GENESIS TRUST BATH 

About this privacy notice 

Genesis Trust Bath (the “Charity”) is committed to protecting and respecting the privacy of our donors and supporters. This privacy notice sets out why we collect personal data, how we collect and use it and who it is shared with. It also explains the legal basis for the use of your personal data and the legal rights you have over the way it is used. 

Who we are and how to contact us 

For the purposes of the UK General Data Protection Regulation (the UK GDPR) and the Data Protection Act (DPA) 2018, the Charity is the controller of your personal data. This means that the Charity determines the why and how we process your personal data. We are registered as a controller with the Information Commissioner’s Office (registration number: Z3294350). 

Our contact details are as follows: 

Address: 10a Church Farm Business Park, Corston, Bath, BA2 9AP 

Telephone number: 01225 463549 

Email: office@genesistrust.org.uk  

What types of personal data we process 

The type and amount of personal data we process depends on the purposes for which we will need to use it, and may include:  

• Basic identifiers, including your name, prefix, contact details (such as your email address, telephone number, address). 
• Date of birth, to confirm you are over the age of 18. 
• Donation history: Information regarding past and present donations, including the amount, purpose, date and any conditions of your donation. 
• Financial data necessary for us to process donations (including those by debit or credit card). These are always processed securely by our trusted providers (such as Enthuse) for online payment services. 
• Personal data contained in any correspondence between us. 
• Photos and videos, for example if you attend one of our events. We will always make sure you are aware if we plan to film an event you are attending. 
• Other personal data that you choose to share with us when making a donation (for example, details of your place of work, position and your reasons for supporting our work). 

Certain types of personal data are considered by data protection law to be more sensitive than others. This includes “special category personal data” (information relating to your health, racial or ethnic origin, details of sexual life, sexual orientation, religious beliefs, political opinions or any genetic or biometric data that is used to identify you) and “criminal offences and conviction data”.  

Given the nature of our work, the Charity may process special category data about you, including: 

• As a Christian charity, the Charity works with local churches and so we may process information about your religious affiliation (such as which church you attend, if relevant).  
• If you attend an event, we may ask you for any dietary restrictions or access needs, which may involve processing personal data relating to your health, religious or philosophical beliefs.  

We do not routinely collect and process information about criminal offences and convictions.  

How we collect your personal data 

We collect your personal data in the following ways: 

• Information you give us directly: you may provide your personal data when you interact with us in any of the scenarios outlined above, for example when you: 
• Make a donation; 
• Sign up to receive news about our activities; 
• Enquire about our activities or services including via our website, email, telephone, SMS, social media or post; or 
• Communicate with us and provide us with information. 

When we collect personal data directly from you, we will make it clear whether you are required by law or under a contract to provide your personal data and what will happen if you do not provide that data. 

• Information collected when you use our website: when you use our website, some information about you may be recorded and temporarily stored (please see our Cookies Policy for more details). 
• Information shared by third party organisations: we may receive information about you from third party partners with whom you interest, for example websites such as Enthuse when you donate. This may include information such as your name, contact information, and whether you are a tax payer so we can claim gift aid. 

How we use your personal data 

We will use your personal data for various purposes consistent with the legal basis we rely on. These purposes include:

• Processing and administering donations you make, including processing for gift aid purposes; 
• Communicating with you, for example to acknowledge receipt of your donation or to provide additional information you may have requested; 
• Organising activities you have told us you wish to be involved in; 
• Sending you communications that may be of interest, including marketing information about our services and activities, campaigns and appeals asking for donations and other fundraising activities and promotions for which we seek support; 
• Seeking your views on our services or activities so that we can make improvements; 
• Maintaining our organisational records and ensuring they are accurate, up to date and we know how you prefer to be contacted; 
• Carrying out analysis of our donor database, including reviewing historical donations in order to find new donors or to increase engagement of existing donors with the Charity. For example, this may include inviting prospective donors to events, or contacting past donors about new opportunities for donation where they have expressed an interest in our work. 
• Inviting or encouraging you to take part in volunteering activities, where you have expressed an interest in this. 

Failure to provide personal data 

When we collect personal information, we will make it clear whether you are required by law, or under a contract, to provide your personal data and what will happen if you do not provide that data. 

Our legal basis for processing personal data 

Data protection law requires us to have a legal basis for processing your personal data. Depending on the purposes for which we use your data, we may rely on one of the following legal bases: 

• Consent: here you have provided your consent for us to use your personal data. For example, if you sign up to receive marketing communications from us. You may withdraw consent at any time by emailing us at office@genesistrust.org.uk. This will not affect the lawfulness of processing of your information prior to your withdrawal of consent being received and actioned. 
• Performance of a contract: It may be necessary for us to use your personal data to carry out our obligations under a contract entered into with you or to take steps you ask us to take prior to entering into a contract. This is what we rely on when carrying out administrative activities relating to your donation (such as processing your donation, issuing receipts, or arranging collection). 
• Legal obligations: It may be necessary for us to use your personal data to comply with our legal obligations. For example, we are legally required to retain transaction details for gift aid or accounting/tax purposes. 
• Legitimate interests: It may be necessary for us to use your personal data for the purposes of “legitimate interests” pursued by the Charity or a third party (as long as those legitimate interests are not overridden by your rights and freedoms). Examples include: 
• providing individual thank you letters to donors; 
• planning future fundraising campaigns by looking at information about past donors, such as location, levels of giving or interests; 
• inviting existing donors to increase their engagement with the Charity; 
• researching and reaching out to prospective new donors. 

