Cherry Trees Data Privacy Policy

Thank you for taking time to read our Privacy policy. We want to be sure we’re using your data appropriately and in line with your expectations. We feel it’s important that you feel confident we protect the information we hold about you and use it considerately and securely.

We respect and take every step to protect the privacy of all our children, parents, donors, volunteers and supporters and will never sell, or give away your information (name, address, email, etc.) for any fundraising or marketing purposes to any third party unless you agree to us doing so.

If you have given us your contact details, then we will send you communication such as House updates, Cherry News and other communications relating to events or services that you have expressed an interest in. However, if you decide you do not want to receive certain communications or want to opt out altogether, you can do this at any time by calling the Fundraising office on 01483 222507, emailing [email protected], popping in and seeing us or sending a letter to: My data, Cherry Trees, School Lane, East Clandon, Surrey, GU4 7RS

We are respectful of the data privacy laws and comply with the EU General Data Protection Regulation (GDPR). If you are in any way concerned about how your data is used, want to know what data we keep, or wish to make a complaint please email or call us on 01483 222507 or [email protected]  

 

This document covers:

What information we collect

Cherry Trees collects data about you such as the kind of information that can be found on a typical business card: first name, last name, contacts details etc. The individual details may differ depending on your preferences and what data you’ve agreed to share with us. From time to time we may ask you to provide additional personal details, however we will always let you know why we believe this is necessary. If this is for fundraising purposes such as for an event, you have a right to withdraw your consent at any time.

We do require more detailed personal information, including special category data such as health information for children, staff and some volunteers to ensure we are adequately fulfilling our safeguarding duties and are able to provide a high-quality service.

We also collect and store certain information automatically using cookies and similar technologies, including IP addresses, the region or general location of a computer or device accessing the internet, browser type, operating system, page view history, and other useful information. Please see our Cookie Policy for further details.

How we collect it

We collect your personal data when you register to receive any of our regular updates online, by post, or by phone. We will also collect data for any participants of events run by Cherry Trees, or in association with third-party organisers. In this instance, however, we will not share your data with the third party unless you consent to do so.

If a group attends an event run by Cherry Trees we may ask for information about the organiser and guests to ensure the smooth running of the event. We will ensure that, unless specified, we will only use these details specifically for the event.

We will also collect data whenever someone signs up for direct debit or regular giving. We do not keep your bank details, these are securely stored by our trusted partners and will only be used for the purpose it is intended.

There are also opportunities to sign up for information at events and fundraising drives. Personal data will only be taken if freely given, specific, informed and unambiguous and will be transferred to our database with your details, the date of the event and type of consent given.

How do we safeguard your personal data?

Cherry Trees has safeguards in place to optimize our security measures and protect your personal data from loss, misuse, unauthorized use, access, inadvertent disclosure, alteration, and destruction.

We work with Computer Strategies to back up our data on a daily basis and provide us with a secure network to protect the data we hold.

We update and test security on an ongoing basis and restrict access to your personal data to only those who need to know in order to provide Cherry Trees content or services to you.

Storage of your personal data

We store your personal data using Cherry Trees’ own secure on-site servers and we use cloud services for back-up hosted by a contracted third party.  This third party does not use or have access to your personal data, other than for cloud storage and retrieval.

We have contracts with Go Cardless and Stripe for online payments who will securely process your personal data e.g. card details. We also have a contract with Donorfy for our database to ensure we can accurately store your contact preferences and details. Cherry Trees requires such parties to adopt at least the same level of security that we use to protect your personal data.

Paper-based records are securely kept at Cherry Trees with restricted access.

Privacy of our children’s data

Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences, safeguarding concerns and their rights in relation to the processing of personal data. We have a legal obligation to keep children’s data to ensure we can perform our duty of care to each child that visits Cherry Trees and to allow us to offer a high-quality short break service.

Parent/Carers are given the option to consent for Cherry Trees to use photographs or information for case studies to support our fundraising and marketing activities. We will always make sure that each young person is happy for their photo to be taken.  

