Privacy Policy

Afield Environmental (“Afield”) is a Charitable Incorporated Organisation, registration number ZC041916, referred to in this policy as “we”, “us” or “our”.

Afield is committed to protecting and respecting your privacy. This policy covers data we collect from you during the course of our operations, including from our website at www.afield.org.uk. It explains how any personal data we collect from you, or that you provide to us, will be processed by us. Processing of data includes storing it. The policy should be read alongside our website Cookie Policy.

Personal data means any information about a living individual from which that person can be identified (but not data where the identity has been removed, like anonymous data).

This policy is not intended for children, and we will not knowingly collect personal data relating to anyone under the age of 18.

We keep this policy under regular review and we may amend it from time to time to comply with law or for legitimate business purposes. Any future changes we make to this policy will be posted on our website and, where appropriate, notified to you by email. The most recent date it was updated is shown at the top of the policy.

Contact Details

Please read the following carefully and, if you have any questions regarding your personal data or its use, please contact us:

• by email on privacy@afield.org.uk;
• by post to Afield, 5 Brayford Square, London, E1 0SG.

Introduction

For the purposes of the Data Protection Act 2018 we are the controller of the personal data we collect for certain purposes as described in this privacy policy.

Afield is registered with the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk) with registration number: C1827123. You have the right to make a complaint at any time to the ICO. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

What we do as a charity and why we do it

We want to be really clear about what we do and why we do it, because it sets the scene for how and why we collect and process personal data. Afield aims to respond creatively to environmental injustice by working with communities to rewild urban spaces; and supporting artists to undertake environmental research.

Where necessary we will collect and process personal information to enable us to: assess and award grants; provide access to restricted areas of our website; work with partners and individuals; and share information about the projects and campaigns that we are running. You can find more detail on what information we collect and how we use it below.

How we collect information

We collect data from you in a number of different ways, depending on how you interact with us. For example we may collect data from you:

• By email
• On our website, for example if you complete a form. Please also read our Cookie Policy.
• Over the phone
• In person
• We may also automatically collect anonymous technical data about your equipment, browsing actions and patterns to help us optimise our website and other digital products.

Information we collect and why

Data: Your contact details including email addresses, names, telephone number, organisation and job title (if relevant).

When: When you provide information to us, for example: at an event, via email, or via a form on our website.

How and why: To analyse interest in Afield, and contact you about events you have expressed interest in.

Lawful basis: Consent — you will be asked to consent if you want to receive this information.

Data: Your contact details including email addresses, names, telephone number, organisation and job title (if relevant).

When: When you apply for a grant, funding or partnership.

How and why: To keep in touch with you during the progress of your application.

Lawful basis: Legitimate interest — it is in our legitimate interest to be able to stay in touch with our applicants and partners.

Data: Your protected characteristics (for example your gender, your ethnicity, or any disabilities that you might have).

When: When you apply for a grant, funding or partnership, in line with our Equality, Inclusivity and Diversity Policy.

How and why: Afield may use this data in order to take positive action in grant awarding decisions, in line with our Equality, Inclusivity and Diversity Policy.

Lawful basis: Consent — we will only use these characteristics with your explicit consent.

Data: Your self-assessed income level.

When: When you apply for a grant, funding or partnership.

How and why: Some grants are only offered to applicants who have self-assessed as being ‘low income’.

Lawful basis: Consent — you will be asked to consent when you provide this information.

Data: Your contact details including email addresses, names, telephone number, organisation and job title (if relevant).

When: When you are awarded a grant, or make a funding or partnership agreement.

How and why: To enable us to deliver our agreement to you as a grantee.

Lawful basis: Perform a contract — we need to do this to provide our obligations as a grant maker, funder or partner.

Data: Your identity, contact data (email address and/or password), technical data, profile, usage, marketing and communications and technical data.

When: When you use the services on our website. For example if you log in to a protected area of our website.

How and why: Your email address is our primary method to identify you in order to provide this access.

Lawful basis: Consent — you will be asked to consent when you provide this information.

Data: Your identity, contact data, email address, technical data, profile, usage, marketing and communications and technical data.

When: When you subscribe to news, blogs, newsletters or contact emails.

How and why: To provide you with information that you request from us (for example, notification of a new news post).

Lawful basis: Consent — where you have consented to receiving communications.

Data: Your identity, contact data, email address, technical, usage and profile data.

When: When you use a form on our website or send us an email to provide feedback or raise a complaint.

How and why: To deal with feedback or complaints about our website or service.

Lawful basis: Legitimate interest — it is in our legitimate interests to deal with feedback and complaints.

Data: Your identity, contact data (email address and/or password), technical data, profile data, usage, marketing and communications and technical data.

