Privacy Notice

Introduction

This privacy notice explains how The Conservation Volunteers (TCV) collects and uses personal information about people who visit our websites or use our online services, volunteer or take part in our activities and programmes, donate or fundraise for us, buy or book our services, receive our communications, contact us, or engage with us as a representative of a community group, partner, funder, supplier or corporate client. It also applies to parents, carers, children and young people where we process their personal information in connection with TCV’s work.

The Conservation Volunteers is the data controller, and we are responsible for your personal data (referred to as “we”, “us” or “our” in this privacy notice).

We have appointed a Data Protection Officer who oversees privacy-related matters for us. If you have any questions about this privacy notice, please contact the Data Protection Officer using the details set out below.

We take our responsibility to everyone who entrusts us with their personal data very seriously. This notice outlines what data we may collect, how we may use it, how we protect your data and what are your rights. This notice includes any data we collect from you during your relationship with TCV.

Contact details

Our full details are:

Full name of legal entity: The Conservation Volunteers
Name of Data Protection Officer: Worknest Secure
Email address: dataprotection@tcv.org.uk
Postal address: Gresley House, Ten Pound Walk, Doncaster, DN4 5HX
Telephone number: 01302 388 883

It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at information@tcv.org.uk.

Summary of how we use your data

We collect and use your personal data to deliver our services, support our charitable activities, and communicate with you. This includes information you provide directly, data from your use of our websites, and photographs or media from our projects.

We use your data to manage volunteering, process donations, improve our services, and report on our impact. We may share your information with trusted partners and service providers who support our work.

We handle your data securely and only keep it for as long as necessary. You have rights over your personal data, including the right to access, correct or object to how it is used.

For more detail, please read the full privacy notice below.

FULL PRIVACY NOTICE

What data do we collect about you, for what purpose and on what ground we process it?

We collect only the personal details needed to fulfil the services you expect from TCV. Depending on the service, the information required may include:

Contact details to allow communication with you regarding the service or product TCV is providing to you,
Health, disability, behavioural and offending history details sufficient to ensure the safeguarding and safety of yourself and OTHERS while volunteering
Information to improve customer service
Demographic, attendance and narrative information to enable us to demonstrate to current or future funders the outputs, outcomes and impact of our programmes and products.
Payment details when transacting donations
Statistical information to see how our website, social media channels and emails are performing to improve our communications

This may include:

any paper forms you fill out
verbal data collection
forms via our website OR online surveys
photographs, video or audio recordings

Personal data means any information capable of identifying an individual. It does not include anonymised data.

We may process the following categories of personal data about you:

Category of data or activity	Personal data collected	Purpose	Lawful basis
Communications	Your name, contact details and the contents of communications sent through our website, email, telephone, text, social media or other channels	To respond to enquiries, communicate with you, maintain appropriate records and establish, pursue or defend legal claims	Legitimate interests – responding to communications, maintaining appropriate records and managing legal claims. Contract – where the communication is needed to take steps at your request before entering a contract or to manage an existing contract
Volunteering	Your name, title, contact details, volunteering activity, attendance records, communication preferences, relevant organisation and employer details for corporate volunteering	To register and support your volunteering, manage activities, communicate with you, maintain volunteer records and report on our charitable work	Legitimate interests – managing TCV’s volunteering activities and maintaining appropriate records. Legal obligation – where TCV must retain particular information to meet a statutory duty. Special-category and criminal-offence information is covered separately below
Donations and Gift Aid	Your name, contact details, address, donation details, payment confirmation, Gift Aid declaration and confirmation that you are a UK taxpayer	To process and acknowledge donations, administer Gift Aid, maintain financial records and meet accounting, audit and tax requirements	Legitimate interests – administering donations and maintaining our relationship with supporters. Legal obligation – meeting accounting, tax and Gift Aid requirements
Purchases and bookings	Your name, title, billing and delivery addresses, email address, telephone number, purchase or booking details and payment confirmation	To process orders and bookings, supply goods or services, take payment, arrange delivery and maintain transaction records	Contract – supplying goods or services that you have requested. Legal obligation – meeting accounting and tax requirements
Payments	Payment details submitted to payment providers such as Stripe, PayPal, JustGiving or CAF, together with transaction references and payment status information provided to TCV	To process payments, prevent fraud, issue refunds and reconcile transactions	Contract – processing payment for goods or services. Legitimate interests – processing donations and preventing fraud. Legal obligation – maintaining financial and accounting records
Website and online service use	Account details, information you submit through online forms, content you ask us to publish, service preferences and information about how you use our websites and online services	To provide and administer our websites and online services, display content you submit, maintain backups, respond to service requests and protect our systems	Legitimate interests – operating, administering and protecting our websites and online services. Contract – where processing is needed to provide an online service you have requested. Consent – where you have made an optional submission for publication and consent is the appropriate basis
Technical and security information	IP address, login information, browser and device details, timestamps, security logs, error records and information about attempts to access our systems	To provide website functions, authenticate users, maintain network and information security, investigate faults and prevent misuse or fraud	Legitimate interests – operating secure and reliable websites, systems and online services
Website analytics	IP address, cookie or device identifiers, browser information, pages viewed, links selected, visit duration, navigation paths and approximate location	To understand how people use our websites, measure performance and improve our content and online services	Consent – where non-essential cookies or similar technologies collect analytics information. Limited analysis that does not use non-essential storage or access technologies may rely on legitimate interests, subject to an assessment
Marketing preferences and communications	Your name, email address, telephone number, postal address, communication preferences, interests, consent records, marketing history and opt-out requests	To send news, fundraising appeals, volunteering opportunities and information about TCV’s activities, and to manage communication preferences	Consent – where you have opted in. Legitimate interests – where the charitable-purpose soft opt-in applies or another form of marketing is permitted, subject to the relevant direct marketing rules. Legitimate interests – maintaining a suppression record so that we respect opt-out requests
Online advertising and audience matching	Your email address or another online identifier, normally shared in a protected or hashed format, together with information about your marketing preferences	To show TCV advertising to selected audiences, exclude existing supporters from campaigns, measure campaign performance or identify audiences with similar interests	Consent – where you have received clear information and specifically agreed to this use and any related non-essential tracking technologies. TCV will not use an email marketing preference alone as authority for audience matching
Competitions, prize draws and promotions	Your name, contact details, entry information, eligibility information and delivery details if you receive a prize	To administer the promotion, contact entrants, select and verify recipients and deliver prizes	Contract – administering the promotion under its terms. Legitimate interests – maintaining records and preventing misuse. Any optional marketing uses consent or another permitted marketing basis

