Heart of England Forest Privacy Policy statement 

The Heart of England Forest is committed to protecting and respecting your data and its security.  

We value our supporters, without whom we could not carry out our vital work establishing a huge new Forest for the environment, people, and wildlife. It is important to us that we are transparent and open with you. This Privacy Policy provides you with information on how and why we use your personal data to help make sure you are confident about trusting us with your information.   

We will take great care of your personal data and promise to:

  • Be accountable for how and why we use your personal information
  • Be transparent about what information we hold about you
  • Never sell your data to third parties

We regularly review our policies, updating them to reflect changes in data protection law as well as our own data processing activities. If necessary, we may need to amend this statement in the future. Where that is the case, we will make reasonable efforts to contact you with updates. 

Heart of England Forest Privacy Policy

1. Introduction

At the Heart of England Forest ("we", "us", "our") our supporters are very important to us and we recognise that it is important for you to understand how we use your personal data. Therefore, please read the following information carefully as it contains important information regarding our website (this/our “Site”) and the way in which we use your personal data. 

This Privacy Policy explains how we use personal data about visitors to our website (“Site”), our kind supporters that make donations to us, who sign up to be a 'Friend of the Forest', who sign up to receive communications from us or who volunteer their time to support our charitable aims. 

The privacy policy applies to you if you are a supporter of the Heart of England Forest (whether that is as a Friend of the Forest, donor, volunteer, supplier, tenant, customer or employee) or use any of our services, visit our website, use our mobile app, email, call or write to us. 

We will only use personal data in ways that are described in this policy and only ways that are consistent with our obligations and your rights under applicable data protection laws. 
In particular, we want you to know that we NEVER sell, rent or trade email lists with other organisations – that is not how we treat our valued supporters. 
 

2. Who we are

The Heart of England Forest is an exciting and ambitious charity. We want to help reverse centuries of woodland decline and are planting the largest new native broadleaf forest in England. Our goal is to create a huge, unbroken woodland – a refuge from the modern world where people can rediscover nature and wildlife can flourish. It is an ambitious vision, and with your help we are determined to make happen, one tree at a time
For the purpose of applicable data protection laws, the data controller (in other words, the organisation that determines how and for what purposes your personal data is used) will be Heart of England Forest.  
If you would like to contact us about our processing of your personal data, you can do so at privacy@heartofenglandforest.org.
 

3. Personal data we may collect from you and how we collect it

Personal data you provide to us directly

Ways in which you might provide the data to us

This is personal data about you that you give us, which can happen in a wide variety of ways, including by: 

  • enquiring about our organisation and its work; 
  • subscribing to hear about us and our work;
  • making a donation to us (either as a standalone or regular donation or when making a donation for a tree dedication (e.g. dedicate a tree, tag a tree, plant a tree));
  • signing up as a 'Friend of the Forest';
  • completing a Gift Aid declaration so that we can benefit from Gift Aid on your donation;
  • signing up to receive information about volunteering opportunities and by kindly volunteering your time to support our charitable aims;
  • signing up to one of our events;
  • engaging with us about our corporate support opportunities and becoming a corporate supporter;
  • fundraising for us;
  • leaving a legacy to the Heart of England Forest;
  • enquiring and / or booking / taking out a licence one of our properties, caravan sites or moorings
  • enquiring and / or reserving / arranging a burial or interment plot
  • completing a survey that we have asked you to complete;
  • applying for a job with us;
  • corresponding with us for any other purposes; or
  • mentioning or interacting with us on social media (for example by mentioning/tagging us or by contacting us directly). 

What type of data might be included?

The personal data you give us may include (depending on your interaction with us) but is not limited to: 

  • your name;
  • postal address;
  • e-mail address;
  • phone number (including mobile number);
  • date of birth;
  • gender (and preferred salutation); 
  • social media handle and personal data on your social media account; 
  • your interests or what motivated you to support us or enquire about us; 
  • your payment information (that will be processed by our third party payment provider on our behalf);
  • donation history; 
  • if you volunteer with us, your health information (if relevant to your volunteering), emergency contact details, your bank details to process any relevant expense claims and your volunteering history; 
  • any information that you provide in a survey that you complete for us;
  • the details of your estate and other intended beneficiaries (if leaving a legacy to us);
  • job title and employer (if you are a corporate contact); and
  • any other information that you give us, including when you get in touch with us or attend one of our events or meetings. 

