Privacy and Cookie Policy - Jubilee Gardens Trust

1. Policy Statement

1.1 Jubilee Gardens Trust is committed to protecting your personal data. In order to protect your data, please read this policy carefully. This will help you understand how we collect, use and store your personal data.

1.2 Jubilee Gardens Trust is a controller of personal information for the purposes of the General Data Protection Regulation (‘GDPR’) .

1.3 Jubilee Garden Trust is a registered UK charity; registration number 06684441. If you have any questions regarding this policy, please feel free to contact our Data Protection Officer at the following address:

The Data Protection Officer
Jubilee Gardens Trust
Elizabeth House
39 York Road
London
SE1 7NQ

mail@jubileegardens.org.uk

1.4 In drafting this policy, we have taken into account the relevant data protection legislation, including (but not limited to):

GDPR;
The Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended by The Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011
Directive 2009/136/EC of 25 November 2009 (“The European Union Cookie Directive”).

2. Notification of change of privacy & cookie policy

2.1 We reserve the right to amend this privacy statement at any time. You are advised to visit this website section periodically in order to keep up to date with any changes that may be made in our privacy policy.

3. PRIVACY POLICY

3.1 How do we collect information?

3.1.1 We may collect personal information about you whenever you interact with us. For example, when you contact Jubilee Gardens Trust regarding our events and activities, register as a donor or volunteer, send or receive information, engage with our social media or make a donation to us, you are specifically and knowingly providing our team with your personal information.

3.1.2 In addition, we collect aggregated or anonymous information about the services you use and how you use them. For example, when you visit our website, view or marketing materials, respond to our adverts and interact with us via social media. We may also receive information about you from third parties – for example, where you’ve given them permission to share your information or where we gather information from publicly available sources which we discuss below.

3.2 Legal basis for processing

We often have two main legal bases for processing personal data. Firstly, where it is necessary for the purposes of the legitimate interests pursued by Jubilee Gardens Trust or by a third party to process your information. We can do that so long as we do not interfere with your fundamental rights or freedoms.
Secondly, because we have your consent (i.e. agreement) to us processing your personal information. Under the GDPR, consent is a legal basis for processing personal information. You can withdraw your consent at any time. This is explained further below in the section entitled ‘Your rights under GDPR’.
The other reasons we can rely upon to process your personal information under GDPR is as follows:

Where we are under a legal obligation or an obligation under a contract to process/disclose the information.
Where we need to protect the vital interests (i.e. the health and safety) of you or another person.

3.3 What information do we collect?

3.3.1 We may collect names, addresses, email addresses, telephone numbers, bank account details for setting up a regular donation (if this is what you ask us to do) and, where appropriate, dates of birth whenever you interact with us. We do not use cookies to collect this type of information. All online financial transactions are encrypted using SSL (Secure Sockets Layer).

3.4 How do we use your information?

3.4.1 We may use your information in a number of ways and for a number of purposes including:

To provide you with information or services that you have requested from us or that we feel may be of interest to you where you have consented to being contacted;
To provide you with information about our work or our activities where you have agreed to receive communications from us;
To invite you to participate in interactive features on our website;
To process donations we may receive from you;
To fundraise in accordance with our internal policies and procedures;
For administrative purposes (for example, we may contact you regarding an event for which you have registered, to provide marketing information that you have requested from us or to address a query regarding a donation you may have made to us);
For internal record keeping relating to your donations, feedback, or complaints;
To invite you to participate in voluntary surveys or research;
To contact you where you have been identified as a contact person for an organisation, such as a school, associations, etc (if we obtain your contact details in this way, we will only use them to contact you in your capacity as a representative of that organisation);
To analyse and improve our website;
To analyse the personal information we collect about you and use publicly available information to better understand your interests, preferences and level of potential donations so that we can contact you in the most appropriate way and to ensure that we do not send you unwanted communications;
To tailor advertising that is presented to you on the Internet according to your interests, preferences and other characteristics;
To direct advertisements and other communications to other people who may have similar interests or other characteristics to yours;
To assess your personal information for the purposes of credit risk and security or fraud prevention; and;
Where it is required or authorised by law.

3.4.2 In particular, we may contact you for marketing purposes by email, if you have specifically provided us with your consent allowing us to contact you in this way. We may also send you acknowledgement communications via email or text, for example where you request services on our website, or you have made a donation.