Parents will be taken through Cherry Trees’ data privacy requirements when introduced to Cherry Trees and during the Application process. If any parent wishes to find out more before their visit, please call the Head of Care on 01483 222506

Online data collection and social media

The www.cherrytrees.org.uk website is the only site that Cherry Trees manages and has ownership of. It is run and maintained on our behalf by Raising IT and data taken on this site will go directly through to our own database, not that of Raising IT. We will ensure our website has controls to prevent the collection or processing of any personal data from children under the age of 13 years without their parental permission; this includes buying through our online shop.

We also have a presence on social network pages. The comments made by individuals on these sites are not managed by Cherry Trees and as such are bound by the privacy policies of each site where we use. These include Twitter, Facebook, Instagram and LinkedIn and their policies can be found by clicking on the site name. If you are not happy with the content that we post which includes pictures, please do contact us with screenshots of the posts so we can address your concerns.

Third-Party Payment Processor

We use two third-party payment processors: Stripe, for single donations and payments and GoCardless for regular giving. Cherry Trees does not store credit card details, instead, we rely on our trusted third party partners for this.

In connection with the processing of such payments, we do not retain any personally identifiable information or any financial information such as credit card numbers. Rather, all such information is provided directly to our third party processor.

What we do with the personal data we collect

We use the personal data that we collect to deliver a service and communicate information we believe you may be interested in based on your preferences and the specific information you have requested. We will also use your data to improve our service and regularly check we hold the appropriate data for the information you want to receive and that your details are correct.

           

To communicate with you

We may use your personal data to send you important notices, such as communications about your registration, transactions, and changes to Cherry Trees terms, conditions, policies, and/or other internal purposes.

            To deliver what you request

We may use your personal data to provide the information, content or services you request. If you enter a competition or similar promotion, we may use your personal data to administer such promotion.

            To improve our service

We may use your personal data for internal auditing, data analysis, and research to improve Cherry Trees services.

            To present events, challenges and functions that may be of interest to you

We may contact you from time to time to offer you additional services that may be of interest to you. You will always have the option to ask us to stop contacting you.

The legal basis for processing your personal data

Cherry Trees processes data for our fundraising, supporter and volunteer communications and in fulfilment of our safeguarding and contractual obligations when children are entrusted to our care.

Cherry Trees uses the personal data that you provide to supply you with information and updates on Cherry Trees activities, children’s events, house updates, news of appeals and fundraising events, challenges and initiatives, volunteer activities and services as you request, to send important notices, and for internal purposes such as auditing, data analysis, and research to provide you with the information you need to be involved as a valued member of our wider Cherry Trees family.

The legal basis for processing your personal data for fundraising/marketing purposes is your consent if you are new to Cherry Trees. We will ask for consent from those we do not have an ongoing relationship with and will ensure permission to use personal data is freely given, specific, informed and unambiguous.

If you have an ongoing relationship with us we may process your personal data if we believe we can demonstrate a legitimate interest in doing so and we do not infringe any of your rights and freedoms. We regularly check whether individuals wish to remain in touch and to update contact details as well as giving opportunity on each communication to opt out of further correspondence, or for personal data to be removed from our database.

When Cherry Trees processes your personal data using legitimate interests as a legal basis, we will consider and balance any potential impact on you and your rights under GDPR and any other relevant law to ensure our legitimate business interests do not override your interests. Cherry Trees will not use your personal data in circumstances where your rights and freedoms override our legitimate interests unless we have your consent or are otherwise required or permitted to by law.

Children’s data will be kept to ensure we fulfil our legal obligations, including safeguarding and for the fulfilment of the contract with relevant county councils, the child’s parents or carers and relevant key contacts, such as social workers, to ensure the wellbeing and safety of the child. This may include health and medical practitioners as well as personal medical details without which we would be unable to meet our safeguarding obligations to the child.

