Data Privacy Notice

1. Your Personal data – what is it?

   Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the GDPR).

   
   

2. Data Controller

   The Foundation of St Matthias (Registered Charity Number 311696) is the data controller. This means the Foundation decides how you personal data is processed and for what purposes.

   
   

3. How do we process your personal data?

   The Foundation comply with their obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect your personal data.

   We use your personal data for the following purposes:

   • Carrying out security/credit checks in connection with your Grant Applications(s) to assess your eligibility for a grant(s) from the Foundation.

   • For administration and management purposes and for statistical analysis.

   • For audit and regulatory purposes.

   • For the purposes of evaluating your application and, if successful, for the purposes of awarding and paying your grant(s).

   • For the purpose of keeping permanent historical record of grants awarded.

     
     

4. What is the legal basis for processing your personal data?

   • The explicit consent that you have given so that we can evaluate your application.

   • Processing is necessary for carrying out legal obligations in relation to your grant(s).

   • Processing is necessary for the Foundation’s legitimate interests including the award and payment of your grant(s).

     
     

5. Sharing your personal data

   Your personal data will be shared with the Trustees of the Foundation, the Chief Operating Officer, the Finance Manager and their clerk, accountants and administrators for the purposes of evaluating your application and processing you grant(s). It will only be shared with third parties if you have explicitly consented or it is necessary to comply with our legal obligations or is necessary for the Foundation’s legitimate interests.

6. How long do we keep your personal data?

   We keep data in accordance with the guidance set out in the ‘St Matthias Trust Records Retention Policy’ which is available from the Clerk to the Trustees. Specifically, if your application is unsuccessful the Foundation will keep your Personal Data for six months before being securely destroyed or irretrievably deleted. If your application is successful the Foundation will keep your Personal Data for seven years for audit reasons and in compliance with the Charity Commission’s Statement of Recommended Practice and for administrative purposes. The Personal Data will then be securely destroyed or irretrievably deleted.

7. Your rights and your personal data

   Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:

   • The right to request a copy of your personal data which the Foundation holds about you;

   • The right to request that the Foundation corrects any personal data if it is

   • found to be inaccurate or out of date;

   • The right to request your personal data is erased where it is no longer necessary for the Foundation to retain such data but only if the data is no longer necessary for the purposes for which it was collected or otherwise processed;

   • The right to withdraw your consent for the purposes for which it was collected or otherwise processed;

   • The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;

   • The right to lodge a complaint with the Information Commissioners Office.

8. Further processing

   If the Foundation wishes to use your Personal Data for new purpose, not covered by this Data Protection Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing. When you give the Foundation information about another person, for example emergency contact details, you confirm that they have appointed you to act for them, to consent to the processing of their personal data and to receive on their behalf any data privacy notices.