3.4.3 We may send you information about our work by direct mail or telephone unless you have told us that you would prefer not to receive information in this way, only if you have provided us with your postal address or telephone number.

3.4.4 It is up to you to choose how you hear from us. If you express that you do not wish us to use your personal data for marketing purposes as outlined above, please tick the relevant boxes on the forms we use to collect your data, such as our donor forms, website when you make a donation, any of our marketing literature and materials and other direct communication we may have with you face-to-face, via emails or over the telephone.

3.4.5 You can also update or change any of your marketing preferences at any time (including telling us that you don’t want us to contact you for marketing purposes) by:

Indicating that you do not wish to receive our marketing emails by clicking the ‘unsubscribe’ link in at the end of our marketing emails;
Asking us to stop sending you marketing texts by sending us an “opt-out” text message, following the instructions we provide you in our initial text; or
Contacting us by email at mail@jubileegardens.org.uk
By telephone on 0207 202 6900
By writing to us at the address provided at the beginning of this notice.

3.4.6 If you have indicated that you do not wish to be contacted for marketing purposes, we will maintain your details on a suppression list to help ensure that we do not continue to contact you.

4 How will we disclose the information we have collected to outside parties?

4.1 Jubilee Gardens Trust may provide your information to service providers that we use. Subject to your communication preferences and our internal policies and procedures, this would include providing your information to third parties that work with us to help deliver on our charitable purposes, other entities that act as fundraisers for Jubilee Gardens Trust, manage the gardens, or provide information and marketing on our behalf.

4.2 Where you have agreed to receive emails for marketing communications from us, we may provide your email address to social media or other similar companies in an encrypted format in order to tailor relevant advertising to you on those social media platforms and other websites, as well as identify audiences with interests similar to yours.

4.3 We enter into contracts with all of these service providers that require them to comply with data protection laws and to ensure that they have appropriate controls in place to protect the security of the information you provide.

4.4 We will never sell your details and will only share your details with third parties who we work with in order to manage the Gardens.

4.5 We will not make cold telephone calls to members of the general public; therefore, we will not purchase your data in order to do so.

4.6 We may disclose your personal information if we are requested or required to do so by a regulator or law enforcement or in order to enforce or apply our rights (including in relation to our website or other applicable terms and conditions) or to protect Jubilee Gardens Trust (for example in cases of suspected fraud or defamation, or in order to comply with any other applicable legal obligation).

5. How we protect your personal information?

5.1 At Jubilee Gardens Trust, we process your personal information in accordance with the principles of GDPR and take the appropriate physical, electronic and managerial measures to ensure that we keep your information secure, accurate and up to date. Also, we only keep your information as long as it is reasonable and necessary.

5.2 Whilst we use appropriate security measures once we receive your personal information, the transmission of information over the internet is never completely secure. We do our best to protect personal information, but we cannot guarantee the security of information transmitted to our website, so any transmission is at the user’s own risk. However, any payment card details (such as credit or debit cards) we receive on our website are passed securely to our payment processing provider according to the Payment Card Industry Security Standards.

5.3 We may on occasion, need to use the services of a service provider outside the European Economic Area (EEA) for financial and technical reasons. However, any service provider we use to process your information will have to do so in compliance with the European Data Protection Regulations. By submitting your personal information to us, you agree that we may transfer, store or process your data at a location outside the EEA as outlined above. Jubilee Gardens Trust will take all steps reasonably necessary to ensure that your data is processed securely and in accordance with this privacy policy.

6. Trustees and Volunteer applicants

6.1 Jubilee Gardens Trust will only use the information you give us to process your application and to monitor volunteer and trustee statistics. If we want to disclose information to someone outside of our organisation, for example, if we need a reference, plan to use an external supplier to run background checks or need to get a ‘disclosure’ from the Disclosure and Barring Service (DBS) – we will make sure we tell you beforehand, unless we are required to disclose this information by law.

6.2 If you are unsuccessful in your application, we will hold your personal information for 6 months only. After this time and only if we have finished recruiting for the post you applied for, then we will destroy or delete your information.

6.3 If you are successful in your application, we will put together a personal file about your involvement with the Trust. The information in this file will be kept secure and we will only use it for matters that apply directly to your involvement with Jubilee Gardens Trust.

6.4 When your involvement with Jubilee Gardens Trust, we will keep your file according to our record retention guidelines. You can contact us to find out more about this.

