Privacy Notice
Effective: July 2025
Your Privacy Matters to Us
At Thrive (the operating name for Community Council for Somerset), we are committed to protecting your personal information and being transparent about how we collect, use, and store it. We handle your data lawfully, fairly, and securely – in line with the UK GDPR and Data Protection Act 2018.
Why We Collect Your Data
We collect and use your information as part of our day-to-day work to deliver community services and support. This may include information about members, clients, employees, volunteers, trustees, contractors, and suppliers.
We may collect data when you:
- Contact us by phone, email, online, or in person
- Sign up to a newsletter
- Apply for a job
- Take part in a project or referral
- Use our website or social media
- Attend an event, training, or service
Some services may require us to collect sensitive data, such as health or support needs. This is only done with your explicit consent or where it is necessary to support you.
How We Use Your Information
We only collect the data we need and use it to:
- Deliver and improve our services
- Respond to your enquiries
- Fulfil legal or contractual obligations
- Manage internal records
- Communicate updates you’ve asked for
- Report anonymised data to funders (no personal data shared without your consent)
Your data is securely stored on our cloud-based systems (e.g., Charity Log and Beacon) and managed with care.
Our Data Protection Commitment
We follow eight key Data Protection Principles, which means your personal data will be:
- Processed lawfully, fairly, and transparently
- Collected for specific, clear, and legitimate purposes
- Limited to what is necessary
- Accurate and kept up to date
- Stored no longer than necessary
- Kept secure against unauthorised access or loss
- Protected by technical and organisational safeguards
- Only transferred outside the EEA where protections are adequate
Security and Confidentiality
We take security seriously. All personal data is protected by:
- Encrypted emails and secure devices
- Strong passwords and restricted access
- A clear desk policy and secure storage
- Encrypted memory sticks (only when necessary)
- Remote data wipe if devices are lost
- VPN and two-factor authentication for remote access
We’re Cyber Essentials Accredited, and our staff are trained in data protection responsibilities. Breaches are taken seriously and managed through our Data Breach Policy.
Photography and Children’s Data
Photos of individuals are treated as personal data and only used with clear consent. For children under 13, parental or guardian consent is required.
We do not store data on children under 13 unless essential for service delivery, and even then, only with appropriate safeguards and consent.
Who Has Access?
We will never sell your information. We may share it with:
- Trusted partners delivering services on our behalf
- Funders or statutory bodies, where necessary and lawful
- Third-party service providers (e.g., IT, email platforms) under strict contracts ensuring GDPR compliance
All contractors, volunteers, trustees, or consultants who handle personal data must adhere to our Data Protection Policy and may be audited.
Your Rights
Under UK GDPR, you have the right to:
- Be informed about how your data is used
- Access your data
- Correct inaccurate information
- Request deletion
- Restrict or object to processing
- Data portability
- Not be subject to automated decision-making
To exercise your rights or make a Subject Access Request, the individual must confirm their identity and complete a Data Subject Access Request form through the ICO portal:
ICO Subject Access Request Form
Somerset Crisis and Resilience Fund Alliance
We are part of the Somerset Crisis and Resilience Fund Alliance. Read the alliance’s privacy policy notice.
Data Controller Information
We are registered with the Information Commissioner’s Office (ICO):
Registration No: Z3356691
Contact Us
If you have questions or concerns about your data, please contact:
Kristy Hirons – Data Protection Officer
info@thrivesomerset.org.uk
01823 331222