We may use Customer Data, User Data, Technical Data and Marketing Data to deliver relevant website content and advertisements to you (including Facebook adverts or other display advertisements) and to measure or understand the effectiveness of the advertising we serve you. Our lawful ground for this processing is legitimate interests, which is to grow our business. We may also use such data to send other marketing communications to you. Our lawful ground for this processing is either consent or legitimate interests (namely to grow our business).

Photographs and media

We may collect and use photographs, video or audio recordings as part of our activities, including group photos taken at events, volunteering sessions and project work.

We use this information to:

promote and report on our charitable work
demonstrate outcomes to funders and partners
support engagement with volunteers, supporters and communities

Where appropriate, we may share photographs and associated information (such as names) with trusted service providers who process data on our behalf. This includes partners such as 3adapt, who support delivery and reporting of our programmes.

Our lawful basis for using photographs and names is:

Legitimate interests, to promote and support our charitable activities
Consent, where images are used in a more prominent or identifiable way

We take steps to minimise risk by:

primarily using group images
limiting identification of individuals unless necessary
respecting any preferences or objections you have raised

If you do not wish to appear in photographs or have your image used, you can let us know at any time by contacting us at dataprotection@tcv.org.uk.

Where photographs include children or vulnerable individuals, we apply additional safeguards and seek appropriate permissions.

We will only use photographs for the purposes they were collected for and will retain them in line with our data retention policy.

Sensitive Data

Sensitive data refers to data that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We only collect information about your health when you volunteer with us and will also ask whether you have any criminal convictions/offences, this is also in-line with our requirements for volunteering. We process this information under UK GDPR Article 9 and Schedule 1 of the Data Protection Act 2018 for safeguarding and health and safety purposes.

Where we are required to collect personal data by law, or under the terms of the contract between us and you do not provide us with that data when requested, we may not be able to perform the contract (for example, to deliver goods or services to you). If you don’t provide us with the requested data, we may have to cancel a product or service you have ordered but if we do, we will notify you at the time.

We will only use your personal data for a purpose it was collected for or a reasonably compatible purpose if necessary. For more information on this please email us at dataprotection@tcv.org.uk. In case we need to use your details for an unrelated new purpose we will let you know and explain the legal grounds for processing.

We collect personal data relating to children as part of our activities. Where required, we obtain consent from a parent or guardian and apply additional safeguards to protect children’s information.

We may process your personal data without your knowledge or consent where this is required or permitted by law.

We do not carry out automated decision making or any type of automated profiling.

How we collect your personal data

We may collect data about you by you providing the data directly to us (for example by filling in forms on our site or by sending us emails, taking part in a quiz, making a donation, interacting with our social channels including paid for ads on Facebook). We may automatically collect certain data from you as you use our website by using cookies and similar technologies. Please see our cookie policy for more details about this.

We may receive data from third parties, such as analytics providers like Google based outside the EU, advertising networks such as Facebook based outside the EU, such as search information providers such as Google based outside the EU, providers of technical, payment and delivery services, such as data brokers or aggregators.

We may also receive data from publicly available sources such as Companies House and the Electoral Register based inside the EU.

Environmental programmes and I Dig Trees

We collect and process personal data as part of delivering and managing our environmental programmes, including the I Dig Trees programme.

