collect information from you in order to tell you about our activities, events and services. We may also need to provide you with information relevant to your membership of the Charity. If you are a customer or user of Hillfields Community Garden, we may need to hold data about you for invoicing purposes, and as part of your hire agreement.
Further information can be found on our HC07 - Data Protection and Information Policy.
2. Types of information
We may need to:
3. Your Consent
We need your consent to hold data about you. Any forms or documents that we need you to complete, manually or electronically, we will ask for your consent and be clear about what the information will be used for if you choose to provide it. There will be some circumstances where we are only able to provide you with services if you consent to providing necessary information, for example, hiring of the community centre or attending a particular group or class.
4. Your right of access
You have a right to ask us what information we hold on you, and to ensure that it is accurate and up to date, and to have it rectified if it is not. We will regularly ask you if there have been any changes to your data so that we are able to keep information up to date. If you are concerned about what information we hold on you, or you would like to update information that we hold on you, please contact us at [email protected] and we will process your request within one month.
5. Storing your data
All physical data will be held securely in a locked cabinet in a non-public location, accessible only by relevant Staff of the Charity. All electronic data on fixed-base computers will be password protected. All electronic data held on portable devices (for example laptops and USB drives) will be password protected and encrypted. All trustees and staff will be supplied with data storage equipment and encryption software to ensure data security where personal or sensitive data is stored.
6. Disposal of data
If we agree to your request to destroy your data, it will be confidentially destroyed in the case of physical data, or permanently erased in the case of electronic data. We may notify you in writing to confirm when and how it has been destroyed or permanently erased. We may not agree to disposal of certain data if we have a legitimate or legal need to retain it. Where there is a legal obligation to, we will keep a record of destruction of data.
7. Retention of personal data
We will not hold personal data longer than necessary. There are certain legal requirements or recommendations which mean that we will keep documents for a minimum period of time. External organisations may also keep information we lawfully provide for periods of time determined by them. Some of the following documents may contain personal data:
The Charity will store archived documents securely, and maintain a register of archived documents along with their planned destruction date. The Charity will review these retention periods regularly to ensure that they remain within the law and recommended practice.
8. Sharing of data
We will not share your information with third parties, unless:
We may use a third party to collect or process your information, for example, an electronic mailing list provider, e.g mailchimp etc. Where we need to share personal data with another organisation, for example an organisation which runs our payroll, we will enter into a data processing agreement.
9. Promoting a culture of data protection
The Charity will have data protection as a standing agenda item at its ordinary meetings to ensure that any issues or concerns are addressed by the Board of Trustees. All new trustees, as part of their induction, will be briefed on The Charity’s data protection arrangements. All staff and relevant volunteers, as part of their induction, will be briefed on The Charity’s data protection arrangements.
How to complain
Hillfields Community Garden has a HC28 - Problem Solving and Complaints Policy and Procedure, a copy of this is available on our website.
If you want to make a complaint about our services or activities, there are several ways you can do this. In writing to us at: [email protected] or to our Chair of Trustees [email protected] or by filling out the following form: https://forms.gle/uCWqu7QnDgcrFPy18
If you have any concerns about our use of your personal information, you can make a complaint to us at the address below. You can also complain to the ICO if you are unhappy with how we have used your data. The ICO’s address:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk
Responsibility of Staff (Personal Data Breaches - internal)
The ICO (Information Control Office) states that all data breaches should be reported via their online system https://ico.org.uk/for-organisations/report-a-breach/. The Charity must notify the ICO within 72 hours of becoming aware of a breach where it's likely to pose a risk to individuals' rights and freedoms. If a breach happens at a data processor (e.g. an external system supplier), it's the controller (e.g. the practice) who must report it — processors are legally required to tell controllers when a breach occurs.
HC27 - Privacy Notice
Date adopted: January 2025
Date for review: July 2027
1. Your Privacy is Important
Your privacy is important to Hillfields Community Garden (referred to as ‘the charity’ in this document). We may need to collect information from you in order to tell you about our activities, events and services. We may also need to provide you with information relevant to your membership of the Charity. If you are a customer or user of Hillfields Community Garden, we may need to hold data about you for invoicing purposes, and as part of your hire agreement.
Further information can be found on our HC07 - Data Protection and Information Policy.