If you are one of our suppliers we will process your business contact details and your job role. 
We will only ever require you to give us personal data which we need in order to provide you with what you have requested from us. Other information will be optional. 

Job applicants

If you apply for a role with us, we will collect a range of information directly from you either by email, over the phone or via an online job application process/system which may include but is not limited to: 

  • your name;
  • postal address;
  • e-mail address;
  • phone number (including mobile number);
  • gender (and preferred salutation); 
  • date of birth;
  • your health information (if relevant to your application);
  • the contents of your CV (including details of previous roles, any relevant qualifications you have obtained and any languages that you speak);
  • evidence that you are legally permitted to work in the United Kingdom;
  • your current and desired annual salary;
  • your current notice period;
  • whether you have previously been employed by us;
  • the details of the role you are applying for and how you heard about it; 
  • whether you have a full and clean driving licence (where applicable to the role you are applying for);
  • the details of your references;
  • details of any criminal convictions (where applicable to the role you are applying for);
  • any information that you provide to us for Equality and Diversity Monitoring purposes (please note, we will anonymise this data and not attribute it to you); and 
  • any other information that we reasonably require as part of the recruitment process. 

If you are a job applicant and want more detail about how we process your personal data as part of our recruitment process, you can contact us at privacy@heartofenglandforest.org. 

Personal data we collect or generate about you

Visiting our Site and contacting us

When you visit our Site or get in touch with us, we may collect, generate, store and use certain personal data about you. 

This personal data may include: 

  • technical information, including the Internet protocol (IP) address used to connect your computer to the Internet; browser type and version; time zone setting; browser plug-in types and versions; device types; operating system; and time and date of consent and platform; and
  • information about your visit to our Site, including: the full Uniform Resource Locators (URL); clickstream to, through and from our site (including date and time);  products you viewed, searched for or purchased;  page response times; download errors;  length of visits to certain pages;  page interaction information (such as scrolling, clicks, and mouse-overs); and  methods used to browse our Site.

We use cookies to obtain this information when you permit us to do so. Please see section 12 of this Privacy Policy for more information. 

Contacting prospective corporate contacts

We rely on support from our corporate partners to help us deliver diverse, tangible and impactful work. From time to time we may obtain information about potential corporate contacts that we would like to contact about our charitable aims from publicly available sources (such as the website of their employer). We may use this information to contact relevant individuals within potential corporate supporter organisations to provide them with information about Heart of England Forest and the ways in which their organisation can support our charitable aims. 

Please also see section 4 below for more information on how we may generate personal data about you. 

Personal data we receive from other sources 

We may occasionally receive personal data about you from other sources. 

Sometimes other people give it to us. For example: 

  • if someone registers you as a 'Friend of the Forest' (for example if two people become joint 'Friends')
  • if someone gifts a tree in your name, we will process your personal data in order to notify you about the gift. We may also get in touch with you with information about our charity by post.  Please note, we will not use your personal data for any other purpose unless you ask us to; 
  • if you are named as a beneficiary in a will in which we are also named as a beneficiary, we may in some circumstances be made aware of your name and entitlement under the will. 

4. Why and how do we use your personal data and what is our "lawful basis" for doing so?

Whenever we use your personal data, we need to make sure that we have established a valid legal justification (known as a "lawful basis") for that use of data. We have described the ways that we use your data and the associated lawful basis below.  Where we rely on our legitimate interests, we will always make sure that we balance these interests against your rights.

How and why we use your personal data: To carry out our obligations arising from any contractual agreement with you and to provide you with the information and services you request. These may include the provision of an event, managing and processing your donation and providing a gift to someone at your request. 