This may include planting order information, tree species and quantities, delivery and planting locations (which may in some cases identify specific sites or land areas), organisation and contact details, inspection and monitoring data, and user account details for authorised staff. We also collect photographs submitted as part of programme delivery. These may include images of sites before and after planting, planting activity, and group or volunteer images which may include identifiable individuals.

We use this data to manage and deliver our programmes, verify and monitor planting activity, carry out inspections, analyse outcomes, and produce reports for funders and partners. We may also use photographs to evidence our work and, where appropriate, to support communications and promotion.

We process this data under our legitimate interests to deliver and manage our environmental programmes, and where applicable to meet contractual and legal obligations.

Where photographs include identifiable individuals, we take steps to minimise identification where possible. We rely on legitimate interests for general group images used in context, and on consent where images are used in a more prominent or identifiable way. Where images are submitted by third parties, we expect the person uploading them to have confirmed that individuals shown are aware and happy for the image to be shared.

We use trusted service providers to collect, store and analyse this data, including 3Adapt, who provide web-based data collection tools and the Landarna platform. 3Adapt acts as a data processor on our behalf and processes data only in line with our instructions.

We retain this data for as long as necessary to support programme delivery, reporting, audit and ongoing monitoring, and review it periodically to confirm it remains relevant. Further detail is set out in the data retention section below.

Marketing communications

Our lawful ground of processing your personal data to send you marketing communications is either your consent or our legitimate interests (namely to to support and promote our charitable activities and services).

Under the Privacy and Electronic Communications Regulations, we may send you marketing communications from us if (i) you made a purchase, donation, interacted with one of our social media campaigns or asked for information from us about our goods or services or (ii) you agreed to receive marketing communications and in each case you have not opted out of receiving such communications since. Under these regulations, if you are a limited company, we may send you marketing emails without your consent. However, you can still opt out of receiving marketing emails from us at any time.

Before we share your personal data with any third party for their own marketing purposes we will get your express consent.

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you OR by emailing us at dataprotection@tcv.org.uk at any time.

If you opt out of receiving marketing communications this opt-out does not apply to personal data provided as a result of a donation or other transactions, such as purchases, warranty registrations etc.

Disclosures of your personal data

We may have to share your personal data with the parties set out below. We share personal data with trusted service providers who process data on our behalf to support our operations. These providers are only permitted to process your personal data in line with our written instructions, must keep it secure and confidential, and cannot use it for their own purposes.

Service providers who support our operations and process personal data on our behalf, including IT systems, digital platforms and data processing systems (such as 3Adapt and the Landarna platform), payment providers (such as Stripe, PayPal, JustGiving and CAF), marketing and advertising platforms, analytics providers, and email communication tools.
Delivery partners and suppliers (for example tree suppliers and logistics providers) where personal data is required to fulfil project activities. These organisations may act as either processors on our behalf or as independent controllers, depending on the service provided.
Professional advisers including lawyers, bankers, auditors and insurers.
Government bodies that require us to report processing activities.
Third parties to whom we sell, transfer, or merge parts of our business or our assets.

We require all third parties to whom we transfer your data to respect the security of your personal data and to treat it in accordance with the law. We only allow third parties acting on our behalf to process personal data in accordance with our instructions.

International transfers

We may transfer personal data outside the UK where our service providers are based overseas. Where this happens, we use appropriate safeguards such as UK International Data Transfer Agreements or Standard Contractual Clauses.

Data security

We have put in place security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed without authorisation. We also allow access to your personal data only to those employees and partners who have a business need to know such data. They will only process your personal data on our instructions, and they must keep it confidential.

We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach if we are legally required to.

Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. For example, volunteer records: 7 years after last activity, photos: retained in line with project or communications use and reviewed periodically to ensure they remain relevant, Donor data: 7 years after financial year of donation.

When deciding what the correct time is to keep the data for, we look at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means and legal requirements.

For tax purposes, the law requires us to keep basic information about our customers and donors (including Contact, Identity, Financial and Transaction Data) for seven years after they stop being customers.

In some circumstances, we may anonymise your personal data for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

Your legal rights

Under data protection laws you have rights in relation to your personal data that include the right to request access, correction, erasure, restriction, transfer, to object to processing, to portability of data and (where the lawful ground of processing is consent) to withdraw consent. Where we rely on legitimate interests, you have the right to object to this processing at any time.

You can see more about these rights at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

If you wish to exercise any of the rights set out above, please email us at dataprotection@tcv.org.uk.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive or refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

All requests to access your personal data are dealt with undue delay and at the latest within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you.

If you are not happy with any aspect of how we collect and use your data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We should be grateful if you would contact us first if you do have a complaint so that we can try to resolve it for you.

How to make a data protection complaint

If you have concerns about how we have used your personal information, you can make a complaint to our Data Protection Officer by emailing dataprotection@tcv.org.uk or writing to the postal address above.

We will acknowledge your complaint within 30 days. We will investigate it without undue delay, keep you informed where our response takes longer, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office. You do not need to complain to TCV before contacting the ICO. Details are available at www.ico.org.uk.

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy.