Privacy Policy (Website Privacy Notice)
1. Who we are
Communities for Nature (“CfN”, “we”, “us”, “our”) is a Charitable Incorporated Organisation registered with the Charity Commission for England and Wales (charity no. 1204810). We are the data controller for the personal data described in this notice.
- Website: www.communitiesfornature.org
- Email: info@communitiesfornature.org
Questions about this notice or your data can be sent to our Data Protection Lead at info@communitiesfornature.org. Our registered address is available on the public Charity Commission register (charity no. 1204810).
2. What this notice covers
It explains what personal data we collect, why, our lawful basis, who we share it with, how long we keep it, and your rights. It applies to visitors to our website, supporters and donors, people who contact us, volunteers and trustees, and applicants for or recipients of our grants and programmes.
3. Information we collect
Depending on how you interact with us, we may collect:
- Contact details — name, email, postal address, phone number.
- Correspondence — messages you send us and our replies.
- Donation and Gift Aid details — amount and date and, for Gift Aid, confirmation of your taxpayer status and home address. Card payments are handled by our payment provider — we do not store full card numbers.
- Grant, programme and due-diligence information — where you apply for or receive a grant or take part in a programme (such as the Green Spark Fund), or make a larger donation: information about you, your organisation and project, and the checks required by our Know Your Donor (POL-15) and Due Diligence (POL-18) policies (which may include identity, source-of-funds and background information).
- Volunteer and trustee information — the information needed to work with us.
- Media and stories — photographs, video, case studies or testimonials, with appropriate permissions (see section 6).
- Website/technical data — limited data from essential and, with your consent, analytics cookies (see our Cookie Policy, POL-27).
We collect most data directly from you. Some due-diligence information comes from public sources (e.g. the Charity Commission or Companies House registers, sanctions lists) where we are required to run checks. We do not routinely collect special category or criminal-offence data, and only do so where a specific lawful condition applies and with extra care.
4. How we use your data and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Respond to enquiries and correspondence | To help you and run the charity | Legitimate interests |
| Process donations and claim Gift Aid | To receive and account for donations | Legal obligation; contract |
| Assess and administer grants/programmes; carry out due diligence | To deliver our purposes and meet regulatory and safeguarding duties | Legitimate interests; legal obligation; contract |
| Manage volunteers and trustees | To run the charity | Contract; legitimate interests |
| Send updates and fundraising messages | To keep supporters informed | Consent (email/text); legitimate interests (post) |
| Tell the story of our work and show its impact | To further our charitable aims | Legitimate interests; consent (identifiable individuals) |
| Keep proper records, accounts and security | To run the charity lawfully and safely | Legal obligation; legitimate interests |
Where we rely on consent you can withdraw it at any time (section 10). Where we use special category data we apply an appropriate additional condition.
5. Grants and programmes
If you apply for funding or take part in a CfN programme (such as the Green Spark Fund), we use your information to assess applications, carry out proportionate due diligence, administer and monitor funding, and evaluate impact. Where necessary we may share information with trustees, our Grants/Management Committee, advisers, programme partners or funders involved in running or evaluating a programme — only where there is a proper reason to do so.
6. Children, photographs and storytelling
Some of the work we support involves children and young people, and images and stories are important in showing the impact of conservation and community work. We take privacy and safeguarding seriously (see our Safeguarding Policy, POL-10, and Social Media Policy, POL-12). Where we or our partners collect or use personal information about children, or photographs, video or personal stories of identifiable people, we follow appropriate safeguarding procedures and permissions and rely on consent or another lawful basis. We do not knowingly use children’s data for marketing without a lawful basis and, where required, parental or guardian consent, and we aim to portray the people and communities we work with respectfully.
7. Cookies
Our website uses a small number of cookies. Strictly necessary cookies make the site work; any non-essential cookies (such as analytics) are only set with your consent. See our Cookie Policy (POL-27).
8. Who we share your data with
We do not sell your personal data. We share it only where necessary, for example with: service providers who process data on our behalf under contract (e.g. our payment processor, email/mailing tools, IT and hosting providers); HMRC for Gift Aid; programme partners, advisers or funders where appropriate; and regulators, auditors, or the police where required or permitted by law (e.g. the Charity Commission, ICO, or for serious-incident or financial-crime obligations).
9. Sending data outside the UK
We work internationally (including Indonesia, Kenya, Nepal, the Philippines and Zimbabwe). Where personal data is transferred outside the UK we make sure an appropriate safeguard is in place (such as UK adequacy regulations or standard contractual clauses) and transfer only the minimum needed.
10. Your rights
You have the right to: be informed (this notice); access your data; ask us to correct, erase, restrict or object to our use of it; ask for data portability; withdraw consent where we rely on it; and opt out of marketing at any time. To exercise a right, contact us (section 1) — we normally respond within one month, usually free of charge. Some rights have legal exceptions.
11. Marketing
We only send marketing (e.g. newsletters or fundraising emails) where you have asked us to or are otherwise permitted. Every message has an easy opt-out, and we honour the Fundraising Preference Service, in line with the Code of Fundraising Practice.
12. Keeping your data secure and how long we keep it
We use appropriate technical and organisational measures — access on a need-to-know basis, strong passwords and (where available) multi-factor authentication, and secure disposal (see POL-20). No internet system can be guaranteed fully secure. We keep personal data only as long as needed for the purpose or as the law requires (e.g. Gift Aid and financial records; due-diligence records for a reasonable period), then securely delete or anonymise it. Our retention schedule (supporting POL-20) has the detail.
13. Other websites
Our site may link to partners’, funders’ or other third-party sites. We are not responsible for their content or privacy practices — please review their own privacy information.
14. Changes to this notice
We may update this notice from time to time. The current version is always on our website, and the “Last reviewed” date above shows when it last changed.
15. How to contact us or complain
Contact us using the details in section 1. You also have the right to complain to the Information Commissioner’s Office (ICO) — ico.org.uk · 0303 123 1113 — though we would ask you to contact us first so we can try to help.
16. Review
Reviewed by the trustees at least annually, or sooner on a material change of activities or the law. Every review is recorded in the Review history table above and in the master POLICY-REGISTER.md.
Related policies and references
- Data Protection Policy (POL-20); Cookie Policy (POL-27); Website Terms of Use (POL-26); Know Your Donor (POL-15); Due Diligence (POL-18); Volunteer Management (POL-19); Safeguarding (POL-10); Social Media (POL-12).
- UK GDPR (Articles 13–14); Data Protection Act 2018; PECR; ICO — Guide to the UK GDPR, Right to be informed.