To measure how satisfied our Site visitors and our supporters are. 

To process payments and maintain accounts and records.

What is our legal justification for processing your personal data: We rely on our contractual arrangements with you as the lawful basis on which we collect and process your personal data in relation to the donations that you make and attendance at our events. Alternatively, in some scenarios, we rely on our legitimate interests as a business (for example, it is in our interests to measure customer satisfaction and troubleshoot customer issues). 

How and why we use your personal data: To send you newsletters, updates and information about the charity that we think might interest you, via email, telephone call or text message, or post. These communications may contain fundraising content providing you with information about the ways that you can support our charitable aims.  

To measure or understand the effectiveness of marketing communications that we send to you.

To carry out market research or similar surveys.

What is our legal justification for processing your personal data: Unless we are contacting you in a business to business capacity, we will only use your personal data to send you email messages if we have consent from you to do so. 

We will not pass your personal data to third parties for their own marketing purposes.

In some cases, we will rely on our legitimate interests to send these types of communications. 

You can amend your preferences or opt out from marketing communications by using the unsubscribe links within our marketing messages, or by contacting us at privacy@heartofenglandforest.org.

How and why we use your personal data: To find out more about the visitors to our Site and our supporter base (including volunteers) as a whole (and not to find out more about you as an individual) to ensure that out communications are most likely to interest our Site visitors and supporters.

We may use cookies to do this. 

What is our legal justification for processing your personal data: We have a legitimate interest to make sure that we are providing you with the information that we think is most relevant to you. 

We will not place cookies other than "strictly necessary" cookies on your device unless you have told us that you are happy for us to do so. For information on how we use cookies, please see section 12 on cookies below. 

How and why we use your personal data: To carry out due diligence on potential donors to ensure that we are able to assess any risks to us in accepting a donation or certain types of donation. 

What is our legal justification for processing your personal data: We are required to carry out due diligence checks for some donations in accordance with our obligations as a registered charity (as determined by the Charities Commissioner and the Fundraising Regulator). 

It is also in our legitimate interests to carry out checks on donors and ensure that no fraudulent activity or potential reputational risk has taken place (or may take place). 

How and why we use your personal data: To carry out potential donor research (which may include wealth screening) to identify individuals who we think might be interested in contributing to our cause.

Please see our section on 'Prospect research and wealth screening' below this table for more information.

What is our legal justification for processing your personal data: We have a legitimate interest to use our charitable resources more efficiently and to identify potential supporters and engage with them to establish if they are interested in supporting our charitable aims. 

We may occasionally seek your consent for this processing if it is necessary in accordance with data protection laws.

How and why we use your personal data: To carry out profiling on and segment our supporter base so that we are able to tailor our communications within our supporter base to ensure that they are more effective.  

Please see our section on 'Profiling and analysing information about our supporters' below this table for more information. 

What is our legal justification for processing your personal data: We have a legitimate interest to engage with our supporters differently as it allows us to be more focused and cost effective with our resources and reduces the risk of someone receiving information they may not want to receive.  

We may occasionally seek your consent for profiling activity if it is necessary in accordance with data protection laws. 

How and why we use your personal data: To get in touch with our 'neighbours' (the owners of land or properties that neighbour the Forest) via post from time to time to update and inform them about the charity that we think might interest them.

These communications may contain fundraising content providing you with information about the ways that you can support our charitable aims.  

What is our legal justification for processing your personal data: We have a legitimate interest to get in touch with our 'neighbours' to let them know what is happening within the charity, in particular areas of Forest close to them. 

Where we process your personal data to do so, we will always provide you with a right to unsubscribe from hearing from us. 

How and why we use your personal data: To contact potential corporate contacts to update and inform them about the charity by email or post. These communications may contain fundraising content providing information about the ways that the contact and/or their organisation can support our charitable aims.  

What is our legal justification for processing your personal data: We have a legitimate interest to engage with potential corporate contacts to see if they are interested in supporting us. 

