This Privacy Policy explains how Community Foundation Wales (the Foundation) collects, uses, and protects your personal information. It covers donors, grantees, staff, trustees, volunteers, and website users. Why do we need your information?

We’re a charitable foundation that works with people to strengthen communities in Wales. We believe that thriving communities with caring people and strong community groups give everyone the chance to achieve their best. We use personal data to ensure we are organising our time and effort for the benefit of people in Wales.

Whose data do we collect?

We collect information about you when you give, or are considering giving, financial or other support to the Community Foundation Wales, along with people who apply to the foundation for grants, whether on behalf of an organisation or personally, and people who wish to support us and follow our activities. We also collect information when you apply for jobs with us or when you become a trustee, to enable us to progress your application.

How do we obtain your data?

The information we hold about you has been provided directly to us by you. We also collect information when you voluntarily complete surveys and provide feedback. Website usage information is collected using cookies. We will notify you in advance at times when we record phone and video calls.

What do we collect about you?

We may collect the following information:

• Name
• Date of birth
• Contact details (i.e. email address, postal address, phone number), including relevant family or friends information including information on successor advisors
• Bank details
• Job title
• Information about our relationship with you – correspondence, meeting notes, attendance at events
• Information necessary for us to manage funds you have established or supported

What do we collect from grantees?

• Name(s) and address, email, phone number and other relevant contact details and preferences
• Purpose and details about an application for a grant
• Any other information needed for the assessment of a grant which may include financial, family, education and employment information
• Details about any grant which was made
• Information about our relationship with you, correspondence, meeting notes, attendance at events etc.
• Bank details for successful grantees (groups and individuals)

Data retention periods

We keep personal data only for as long as necessary to provide our services or comply with legal obligations. Specific retention periods may apply for certain types of data, such as funding applications, recruitment, or donor records.

Recording calls and meetings

We may record phone calls, Teams, or Zoom video meetings. You will always be notified when a recording is taking place. Recordings are used to monitor the quality of our services, support staff, volunteer and trustee training, and investigate or resolve complaints. All recordings are stored securely and deleted confidentially after 90 days.

If you do not wish to be recorded, you may request to speak with a manager or, in exceptional circumstances (for example, if the conversation might cause distress or harm), the call or meeting may be conducted without recording.

How is this information used?

Community Foundation Wales collects data for several reasons, including:

• To provide personalised services or information to users who have requested it
• To process donations
• To help improve our understanding of how our website is used
• To monitor and improve the services we offer
• General administration purposes
• Promoting the aims and objectives of the foundation through other activities.

Use of Artificial Intelligence (AI)

Community Foundation Wales uses AI tools where appropriate to improve efficiency, accessibility and understanding across our work. AI does not make decisions about funding or replace human judgement; all key decisions are made by people. Where AI is used, it is subject to human oversight and complies fully with UK data protection law. We do not share personal data with AI systems without appropriate safeguards and only use it in ways that are secure and necessary. Further details about how and why we use AI are available in our AI Statement.

When you apply to work or volunteer with us

All of the information you provide during the application process will only be used for the purpose of progressing your application, or to fulfil legal or regulatory requirements if necessary.

We will not share any of the information you provide during the recruitment process with any third parties for marketing purposes. The information you provide will be held securely by us whether the information is in electronic or physical format. We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.

Our recruiting managers and trustees will have access to the information you provide.

If you are unsuccessful following assessment for the position you have applied for, we may ask if you would like your details to be retained in our talent pool for a period of six months. If you say yes, we would proactively contact you should any further suitable vacancies arise.

If you are unsuccessful at any stage of the recruitment process, we will retain your personal information, including assessment materials, only for as long as necessary, in line with our data retention practices. If you are successful in your application, we will retain your information in accordance with our Data Protection policy. A copy of this will be provided to you with your offer letter.

Cookies

A cookie is a small file which is stored on a user’s computer, once permission is received. The cookie then analyses that data specific so that information and services can be tailored specifically. You can choose not to accept cookies on our homepage though some of our website features may not function as a result.

Protecting your data

We keep your data secure in our database with appropriate security mechanisms in place. We will not share your data unless it is necessary for the purpose for which you have given us the data.

Examples are given below:

• We will provide information to HMRC on Gift Aided donations since we have a legal obligation to provide this information.
• We will share information on grant applicants with grant panel members and donors. These are volunteers working with the Foundation. We will also publish data on grant recipients for groups/organisations (amounts/names/purpose) but we anonymise details for any individual grantees.

Our responsibilities

If the law requires your consent to process data in a certain way then we will obtain it before carrying out that activity.

Other activities are carried out to fulfil a contract or agreement. Examples include holding funds which are subject to Philanthropy Agreements or organising a ticketed event. Each requires us to know who you are and to process your information in order to do the thing you have asked us to do. If a contract is in place then we will process your data based on that contract.

In all other cases the law allows us to process your data if it is in our legitimate interest to do so, but only so long as we need to and your “interests or your fundamental rights and freedoms are not overriding”. This means we carry out an exercise to check that we will not cause you harm by processing your data, that the processing is not overly intrusive and that we will only do so in a way which is described in this privacy notice. We will keep data for as long as is needed to complete the task for which it was collected. Relationships between donors, grantees and the foundation are often long term, and so we expect to keep your data for as long as that relationship exists, or until we no longer need it.

Marketing

We would like to keep in touch with you about our work supporting people and communities in Wales.

You have the right at any time to opt out of emails, newsletters, phone calls, and other communications. If you no longer want to receive our information, please contact us and let us know.

Your rights

You have the right to:

• Withdraw consent to use your data
• Request a copy of the data that we hold about you
• Ask that we suppress or stop processing your data, and we will honour this where possible. However, in some circumstances we may need to continue processing your data. For more information, please contact us.
• Ask for inaccuracies in your personal data to be corrected
• Request deletion of personal data used by AI. You can ask us to delete personal data that may have been processed by AI tools.
• Access to information about automated decision-making. Even though we do not use AI to make funding or other decisions, you have the right to know if any automated decision-making processes are used and how they work.
• If you are not satisfied with the way we have processed your data then you can complain to the Office of the Information Commissioner. This link may be helpful – https://ico.org.uk/concerns/

Changes to this Privacy Policy

We regularly review this Privacy Policy to ensure that it is an accurate reflection of how we process your personal data.

How to contact us:

Email: info@communityfoundationwales.org.uk

Post: Chief Executive, Community Foundation Wales, 1st Floor, Hastings House, Fitzalan Place, Cardiff, CF24 0BL

Phone: 02920 379580