2. Types of information
We may need to:
- collect your contact details (e.g. name, email address) so that we can contact you
- record financial details so that we can make or receive payment from you for goods or services
- collect anonymised information about diversity to help us monitor our accessibility
- record CCTV images to ensure the safety of the centre and its users
- collect information on employees and volunteers to ensure that we can meet our legal obligations to them
3. Your Consent
We need your consent to hold data about you. Any forms or documents that we need you to complete, manually or electronically, we will ask for your consent and be clear about what the information will be used for if you choose to provide it. There will be some circumstances where we are only able to provide you with services if you consent to providing necessary information, for example, hiring of the community centre or attending a particular group or class.
4. Your right of access
You have a right to ask us what information we hold on you, and to ensure that it is accurate and up to date, and to have it rectified if it is not. We will regularly ask you if there have been any changes to your data so that we are able to keep information up to date. If you are concerned about what information we hold on you, or you would like to update information that we hold on you, please contact us at [email protected] and we will process your request within one month.
5. Storing your data
All physical data will be held securely in a locked cabinet in a non-public location, accessible only by relevant Staff of the Charity. All electronic data on fixed-base computers will be password protected. All electronic data held on portable devices (for example laptops and USB drives) will be password protected and encrypted. All trustees and staff will be supplied with data storage equipment and encryption software to ensure data security where personal or sensitive data is stored.
6. Disposal of data
If we agree to your request to destroy your data, it will be confidentially destroyed in the case of physical data, or permanently erased in the case of electronic data. We may notify you in writing to confirm when and how it has been destroyed or permanently erased. We may not agree to disposal of certain data if we have a legitimate or legal need to retain it. Where there is a legal obligation to, we will keep a record of destruction of data.
7. Retention of personal data
We will not hold personal data longer than necessary. There are certain legal requirements or recommendations which mean that we will keep documents for a minimum period of time. External organisations may also keep information we lawfully provide for periods of time determined by them. Some of the following documents may contain personal data:
- Invoices (may contain customer personal information) - Kept for 6 years from the end of the current financial year.
- Hirer’s invoice or receipts (may contain customer / supplier personal information) - Kept for 10 years.
- Customer receipt. HMRC records (may contain employee personal information). Kept for 6 years from the end of the current financial year. P60 form.
- Trustee information (may contain personal trustees’ information). May be kept by the Charity Commission.
- Annual Return. Financial donor and GiftAid records (may contain donor’s personal information). Kept for 6 years from the end of the current financial year.
The Charity will store archived documents securely, and maintain a register of archived documents along with their planned destruction date. The Charity will review these retention periods regularly to ensure that they remain within the law and recommended practice.
8. Sharing of data
We will not share your information with third parties, unless:
- we are legally obliged to,
- we have notified you in advance of a data sharing agreement with a partner, or
- there is a risk of harm to you or another, for example, in a safeguarding situation.
We may use a third party to collect or process your information, for example, an electronic mailing list provider, e.g mailchimp etc. Where we need to share personal data with another organisation, for example an organisation which runs our payroll, we will enter into a data processing agreement.
9. Promoting a culture of data protection
The Charity will have data protection as a standing agenda item at its ordinary meetings to ensure that any issues or concerns are addressed by the Board of Trustees. All new trustees, as part of their induction, will be briefed on The Charity’s data protection arrangements. All staff and relevant volunteers, as part of their induction, will be briefed on The Charity’s data protection arrangements.
How to complain
Hillfields Community Garden has a HC28 - Problem Solving and Complaints Policy and Procedure, a copy of this is available on our website.
If you want to make a complaint about our services or activities, there are several ways you can do this. In writing to us at: [email protected] or to our Chair of Trustees [email protected] or by filling out the following form: https://forms.gle/uCWqu7QnDgcrFPy18
If you have any concerns about our use of your personal information, you can make a complaint to us at the address below. You can also complain to the ICO if you are unhappy with how we have used your data. The ICO’s address:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk
Responsibility of Staff (Personal Data Breaches - internal)
The ICO (Information Control Office) states that all data breaches should be reported via their online system https://ico.org.uk/for-organisations/report-a-breach/. The Charity must notify the ICO within 72 hours of becoming aware of a breach where it's likely to pose a risk to individuals' rights and freedoms. If a breach happens at a data processor (e.g. an external system supplier), it's the controller (e.g. the practice) who must report it — processors are legally required to tell controllers when a breach occurs.
