Kingston Giving Data Protection Policy 

 

Introduction 

  1. Kingston Giving is committed to ensuring the privacy and protection of personal data. This Data Protection Policy outlines how we collect, store, process and protect the personal data of our funders, clients, supporters, trustees, employees and any other individuals with whom we interact. 

  2. Data protection is covered by the UK General Data Protection Regulations (GDPR) and the Data Protection Act 2018 (DPA). The Privacy and Electronic Communications Regulations 2003 (PECR) are also relevant (para 16). 

 Purpose 

3. This policy: 

  • Sets out how we handle personal data responsibly and transparently. 

  • Defines roles and responsibilities for data protection. 

  • Sets out guidelines for collecting, storing, processing and deleting personal data. 

  • Ensures we meet our legal obligations regarding personal data protection, including compliance with PECR for electronic communications. 

Scope 

4. This policy applies to all trustees, contractors, employees and anyone who has access to personal data. It is all of our responsibility to: 

  • Ensure personal data is processed securely and in accordance with this policy. 

  • Report any data breaches or concerns about data protection immediately to the Chair of the Board who will notify the Data Protection lead. 

  • Follow Kingston Giving’s procedures for handling personal data. 

What is personal data? 

5. Personal data is any information that relates to an identified or identifiable individual. This can include, but is not limited to, name, contact details, email addresses, identification number or any other information that could be used to identify someone directly or indirectly. 

Types of personal data we collect 

6. We may collect the following types of personal data: 

  • Contact information: Name, email address, phone number, and postal address. 

  • Professional information: Job title, organisation, areas of expertise and other information relevant to our activities. 

  • Event and membership data: Information related to event attendance and attendees. 

  • Communications data: Correspondence between Kingston Giving and individuals, including emails, phone calls, and meeting notes. 

Processing personal data 

7. Under the UK GDPR, we process personal data based on the following grounds: 

  • Consent: Where individuals have provided clear consent to us for processing their data. 

  • Contractual necessity: Where processing is necessary for the performance of a contract. 

  • Legal obligation: Where processing is necessary for compliance with a legal obligation. 

  • Legitimate interests: Where we have a legitimate interest in processing personal data, provided that this interest is not overridden by the individual's rights and freedoms. 

How we use personal data 

8. We process personal data for the following purposes: 

  • To communicate with individuals about grant programmes, events, publications, research and the outcome of grant applications. 

  • To provide updates on Kingston Giving’s and activities. 

  • To fulfil legal or contractual obligations. 

  • To analyse and improve our services and operations. 

  • To manage donations and subscriptions. 

Data security 

9. We take protecting personal data seriously. Our measures to safeguard it include: 

  • Secure storage and access controls through Microsoft 365. 

  • Password protection of sensitive data where necessary. 

  • Regular audits of our data protection practices. 

  • Board and employee training on data protection responsibilities. 

Data retention 

10. We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law, in line with our Retention Policy. Personal data will be securely deleted when no longer needed. 

Data sharing 

11. We do not share personal data with third parties except where necessary for the purpose for which it was collected, and in compliance with data protection laws. Any third-party service providers who process personal data on our behalf are required to have adequate safeguards in place to protect personal data. 

12. We may share personal data with the following parties: 

  • Service Providers: For services such as website hosting, email services, and event management. 

  • Legal or Regulatory Authorities: Where required by law or regulatory obligations. 

Data breaches 

13. In the event of a data breach that could affect individuals’ rights and freedoms, the Data Protection lead will notify the Information Commissioner’s Office (ICO) and affected individuals in line with legal requirements. 

Data subject rights 

14. Individuals have the following rights under GDPR: 

  • Right to Access: The right to request a copy of the personal data we hold about them. 

  • Right to Rectification: The right to request corrections to any inaccurate or incomplete personal data. 

  • Right to Erasure: The right to request the deletion of personal data, subject to certain exceptions. 

  • Right to Restriction of Processing: The right to request the restriction of processing under certain conditions. 

  • Right to Data Portability: The right to request a transfer of personal data to another organisation in a structured, commonly used, and machine-readable format. 

  • Right to Object: The right to object to the processing of personal data for certain purposes. 

15. If any individual wishes to exercise any of the above rights, they should submit their request in writing to the Chair of the Board.  

 

Privacy and Electronic Communications Regulations 2003 

Direct marketing & PECR compliance 

16. We comply with PECR with respect to any electronic communications, including: 

  • Consent for Marketing: We will seek clear, informed consent before sending marketing emails or making unsolicited marketing phone calls, as required under PECR. Individuals will always have the option to opt-out of receiving such communications, and we will respect their preferences. 

  • Marketing Opt-Out: All marketing communications will include clear instructions on how individuals can opt out of receiving future communications (e.g., through an unsubscribe link in email newsletters). 

  • Cookies: We will only use cookies for marketing and tracking purposes with users’ consent, in compliance with PECR. Users will be informed about the cookies we use and given the option to manage their preferences regarding their use through our website.