Privacy Policy

Introduction

Heart of England Community Foundation is committed to protecting the privacy of our donors, grantees, volunteers, partners and community members. This privacy statement explains how we collect, use, disclose, and protect your personal information.

Heart of England Community Foundation is a data controller and a data processor and are registered with the Information Commissioner’s Office.

 

Why do we need your information?

Heart of England Community Foundation collects personal information so that we can manage and support our relationships with stakeholders, comply with legal obligations, improve our services, and achieve our legitimate business and charitable aims.

We are responsible for the collection and management of the personal information that we hold and take our responsibilities seriously. We are committed to complying with all relevant data protection legislation and best practice when handling personal data.

We seek money from people who want to make an impact, and we award it to organisations who support local communities. We are passionate about the West Midlands and Warwickshire.

Working with local donors including individuals, businesses, and other funders, we channel funding where it’s needed most. We champion local social action, acting as a voice for our communities.

 

Whose data do we collect?

We hold data on those who have given financial or other support to Heart of England Community Foundation, those who might do, and those who apply to Heart of England Community Foundation for grants, whether on behalf of an organisation or personally.

Donors

We may collect:

Contact details e.g. name, address, email, and phone number. Taxpayer status information for the purposes of Gift Aid claims. Donation amounts, methods, and history. Employer or affiliated organisation (e.g., for matching gifts). Communication preferences. Payment information (processed securely through third-party providers).

Grantees and applicants

We may collect:

Individual and organisational contact details, including trustee information. Information necessary for application assessment (program descriptions, budgets, outcomes). Legal and registration information. Financial information for grant disbursement and reporting. Impact and evaluation data.

Volunteers, Event Participants and Website Users

We may collect:

Registration information including contact details. Communication and marketing preferences. Website analytics.

 

How we obtain your data

Most of the information we hold has been provided directly to us by the data subject.

In some cases, we may collect data from third parties, including:

Partner charities, community organisations, or donor-advised funds that refer or recommend donors or grantees. Publicly available sources such as charity registers, social media, or government databases.

We process personal information only where there is a lawful basis to do so and for the purposes consistent with this privacy policy.

 

How we use personal information

We use personal information to:

Process donations, including gift aid claims. Manage donor relationships, acknowledgments, and communications. Administer grant applications, approvals, and reporting. Evaluate program outcomes and share community impact. Host and manage events and volunteer initiatives. Improve our operations, communications, and website. Meet legal, financial, and regulatory obligations.

 

How we share information

We share information only as necessary:

With authorised service providers (e.g., payment processors, auditors, IT vendors) under confidentiality agreements. With regulators or authorities as required by law. With partner organisations, only with appropriate consent. With fund representatives or donors supporting specific projects.

Some of our suppliers run their operations outside of the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law. By submitting your personal information to us you agree to this transfer, storing or processing at a location outside of the EEA.

 

Cookies and Website Analytics

Our website uses cookies and analytics tools to enhance performance and understand user engagement. You can manage or disable cookies through your browser settings. No personal data is collected without your consent.

 

Protecting your data

We keep your data secure from loss, misuse, unauthorised access or alteration through a combination of administrative, technical and physical safeguards.

 

Data Breach Notification

Despite our best efforts, security incidents can occur. In the event of a data breach involving personal information, the Foundation will:

Immediately investigate: Assess the scope, cause, and potential impact of the incident. Contain and mitigate: Take urgent steps to stop unauthorised access and limit any potential harm. Notify affected individuals: If the breach poses a real risk of significant harm, we will notify affected individuals promptly, explaining what happened, what information was involved, and what steps they can take. Notify regulators: Where required by law, we will notify relevant supervisory authorities or privacy commissioners.

 

Data Retention

We will keep data for as long as is needed to complete the task for which it was collected or as required by law.

 

Your Rights

Individuals have the right to:

Access and obtain a copy of their personal information. Request corrections or updates. Withdraw consent for specific uses. Request deletion or restriction of data, where legally permissible. Object to processing for legitimate interest purposes.

Data subject access requests (DSARs) must be made by contacting compliance@heartofenglandcf.co.uk where they will be acknowledged and processed within the legal timeframes.

If you are not satisfied with the way we have processed your data, then you can complain to the Office of the Information Commissioner.

 

Contacting us

If you have any questions about this privacy notice, about the way in which we process your data, or if you wish to change the way we use your data, including how we communicate with you, then please contact:

Heart of England Community Foundation c/o Stellantis Pinley House 2 Sunbeam Way CV3 1ND

T: 024 77800 520 E: compliance@heartofenglandcf.co.uk Charity number: 1117340

 

Policy Review

The Foundation will monitor the effectiveness of this policy regularly to ensure its suitability and effectiveness. Any improvements identified will be made as soon as possible. The policy will be reviewed by the Board of Trustees every three years.

Last Amended: February 2026

Last Approved: March 2026

Next Review: February 2029