Privacy Policy

Thomas Oken and Nicholas Eyffler Charity Privacy Policy  

 

The Thomas Oken and Nicholas Eyffler Charity (“the Charity”) is committed to protecting your personal information, being transparent about the information we hold about you and ensuring your personal data is only ever used in accordance with your rights and expectations. 

 

The Charity is a Registered charity based in Warwick with charity number 216829.  

 

The Charity decides what personal data we hold, how we hold it and how we use it. This makes us responsible for that data as a “data controller” and requires us to provide you with this privacy policy, outlining why we need your personal data, what we do with it and your rights in relation to it. 

When we refer to: 

• “we”, “us” or “our”, we mean Charity; 
• “personal data”, we mean any information relating to an identified or identifiable living individual; 

• “processing”, we mean collecting, recording, organising, storing, sharing, destroying or anonymising personal data. 

Please read this privacy policy together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and is not intended to override them. 

 

How to contact us and how to complain 

We have appointed a data privacy lead who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the Clerk to the Charity at clerk@thomasoken.org.uk or 34 High Street, Warwick, CV34 4BE or on 01926 478 008. 

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance. 

 

The Data we collect about you 

 

We collect information about you in various ways.  For example, information you give us, when you make a donation to us, make an application to us, or otherwise provide us with personal information in person, over the telephone, through the post or online via email or our website.  

 

Wherever possible we use aggregated or anonymous information which does not identify individuals by name. For example, if we are reviewing, or evaluating a current project that is being funded by the charity, which includes individuals who have been involved in projects but are not directly identified.  

 

We do, at times, need to collect, store and use certain personal information. For example, information you give to us should you apply for one of the properties owned by the Charity such as Castle Hill Alms Houses or Guild Cottages. In such cases personal information such as name, postal address, telephone number, email and financial details may be stored. 

 

Certain categories of personal information are regarded by the law as more sensitive than others. This is known as ‘special category’ or ‘sensitive data’ which covers things like your health information, ethnic origin, or political views. We do not usually collect ‘sensitive personal data’ but we will make it clear to you when and why we need to collect it should we need to. 

 

How we use your personal data 

We only use your personal data when we have a proper reason for doing so. There are various legal bases upon which we may rely, depending on what personal data we process and why. 

The legal bases we rely on most commonly to process your data include: 

• contract: where our use of your personal data is necessary for a contract we have with you, or because you have asked us to take specific steps before entering into a contract; 
• legal obligation: where our use of your personal data is necessary for us to comply with the law; 
• legitimate interests: where our use of your personal data is necessary to pursue our legitimate interests in a way which might reasonably be expected (that is, to pursue our aims of promoting the establishment, continuation and efficiency and effectiveness of almshouses, and to promote the provision, improvement, upkeep and maintenance of almshouses) and in a way which does not materially impact your rights, freedoms or interests. 

In a small number of cases, we may also rely on the following legal bases: 

• vital interests: where our use of your personal data is necessary to protect your or someone else’s life, typically in an emergency; 

• consent: where you have given us clear consent for us to process your personal data for a specific purpose, where another legal basis cannot be used. 

In relation to any “special category” personal data or data concerning criminal convictions and offences, we rely on different reasons to process your personal data. Most commonly these include that the processing is: 

• necessary in the substantial public interest, and further conditions are met; 
• necessary for the establishment, exercise or defence of legal claims; 
• carried out in the course of our legitimate activities and relates solely to our members or former members, and personal data is not disclosed outside of the Charity; 

• carried out with your explicit consent. 

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. 

If you have given your consent for us to process your personal data, you have the right to change your mind at any time and withdraw your consent. 

Who we share your personal data with 

We do not share personal data with anyone unless:  

• we are legally required to do so, for example, by a law enforcement agency or court; 
• we need to enforce or apply any contract we have with you; or 
• if it is necessary to protect our rights, property or safety or to protect the rights, property or safety of others. 

Data security 

We take the security of your personal data seriously. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those who have a business need to know. They will only process your personal data on our instruction, and they are subject to a duty of confidentiality. 

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. 

 

Data Retention 

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. 

Different retention periods apply for different types of personal data. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. 

At the end of the relevant retention period, your personal data will either be deleted completely, put beyond use or anonymised. Some data about members will be kept in perpetuity as a record of our history and heritage. 

Details of retention periods for different types of personal data are available in our retention policy which you can request from us by contacting us. 

 

Your rights 

Under the data protection law you have rights including:  

• Your right of access to copies of your personal information; 
• You have the right to ask us to rectify personal information you think is inaccurate, and to complete information you think is incomplete; 
• You have the right to ask us to erase your personal information in certain circumstances; 
• You have the right to ask us to restrict the processing of your personal information in certain circumstances; 
• You have the right to object to the processing of your personal information in certain circumstances; 

• You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.  

 

If you wish to exercise any of these rights, please contact the Clerk to the Charity at clerk@thomasoken.org.uk or 34 High Street, Warwick, CV34 4BE or on 01926 478 008, and let us have enough information to identify you. 

If you request the personal data that we hold about you, we will respond within one month (unless the complexity and number of requests mean that we need more time). 

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

 

Updated April 2022