This privacy notice sets out how the River Restoration Centre (RRC) uses and protects any information that you provide to us.
The RRC is committed to ensuring that your right to privacy and confidentiality is protected. Any personal identifiable information (PII) by which you can be identified is regulated by the Data Protection Act (and from 25th May 2018, by the General Data Protection Regulation). You can be assured that the RRC will only use your information in compliance with these laws and accordance with this privacy notice.
The RRC may change the privacy notice from time to time and will always endeavour to let you know that changes have been made. But you should check the RRC’s website www.theRRC.co.uk from time to time to review this policy to ensure that you are still happy with how the RRC manages and protects your information. This privacy notice is effective from May 2018.
The River Restoration Centre is an independent not-for-profit company limited by guarantee registered in England and Wales (2904139).
The RRC is committed to ensuring that rivers are restored and managed for the benefit of all, with enduring results which future generations can enjoy. We actively promote the re-establishment of natural processes, features and habitats of a river system. To support others to achieve this by collating and disseminating information, knowledge and evidence in order to spread best practice across the river and catchment management community.
The Data Protection Act requires every organisation that processes personal information to register with the Information Commissioner’s Office (ICO) and pay a fee, unless exempt. As a not-for-profit organisation, the RRC is exempt.
Any personal information provided or obtained by the RRC is used and processed only for the legitimate purposes of the RRC.
If you have any questions or concerns relating to how the RRC may use your personal information please contact Nicola Mackley (Data Manager) at the RRC Office, email@example.com, 01234 752979
The River Restoration Centre, 2nd Floor Ziggurat, Vincent Building (B52a), Cranfield University, Cranfield, Bedfordshire, MK43 0AL
Personal information collected about you
We will collect the following information about you that will be held securely on a central database:
- Contact information including email address and telephone number
- Demographic information such as postcode, communications & preferences
- Membership information and subscription fees
- Banking details relating to membership subscriptions or events
- Projects and training attended
The information we collect is necessary for us to be able to provide you with the service you require, for the effective management of RRC and to fulfil our advocacy work. Refer to the section below ‘What we do with your information’ for further details.
Where we collect your information from
The following are the different sources we may collect personal data about you from:
Directly from you. This is information you provide to us when you become a member, sign up for one of our events, and use our advisory services.
Indirectly from you. You may give us your information indirectly when you pay via PayPal. These independent third parties will pass your data to RRC where you have indicated that you wish to support RRC events and have given your consent or it is a necessary part of completing a contract with you.
From an agent/third party acting on your behalf. We may obtain information about you from a third party in relation to restoration projects and other interest of RRC.
When you access RRC’s social media. We might also obtain your personal data through your use of social media such as Facebook, Twitter, or LinkedIn, depending on your settings or the privacy policies of these social media and messaging services. To change your settings on these services, please refer to their privacy notices, which will tell you how to do this.
Through publicly available sources. We may use the following public sources:
Newspaper or other media coverage, open postings on social media sites such as LinkedIn, and data from Companies House.
By Reference or word of mouth. For example, you may be recommended to us by a friend or a colleague.
What we do with your information
Project and Advice work: We collect information about individuals who request our support with project or general advice relating to the restoration or rivers, floodplains and catchments. This is collected for the purposes of understanding your needs and requirements better, so that we can communicate with you and others involved with the project and where we are able to, to provide the service and support that you require.
Members of the River Restoration Centre: Individuals and organisations are invited to become a member of the River Restoration Centre in support of our work. Membership is through annual subscription that brings with it many benefits, from the regular bulletins and invitations to RRC events. Information is collected on our members for the purposes of managing membership subscriptions.