How and why we use your personal data: To contact you regarding volunteering opportunities and to engage with you when you have become an active volunteer.

We will add your contact details to our CRM system (Contact Relationship Management System/supporter database).

What is our legal justification for processing your personal data: We rely on your consent to contact you. You can amend your preferences or opt out from receiving volunteering opportunities by using the unsubscribe links within our volunteering messages, or by contacting us at privacy@heartofenglandforest.org

We have a legitimate interest to process the personal data of our volunteers in our CRM system and understand how our volunteers interact with us as an organisation. 

How and why we use your personal data: For administrative or business purposes, where you contact us for a particular reason other than those set out above, such as to report problems with our Site.

What is our legal justification for processing your personal data: We have a legitimate interest to respond to your contact for the purposes of administering our business.

How and why we use your personal data: If you attend one of our in-person events and we take your photograph, we may use your image in our marketing materials.  

What is our legal justification for processing your personal data: We would always obtain your consent for this use of your data. Where we take photographs of groups at these events, we may rely on our legitimate business interest of using the images for marketing and promotional materials to promote our organisation. We will make sure that it is clear at the event group photographs will be taken and images used in this way, and we will give you the opportunity to avoid having your photograph taken.

How and why we use your personal data: To prevent or detect crime, fraud or abuses of our products and services or our Site and to enable third parties to carry out related technical, logistical, research or other functions on our behalf related to these purposes.

What is our legal justification for processing your personal data: In some circumstances we will use your personal data because it is necessary for us to comply with a legal obligation (for example, if we receive a legitimate request from a law enforcement agency). 
In other cases (such as the detection of theft, fraud or ensuring security of our Site) we will rely on our legitimate interests in keeping our employees and our Site secure and to prevent theft and fraud

How and why we use your personal data: If you are a job applicant, we will use your personal data to assess your suitability for the role and to make recruitment decisions.  Unless you ask us not to, we will continue to process the application data (including CVs and any interview notes) of unsuccessful applicants for a period of 6 months.

What is our legal justification for processing your personal data: We have a legitimate interest in recruiting talent into our business and assessing candidates to ensure that we are making fair and appropriate recruitment decisions.  
We may process some of your data on the basis of a legal obligation that applies to us as an employer (e.g. in some territories, this may require us to process data relating to race, religion, gender or disability/health). 

How and why we use your personal data: We use CCTV in our premises, for the safety of and prevention of any crimes committed against our employees and volunteers, our equipment and our property, not for other monitoring purposes.

What is our legal justification for processing your personal data: We have a legitimate interest to ensure the safety of and prevention of any crimes committed against our employees and volunteers, our equipment and our property.

In some circumstances we will use your personal data because it is necessary for us to comply with a legal obligation (for example, in the event of any criminal investigations, we may be required by law, to share the data captured with the relevant authorities.)

Profiling and analysing information about our supporters

In order to tailor how we engage with our supporters, we may analyse personal information that you give us and that we collect about you including the level of support that you have provided us with previously, demographic information, your interests and your reasons for engaging with us. 

We may use the information that you provide us and match it with data that we have obtained from external sources to better understand our supporter base and tailor our communications to you or others like you. 

We may also segment our supporter base into different groups based on what we know about them to ensure that our communications are sent to those that are most likely to respond and engage with us. For example, we may invite our highest donors to a special event to thank them for their continued support.  Once we have carried out this segmentation, we will either only contact you in the ways that you have asked us to, or where we are entitled to do so in accordance with data protection laws (e.g. by post). We do not target specific individuals in this way, but we target groups of individuals that may share the same characteristics. 

You are in control of how we process your personal data so if you don't want us to do this, you can opt-out at any time by contacting us at privacy@heartofenglandforest.org.

Prospect research and wealth screening

We use the information that we know about our supporters and publicly available information to help us identify our current supporters who we could engage more with our work to become significant philanthropists to our charity and other people who may be interested in supporting us. This allows us to become more focused and cost effective with our charitable resources and use them more efficiently. 

