Privacy policy

Personal Data (or personal information) is any information about a living individual, where that individual can be identified using the information we hold, or the information we hold in combination with other obtainable data.

In brief, the Data Protection Principles in the UK Data Protection Act 2018 state that personal data shall be:

• processed fairly, lawfully, and in a transparent manner
• processed for specified purposes
• adequate, relevant, and not excessive
• accurate and (where necessary) kept up to date
• not kept longer than necessary (in an identifiable format)
• appropriately secured and protected from unauthorised or accidental access, loss, or disclosure

Your personal data

We need your personal data to allow us to offer our services to you and to comply with our legal and fiduciary duties. We will only collect the minimum amount of information necessary to provide our service to you or to comply with our legal obligations.

To help you swiftly find which part of this policy applies directly to you we have split the information into the following sections:

• Grant applications
• Grants in Historic Parishes
• Kindred
• Volunteers
• Kindred Visitors
• Ordinands
• Trustees
• Visitors to our website
• Human Resources
• Finance
• Photographs
• Requests to use our logo

In order to process grant applications, we need some personal information . This includes the name and contact details of parties making the application as well as other relevant information. 

We will use this information, along with progress reports, only for the purposes of assessing your application, managing or monitoring any grant awarded and related administration or research purposes. Details may be shared with other funding organisations to use in their own assessment of applications and managing or monitoring of grants awarded, and for the detection and prevention of fraud.

Applicants should ensure that no personal information relating to third parties is included without the written agreement and permission of the individuals concerned. Whilst not requested, some applicants include case studies and other identifiable personal information about other individuals in their application. Where possible this information is deleted upon receipt. 

Grants in Historic Parishes

In order to process your Parish Grant Form, personal information must be provided to us, this will include name and contact details of the parties submitting the Form, as well as other relevant information relating to your grant.

We will use this information, only for the purposes of assessing your eligibility for funding, managing or monitoring any grant awarded and related administration or research purposes.

Whilst it is not required, some grant holders do include case studies and other information which might identify other individuals within their Form. Where possible this identifying information is deleted immediately on receipt. Grant Holders should ensure that no personal information relating to third parties is included without the written agreement and permission of the individuals concerned.

If you are applying for, or in receipt of, a Parish Community Grant please refer to the Grant Applications section of this policy.

Kindred

The Henry Smith Foundation support the descendants of our founder and benefactor, Henry Smith.

We maintain a register of all the descendants of Henry Smith to help identify people who may benefit from our support. We use online and offline family tree services and genealogy websites together with public records such as the Probate Office and the Central Registry Office to help us verify relationships and applications. We refer to this descendent information as ‘Kindred’ data.

If you apply for a grant, we will collect only information necessary to process it. This may include copies of documents and certificates to verify your identity, details of your finances and your personal circumstances, some of which may be of a sensitive nature, such as details of medical conditions. Other information that may be relevant to supporting the grant application may also be processed.

As with all personal data we will keep this information secure and never share with any unauthorised third parties. If you would like to know more about how we collect, process and use this information contact our Kindred team

[Kindred team details]

Volunteers

We will use your information for the purposes of managing the volunteer recruitment process, administering and arranging volunteer visits, managing your volunteer experience, including training and conferences and for the purposes of anonymised statistical analysis and research.

Some information, such as your nationality, date of birth, address and bank details are essential for your volunteering role.

We may ask for medical information so that we can support you in your volunteering, although you are free to decline these requests as they are not compulsory.

Details of a person to contact in an emergency are required for our lone working policy as well as any other information you chose to give us.

We may share your name and basic contact information with organisations you have agreed to visit.

Kindred visitors

We will use your information for the purposes of managing the Kindred visitor recruitment process and administering and arranging Kindred visits.

Some information, such as your CV, nationality, date of birth, address and bank details are essential for your recruitment, visiting role and for enhanced DBS clearance checks.

We share your name with kindred grants applicants you have agreed to visit.

Ordinands

We collect the details supplied in bursary fund application forms for the purposes of awarding these bursaries. Information collected includes name, age, gender and supporting statement. This information may be used internally for analysis of our bursary funding work.

Trustees

We process the personal details of Trustees to comply with our legal obligations, to comply with the requirements of the Charity Commission  and to keep in regular contact.

We maintain a list of Retired Trustees for the purposes of keeping in touch with newsletters and invitations to events.

Our web server collects some information about your visit to our site in the logs stored on that web server. These logs may be used by our hosting provider for support and troubleshooting purposes, and will contain your IP address.

Other than this IP address information, no personal data is collected about you when you visit our site, except for information you choose to submit when completing a form.

If you ‘Accept all cookies’ or choose to enable Analytics cookies in the cookie settings area, then information is captured by Google Analytics – please see our Cookies Policy for full details.

People and Culture

To comply with employment legislation and ensure that all staff and trustees working within the organisation are qualified, competent, vetted and receive ongoing training we will collect both personal and sensitive information and may keep that in a manual or electronic form.

Records will include personnel files, training records, minutes of meetings and other relevant documentation.

In order to consider your application, offer employment, and comply with our legal obligations, for example, the right to work within the UK, we ask for your personal details including contact details. Other information such as qualifications and work experience will be requested to ensure you are qualified to fulfil your role. Some information, such as your nationality, date of birth, address and bank details, are essential for your employment.

We do not need your consent if we use your sensitive personal data in accordance with our rights and obligations in the field of employment and social security law.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.

We share employee details such as salary information and bank details with an external payroll service company who process the payroll on our behalf.

We share details of current employees with medical insurance and health check-up service providers to ensure employees are registered and able to access these services. We do not have access to any employee medical records without explicit consent from employees.

