The Helen Hamlyn Trust
Privacy Notice for Supporters and Grantees
1. Who processes your personal data
The Helen Hamlyn Trust (registered charity number 1084839; registered company number 4115082) (the "Trust", "we", "our" or "us") is the organisation responsible for the processing of your personal data as described in this privacy notice. This means that the Trust is a ‘data controller’ under the General Data Protection Regulation ("GDPR"). The Trust is registered with the Information Commissioner's Office with registration number Z2534251.
2. How we collect your personal data
We may collect your personal data in a number of ways, for example:
- when you enquire about receiving a grant from us
- when you communicate with us by post, telephone, fax, email or other forms of electronic communication
- when you interact with us through attending our events
- when you make an enquiry via our website, or sign up to benefit from our services (for example, when applying for a training course, making use of our online bulletin boards or other forums, or uploading content to our websites)
- We may also obtain information about you from third parties, such as The Charity Commission.
3. The types of personal data we collect
The Trust holds a secure database of our partners, as well as information on those who have received grants from us and certain data of other contacts. The personal data that we hold can include:
- name, title, date of birth
- contact details including postal address, email, telephone numbers and links to social media accounts
- occupation and professional activities
- your relationship to other current or existing or prospective supporters or grantees
- records of donations and Gift Aid claims
- records of communications from us to you, and vice versa
- other information on your engagement with the Trust (including attendance at events, details of volunteering, responses to surveys or focus groups, your image and likeness as captured in photographs or video footage, and records of the Trust's meetings)
4. The purposes and the legal bases for processing your personal data
We may process your personal data because it is necessary for our legitimate interests. Our "legitimate interests" in this context means the operation of the Trust in a responsible and sustainable manner, in compliance with our compliance and regulatory obligations and in pursuit of our charitable objectives, including the Trust's core aim of initiating and supporting medium to long term charitable projects in the areas of: medicine, the arts and culture, education and welfare, heritage and conservation in India, international humanitarian affairs and healthy aging. In this respect, we may use your personal data:
- for the promotion of the Trust generally, except where we require your consent (for example, before sending you unsolicited marketing communications by email – see the section on marketing communications below)
- for grant-making purposes, including processing grant applications and, where those applications are successful, the administration of grant-making by the Trust (which may also be subject to contractual terms)
- for engagement and for research
- to involve you in projects that you have agreed to support
We may also process your data for our compliance with our legal obligations. In this respect, we may use your personal data in order to meet our compliance and regulatory obligations, such as compliance with anti-money laundering laws, to conduct due diligence on grants as required by the Charity Commission, for the prevention and detection of crime and in order to assist with investigations (including criminal investigations) carried out by the police and other competent authorities.
Marketing communications. We aim to meet the communications preferences of all our supporters and grantees whenever possible. You can personalise your communications preferences by getting in touch with us – our contact details are listed at the end of this privacy notice.
Our engagement activities may include the following, which may be communicated via email and social media (if you consent to this, these will be our primary methods of communication), post and telephone:
- details of and invitations to events
- promotion of the Trust's services and available support for grantees
- promotion of the Trust's charitable projects
- strategic programmes
If you have given your consent and you wish to withdraw it, please contact us using the contact details at the end of this privacy notice. Please note that where our processing of your personal data relies on your consent and you then withdraw that consent, we may not be able to provide some aspects of our services to you.
5. Recipients of your personal data
We may use third party organisations to support our personal data processing activities (for example, a mailing house to assist our marketing operations or, more generally, we may use third party suppliers or agents to provide training courses on our behalf).
We may also disclose your personal data to our professional advisors (including our auditors). In the event that we sell or buy any charitable undertaking or assets, we may disclose your personal data to the prospective seller or buyer of such undertaking or assets.
6. Where we store and use your personal data
The personal data that we collect from you will be primarily stored in our own secure servers in the EU.
Your personal data may also be transferred to, and stored at, destinations outside the European Economic Area ("EEA"), including India and the United States of America (where the Trust operates). In each case, we will only transfer your personal data if it is necessary for one or more purposes set out in this privacy notice. For example, your personal data may be processed by staff operating outside the EEA who work for us or for one of our suppliers or agents.
In these circumstances, your personal data will only be transferred on one of the following bases:
- where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (for example, standard data protection clauses adopted by the European Commission, which we will use in respect of transfers of personal data from the EEA to India); or
- there exists another situation where the transfer is permitted under applicable law (for example, where a third party recipient of personal data in the United States has registered for the EU-US Privacy Shield).
7. How long we store your personal data
We retain information about our previous grantees and those engaging in the Trust’s programmes for internal audit purposes and to keep a record of those who may benefit from future activities/grants of a similar nature and purposes. Details of activities funded by the Trust will be used to inform future charitable activity. We typically retain information about our grantees for seven years from your last communication with us, although we may store your personal data for a longer period if required under our legal or regulatory obligations.
8. Your rights
- Under the GDPR, with effect from 25 May 2018, you have the following rights in relation to our processing of your personal data.:to obtain access to, and copies of, the personal data that we hold about you
- to require us to correct the personal data we hold about you if it is incorrect
- to require us to erase your personal data in certain circumstances
- to require us to restrict our data processing activities in certain circumstances
- to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of your transmitting that personal data to another data controller
- to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights
- where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal.
Please note that the above rights are not absolute, and we may be entitled to refuse your requests where exceptions apply. For example, if you ask for your personal data to be erased, we may nevertheless continue to maintain certain details about you to comply with our legal or regulatory obligations.
9. How to contact us
If you have any questions about this privacy notice, if you would like to change your communications preferences, or in order to exercise any of your legal rights in respect of your personal data, please contact:
- John Roche, Director of Finance and Administration, The Helen Hamlyn Trust, 129 Old Church Street, London, SW3 6EB.
- 07969 811 531
If you are not satisfied with how we are processing your personal data, you can make a complaint to the Information Commissioner.
You can find out more about your rights under applicable data protection legislation from the Information Commissioner’s Office website available at www.ico.org.uk.
This privacy notice was last updated in May 2018.