Privacy and Data Protection Statement
About the Trust
The Holywood Trust (the Trust) is a charity registered in Scotland – registration number SC009942.
Contact information: The Holywood Trust
Crichton Business Park
Telephone – 01 387 269 176
E-mail – holywood-trust.org.uk
What information is processed
When an eligible organisation makes an application to the Holywood Trust the names and addresses of management committee, directors or similar and the name, address, telephone number and e-mail of the person assigned the task of preparing the application to the Trust are required. This is “personal information” in the context of data protection law.
In addition the application form requests the name, address, telephone number and e-mail address for two referees and the capacity in which they provide a reference.
The information provided for both members of the organisation and the referees will, in many instances, be within the public domain (e.g. name, address and telephone number in a telephone directory or on a website). Information in the public domain is not covered by data protection law, however the Trust will treat all personal information provided as if this is not the case.
All such personal information will be processed by the Trust, along with all other information provided within the application and any supplementary material, for the purpose of considering an application for grant funding, making grant payments if an application has been approved, monitoring the progress of a funded project, for research and monitoring of Trust funded projects generally and meeting the requirements in law for the Trust to account for its charitable activities. For the duration of the funding and for up to 3 years afterwards, the Trust may also use personal details to invite those associated with the organisation to events such as social functions or organisation development opportunities.
The Trust’s lawful bases for processing this information
Data protection legislation requires that the Trust identifies lawful bases for this processing of personal information; the lawful bases are the Trusts Legitimate Interests and Legal Obligations; invitations to social functions will be by “Consent” (data protection law provides for consent to be withdrawn but there are only limited grounds for objecting to the use of the information for other purposes).
How the information will be processed
The information will be processed in both paper and electronic formats within the Trusts offices and in other locations including cloud-based storage. “Other locations” may include locations outwith the European Union where appropriate safeguards are in place (currently Dropbox, which is based in the USA, is used to share application information with Trustees of the Holywood Trust).
The Trust is a “data controller” in terms of data protection law; Dropbox along with two other bodies – 8020 IT Ltd (the Trust’s IT support provider) and Farries Kirk and McVean (the Trust’s accountants) are “data processors” for the Trust. All information provided in an application form and any supplementary information provided will be processed by 8020 IT Ltd, the application form and some supplementary information will be processed through Dropbox and limited information – usually information about the organisations rather than the individuals associated with the organisation – is processed by Farries Kirk and McVean.
Sharing of information
General application information, which may include the information provided about individuals, may be shared with:
• other funding bodies, details of which the organisation has provided within the application,
• other bodies identified on the form as beneficiaries of the work or the resources which the Trust has been requested to fund or
• other funding bodies involved with the wider work of the organisation of which the Trust’s funded work or resource is part.
Retention of information
For most applications the complete paper and electronic file will be retained for 7 years after the application was considered for declined applications or the date of the last payment where a grant is agreed; personal data will be removed after this date. The Trust sometimes retains files for longer when supporting large capital projects and this could be up to 25 years; this may include the retention of personal data in some instances. For such capital projects any proposed extended retention period will be made clear in any grant offer letter.
Rights of individuals
Individuals have certain rights in law regarding the data we hold about them:
• The right to be informed (covered by this statement).
• The right to access their data and to know how it is processed.
• The right for the rectification of inaccurate or incomplete data.
• The right to have their information erased (this is not an absolute right as there is some information which the Trust needs to keep for the purposes we have described previously under “Lawful Bases for processing”).
• The rights to restrict the processing of data (see note against erasure).
• The right to data portability – this does not apply in this instance.
• The right to object to processing – we do not foresee any circumstances where this is likely but we will always comply with data protection law.
• There are rights regarding automated decision making and profiling – we do not use such processes.
Please ensure that members of the organisation whose personal details are provide on the application and the referees for the application are made aware of this statement.
For the avoidance of doubt, please note that this statement applies only to personal information provided to the Trust (that is information which will allow an individual person to be identified).
Please do not provide personal details of others such as beneficiaries. Please anonymise any case study provided in support of an application.
If an individual has concerns about the data held by the Holywood Trust about them they should contact the Trust in the first instance. If they are not satisfied with the Trust’s response they may contact the Information Commissioner’s Office (ICO).
The Trust is registered with the ICO – registration number ZA449496.
ICO contact details: The Information Commissioner’s Office – Scotland
45 Melville Street,
Edinburgh EH3 7HL
T: 0303 123 1115