Data Security & Privacy Statement
About us
In this privacy policy, references to “we”, “us”, St. Paul’s Community Development Trust, St. Paul’s Trust Children’s Centres, and St. Paul’s School are to St. Paul’s Community Development Trust, a limited company registered in England, and Wales as a private company limited by guarantee (company no 01429707) and registered as a charity with the Charity Commission (charity no 508943) whose registered office is St. Paul’s Centre, Hertford Street, Balsall Heath, Birmingham B12 8NJ
Privacy Policy
We understand the importance of maintaining your privacy, keeping your personal information secure, and complying with data protection laws.
We are the data controller of any personal information you provide to us. This means that we are responsible for complying with data protection laws. This privacy policy describes what personal information we may collect from you, why we use your personal information, and, more generally, the practices we maintain and ways in which we use your personal information.
By providing your personal information to us, you acknowledge that we may use it in the ways set out in this privacy policy. We may provide further notices highlighting certain uses we wish to make of your personal information. We may also allow you to opt in or out of selected uses, such as fundraising and promoting the charity’s interests, when we collect your personal information.
We may collect information from you about other people, such as family members. If you give us information about another person, it is your responsibility to ensure and confirm that:
you have told the individual who we are and how we use personal information, as this privacy policy notice sets out.
you have permission from the individual to provide that personal information to us and for us to use it, as set out in this privacy notice.
Our Privacy policy is divided in 13 sections to help you concentrate on the area you are interested in.
1. Why we need it and how we use your personal information
2. Nature of personal information
3. How we collect your personal information
4. Sharing information
5. Marketing
6. How we protect your personal information
7. How long we keep your personal information
8. Data transfer outside the UK
9. Your rights
10. Your right to complain to the Information Commissioner’s Office
11. Other websites
12. Cookies
13. How to contact us
Section 1: Why we need and how we use your personal information.
We only collect and store your information where we have lawful grounds and legitimate reasons to do so.
We collect, use, and store your personal information to ballow you to access our services.
We record basic information about who you are, where you live, why you are accessing a St Paul’s Community Development Trust service, and about the work we are doing with you.
Using your data is essential for some of our services to enter into a contract and operate, for example, if you access our nursery, out-of-school provision, or other services where a contract is required.
We may monitor your emails and other communications with us. When you contact us, we will keep a record of that correspondence and any information provided to us in that or subsequent communications.
Under data protection laws, for each purpose, we must be able to rely on legal grounds to justify why we are using your (non-sensitive) personal information. The legal grounds that we may rely on are:
For Processing (non-sensitive) personal information
Consent of the individual You have provided informed and unambiguous consent for specific data processing purposes.
Performance of our contract with you Processing is necessary for the performance of a contract that you are party to or in order to take steps at your request prior to entering into a contract.
Compliance with a legal obligation Processing is necessary for compliance with a legal obligation to which we are subject.
To protect your vital interests or those of another person Processing is necessary where we believe you or another person is at risk.
For our legitimate interests where these do not cause you undue harm.
Processing is necessary for the purposes of the legitimate interests pursued by us or by a third
party, except where such interests are overridden by your interests or fundamental rights and
freedoms which require the protection of personal information.
Our main legitimate interests for using your personal information are:
· to enable us to provide and deliver services
· to promote our work and services
· for the purposes of fundraising
When we use your sensitive personal information (for example, details about your health), we must be able to rely on additional legal grounds. The additional legal grounds that we may rely on in these instances are:
For Processing sensitive personal information.
Your explicit consent You have given your explicit consent to the processing of your sensitive personal information for one or specified purposes.
You may withdraw your consent at any time by contacting us. if you do so, you may not be able
to receive the benefit of some of our services where in order to provide them, we rely on your
explicit consent to process your sensitive personal information.
Necessary to protect the vital interests of the data subject or another person Processing is necessary where we believe you or another person is at risk.
Where it is necessary to consider your medical condition when providing services It may be necessary to process sensitive data where we need understand more about your health in order to provide our services.
For legal claims Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
You have made this information public You have made your sensitive personal information manifestly public.
Section 2: Nature of personal information
Personal information is any information that may identify a living individual.
Depending on the nature of the service we are providing, we collect personal information such as name, email addresses, date of birth, financial details, and IP addresses.
We may collect and use special categories of data such as physical or mental conditions, racial or ethnic origins (for example, if we are required to collect this information as part of our recruiting process), and your religious beliefs as necessary in relation to providing our services to you. This information may be shared with other agencies and third-party service providers.
Where necessary, we shall obtain your consent to process such information.
We may collect information from:
Present, past, and prospective clients
Employees from other agencies we work with when delivering services (for example, referrals)
Users of the St Pauls Community Development Trust website
We might collect your information if:
you ask to be part of any fundraising or marketing campaign
you register (or someone on your behalf registers you) to attend one of our
events or training courses
you apply for an advertised employed role
you approach St Pauls Community Development in relation to any of the
services it offers
you use our website (for more information, please see section12 on Cookies)
Where you have registered for an event or training hosted by us, we will use your
personal information to:
process bookings
send you the relevant information relating to the event
include your name on delegate lists and registers which are available to other delegates (unless you have indicated to us that you do not want your details to appear on such lists) and third parties such as event organizers
to produce name badges
for security, catering, and to make other necessary purposes related to
running of our events
Section 3: How we collect your personal information.
We may collect your personal non-sensitive personal information and sensitive personal information:
face-to-face (directly from you)
by telephone
by email
via our website (including through cookies – please see section 12 on Cookies)
via forms including payment and direct debits
via our management information systems
from partner and local authority agencies with whom we work.
Section 4: Sharing Information.
We may disclose your information to the Third Parties listed below for the purposes disclosed in this privacy policy. You can contact us for details of specific disclosures concerning your personal information. The third parties listed below will only use your personal information under strict instruction and are under an obligation to ensure that appropriate security measures are in place.
Specific organizations where we are in a partnership to deliver contracted services
IT Service Providers
Professionals who are engaged to facilitate the delivery of services
Local Authorities
Regulators and official bodies
We may also disclose your personal information to other third parties where:
the disclosure is required by law or by a regulator who has authority over us
or you, such as where there is a court order or statutory obligation.
We never share your information outside our organization for marketing purposes.
Section 5: Fundraising and promoting our interests
We are committed to only sending you communications relating to fundraising and promoting our interests if you have expressed an interest in receiving them. These may include:
subscribing to our social media feeds, for example, Facebook and X (formerlyTwitter)
news of crowdfunding campaigns
annual impact reports
communications from third-party providers
newsletters and updates
You may unsubscribe from any of these communications at any time by contacting us.
Section 6: How we protect your personal information.
We are committed to keeping your personal information secure. We keep your personal information on secure servers and have appropriate measures in place at our physical facilities. Where we have contracted IT services out, we make every effort to ensure that their systems and facilities conform to the highest security standards and can provide the necessary documentation to show they are compliant with data protection law concerning data security.
While we strive to protect your information, due to the nature of the Internet, we cannot guarantee the security of any information you transmit to us. Any transmission is at your own risk, and we urge you to take every precaution to protect your personal information while you are online.
Section 7: How long can we keep your personal information?
We only keep your personal information for as long as is reasonably necessary to fulfill the relevant purposes described in this privacy policy or longer if required by law. The minimum retention period relating to financial transactions (for example, the payment of fees or subscriptions) will be seven years. Once we decide it is no longer necessary to keep your information, it will be securely and confidentially destroyed.
Section 8: Transfer of data outside the EEA.
We will not transfer your data outside the UK and EEA as we cannot guarantee that such transfers will be subject to the same levels of data protection as within the EEA under data protection law.
Section 9 Your Rights:
The right to access your personal information. Subject to any relevant exemptions, you are entitled to see a copy of the personal information we hold about you and request details of how we use your personal information, including any disclosures. To exercise your rights to access your personal information, please get in touch with us. There will not usually be a charge for dealing with these requests.
Your personal information will be provided to you in writing or, where you have made
the request, electronically, where possible. The right to rectification. We take reasonable steps to ensure that the personal information we hold about you is reliable, accurate, and as complete as necessary for its intended use. Still, you are entitled to ask us to update or amend any inaccuracies in the personal information that we hold about you. To request that we update or amend any personal information we hold about you, please get in touch with us.
The right to object to marketing.
As set out in section 5, you are entitled to object to receiving marketing material from us at any time. You can exercise this right by contacting us or clicking ‘unsubscribe’ at the bottom of any marketing email.
Other rights
Under certain conditions, you may also have the right to require us to:
delete any personal information where no longer legal grounds have to retain it
where processing is based on consent, withdraw your consent so that we can stop that particular processing
object to any processing based on the legal ground of legitimate interest unless our reason for undertaking that processing outweighs any prejudice to your data protection rights
restrict how we use your personal information while investigating a complaint.
If you contact us to exercise any of these rights, we will confirm your right to do so
and respond within 30 days in most cases.
Section 10: Your right to complain to the Information Commissioner’s Office
If you are not satisfied with our use of your personal information, with our response to any exercise of your rights set out in section 9, or if you believe us to be in breach of our data protection obligations, you have the right to complain to the Information
Commissioners Office at: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 SAF. Telephone 0303 123 1113 (local rate) or 01625 545 745 (national rate number).
Section 11: Other websites
Our website may contain links to other third-party websites. If you follow a link to any of those third-party websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for their policies or processing of your personal information. Please check these policies before submitting personal information to such third-party websites.
Section 12: Cookies
We use a very limited number of cookies on our website. Cookies are small data files that are transferred from the website to your device, where they are stored on the device’s hard drive. We use cookies to enhance user experience and track user behavior on the site, such as the areas visited, which are then anonymized and processed by Google Analytics. You can set your web browser to refuse cookies; however, some of our website features may not function.
The cookies we make use of on the St. Paul’s Community Development Trust website are:
Cookie Name Purpose Lifetime
Google Anonymised tracking data to Google Analytics. 14 Months
X Records interaction with Twitter 30 days
Facebook Cookies Records interaction with Facebook 30 Days
For further information please visit www.allaboutcookies.org
Section 13: How to contact us
Please get in touch with us if you have any questions about our privacy policy or the
information we hold about you.
You can email us at dpo@stpaulstrust.org.uk or write to us at St. Paul’s Community
Development Trust, 73 Hertford St, Birmingham B12 8NJ.
We may update this policy occasionally to keep it current or comply with legal
requirements. The latest version can be found at www.stpaulstrust.org.uk