This privacy notice explains how Cardiff National Park City uses personal data that you provide or which we collect and holds about you when you use our website and/or other services. Cardiff National Park City is the data controller of this information for the purposes of this notice.

Cardiff National Park City respects all personal data shared with us by our members and contacts in line with their wishes. We aim to be clear when we collect any personal information or data such as names, addresses, email contacts, and we do not do anything which members and contacts would not reasonably expect.

The policy reflects our duties under the General Data Protection Regulations (GDPR) to use information fairly, to ensure it is keep securely, to ensure it is accurate and up to date, and that it is disposed of safely if this is requested / required.

What types of personal data do we collect and process?

  • If you sign up to become a member of Cardiff National Park City or sign up to receive our newsletters we will collect your name and email address.
  • Occasionally we will contact you to ask for your feedback on Cardiff National Park City aims and activities, to ensure our work remains relevant to our member, residents of Cardiff and other stakeholders. In these instances we may collect information you provide to us in response to a survey or consultation.
  • In order to take part in events and/or activities run by Cardiff National Park City, you may need to provide data such as name, date of birth, address. 
  • If you correspond with us by email or social media, we may retain the content of your messages, your address and our responses. 
  • If you make a donation to Cardiff National Park City or fundraise in aid of us, we will collect and process information which may include the following:
  • Name, title, gender, and date of birth.
  • Contact details including postal address, email address, phone number
  • Your occupation and/or workplace.
  • Your interests.
  • Records of donations and Gift Aid status, where applicable (as required by HMRC).
  • Records of communications sent to you by Cardiff National Park City or received from you.
  • Records of your volunteering activity on behalf of Cardiff National Park City.
  • Where you have left us a gift in your Will, any information regarding next of kin with which you may have provided us to administer this.
  • Links to media articles about you.
  • Information on your engagement with Cardiff National Park City events.
  • If you donate or fundraise for us through a third party (for example, via JustGiving, or through a recognised volunteer group) then we may obtain information about you from that third party. The receipt of personal information by Cardiff National Park City in this manner is subject to the third party’s own privacy policy or the information they have provided to the data subject. Information obtained in this way is treated no differently to any other once held by Cardiff National Park City and is bound by the terms of this Privacy Notice as soon as it is received.
  • We may collect information to help us improve the effectiveness of our communications with you. This includes tracking whether the emails we send are opened and which links are clicked within a message, and tracking interactions with our website and/or social media adverts (via cookies).
  • We may collect data about professional contacts and partners with whom we have worked with in the past, work with currently or hope to work with in the future. 
  • We do not collect special categories of personal data. We use the term special categories of personal information to mean information about your race, ethnic origin, political opinions, religious beliefs, health, or sexual orientation.

While you are not obliged to provide any personal data to us, in some cases we may not be able to provide services to you unless you provide certain minimum information.  

How we use your information

The legal basis we use for processing your data includes:

  • Consent: 

We will use your information for marketing purposes where we have your consent. This may include contacting your electronically or by telephone with marketing, fundraising appeals and news from Cardiff National Park City. 

We also use your explicit consent to collect Special Categories of Data which is collected voluntarily. This data is collected in accordance with all of our standard Data Protection processes and anonymised immediately where possible. 

  • Legitimate interest:

We use legitimate interest as the legal basis for processing your data provided that your interests and fundamental rights do not override those interests. This includes surveys, marketing or fundraising where your consent is not necessary. 

To enable us to fundraise appropriately and effectively, using our legitimate interests, we will research individuals and organisations to help us identify suitable major donors, corporate partners and charitable trusts. This research helps us to identify individuals or organisations who have the capacity to make substantial donations, who appear to have an interest in supporting our cause and who may be able to help us to raise funds through volunteer support for our appeals, events or partnership opportunities. We appreciate that you expect us to conduct such processing in an efficient and professional manner whilst taking your right to privacy into account. We are careful to ensure information collated is not excessive or intrusive and is sourced reliably and appropriately. Any research is undertaken using only credible, publicly available information. 

We may send our professional partners information and updates about our work (primarily by email). Such contacts can opt out of receiving this information at any time.

