This policy explains when and why we collect personal information about you, how we use it, the conditions under which we may disclose it to others, how we keep it safe and secure and your rights and choices in relation to your information.
Separate versions of Privacy Notices are issued to our supported people, staff and board members.
Our Data Protection Officer is provided by RGDP LLP and can be contacted at info@rgdp.co.uk
Who we are and what we do
Carr Gomm is a not-for-profit company and a Scottish Charity which provides services to people with a wide range of reasons for needing our support. Our philosophy of support is based on the fact we are all human beings who naturally have a lot to contribute to each other and wider society.
We are a Company limited by guarantee in Scotland: SC 236436 Scottish charity: SC 033491
Our National and Registered Office is based at Space, 11 Harewood Road, Edinburgh EH16 4NT. All enquiries should be directed to info@carrgomm.org.
Information we collect about you
There are a number of ways we collect your data and these are detailed below. (If you are supported by Carr Gomm, please click here)
Information you give us directly
-
- you may have made an enquiry or information request to our helpline
- you may have subscribed to a publication with Carr Gomm, and thereby given your consent, you will be contacted with relevant information that you have expressed an interest in. If at any time you wish Carr Gomm to stop contacting you, you are able to unsubscribe by emailing info@carrgomm.orgto revoke your subscription or by using the unsubscribe link at the bottom of the email. Your details will also be hosted on our secure Client Relationship Management System database, Donorfy.
- you may have applied for employment or a volunteering opportunity
- you may have made a donation
- you may represent one of our member groups
Information you give us indirectly
- Fundraising sites like Just Giving
- Professional fundraisers
- A Carr Gomm employee or volunteer gives your contact details as an emergency contact or referee
- subcontractors acting on our behalf who provide us with technical, payment or delivery services, our business partners, advertising networks analytics providers and search information providers
Social Media
When you interact with us on social media platforms such as Facebook and Twitter we may obtain information about you (for example, when you publicly tag us in an event photo). The information we receive will depend on the privacy preferences you have set on those types of platforms.
You should check any privacy notice provided to you where you give your data to a third party.
Suppliers, contractors and Business contacts
If you are a supplier, contractor or business contact we may collect your business contact details such as your name, business address and business e-mail and your company’s bank account details. If you are a sole trader this may be your personal details.
We need these details in order to provide our services, run our business and pay/invoice suppliers and contractors.
We will only hold information about you that is relevant to the above, even if you have supplied us with more details.
Carr Gomm will never share your personal information for marketing or any other purposes without your consent, unless where required by law.
If you have:
- applied for a job with us, the information you have provided is shared with our online recruitment partner
- enrolled for fundraising activities with us, the information you have provided is shared with our website host and designers. Your details will also be hosted on our Donorfy database.
- donated via JustGiving your details will be held by them. Their privacy statement is available on their website, alternatively contact info@carrgomm.orgfor more information. If you donate or have previously donated to Carr Gomm via the website, we do not store your bank details on our database. Such information is securely held by the online payment platform provided through Stripe and GoCardless, our service providers, and can only be accessed by trained staff members within the Carr Gomm Business Development Team.
The information that we hold about you for all of the above transactions are only held for that specific purpose and are destroyed as per our retention guidelines, for more information please contact info@carrgomm.org
How and why is your information used?
We may use your information for a number of different purposes, which may include:
- providing you with the services, products or information you asked for
- carrying out our obligations under any contracts entered into between you and us
- keeping a record of your relationship with us
- administering your donation or support your fundraising, including processing Gift Aid
- responding to, or fulfilling any requests, complaints or queries you make to us
- conducting analysis and market research to better understand how we can improve our services, products or information analysing the number and type of people who have used our services to demonstrate our impact and apply for funding monitoring the interactions we have with our customers, donors and beneficiaries for quality control and compliance purposes
- seeking your views or comments on the services we provide
- notifying you of changes to our services
- sending you communications which you have requested and that may be of interest to you. These may include information about campaigns, fundraising appeals and activities and promotions of goods and services
- checking donations for the purposes of prevention of fraud or other crime; and
- processing grant or job applications
How long is your information kept for?
We review our data retention periods regularly and will only hold your personal data for as long as is necessary for the relevant activity, or as required by law / best practice and as detailed in our Data Protection and Confidentiality Policy. The length of time we retain your personal information for is determined by operational and legal considerations, as well as best practice. For example, we are legally required to hold some types of information to fulfil our statutory and regulatory obligations, for example health and safety, and tax and accounting purposes.
Further reasons we may retain personal information include:
- For auditing purposes
- Evidence in defence of a legal claim
- Ensuring you are removed from marketing lists if you prefer never to hear from us in the future
If you would like to know more about how long we hold your personal data for please email us at: info@carrgomm.org
Legal Bases for processing your personal information
Data protection law requires us to rely on one or more lawful grounds to process your personal information. We consider the following grounds to be relevant:
- Consent
Where you have provided specific consent to us using your personal information in a certain way, such as to send you email, text and/or telephone marketing.
- Performance of a contract
Where we are entering into a contract with you or performing our obligations under it, this includes where you apply for support from us.
- Legal Obligation
Where necessary so that we can comply with a legal or regulatory obligation to which we are subject, for example where we are ordered by a court or regulatory authority like the OSCR or Fundraising Regulator.
- Vital Interests
Where it is necessary to protect life or health (for example in the case of medical emergency suffered by an individual) or a safeguarding issue which requires us to share your information with the emergency services
- Legitimate Interests
Where it is reasonably necessary to achieve our or others’ legitimate interests (as long as what the information is used for is fair and does not duly impact your rights), for example: through our use of CCTV.