6.5 If you apply for post as a Trustee or volunteering opportunity at Jubilee Gardens Trust, we will also collect information so we can assess your suitability for the role.

7. Your credit or debit card information

7.1 If you use your credit or debit card to donate to Jubilee Gardens Trust, we pass your card details securely to our payment processing partner, as part of the payment process and payments are processed in accordance with the Payment Card Industry Security Standards. Jubilee Gardens Trust can assure you that we do not store the details on our website or databases.

8. Your rights under GDPR

8.1 You have a number of rights under the GDPR. To exercise any of the rights below, please contact us in writing using the address provided at the top of this notice.

8.2 Access to personal information
You are entitled to request a copy of the personal information Jubilee Gardens Trust have in relation to you which is kept on internal databases created and accessed only by authorised third parties (third parties that manage the activities of the Trust). This is also known as a ‘subject access request’. We have one calendar month within which to provide you with the information you have asked for.

8.3 Rectification
You can ask us to correct any mistakes contained in the information we hold about you.

8.4 Erasure (‘right to be forgotten’)
You have the right to ask us to delete personal information we hold about you. You can do this where:

the information is no longer necessary in relation to the purpose for which we originally collected/processed it
where you withdraw consent
where you object to the processing and there is no overriding legitimate interest for us continuing the processing
where we unlawfully processed the information
the personal information has to be erased in order to comply with a legal obligation

We can refuse to erase your personal information where the personal information is processed for the following reasons:

to exercise the right of freedom of expression and information;
to enable functions designed to protect the public to be achieved
to comply with a legal obligation or for the performance of a public interest task or exercise of official authority;
for public health purposes in the public interest;
archiving purposes in the public interest, scientific research historical research or statistical purposes;
the exercise or defence of legal claims; or
where we have an overriding legitimate interest for continuing with the processing

8.4 Restriction on processing
You have the right to require us to stop processing your personal information. When processing is restricted, we are allowed to store the information, but not do anything with it. You can do this where:

You challenge the accuracy of the information (we must restrict processing until we have verified its accuracy)
You challenge whether we have a legitimate interest in using the information
If the processing is a breach of the GDPR or otherwise unlawful
If we no longer need the personal data but you need the information to establish, exercise or defend a legal claim.

If we have disclosed your personal information to third parties, we must inform them about the restriction on processing, unless it is impossible or involves disproportionate effort to do so.

We must inform you when we decide to remove the restriction giving the reasons why.

8.5 Objection to processing
You have the right to object to processing where we say it is in our legitimate business interests. We must stop using the information unless we can show there is a compelling legitimate reason for the processing, which override your interests and rights or the processing is necessary for us or someone else to bring or defend legal claims.

8.6 Withdrawal of consent
You have the right to withdraw your consent to us processing your information at any time. If the basis on which we are using your personal information is your consent, then we must stop using the information. We can refuse if we can rely on another reason to process the information such as our legitimate interests.

8.7 Right to data portability
The right to data portability allows us to obtain and reuse your personal data across different services. It allows us to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way. The right only applies to personal data you have provided to us where the reason we are relying on to use the information is either your consent or for the performance of a contract. It also only applies when processing is carried out by us using automated means.

9. Children’s data

9.1 When you register with us, you are stating that you are 18 years of age or over, or are a minor acting with parental consent. By registering, you agree that any information you provide to us about yourself upon registration or at any time is true. Your data will be held as described above.

9.2 Children’s data may only be collected in the case of a complaint which might lead to a claim. The information will only be collected and stored upon formal parental consent in writing. The information provided will be stored and accessed exclusively by certain Trustees of the Trust and the third-party provider who manages the activities of the gardens. The information will be kept in accordance with our Retention Policy.

10. Confidentiality

10.1 We cannot be held responsible for the privacy of data collected by websites not owned or managed by Jubilee Gardens Trust, this includes those linked through our website.

11. Emails terms of use

11.1 Emails aren’t always secure, and they may be intercepted or changed after they’ve been sent. Jubilee Gardens Trust as an organisation do not accept any liability if this happens. The contents of emails exchanged reflect their author’s views and not necessarily those of Jubilee Gardens Trust.

11.2 We would ask that you do not send Jubilee Gardens Trust any financial data through email. The information in emails is confidential, so if you’ve received one by mistake, please delete it without copying, using, or telling anyone about its contents.