We may also ask for details of your ethnicity and sexuality, to comply with anti-discrimination laws, and medical information so that we can support you in your employment. You are free to decline these requests as they are not compulsory.

Details of next of kin will be collected as well as any other information you wish to give us. For further details regarding the use of employee personal data, please contact the People and Culture team.

[People and culture contact details]

Email newsletter

Current and new grant holders (organisations) will be automatically signed-up to The Henry Smith Foundation email newsletter. The email address signed up to the newsletter will be the one given to us as the main contact when applying for grants. Everyone who wishes to can also subscribe to our email newsletters by completing the sign up form 

[Newsletter sign up form]

Everyone signed up to the newsletter will receive an initial request  for double opt-in confirmation before they receive any newsletters. Subscriber information, in addition to the email address, may be provided, but is not required.

Every newsletter email will include an option to unsubscribe via a link.

Interaction with email newsletters is monitored for activities such as opening the newsletter and clicking on links. Email addresses will be unsubscribed from our newsletters if no interaction has been detected for two years.

Email addresses, email interaction data, and optionally supplied subscriber details are stored by our partner DotDigital.

Finance

Where there is a need to make financial transactions, such as processing expenses claims, for individuals, we will hold details such as name, contact details and bank details within our finance system. These details are used only for the purpose of making these transactions and for holding a record of these transactions.

Photographs

We sometimes use photographs of funded projects and the people supported by them for publicity purposes. Where these photographs include pictures of people, we request confirmation that those people in the picture have given their consent for the picture to be used in this way or request consent directly from the person

Using our logo

We receive names, email addresses and other contact details of media and grant holders requesting to use our logo. This allows us to verify that requests are from existing grant holders and verified media, and provide our logo in a digital format. Media and grant holders  agree to acknowledge The Henry Smith Foundation when using photos or logos provided by us in their publications.

Storing your data

We will only use your personal information for the purpose for which it was given, will not keep it for longer than necessary and will destroy the information securely according to our data retention policy.

Below is an overview of the legal reason, called the ‘lawful basis’ of why we process your information as well as guidance on how long we shall retain personal information:

Lawful basis explanation

Security

We are committed to ensuring that your information is kept secure. To prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect.

All information collected from or about you is hosted within the UK or the EEA (European Economic Area).

Third party sharing

Your information will not be shared with third parties unless you have previously been informed and consent for us to do so. For example, on an application form we will advise you if we need to share with partners or other bodies, or with the Kindred we may need to share your details for you to obtain external assistance or support. For some of our impact stories, we work with partner agencies to collect and share stories and video or photography.  In many cases we must share your data as the law requires it, for example, sharing financial or tax information with HMRC, or with the police for the detection or prevention of crime.

We also have a duty to ensure that no fraudulent claims are made; sharing with other grant making bodies may take place to assist with this aim. Details of applications and, albeit it very rarely, complaints will be shared with the appropriate teams internally and with our board of Trustees.

Cookies Policy

A cookie is a small file which is placed on your computer’s hard drive. Some cookies are essential for the site to operate. Other non-essential cookies, such as analytical cookies, help us understand how our site is being used. These ‘non-essential’ cookies are only used if you agree to their use. Read our Cookies Policy for more information.

Google Analytics

We use Google Analytics to analyse the use of our websites; Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users’ devices.

The information generated relating to our website is used to create reports about the use of our website. Details captured during your visit will include, but are not limited to, traffic data, location data, weblogs and other communication data and the resources you access. All data collected by Google is anonymous and will not be used to identify you as an individual.

Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links and left our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Your rights

The Data Protection Act 2018 and GDPR provides you with certain rights and these are listed below for your convenience:

• You have the right to access a copy of the personal information we hold about you by making a Data Subject Access Request (DSAR), you can do this by phone, in writing or by email to the Compliance Manager whose full contact details are provided at the end of this Privacy Policy. We will have to verify your identity before we can proceed.
• You have the right of rectification to amend or update your personal information and ensure we maintain accurate and up to date records and or data about you.
• You have the right to erasure, also known as ‘the right to be forgotten’. The broad principle underpinning this right is to enable an individual to request the deletion or removal of personal data where there is no compelling reason for its continued processing by The Henry Smith Foundation.
• You have the right to ‘block’ or suppress the processing of your personal data. Processing of your personal information may be restricted in the event it is no longer essential to support the use of services provided to you and/or not part of any contractual, legal or financial requirement to do so. The Henry Smith Foundation is permitted to store the personal data, but not further process it. We will retain just enough information about you to ensure that any restriction is respected in future.
• You have the right for data portability which allows you to obtain and or reuse your personal data for your own purposes across different services. This right allows you to move, copy or transfer your personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability. This right does not apply to any information held by The Henry Smith Foundation.
• You have the right to object to the processing of your personal information where processing is based on consent, our legitimate interests or the performance of a task in the public interest or exercise of official authority including profiling activity, direct marketing including profiling activity; and processing for purposes of scientific and or historical research and statistics.
• You have right to be made aware of any automated decision-making, that is a decision or processing made without any human involvement, and/or profiling of your personal information – again, The Henry Smith Foundation do not perform any automated decision on you.
• You have an absolute right to ask us to stop sending you direct mail or email. At The Henry Smith Foundation we do not send unsolicited direct marketing.

For some processing you will have given us permission to process your information, and in these cases, you can withdraw your consent at any time. In certain situations, these rights may not apply, for example, if you applied for a grant we would process your original request with your consent. If you then withdraw your consent after the application had been processed any information relating to that grant would not be deleted until the 7 year term. The reason being that we are then processing the application under our legitimate interests, for legal obligations and defence of a legal claim.

If you are unhappy with how we have processed your information, you have the right to lodge a complaint with the Office of the Information Commissioner, contact details below.