For example, we may use information that is available from public sources (such as Companies House and other company formation databases, organisation websites, the press and information you have made publicly available via social media) to assess your inclination to receive communications about how you can support us. 

We may also use other publicly available information (such as your postcode or information relating to you online such as LinkedIn and Just Giving) to identify your perceived propensity to make a donation, which when combined with other information that we have obtained about you may impact on how we communicate with you (or whether we wish to communicate with you at all). This helps us identify people who have not previously engaged with us in the past but who we believe may have a connection to our cause and have the capacity to give at a high level. This may lead to us contacting you by post, or to contact you by email where we are able to do so in accordance with data protection law. 
We may engage a third party wealth screening or insight company to provide us with general information about individuals. 

You are in control of how we process your personal data so if you don't want us to do this, you can opt-out at any time by contacting us at privacy@heartofenglandforest.org.

5. What if you fail to provide personal data?

Please make sure you provide us with certain information when requested as if you don't we may not be able to do what you have asked us to (such as, to send a gift of a tree donation to someone). In this case, we may have to cancel your gift but we will notify you if this is the case at the time.

6. Change of purpose

We will only use your personal data for the purposes for which we collected it. If we need to use your personal data for a purpose other than that for which it was collected, we will provide you, prior to that further processing, with information about the new purpose, we will explain our legal justification for doing so and we will provide you with any relevant further information. We may also issue a new privacy notice to you.

7. How we share your personal data

Third party suppliers and service providers involved in our relationship with you

We work with third party suppliers and service providers as part of the day to day operations of our organisation. Some of these trusted suppliers will process your personal data on our behalf and provide services to us such as website hosting, helping us put on events, carrying out wealth screening/insight services and taking payments on our behalf. 

We will always make sure that we require them to meet agreed standards for the protection of your personal data and they will only ever be allowed to use your personal data in order to provide us with services and not for their own commercial purposes. We require all third parties to take appropriate technical and organisational security measures to protect your personal information and to treat it subject to a duty of confidentiality and in accordance with applicable data protection law. 

Other scenarios in which we might share your personal data

  • with government authorities or professional bodies, such as HM Revenue & Customs in the United Kingdom (for tax purposes) or regulatory bodies such as the Charities Commission or Fundraising Regulator.
  • with our professional advisors including tax, legal or other corporate advisors who provide professional services to us.
  • with regulators, law enforcement or fraud prevention agencies, as well as our legal advisers, courts, the police and any other authorised law enforcement bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory or legal matters etc.
  • in the event that we consider selling or buying any business or assets we will disclose your personal data to any prospective sellers or buyers of such business or assets.
  • in the event of any insolvency situation (e.g. administration or liquidation).
  • if we, or substantially all of our assets, are acquired by a third party, in which case your personal data will be one of the transferred assets.
  • in order to enforce or apply website terms of use or other terms and conditions in place between us.
  • to protect the rights, property or safety of our employees, workers, volunteers, supporters or others. This includes exchanging your personal data with other companies and organisations (including without limitation the local police or other local law enforcement agencies) for the purposes of our employee, worker, volunteer and supporter safety, crime prevention, fraud protection and credit risk reduction.
  • if we are under a duty to disclose or share your personal data in order to comply with any legal obligation or regulatory requirements, or otherwise for the prevention or detection of fraud or crime.

8. How do we protect your personal data?

We take the security of your personal data very seriously and have put in place physical, technical, operational and administrative strategies, controls and measures to help protect your personal data from unauthorised access, use or disclosure as required by law and in accordance with accepted good industry practice. We will always keep these under review to make sure that the measures we have implemented remain appropriate. 

Unfortunately (and as you will probably already know) the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our Site; any transmission is at your own risk. 

9. How long do we keep your personal data?

We will retain your personal data for as long as we need it in connection with our relationship with you. This retention period may depend on whether you are visiting our Site or making a regular donation and on whether we need to retain your personal data in order to comply with applicable laws.

