1.    Introduction

This notice explains when and why we collect personal data, how we use it and how we keep it secure.  Personal data relates to a living individual who can be identified from that data.  Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).

We may update this Notice from time to time. We will notify you of significant changes by contacting you directly where reasonably possible for us to do so and by placing an updated notice on our website. This Notice was last updated on 25th May 2018

2.    Who are we?

True Freedom Trust (TFT) is a Charitable Incorporated Organisation (CIO), registered with the Charity Commission of England and Wales (registered charity number 1159015).  We are committed to protecting your privacy and at all times we aim to respect any personal information you share with us, or that we receive from others, and keep it safe.

3.    How do we collect data from you?

We obtain information about you when you fill in one of our webforms, or we may ask for details over the phone. Sometimes we also collect data in person.  If you donate or make a payment to us through a third party such as PayPal, Stewardship or CAF, we will receive the information they are legally obliged to give us.  Please refer to their privacy policies for further details.

4.    How do we process your personal data?

TFT complies with its obligations under the “GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

We may use the personal data of members for the following purposes: -

• To administer membership records; 
• To follow up a request for support; 
• To process a donation you have made;
• To inform you of fundraising activities and promote the interests of the charity; 
• To manage our employees and volunteers; 
• To maintain our own accounts and records (including the processing of gift aid applications);
• To send you our publications by post or email;
• To inform you of news and events organised or endorsed by TFT relevant to your interests or location.

Your personal data will be treated as strictly confidential in accordance with our code of confidentiality.  We will not sell your personal data to any third parties.  We will not share any of your contact details with a volunteer or another member without your clear consent on each occasion.

5.    How long do we keep your personal data?

We review our retention periods for personal data on a regular basis. We keep your data for as long as it is necessary to provide the services that you have asked for, and to meet our legal obligations to HMRC and other accounting regulations. As a general rule, we will keep your data for seven years from the end of your relationship with us. However, if before that date (i) your personal information is no longer required in connection with such purpose(s), (ii) we are no longer lawfully entitled to process it, or (iii) you validly exercise your right of erasure, we will remove it from our records at the relevant time.
If you request to receive no further contact from us, we will keep some basic information about you on our suppression list in order to comply with your request and avoid sending you unwanted materials in the future.

6.    Security and storage of your personal data

TFT is committed to keeping your personal information safe and secure. We have appropriate and proportionate security policies and organisational and technical measures in place to help protect your personal information.
Your personal information is only accessible by appropriately trained staff and stored on secure servers which have features to prevent unauthorised access.

7.    What is the legal basis for processing your personal data?

The GDPR requires us to rely on one or more “lawful bases” to use your personal information. We consider the bases listed below to be relevant:

• Where you have provided your consent for us to use your personal information in a certain way (for example, we will ask for your consent to use your personal information to send you monthly prayer email updates, or to put you in touch with one of our volunteers).
• Where necessary so that we can comply with a legal obligation to which we are subject (for example, to maintain records of Gift Aid donations for HMRC).
• Where there is a legitimate interest in us doing so. The GDPR allows us to collect and use your personal information if it is reasonably necessary to achieve our legitimate interests (as long as that use is fair, balanced and does not unduly impact your rights).

In broad terms, our “legitimate interests” means the interests of our TFT membership, and pursuing our vision, mission and goals according to the basis of the charity.  This is the lawful basis on which we process the data of our members.

When we use the personal information of our members to achieve such legitimate interests, we consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. We will not use your personal information for activities where our interests are overridden by the impact on you, for example where use would be excessively intrusive (unless, for instance, we are otherwise required or permitted by law).

8.    Your rights and your personal data

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: -

• The right to request a copy of your personal data which TFT holds about you; 
• The right to request that TFT corrects any personal data if it is found to be inaccurate or out of date;  
• The right to request that your personal data is erased where it is no longer necessary for TFT to retain such data;
• The right to withdraw your consent to the processing at any time;
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
• The right to data portability;
• The right to object to the processing of personal data,
• The right to lodge a complaint with the Information Commissioners Office.

9.    Links and Third Parties

Our website contains links to other websites run by other organisations. This Notice does not cover external websites and we are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policies of any external websites you visit via links on our website.

10.    Contact Details

To exercise all relevant rights, raise any concerns or complaints please in the first instance contact our staff team.

You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.