What we do with the information we gather:
- Internal record keeping, accurate accounting and financial reporting and compliance purposes
- Processing of payments and membership fees
- Reporting on restoration projects and support provided
- To contact you in response to a specific enquiry, compliment or complaint
- Promotional awareness and fundraising
- We may use the information to improve our products and services that we provide
- We may periodically send promotional emails about new events, products, special offers or other information which we think you may find interesting. However you will need to have given consent to the RRC for this purpose
- We may use your email address to contact you for purposes that relates to your membership, to respond to your questions or queries or to discuss river restoration with you
- We may use your information for statistical reporting purposes, archiving for historical purposes
- We are obliged to process our information in compliance with any lawful request made by order or the court or under police warrant
Our legal basis for processing your information:
For anyone using our service, support, advice or guidance (e.g. our publications, events and support with project work), our processing is necessary for our legitimate interests in that we need the information in order to provide these services to you (e.g. to administer your membership benefits).
RRC will only contact you for marketing purposes — for example keep you up to date on our work, or let you know of ways in which you can support that work — where we have your consent or we are otherwise allowed to do so.
If you notify us of any health or disability requirements then this may involve the processing of more detailed personal data including sensitive data such as health information that you or others provide about you. In that case we always ask for your consent before undertaking such processing.
Consequences of not providing your information:
If you do not provide the personal data necessary, or withdraw your consent for the processing of your personal data, it will be very difficult for the RRC to provide you with the service, support, advice or guidance or to work collaboratively with you to look after our rivers.
For our members it is very important to us that we have access to their information so that we can thank them accordingly, show our appreciation of their valuable support and keep them up to date with how their support is helping the RRC’s restoration efforts.
The RRC must also have access to some of your information in order to operate and to comply with legal obligations.
How long we keep your information for
How long we keep your information will depend on the purpose or purposes for which we use it. While you are a member of RRC, a visitor to our website or engaged with RRC for restoration and project work, we will only retain your information for as long as is necessary for those purposes and to comply with statutory or regulatory retention periods. For example, we will keep a record of payments for at least seven years to comply with HMRC rules.
If you request that we stop sending you marketing materials we will keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.
What we will not do with your information
The RRC respects your rights under data protection laws and takes our obligations seriously. Any information provided to the RRC is used and protected by the RRC for the RRC’s own legitimate purposes. Your rights to privacy, confidentiality and information security are highly important to us and upheld by us. Your support is extremely important to the RRC so we do not and will not share, swap, or sell your personal information with any other organisation for their own purposes.
We will not use your information for a different and non-compatible purpose to those described above or those that you would not reasonably expect. We will always let you know at the time of capturing your information if our intended purpose is different to those described above.
We do not carry out automated decision making or automated profiling.
We never have and never will share, swap or sell your personal details to any organisation for their own marketing purposes. Your privacy and confidentiality is paramount to us and we will only use the information that you provide for the RRC’s own purposes.
Information security and how we store your information
We are committed to ensuring that your information is secure and that your right to privacy and confidentiality are protected. We take information governance and security seriously and have technical and organisational measures in place that include ensuring all antivirus, antispam and software packages are up-to-date, correctly configured firewalls, encryption, secure file transfer protocols, policies, processes and staff training to manage and protect your personal information in order to prevent unauthorised access, unlawful processing, accidental loss, damage, destruction or disclosure.
All information you provide to us is stored securely by RRC and governed by IT Security Policy and Procedures. You have the right to access your information at any time. Refer to section below ‘Your legal rights’.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to us online; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access, loss or damage.
Where possible, we try to only process your information within the UK and European Economic Area (EEA). If we or our service providers transfer personal data outside of the UK or EEA, we always require that appropriate safeguards are in place to protect the information when it is processed.
A cookie is a small file which asks permission to be placed on your computer’s hard drive, smart phone, tablet or other device and are used to improve your online experience by almost every website including ours. This is why it is important to understand how cookies work, what they are for and when they are being used.
Once you agree, the cookie file is added to your computer and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes.
Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. The cookies we use in no way give us access to your computer or any information about you, other than the data you choose to share with us.
You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
Links to other websites
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.
You can manage your cookie preferences for our website or any other websites by using your browser settings. Your browser’s ‘help’ function will show you how to do this. However, please remember that cookies are often used to enable and improve certain functions on our website. If you chose to switch certain cookies off, it could affect how our website works on your device.