When: When you use the services on our website.

How and why: To respond to law enforcement or regulators about users of our site.

Lawful basis: Legal or regulatory obligation — we need to do this so that we do not break the law.

Our lawful bases of processing

• Where we need to perform a contract — that’s the way the law puts it, but it’s essentially using your personal data to carry out something we’ve made a contract with you to do (for example, providing you with a grant).
• Where it’s necessary for our legitimate interests — this is where we or a third party have a legitimate interest in using your personal data, and your interests or fundamental rights don’t override it (for example, if you provide feedback or make a complaint).
• You have the right to object to this processing if you wish, and if you wish to do so please see the “Your Rights” section below. Please bear in mind that if you object this may affect our ability to carry out the tasks identified in the table above for your benefit.
• Where we have your consent to do so — this is where you clearly say to us it’s OK to do something (for example, you ask us to send you news and updates in your preferences).
• Where we need to comply with a legal or regulatory obligation — this one is probably self-explanatory, but if there’s a law that says we need to keep or hand over some personal data, or if someone in authority asks us to, we’ll follow the rules.

Special category data

Special category data is sensitive personal data that requires greater protection and includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and data concerning a person’s sex life or sexual orientation. Afield may collect and use special category data for evidence-based, proportionate targeting of certain grants.

Keeping personal data secure

We have taken all appropriate technical, physical and organisational security measures to ensure that your data is protected against unauthorised access, use and disclosure. Unfortunately, the exchange of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our sites; any transmission is at your own risk.

If you are invited to choose a password (for example to access part of our website), you are advised to choose a non-guessable password and you will need to follow the password rules which are outlined when you create your account or change your password.

The servers where we store personal data are located in the UK. If we ever need to transfer personal data outside of the European Economic Area, we will take all steps reasonably necessary to ensure that your data is subject to appropriate safeguards, such as relying on a recognised adequacy decision or standard contractual clauses, and that it is treated securely and in accordance with this privacy policy. If you would like more information about these safeguards, please contact us at privacy@afield.org.uk.

Disclosure of your information

We may disclose your personal information to any member of our group, which means to any subsidiaries, any ultimate holding company or its subsidiaries. We may disclose your personal information to third parties, including:

• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
• If Afield Environmental, or substantially all of its assets, are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of Commonplace Digital Ltd, our customers, or others.
• If we are asked to as part of them seeking to exercise or defend their legal rights (for example, as part of a planning application or a judicial review).

Links to other websites

Our website includes links to other websites which we may not control. We cannot be responsible for the protection and privacy of any information that you provide while visiting those sites. These links are not an endorsement by Afield of the site to which it points, and they are not governed by this policy. When you leave our website, we encourage you to read the privacy policy of every website you visit.

How long we keep your information

We will only keep your information for as long as necessary to carry out the purposes for which we collected it. This will depend on the type of information and the types of legal and contractual obligations we must comply with. In the normal course of our activities we will not keep personal information that has not been used for more than 12 months.

Your rights

Under the General Data Protection Regulation you have the following rights:

• The right to be informed — that’s us telling you what we do with your personal data (which we do via this privacy policy, and when we collect consent).
• The right of access — the right for you to ask us what information we hold about you and how it’s used. You can find this out by emailing privacy@afield.org.uk.
• The right of rectification — that’s an obligation on us in certain circumstances to correct your personal data if it’s inaccurate or incomplete.
• The right to erasure — that’s an obligation on us in certain circumstances to delete or remove your personal data where there is no compelling reason for its continued processing (some people also call this right ‘the right to be forgotten’).
• The right to restrict processing — that’s an obligation on us in certain circumstances to stop actively processing your personal data.
• The right to data portability — that’s an obligation on us in certain circumstances to allow you to transfer your personal data from us to a third party.
• The right to object — that’s an obligation on us in certain circumstances to allow you to object to us processing your personal data where we do not have an overriding reason.

Not all of these rights will be relevant to your interaction with Afield, but they are important rights and we want to make sure you know about them. If you wish to exercise any of the rights set out above, please contact us at privacy@afield.org.uk.

When you contact us, on privacy@afield.org.uk or via other means, we need to be sure it’s you. We may need to ask you to confirm your identity — this is an important security measure so that we don’t disclose personal data to any person who doesn’t have the right to receive it.

We try to respond within a month (30 days), but if your request is complex or you’ve made a number of different requests, it may take us longer. If that’s the case, we’ll keep you updated. Normally we do this work without charge, but if a request is unfounded, repetitive or excessive in our view, then we reserve the right to charge for producing the data. Alternatively, we could refuse to comply with your request in these circumstances.