Rees Foundation Privacy Policy

1.0 Overview
1.1 The Charity takes the security and privacy of your personal data seriously. We collect and use information about you as part of our operations and to manage our relationship with you. We are committed to complying with our legal obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains how we process your personal data and your rights in relation to it.
1.2 This policy applies to our beneficiaries. If you fall into this category, you are a ‘data subject’ for the purposes of this policy. We may update this policy from time to time and will notify you of any significant changes where appropriate.
1.3 The Charity has separate policies and privacy notices in place for job applicants, employees and other categories of data subjects. Copies of these can be obtained from Claire Banner, Head of HR.
1.4 The Charity is the ‘data controller’ of your personal data. This means we determine the purposes for which and the manner in which your personal data is processed.
1.5 This policy explains how the Charity collects, holds, uses and protects your personal data, and outlines your rights as a data subject.

2. Data Protection Principles
2.1 Personal data must be:
  • processed lawfully, fairly and transparently;
  • collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
  • adequate, relevant and limited to what is necessary;
  • accurate and kept up to date;
  • not kept for longer than necessary; and
  • processed securely to protect against unauthorised or unlawful processing, loss, destruction or damage.
2.2 The Charity is responsible for, and must be able to demonstrate, compliance with these principles.

3. How We Define Personal Data
3.1 Personal data means any information relating to an identified or identifiable individual (‘data subject’). It does not include anonymised data.
3.2 This policy applies to personal data stored electronically, on paper, or in other formats.
3.3 Personal data is usually provided directly by you, for example when you complete forms, communicate with us, or apply for support.
3.4 We may collect and use the following types of personal data:
  • name
  • address
  • email address
  • telephone number
  • proof of identity
  • information relevant to assessing and providing support
  • safeguarding-related information where necessary
  • limited website usage data (e.g. pages visited)
  • any other personal data we notify you of from time to time
3.5 Cookies

3.5 Cookies and Website Usage
We use cookies and similar technologies on our website to ensure it functions properly and to help us understand how it is used.
Cookies are small text files placed on your device when you visit a website. Some cookies are essential for the website to operate and do not require your consent. Others, such as analytics cookies, are non-essential and will only be used with your consent.
We currently use:
  • Essential cookies – required for the operation, security, and basic functionality of the website.
  • Analytics cookies (e.g. Google Analytics) – these help us understand how visitors use our website. They collect information such as:
    • pages visited and time spent on the site
    • how users navigate between pages
    • general location data (e.g. city or country level)
    • device type and browser
This information is aggregated and anonymised and is used to improve the performance, content, and user experience of our website.
We do not currently use cookies for targeted advertising or advanced tracking.
When you first visit our website, you will be presented with a cookie consent banner. This allows you to accept, decline, or manage your preferences for non-essential cookies. Non-essential cookies will not be placed on your device unless you have given your consent.
You can also control or disable cookies at any time through your browser settings. Please note that disabling some cookies may affect how the website functions.

4. How We Define Processing
4.1 ‘Processing’ means any activity carried out on personal data, including:
  • collection, recording, organisation and storage;
  • updating or alteration;
  • retrieval or use;
  • sharing or disclosure;
  • combining or aligning;
  • restriction, deletion or destruction.
4.2 This includes both manual and automated processing.

5. How We Process Your Personal Data
5.1 The Charity will process your personal data (including special category data where applicable) in accordance with UK GDPR and the Data Protection Act 2018.
5.2 We will process your personal data where:
  • it is necessary for the performance of an agreement between us;
  • it is necessary to comply with a legal obligation;
  • it is necessary for our legitimate interests, provided your rights and freedoms are not overridden; or
  • you have given your consent (where required).
You have the right to object where we rely on legitimate interests (see section 11).
5.3 We will always ensure that your personal data is processed lawfully and fairly. Where consent is required, we will obtain it from you. We will not use your personal data for unrelated purposes without informing you.
5.4 If you do not provide certain personal data, we may not be able to provide services or fulfil our obligations (for example, verifying your identity).
5.5 We do not carry out automated decision-making or profiling.

6. Examples of When We May Process Your Personal Data
6.1 We may process your personal data to:
  • provide support and services;
  • communicate with you;
  • assess eligibility for financial or other assistance;
  • meet safeguarding obligations and protect individuals;
  • ensure security, health and safety;
  • manage and improve our services;
  • prevent fraud or criminal activity;
  • defend legal claims;
  • comply with legal or regulatory requirements.

7. Sharing Your Personal Data
7.1 We may share your personal data where necessary, including:
  • to meet safeguarding obligations;
  • to comply with legal requirements;
  • to deliver services to you.
7.2 We will only share your personal data where it is lawful, necessary and proportionate.
7.3 When making payments via our website, your personal data may be processed by our payment provider (e.g. Square).
7.4 All third parties are required to keep your personal data secure and confidential and to process it only in accordance with our instructions.
7.5 We do not routinely transfer your personal data outside the UK. Where this is necessary, appropriate safeguards will be in place.
7.6  Where we use third-party analytics providers (such as Google Analytics), they may process limited personal data on our behalf. These providers are required to process your data securely and in accordance with data protection laws. We ensure appropriate safeguards are in place when using such services.

8. Data Protection Queries and Retention
Any questions about this policy or data protection should be directed to Claire Banner, Head of HR.
Data Retention
We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Retention periods vary depending on the type of data and purpose.

9. Data Breaches
9.1 We have measures in place to minimise and prevent data breaches. Where required, we will notify the Information Commissioner’s Office (ICO) within 72 hours.
9.2 Any suspected data breach must be reported immediately to Claire Banner.

10. Subject Access Requests
10.1 Data subjects can make a ‘subject access request’ (‘SAR’) to find out the information we hold about them. This request must be made in writing and sent to Claire Banner to process and who will coordinate a response.
10.2 We must respond within one month unless the request is complex or numerous in which case the period in which we must respond can be extended by a further two months.
10.3 There is no fee for making a SAR. However, if your request is manifestly unfounded or excessive we may charge a reasonable administrative fee or refuse to respond to your request.

11. Your Data Subject Rights
You have the right to:
  • be informed about how your data is used;
  • access your personal data;
  • correct inaccurate data;
  • request erasure of your data;
  • restrict processing;
  • object to processing;
  • data portability;
  • be informed of data breaches;
  • withdraw consent where applicable;
  • complain to the ICO.

Further information is available at www.ico.org.uk

If you have any questions about our use of cookies or website data, please contact Claire Banner, Head of HR.

Contact Details
Claire Banner: [email protected]
Head of HR