Special category data 

We will only process special category data where we have also identified an appropriate condition for doing so in accordance with Article 9 of the UK GDPR. When we process special category data, we only do so where you have provided your explicit consent (such consent may be withdrawn at any time by emailing office@genesistrust.org.uk). 

Who has access to your personal data? 

We will not share your personal data with third parties without your consent unless the law allows us to. We may disclose your personal data to the following third parties, to enable us to provide our services, fulfil our charitable objectives or comply with our legal obligations: 

• Service providers we use in connection with the management of our donor database, and our internal accounting and compliance systems; 
• Third parties to whom we are required to do disclose personal data under a legal obligation (for example for the purposes of fraud prevention or tax compliance); 
• We may also need to disclose personal data to other third parties that provide services for us, for example event providers, our legal advisors, or accountants. We select all our service providers with care and only share with them the minimum amount of data required to provide their service. Where appropriate, we put appropriate agreements in place that require third parties to comply with data protection laws and protect your personal data with the same care as we do. 

Transfers of personal data to other countries  

For financial or technical reasons, we may need to transfer your personal data to countries outside the UK, which are subject to different data protection laws. We may do this where for example, we use suppliers in a third country or data is stored on servers outside the UK. We meet the UK GDPR requirements by ensuring that any personal data transferred outside the UK continues to be protected as if it were being held in the UK.  

How long we keep your personal data 

We will only store your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements and, where required for us to assert or defend against legal claims, until the end of the relevant retention period or until the claims in question have been settled. 

When determining how long to store personal data, we consider the amount and nature of the data, the purposes for which it is kept, the sensitivity of the data and the potential risk of harm from unauthorised use or disclosure. We continually review what information we hold and will securely delete or anonymise personal data which is no longer required. For further information about how long we store your personal data, please contact us using the email address above. 

Your rights 

You have the following rights in relation to your personal data: 

• Right to be informed – You have a right to information about how we collect and use your personal data (this is contained within this privacy notice). 
• Right of access to your personal data (commonly known as a “subject access request”) – You can ask us to confirm if we process your personal data, request a copy of your personal data and certain information to check that we are processing your data lawfully. This right always applies but there are some exceptions which mean you may not always be entitled to a copy of all of your personal data that we hold. 
• Right to rectification – You can ask us to correct any information about you if you think it is wrong, or to update or complete information if you think it’s incomplete.
• Right of erasure – You can ask us to erase information about you in some circumstances although there might be reasons why we cannot do this (for example, because of gift aid claims).  
• Right to restrict our processing of your personal data – You can ask us to stop processing your personal data, for example if you want us to establish its accuracy or you’re questioning our legal basis for processing it. This right only applies in certain circumstances.  
• Right to object – You can object to our use of your personal data in certain circumstances. Please note, you always have a right to object to processing of your personal data for direct marketing purposes. 
• Right to data portability – You can ask us to transfer your personal data to you or to another organisation free of charge and in a structured, commonly used format which is openly accessible to software (such as a CSV file). This right only applies where we hold your personal data to fulfil a contract or because we have gained your consent.  

Some of these rights do not apply in all circumstances and we may be able to refuse or partially refuse requests in certain circumstances such as where a legal exemption applies. In most cases we have one month to respond to you. Occasionally, we may need to verify your identity before we are able to process a request. 

Automated decision-making and profiling  

Automated decision-making is when a computer or similar electronic system uses personal data to make decisions about people without any human involvement. Profiling involves collecting various pieces of information about a person in order to analyse or evaluate certain aspects relating to that person or to make predictions about them (for example, how that person may behave or what their preferences are). Automated decision-making does not have to involve profiling, though it often will.  

We do not use your personal data in automated decision-making, including profiling (i.e. we do not make decisions about you by way of automated means without human involvement). 

Your right to complain 

You also have the right to make a complaint to the Information Commissioner’s Office (ICO) if you are not happy with the way we are processing your personal data or have processed your request. Details of how to do this can be found at https://ico.org.uk/make-a-complaint/. In the first instance, please contact us to discuss your concerns and we will make every effort to resolve any issues. 

Changes to this privacy notice  

This Privacy Notice was published on 2nd February 2024. We will update and change this Privacy Notice from time to time to keep it up to date and accurate. We will always publish the most up to date version on our website. If we make a substantial change that affects your rights, we will notify you of the change, usually by email.