Oxfordshire Community Foundation (OCF) (“we”) promises to respect any personal data that you share with us, or that we get from other organisations, and keep it safe. We aim to be clear when we collect your data and not do anything you wouldn’t reasonably expect.

From May 2018, we moved to an ‘opt-in’ communication policy. This means that we will only send marketing communications to those that have explicitly stated that they are happy for us to do so via their preferred channel(s) (email, text message, phone or post). We also use ‘Legitimate Interest’ for communications relating to grant-making, donations, our partnerships and fundraising.

Our marketing communications include information about our grant-making, events, insights and strategic programmes. If you would like to receive such communications but have not opted in, please contact us on 01865 798666 or ocf@oxfordshire.org.

We collect information in the following ways:

When you give it to us directly

OCF is known as the ‘controller’ of the personal data you provide to us. We will usually collect personal data about you like your name, postal address, telephone number and e-mail address if you are supporting or partnering with us. If you have applied for a grant from OCF, we collect the data given on the grant application. You may give us your information in order to sign up for one of our events, tell us your story, make a donation, purchase our products or communicate with us.

Your activities and involvement with OCF will result in personal data being created. This could include details of how you’ve supported us by volunteering or being involved with our campaigns or events. We may also collect details of your interests and preferences (such as the ways you support us or types of causes you care about).

We do not normally collect or store sensitive data (such as information relating to health, beliefs or political affiliation) about supporters or grant recipients. However, there are some situations where this will occur including, but not exclusively, if:

• An accident or incident occurs on our property, at one of our events or involving one of our staff (including volunteers)
• You are attending one of our events and have disclosed specific access or dietary needs
• Data around an individual’s health is directly relevant to the awarding of a grant.

If this does occur we will be clear with you that we wish to collect such information, our reason for collecting such information, and that we will only do so with your specific consent and permission. We will also take care to ensure your privacy rights are protected.

When you give it to us indirectly

Your information may be shared with us by fundraising sites like JustGiving, Enthuse (previously Charity Checkout) or The Good Exchange, or a funding partner such as MidCounties Co-operative. These independent third parties will only do so when you have indicated that you wish to give your consent. You should check their privacy policy when you provide your information to understand fully how they will process your data.

When it is available publicly

We may combine information you provide to us with information available from external sources in order to gain a better understanding of our supporters to improve our services and any fundraising activities. We may conduct research and analysis on the information we hold, which can in turn generate personal data. For example, by analysing your interests and involvement with our work, we may be able to build a profile that helps us decide which of our communications are likely to interest you. This may include information found in places such as Companies House and information that has been published.

From time to time, we engage specialist agencies such as Prospecting for Gold to gather information from publicly available sources to identify individuals who may have an affinity to our cause but with whom we are not already in touch. For example, Companies House, the Electoral Register, company websites, ‘rich lists’, social networks such as Linkedin, political and property registers and news archives.

You will always have the right to opt out of this processing.

This research helps us to understand more about you as an individual so we can focus conversations we have with you about fundraising in the most effective way, and ensure that we provide you with an experience as a donor or potential donor which is appropriate for you.

Social media

Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp or Twitter, you might give us permission to access information from those accounts or services, such as your location or engagement with posts online.

When we collect it as you use our websites

Like most websites, we use ‘cookies’ to help us make our sites – and the way you use them – better. Cookies mean that a website will remember you. They’re small text files that sites transfer to your computer (or phone or tablet). They make interacting with a website faster and easier – for example by automatically filling your name and address in text fields. There are more details in our Cookie Policy.

In addition, the type of device you’re using to access our websites or apps and the settings on that device may provide us with information about your device, including what type of device it is, what specific device you have, what operating system you’re using, what your device settings are, and why a crash has happened. Your device manufacturer or operating system provider will have more details about what information your device makes available to us. We use Google Analytics to track visits to our websites (e.g. which pages are visited the most), but this is not linked with personal information collected in grant applications.

Our websites may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information that you provide whilst visiting such sites, and such sites are not governed by this Data Privacy Notice.

The type and quantity of information we collect and how we use it depends on why you are providing it.

Supporters

If you support us, for example by making a donation, becoming a fundholder with a Memorandum of Understanding, volunteering, or signing up for an event, we will usually collect:

• Your name
• Your contact details
• Your date of birth
• Any relevant organisations to which you are connected
• Information about how you found out about us, or people in our network with whom you are connected.

We will mainly use your data to:

• Provide you with the services, products or information you asked for
• Administer your fund or donation, or support your fundraising, reclaiming any Gift Aid
• Keep a record of your relationship with us
• Ensure we know how you prefer to be contacted
• Understand how we can improve our services, products or information.

If you enter your details onto one of our online forms, and you don’t ‘send’ or ‘submit’ the form, we may contact you to see if we can help with any problems you may be experiencing with the form or our websites.

