Privacy Policy
Introduction
1.1 Purpose of this notice
This privacy notice explains how Byfleet United Charity (BUC) collects, uses, stores and protects personal data when individuals visit the BUC website, contact BUC through the website, sign up for updates, or otherwise interact with BUC online. BUC is committed to processing personal data lawfully, fairly and transparently and to keeping personal data secure, accurate and up to date.
1.2 Data controller
BUC is the data controller for the personal data processed through this website, except where this notice explains that another organisation is separately responsible for its own processing.
1.3 Contact details
If you have questions about this notice, want to exercise your data protection rights, or wish to raise a data protection complaint, please contact:
Byfleet United Charity
Address: Stoop Court, Leisure Lane, West Byfleet, Surrey KT14 6HF
Email: ku/gro/ytirahcdetinuteelfyb//cub
Telephone: 01932 340532
Data Protection Lead / Officer: Chief Executive Officer
2. Scope of this notice
2.1 Who this notice applies to
This notice applies to people who visit the BUC website, submit enquiries, complete online forms, subscribe to newsletters or updates, make donations online where applicable, or otherwise provide personal data through the website.
2.2 What this notice does not cover
This notice does not apply to BUC’s processing of personal data relating to employees, trustees and workers, which is covered by a separate workforce privacy notice. It also does not apply to third-party websites linked from the BUC website, which will have their own privacy information and practices.
3. The personal data BUC collects
3.1 Information provided directly by users
Depending on how an individual uses the website, BUC may collect personal data such as name, job title, organisation name, postal address, email address, telephone number, postcode, and the contents of any message, enquiry or form submission. If BUC offers newsletters, events, donations or surveys online, it may also collect communication preferences and any other information the individual chooses to provide.
3.2 Technical and usage information
BUC may also collect technical information about the use of the website, including IP address, browser type and version, device type, operating system, referral source, pages viewed, date and time of access, time spent on pages, and general website navigation data. This information helps BUC maintain website security, understand how the website is used, and improve the website and its services.
3.3 Cookies and similar technologies
The website may use cookies and similar technologies to operate effectively and, where appropriate consent has been given, to remember preferences and produce analytics about website use. Non-essential cookies, including analytics or advertising cookies where used, should not be set unless the user has been given a fair choice and has actively consented.
4. How BUC collects personal data
4.1 Direct collection
BUC collects personal data directly when a user completes a contact form, sends an email, subscribes to updates, responds to a survey, makes a donation through the website if applicable, or otherwise submits information to BUC.
4.2 Automatic collection
Some information is collected automatically through server logs, cookies and website analytics tools when individuals browse the website. This automatic collection should be proportionate, transparent and limited to what is necessary for the relevant purpose.
5. How BUC uses personal data
5.1 Core purposes
BUC may use website personal data to:
(a) respond to enquiries and correspondence;
(b) provide information, services or support requested by the user;
(c) manage website administration, security and troubleshooting;
(d) improve the website, user experience and BUC’s services; and
(e) comply with legal, regulatory and governance obligations.
5.2 Communications and marketing
Where BUC sends newsletters, campaign updates, fundraising messages or other marketing communications, it will only do so where it has an appropriate lawful basis, such as consent where required, and individuals will be given a clear opportunity to opt out of non-essential communications. Personal data collected for one purpose should not be reused for unrelated marketing without a proper lawful basis and clear transparency.
6. Lawful bases for processing
6.1 General lawful bases
Depending on the circumstances, BUC may process website personal data because:
(a) the individual has consented;
(b) the processing is necessary to take steps requested by the individual before entering into an arrangement or to provide a requested service;
(c) the processing is necessary to comply with a legal obligation; or
(d) the processing is necessary for BUC’s legitimate interests, provided those interests are not overridden by the individual’s rights and freedoms.
6.2 Legitimate interests
Where BUC relies on legitimate interests, these may include operating and improving the website, keeping systems secure, responding to enquiries, administering services, preventing misuse, and maintaining appropriate records. BUC should ensure that such processing is proportionate and that individuals are informed clearly about it.
7. Cookies and analytics
7.1 Essential and non-essential cookies
Cookies that are strictly necessary for the website to function may be used without consent where lawful. Analytics, advertising or other non-essential cookies should only be placed after users are given a genuine choice to accept or reject them. Cookie banners must not pressure users into accepting non-essential tracking and must offer fair choices.
7.2 Google Analytics and similar tools
If BUC uses Google Analytics or any similar analytics service, BUC may collect information about how users interact with the website in order to understand website traffic and improve the site. Analytics cookies should be treated as non-essential unless configured in a way that makes them strictly necessary, so they should only be activated after valid consent has been obtained.
7.3 Managing cookie preferences
Users can manage cookies through the cookie banner or preference tool on the website and can also change browser settings to block or delete cookies. Blocking some cookies may affect website functionality, but users should still be given a fair and accessible choice about non-essential cookies.
8. Sharing personal data
8.1 Who BUC may share data with
BUC may share website personal data with trusted service providers who help operate the website or deliver services, such as website hosts, IT support providers, analytics providers, email communication platforms, payment or donation processors, professional advisers, insurers, auditors, regulators, or public authorities where required by law. Where third parties process data on BUC’s behalf, BUC should require them to protect it and use it only in accordance with the law and BUC’s instructions.
8.2 Legal and regulatory disclosures
BUC may also disclose personal data where necessary to comply with legal obligations, respond to lawful requests, protect legal rights, investigate complaints, prevent fraud or misuse, or safeguard people and property.
9. International transfers
9.1 Transfers outside the UK
If any website supplier stores or accesses personal data outside the UK, BUC will ensure that the transfer is made lawfully and that appropriate safeguards are in place, such as adequacy regulations or approved contractual protections.
10. Data security
10.1 Security measures
BUC takes the security of personal data seriously and uses appropriate physical, technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures may include access controls, secure systems, password protection, encryption where appropriate, staff training, and regular review of security arrangements.
11. Retention
11.1 How long data is kept
BUC will keep website personal data only for as long as necessary for the purposes for which it was collected, including to respond to enquiries, administer relationships, manage legal or regulatory issues, and maintain appropriate records. Retention periods may vary depending on the nature of the interaction, the sensitivity of the data, and any legal, accounting or reporting requirements.
12. Individual rights
12.1 Data protection rights
Individuals may have the right to:
(a) be informed about how their personal data is used;
(b) request access to their personal data;
(c) request correction of inaccurate or incomplete data;
(d) request erasure in certain circumstances;
(e) request restriction of processing in certain circumstances;
(f) object to processing where BUC relies on legitimate interests;
(g) request portability where applicable; and
(h) withdraw consent where processing is based on consent.
12.2 Requests and verification
BUC may ask for proof of identity or clarification before responding to a request, where this is reasonable and necessary to protect personal data and confirm entitlement. BUC will respond in line with applicable legal timescales and may carry out reasonable and proportionate searches when handling access requests.
13. Data protection complaints
13.1 Internal complaints route
Anyone who is unhappy with how BUC has handled their personal data, a data subject access request, or another privacy-related matter may raise a data protection complaint directly with BUC using the contact details above. BUC will provide a clear and accessible route for doing so.
13.2 Complaint handling timescales
BUC will acknowledge receipt of a data protection complaint within 30 days, investigate and progress the complaint without undue delay, keep the complainant updated as appropriate, and notify the complainant of the outcome without undue delay once a decision has been reached.
14. Changes to this notice
14.1 Updates
BUC may update this website privacy notice from time to time to reflect changes in law, guidance, technology or BUC’s data processing activities. The current version should be published on the website with a clear effective date.