Your legal rights
Individuals have specific rights contained within data protection laws that relates to their personal information. These rights can be enforced against any organisation, from any sector, that holds your information. This section will detail what these rights are and how you can exercise them.
You have the right to be informed of how and why your information is being used and who it is being shared with. This right relates to the first data protection principle of fair and lawful processing and the second data protection principle that relates to processing personal information for specified and lawful purposes. Both of these principles obligates organisations to be open, honest and transparent with what and how they use personal information.
The RRC has published this Privacy Notice to detail how and why we use your information and what we will do with it. This privacy notice is available from our website and on request. The RRC will also endeavour to place data protection statements on all documents that capture or ask for your personal information that draws your attention to how your information will be used as well as how to obtain a copy of this policy.
You have the right to access information about you. This is called a Subject Access Request. This means you can have a copy of your personal information held by the RRC. If an exemption is being relied on to restrict your right to access specific details that contain your information, you are entitled to know which exemption applies. There is no charge for a Subject Access Request and the RRC must provide you with a copy within 30 days.
You have the right to have any incorrect or inaccurate information about you rectified or erased from our records. If we are holding information about you that you know or feel is incorrect you have a right for this to be corrected.
You have the right to be forgotten. This means you have the right to ask the RRC to delete or remove your information from our systems where there is no lawful reason for its continued processing.
You have the right to restrict processing of your information. For example you can request that we do not use your information in a way that will cause you any distress such as the publication of your photograph on our website or in our magazine or newsletters.
You have the right to withdraw consent. If you have given your consent to us using your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful).
You have the right to object to automated decisions and profiling. This right relates to decisions being made about you by automated or mathematical reasoning applied by a computer. There is no human input to the decision making process. This is quite common for online credit card applications where the decision is based upon an algorithm. The RRC does not use this kind of technology.
You have the right to data portability. This means you have the right to move your information from one database to another. For example you could ask to move all of your personal data from one utility provider to another.
There are other more general rights that you have within the law, these are:
The right to compensation for distress caused
The right to complain to the Information Commissioner by calling 0303 123 1113 or visiting the ICO’s website https://ico.org.uk/concerns/
The right to privacy and confidentiality and for your information not to be disclosed without your knowledge or consent.
If you have any questions or queries relating to this privacy notice or any of your rights detailed above please contact the RRC Data Manager, Nicola Mackley, by email at office@theRRC.co.uk or by calling 01234 752979.
Our lawful obligations
All organisations that process personal information are under strict obligations that govern how they use and process personal information. Predominantly these are found within the data protection principles:
Fair and lawful processing. This means we need to tell you about how and why we collect and use your information. The RRC does this through data protection statements and privacy notices.
Specified and legitimate purpose(s). This means that we need to be clear, honest and transparent as to the purpose(s) that we will use your information for. This is also achieved through the use of data protection statements and privacy notices.
Adequate, relevant and not excessive. This relates to the capture of information about you not being excessive for the intended purpose. For example asking for your banking details when they are not required would be excessive.
Accurate and where necessary up to date. This relates to our obligations around the management of your information.
Not kept for longer than necessary. This principle means that the information held about you cannot be held indefinitely. Your information can only be retained for the purpose(s) required and to comply with certain other legal obligations. For example tax laws requires information to be retained for seven years. The RRC will retain your information to conform with legal requirements and for as long as is justifiable for the management and historical account of the RRC’s work.
Appropriate security against unlawful and unauthorised processing. This obligation means that organisations are under a lawful duty to protect your information. Information security comes in different forms from physical security, technical and organisational measures to restrict access to your information and protect it from unlawful or unauthorised disclosure.
Controlling your personal information
You are entitled to enforce any of your legal rights and to make a complaint to the Information Commissioner’s Office. Refer to the section above ‘Your legal rights’.
If you believe that any information we are holding on you is incorrect or incomplete, please let us know as soon as possible. We will promptly correct any information found to be incorrect.
If you have any questions, concerns or complaints please contact the RRC Data Manager, Nicola Mackley, by email at office@theRRC.co.uk or by calling 01234 752979.