We may also use your personal information to detect and reduce fraud and credit risk in order to ensure due diligence around processing donations to ensure the source is genuine e.g. sale of shares and to protect against money laundering.

Direct marketing

With your consent, we will contact you to let you know about the progress we are making, to ask for donations or other support, and to publicise funding opportunities. Occasionally, we may include information from partner organisations or organisations who support us in these communications. We make it easy for you to tell us how you want us to communicate, in a way that suits you. Our forms have clear marketing preference questions and we include information on how to opt out when we send you marketing. If you don’t want to hear from us, that’s fine. Just let us know when you provide your data, or contact us on 01865 798666 or ocf@oxfordshire.org.

If we run an event in partnership with another named organisation, your details may need to be shared. We will be very clear what will happen to your data when you register. We do not sell or share personal details to third parties for the purposes of marketing.

Sharing your story

Some people choose to tell us about their experiences as donors or grant recipients to help further our work. They may take on a role as a patron or volunteer, attend our events or sit on our committees. This may include sharing sensitive information related to their personal life, in addition to their biographical and contact information.

If we have the explicit and informed consent of the individuals, or their parent or guardian if they are under 18, this information may be made public by us at events, in materials promoting our work, or in documents such as our annual impact report.

We may also collect and retain your information if you send feedback about our services or make a complaint.

We ensure that there are appropriate technical controls in place to protect your personal details. For example our online forms are always encrypted and our IT network is protected and routinely monitored. Personal data is managed through the Salesforce CRM system, a well-reputed system with its own built-in security measures.

We undertake regular reviews of who has access to information that we hold to ensure that your information is only accessible by appropriately trained staff and volunteers. Staff receive training and support on how to keep online and paper-based data safe from cyber-attack, misplacement, loss or breach, both in and out of our office premises.

Some of our suppliers run their operations outside the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law. We will only use reputable suppliers e.g. Salesforce who can provide assurances of the security of data. A record of our checks will be kept. By submitting your personal information to OCF you agree to this transfer, storing or processing at a location outside the EEA.

We may need to disclose your details if required to the police, regulatory bodies or legal advisors. We will only ever share your data in other circumstances if we have your explicit and informed consent.

Retention

We hold your information only as long as necessary for each purpose we use it. We regularly review what information we hold and delete what is no longer required. For successful grant applications, we will retain your data for up to seven years, in line with financial best practice for our accounting purposes.

If you decide not to support OCF any longer, or request that we have no further contact with you, we will keep some basic information in order to avoid sending you unwanted materials in the future and to ensure that we don’t accidentally duplicate information.

Payment security

If you wish to make donations to OCF, we never request your bank details directly. BACS payments can be made directly to our business bank account (details of which are available upon request), or via our secure online donation pages provided by JustGiving and Enthuse (previously Charity Checkout).

Of course, we cannot guarantee the security of your personal computer or the internet.

Legitimate Interest

Under the General Data Protection Regulation there are a number of lawful reasons that we can use (or ‘process’) your personal information. One of these lawful reasons is known as ‘Legitimate Interest’.

Broadly speaking, Legitimate Interest means that we can process your personal information if we have a genuine and legitimate reason and we are not harming any of your rights and interests. We believe that Legitimate Interest can be applied to our staff and volunteers, grant applicants, fundholders, members of our partnerships such as Age Friendly Banbury, Growing Minds and Oxford Homeless Movement, and for prospect research. We will review this regularly.

We will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Remember you can change the way you hear from us or withdraw your permission for us to process your personal details at any time by contacting us.

Keeping your information up to date

We really appreciate it if you let us know if your contact details change.

You have a right to ask us to stop processing your personal data, and if it’s not necessary for the purpose you provided it to us for (e.g. processing your donation or grant application, or registering you for an event) we will do so. Contact us on 01865 798666 or ocf@oxfordshire.org if you have any concerns.

You have a right to ask for a copy of the information we hold about you, although a small fee may be payable to cover the costs involved. If there are any discrepancies in the information we provide, please let us know and we will correct them.

If you want to access your information, send a description of the information you want to see and proof of your identity by post to Oxfordshire Community Foundation, 3 Woodin’s Way, Oxford OX1 1HD. We do not accept these requests by email so we can ensure that we only provide personal data to the right person.

If you have any questions please send these to ocf@oxfordshire.org, and for further information see the Information Commissioner’s guidance here (link is external).

We may change this Data Privacy Notice from time to time. If we make any significant changes in the way we treat your personal information, we will make this clear on our website or by contacting you directly.

If you have any questions, comments or suggestions, please let us know by contacting: Oxfordshire Community Foundation, 3 Woodin’s Way, Oxford OX1 1HD, 01865 798666 or ocf@oxfordshire.org.

Approved by Oxfordshire Community Foundation Board of Trustees on 14th September 2020.