  • Legal obligation: 

Cardiff National Park City retains records of all of its financial transactions with you in order to comply with its legal obligations to maintain adequate accounting records. We may use (and disclose) the information it holds about you in order to comply with any investigative demand, court order, or a request for cooperation from a law enforcement or other government agency.

We are also legally required to carry out checks on individuals who give us large donations, to comply with our duties in respect of anti-money laundering legislation and the prevention of fraud.

Cardiff National Park City will not carry out any automated decision-making using the information it holds about you. 

Use of third party services

Cardiff National Park City We will never share or sell your personal data to a third-party organisation for their own marketing, fundraising, or campaigning purposes.

Cardiff National Park City may share your information with suppliers and sub-contractors from time to time in order that they can process it on our behalf for the purposes set out in this privacy notice. However, where we do so we will put in place suitable measures in order to protect your information. This may include (but not limited to) managing mailings for fundraising appeals, campaigns, conducting research surveys, storage of your personal information on our behalf, analytics services. 

How do we keep your information secure?

 Cardiff National Park City is committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure of personal data, we have put in place appropriate physical, electronic and managerial procedures to safeguard and secure the information we collect. 

In the event that personal information is compromised as a result of a breach of security, Cardiff National Park City will promptly notify those persons whose personal information has been compromised as required by applicable law.

How long do we keep your data?

Whatever your relationship with us, we will only store your information for a specified amount of time. The length of time that data will be kept may depend on the reasons for which we are processing the data, and on the law or regulations that the information falls under, or any contractual obligation we might have.  Once the retention period has expired, the information will be confidentially disposed or permanently deleted.

If you request to receive no further contact from us, we will keep some basic information about you on our suppression list to avoid sending you unwanted materials in the future.

Your rights

You have several rights under applicable data protection laws, which are summarised below:

You have a right to:

  • Ask us not to process your personal data for direct marketing purposes.
  • Request access to personal information held about you and a copy of it.
  • Obtain the rectification of inaccurate or incomplete personal data.
  • Obtain the erasure of your personal data in certain circumstances, for example if our processing of your personal data is no longer necessary for the purpose for which we collected it.
  • Restrict the processing of your personal data in certain circumstances rather than having it erased.
  • Object to the processing of personal data in certain circumstances. 
  • Receive personal data, which you have provided to Cardiff National Park City, in a structured, commonly used and machine-readable format and transmit that personal data to another data controller or have us do so on your behalf where technically feasible.
  • Be informed about any use of your personal data to make automated decisions about you, and to obtain meaningful information about the logic involved, as well as the significance and the envisaged consequences of this processing; and
  • Lodge a complaint about the way in which your personal data is being used to a supervisory authority.
  • Withdraw consent for the processing of your personal data at any time, wherever consent is the lawful basis

How do I withdraw my consent?

If after you opt-in, you change your mind, you may withdraw your consent for us to contact you, for the continued collection, use or disclosure of your information, at anytime, by unsubscribing using the links which are included in every communication, or by contacting us at caerdyddnpc@gmail.com 

Protecting the data of children

Protecting the privacy of young children is especially important. For that reason, Cardiff National Park City does not knowingly collect or solicit personal information from anyone under the age of 13 or knowingly allow such persons to subscribe to our emails. If you are under 13, please do not send any information about yourself to us, including your name, address, telephone number, or email address. In the event that we learn that we have collected personal information from a child under age 13 without verification of parental consent, we will delete that information as quickly as possible. If you believe that we might have any information from or about a child under 13, please contact us at caerdyddnpc@gmail.com. 

Complaints

If you are unhappy with the way in which your personal data has been processed, you may contact us in the first instance by email at [insert email address] and if not satisfied you can contact the Information Commissioner’s Office. Further information can be found at the Information Commissioner’s Office website here https://ico.org.uk/your-data-matters/

Changes to this privacy policy

If we change our privacy policies and procedures, we will post those changes on this webpage to keep you aware of what information we collect, how we use it and under what circumstances we may disclose it. Changes to this Privacy Policy are effective when they are posted on this page.

This Privacy Policy was last updated in 18th May 2022