12. COOKIES POLICY

12.1 Statement

Jubilee Gardens Trust uses “Cookies” on its website, as almost all websites do; in order to help us to provide you with the best experience we can.

13. What are Cookies?

13.1 Cookies are text files containing small amounts of information which are downloaded to your device when you visit a website. They are then sent back to the originating website on each subsequent visit, or to another website that recognises that cookie.
13.2 Cookies are useful because they allow a website to recognise a user’s device. It enables Jubilee Gardens Trust to collect and process the information you have provided to us in the way that you have intended (as described in the Privacy Policy above).

14. Categories of Cookies we use

14.1 Cookies may be either ‘session cookies’ or ‘persistent cookies’. Your computer automatically removes session cookies once you close your browser. Persistent cookies will survive on your computer until an expiry date specified in the cookie itself, is reached. We use both session and persistent cookies.

14.2 We also use the following types of Cookies:

Strictly necessary cookies: These cookies are essential for the user to move around the website and to use its features;
Performance cookies: These cookies collect information about how the user makes use of the site, e.g. which pages the user visits most. These cookies do not collect information that identifies the user.
Functionality cookies: These cookies remember choices made by the user and enhance the features, e.g. language or users location. This cookie is also used to remember a user’s preferences for a font size, or customisable parts of a web page.

15. What information do we collect?

15.1 We may collect some, or all, of this information when you visit our website, depending on how you use it. We monitor how people use our website so we can improve it. We collect this information anonymously. However, you can use our website anonymously without giving us any information. If you visit our website, we may record information about including (but not limited to):

the areas of the website you visit
the amount of time you spend on the site
whether you are new to the site, or have visited it before
how you came to our website – for example, through an email link or a search engine
the type of device and browser you use.
how you use the website and the quality of your experience – for example we may track your bandwidth when viewing videos.

16. What we do

16.1 We use cookies to track how visitors come to our site. For example, we use approach codes in our internet addresses (URLs) to show us where a donation came from and give us insight into the effectiveness of our marketing material. Some of this will be used by third party cookies to target you with relevant advertising (see below).

16.2 Although not through cookies, we do measure the success of the emails we send – so we know what subject lines and stories people liked the most. We receive this information anonymously, we don’t share this information.

16.3 We do not use Cookies to:

collect any personally identifiable information (without your express permission);
collect any sensitive information (without your express permission);
pass your data onto advertising networks;
pass personally identifiable data to third parties;
pay sales commissions.

17. Do you have to consent to the use of Cookies?

17.1 Most web browsers automatically accept cookies, but if you prefer, you should be able to change your browser to prevent that. You should read the information that came with your browser software to see how you can set up your browser to notify you when you receive a Cookie. This should then give you the opportunity to decide whether to accept it. However, you may not be able to take full advantage of a website if you do so.

17.2 Please note that Cookies are specific to the server that created them and cannot be accessed by other servers, which means they cannot be used to track your movements around the web. If you do not change your browser settings and continue to use our websites, Jubilee Gardens Trust will infer that you have consented to us using cookies for the purposes set out below.

17.3 There is no way to prevent these cookies being sent other than to not use our site.

18. Turning Cookies Off

18.1 You can usually switch cookies off by adjusting your browser settings to stop it from accepting cookies (Learn how here). Doing so however will likely limit the functionality of Jubilee Gardens Trust’s webiste and a large proportion of the world’s websites as cookies are a standard part of most modern websites.

19. Anonymous Visitor Statistics Cookies

19.1 We use cookies to compile visitor statistics such as how many people have visited our website, what type of technology they are using (e.g. Mac or Windows which helps to identify when our site isn’t working as it should for particular technologies), how long they spend on the site, what page they look at etc. This helps us to continuously improve our website. These so called analytics programs also tell us if, on an anonymous basis, how people reached this site (e.g. from a search engine) and whether they have been here before helping us to put more money into developing our services for you instead of marketing spend.

20. Further information

For further information on how to request your personal information and how and why we process your information, you can contact us using the address provided at the beginning of this notice.

The Information Commissioner (ICO) is also a source of further information about your data protection rights. The ICO is an independent official body, and one of their primary functions is to administer the provisions of the GDPR.

You have the right to complain to the ICO if you think we have breached the GDPR. You can contact the ICO at:

Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire, SK9 5AF

0303 123 1113 / http://www.ico.org.uk/