 

We have the right to refuse to meet the wishes of the parent/ carer for a child to spend time at Cherry Trees if we cannot obtain the necessary details in a timely manner from the parent/carer to ensure the wellbeing and safety of their child.

 

Your personal data may be shared when authorised by law or necessary to comply with a valid legal process.

When and how we share your personal data with others

 

Promoting the welfare and protecting the safety of the children that use our services is very important to us. Information that could be relevant to keeping a child safe will be shared so that informed decisions can be made about a child’s welfare. We will share children’s information with children’s services (social workers), health professionals and schools to ensure we adequately safeguard and promote the well-being of the children that stay with us.  

The data you kindly give us for fundraising purposes is for our use only and we will not pass it onto any third party without your express permission.  The only time we involve others in the handling of your personal data is where Cherry Trees has contracted third parties to support our operations including delivery, fulfilment, direct debit, regular giving and payment processing, email deployment, suppression list management and data processing.

How long we keep your personal data

We will keep your personal data for fundraising communications whilst you are actively supporting Cherry Trees; this includes volunteering, attending events or making a donation. During this period, from time to time we will send requests for you to confirm your details and ensure your contact preferences are still accurate. If we have not heard from you after three years since the last contact, we will remove your data from our Fundraising database unless you instruct us otherwise.

The requirements for data retention are different for children, staff, some volunteers, parents and carers. We are obliged to retain children’s data for 75 years, or 15 years after death if this occurs before their 18th birthday. This is standard practice under the Children’s and Families Act, 2014, Childcare Act, 2006, Children’s Act, 2004 and Care Standards Act, 2000. Staff data and volunteers working with children shall be retained for 15 years after their last entry.

Your rights and preferences

If you inform us that you want your personal data erased, or that you no longer wish for us to communicate with you, or to otherwise restrict Cherry Trees processing of your personal data, we may retain some basic information in order to avoid sending you unwanted materials in the future, and to keep a record of your request and our response. Cherry Trees may not need consent for this, as long as we inform individuals the reason why we need the records and the lawful basis for this processing (e.g. legal obligation or legitimate interests).

We reserve the right not to erase your data if we believe it in any way prevents Cherry Trees from meeting its safeguarding or legal obligation towards the children in our care.

What happens if you don’t provide personal data?

We are unable to provide short breaks for families without adequate data about the child and family.

We need personal information in order for us to provide appropriate communication or services that you requested such as for attendance at an event, email newsletters, or direct debit. Therefore, if you do not provide such personal data, we cannot deliver the content or services you have asked for.

How can we help? Getting in touch

            Confirming your personal data, opting out of communication or to restrict the processing of your personal data

To confirm that Cherry Trees is processing your personal data, to access, update or change the personal data we hold about you, your preferences, or to obtain a copy to reuse for your own purposes, please contact our Head of Fundraising on 01483 222507 or email  [email protected]

If your query relates to data we keep on our children or parents, or primary carers, please call the Head of Care on 01483 222506 or email [email protected]

            Erasing your personal data

If you want your personal data erased, please send an email to: [email protected] or call 01483 22507

How you can make a complaint about the way we hold your data

 

Please contact our CEO at Cherry Trees on 01483 22206 or [email protected] if you have a concern about the way Cherry Trees is handling your information, particularly if you believe your data is:

  • not being kept securely
  • continually inaccurate
  • being disclosed to others without your permission
  • being held for longer than is necessary
  • being held for one reason and used for something else

Alternatively, If you would prefer to air your concerns to the Trustee designated to oversee GDPR compliance you may do so by email to [email protected] (please title your email – Data Compliance), or by letter to:

Simon Runton
Data Compliance
Cherry Trees
School Lane
Clandon
GU4 7RS

Feedback

Your feedback is important to us. We’d welcome your ideas, opinions and comments about our dealing with your data. Please email: [email protected]

 

 

Policy reviewed: May 2018
Next review: May 2019