Personal data which we no longer need to be retained will be securely and effectively destroyed or permanently erased from our IT systems and we will also require third parties to destroy or erase such personal data where applicable.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you. In this case, we may retain such information for a longer period without further notice to you.

10. Your rights in relation to your personal data

You have a number of rights in relation to your personal data as set out below. 

If you would like to exercise any of those rights (or if you have any queries about this policy or the way that we use your data), please contact us at privacy@heartofenglandforest.org.

Right: Information 

Description of right: A right to be informed about how your personal data will be processed. This enables you to receive information about how we use your personal data. We have set this information out in this Privacy Policy.

Right: Access 

Description of right: A right to access personal data held by us about you. 

Right: Rectification

Description of right: A right to require us to rectify any inaccurate personal data held by us about you.

Right: Erasure

Description of right: A right to require us to erase personal data held by us about you. This right will only apply where (for example): we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with your right to object, below). 

Right: Restriction

Description of right: In certain circumstances, a right to restrict our processing of personal data held by us about you. This right will only apply where (for example): you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but you require the data for the purposes of dealing with legal claims.

Right: Portability

Description of right: In certain circumstances, a right to receive personal data, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to require us to transfer this personal data to another organisation, at your request.

Right: Objection

Description of right: A right to object to our processing of personal data held by us about you where the processing of such data is necessary for the purposes of our legitimate interests, unless we are able to demonstrate, on balance, legitimate grounds for continuing to process personal data which override your rights or which are for the establishment, exercise or defence of legal claims.

Right: Not to be subject to automated processing

Description of right: A right for you not to be subject to a decision based solely on an automated process, including profiling, which produces legal effects concerning you or similarly significantly affect you

Right: Withdrawal of consent and objection to marketing

Description of right: A right to withdraw your consent, where we are relying on it to use your personal data (for example, to provide you with marketing information about our services or products).  You can object to direct marketing at any time. 

It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if your personal data changes so that our records can be updated. We cannot be held responsible for any errors in your personal data in this regard unless you have notified us of the relevant change. 

11. Where your personal data may be processed

We may transfer your personal data outside of the UK and the European Economic Area ("EEA") where local laws may not provide legal protection for personal data in the same way as is applicable in the UK or the EEA. Similarly, some of our trusted third-party suppliers may transfer data outside of the UK/EEA and wherever this is the case, we will implement appropriate safeguards to protect your personal data.  

Whenever we send (or permit a third party to send) your personal data outside of the UK and the EEA, we will make sure that we take steps necessary to protect your data as required by applicable laws. For example, we may require the overseas recipient to enter into particular contract terms.

12. Cookies 

Our Site uses cookies to distinguish you from other users of our Site. This helps us to provide you with a good experience when you browse our Site and allows us to improve our Site and our services.
For information on how we use cookies, please see our cookie policy.

13. Third-party websites

Our Site may, from time to time, contain links to and from other websites (for example, to our events partner). If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

14. Changes to this Privacy Policy

We keep this Privacy Policy under regular review, and we will place any updates here on this page. This Privacy Policy was last updated on 05 May 2022.

15. Complaints 

We encourage you to contact us first if you have any queries, comments or concerns about the way we handle your data (our details are in the section immediately below). We will always try to answer your questions, reply to your comments and address your concerns. 

However, if you are not satisfied with our handling of any request by you in relation to your rights or concerns, you also have the right to make a complaint to the UK's Information Commissioner's Office ("ICO"). You can contact the ICO at: First Contact Team, Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF; 0303 123 1113;  or https://ico.org.uk/.

16. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at privacy@heartofenglandforest.org.

For general enquiries about the Heart of England Forest, please contact us at info@heartofenglandforest.org.  

The Heart of England Forest is a charity registered by the Charity Commission for England and Wales (no. 1097110) and a company limited by guarantee registered in England and Wales (no. 04309564) whose registered office is Colletts Farm Office, Dorsington, Stratford-upon-Avon, CV37 8AU.
 

This policy was last updated on 6th May 2022.