Special categories of personal data
Special categories of personal data means information about your racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; health; sex life or sexual orientation; criminal convictions, offences or alleged offences; genetic data; or biometric data for the purposes of uniquely identifying you.
The “special categories” of sensitive personal information referred to above require higher levels of protection. We need to meet additional legal requirements for collecting, storing and using this type of personal information.
Your Rights
Under UK data protection law, you have certain rights over the personal information that we hold about you, these are:
- Right to be informed
Covered by this privacy notice
- Right of Access
You have a right to request access to the personal data that we hold about you, you also have the right to request a copy of the information we hold about you, and we will provide you with this unless legal exceptions apply
If you want to access your information, please send a description of the information you would like to see and proof of your identity by post to the address provided below
- Right to rectification
You have the right to have inaccurate or incomplete information we hold about you corrected, there may be instances where it is not appropriate to rectify information, for example, if something was done incorrectly but identified and the correct cause of action taken, the record would show the full picture so would be accurate
- Right to restrict processing
You have a right to ask us to restrict the processing of some or all of your personal information if there is a disagreement about its accuracy, or we’re not lawfully allowed to use it. This is not an absolute right and only applies in certain circumstances, for example, where the processing is unlawful or we no longer need the data for the purpose of the processing
- Right to erasure
You may ask us to delete some or all of your personal information and in certain cases, and subject to certain exceptions; we will do so as far as we are required to. In many cases, we will anonymise that information, rather than delete it. If there is a legal obligation to keep the information then this does not apply, for example, where there is a contractual obligation to keep the information
- Right to data portability
If we are processing your personal information (1) based on your consent, or in order to enter into or carry out a contract with you, and (2) the processing is being done by automated means, you may ask us to provide it to you or another service provider in a machine-readable format. This is unlikely to apply to Carr Gomm
- Right to object
You have the right to object to processing where we using your personal information (1) based on legitimate interests, (2) for direct marketing or (3) for statistical/research purposes.
- Rights in relation to automated decision making and profiling: this is unlikely to apply as Carr Gomm do not carry out automated decision making or profiling
If you want to exercise any of the above rights, please email us at: info@carrgomm.org, write to the Compliance Manager at:
Carr Gomm
Space
11 Harewood Road
Edinburgh
EH16 4NT
or contact us on: 0131 659 4777
We will endeavour to respond fully to all requests within one month of receipt of your request, however if we are unable to do so we will contact you with reasons for the delay.
Please note that exceptions apply to a number of these rights, and not all rights will be applicable in all circumstances. For more details we recommend you consult the guidance published by the UK’s Information Commissioner’s Office
Keeping your information safe
When you give us information, we take steps to make sure that your personal information is kept secure and safe. All information is kept in line with our data protection policies and procedures, which are available on our website.
Transfers outside the UK
Your information will only be processed within the UK, except where international transfers are authorised by law.
Keeping your information up to date
Our information is only as up to date as the information you share with us. Please let us know if your contact details change by emailing info@carrgomm.org
Cookies
The Carr Gomm website uses Google Analytics; a web analytics service provided by Google, Inc. Google Analytics sets a cookie in order to evaluate your use of the web site and compile reports for us on our website activity.
Google stores the information collected by the cookie on servers in the United States. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. By using the web site, you consent to the processing of data about you by Google in the manner and for the purposes set out above. To reject or delete these cookies please visit: http://www.google.com/intl/en/privacypolicy.html
The Carr Gomm website also uses Facebook Pixel. This is a tool provided by Facebook which enables us to create “pixels” that track conversions, add them to the pages of our website where the conversions will happen, and then track these conversions back to ads we are running on Facebook. This conversion tracking helps us measure the return on investment of Facebook Ads by reporting on the actions that people take after viewing those ads.
No personal information is contained in or collected as a result of using these cookies or pixels. To opt out of these marketing pixels and technologies, please visit https://www.facebook.com/ads/preferences
Feedback and complaints
Compliance Manager
Carr Gomm
Space
11 Harewood Road
Edinburgh
EH16 4NT
0131 659 4777
If you have any questions regarding this policy or feedback on how we hold and use your personal information, and this can be sent to info@carrgomm.org
You have the right to make a complaint to the Information Commissioner, the UK regulator for data protection, about how we hold and use your personal information. The Information Commissioner’s website is https://ico.org.uk/ and complaints can be made there.
Our website provider
Your data may also be available to our website provider to enable us and them to deliver their service to us, carry out analysis and research on demographics, interests and behaviour of our users and supporters to help us gain a better understanding of them to enable us to improve our services. This may include connecting data we receive from you on the website to data available from other sources. Your personally identifiable data will only be used where it is necessary for the analysis required, and where your interests for privacy are not deemed to outweigh their legitimate interests in developing new services for us. In the case of this activity the following will apply:
- Your data will be made available to our website provider
- The data that may be available to them include any of the data we collect as described in this privacy policy
- Our website provider will not transfer your data to any other third party, or transfer your data outside of the EEA
- They will store your data for a maximum of 7 years
- This processing does not affect your rights as detailed in this privacy policy
Changes to this policy
Any changes we may make to this policy in the future will be posted on this website so please check this page occasionally to ensure that you’re happy with any changes. If we make any significant changes we’ll make this clear on this website
Review of this Policy
We keep this policy under regular review. This policy was last updated in August 2024
