Privacy Policy

INTRODUCTION

 

The Age Friendly Cotswolds website is run by Cotswold Friends.  We are committed to protecting your personal information and being transparent about how we use it.

​

This Privacy Policy explains how we collect, use, store, and share personal data, and outlines your rights under data protection law.

​

This policy applies to personal data collected through our website, services, activities, events, communications, and recruitment processes.

​

Cotswold Friends is the data controller for the purposes of UK data protection law.

​

Contact details:
Email: info@cotswoldfriends.org
Address Cotswold Friends, High Street, Moreton in Marsh, Gloucestershire, GL56 0AZ
Telephone: 01608 651415

Our ICO Registration reference is  ZA132774

If you have any questions about this policy or how your data is handled, please contact us using the details above.

 

DATA PROTECTION PRINCIPLES

We process personal data in accordance with UK data protection law. This means personal data is:

• Processed lawfully, fairly and transparently

• Collected for specified and legitimate purposes

• Limited to what is necessary

• Accurate and kept up to date

• Retained only for as long as necessary

• Kept secure using appropriate technical and organisational measures

​

WHAT PERSONAL DATA WE COLLECT

We may collect and process the following types of personal data:

​

Website Users

• IP address

• Browser type and device information

• Pages visited and time spent on our website

• Referral sources (the site you found us from)

This information is collected via analytics tools to help us understand and improve our website.

​

People Who Contact Us

• Name

• Email address

• Telephone number

• Information provided in correspondence or forms

 

Clients / Service Users

• Contact details

• Support needs and service information

• Safeguarding information (where applicable)

• Special category data such as health information (only where necessary)

 

Volunteers, Staff and Trustees

• Contact details

• Application and recruitment information

• Staff or volunteering records

• DBS information where required

• Special category data such as health information (only where necessary)

 

Donors and Supporters

• Contact details

• Donation records

• Gift Aid information

We only collect information that is relevant and necessary for the purposes described in this policy.

​

LAWFUL BASIS FOR PROCESSING

We process personal data under one or more of the following lawful bases:

• Legal obligation - where required by law

• Contract - to deliver services or manage staff/volunteering

• Legitimate interests - to operate and improve our services

• Vital interests - including safeguarding

• Consent - where explicitly given (for example, certain communications)

 

Where we process special category data (such as health or safeguarding information), we do so under Article 9(2)(g) of UK GDPR - substantial public interest - including safeguarding of vulnerable individuals, and in accordance with the Data Protection Act 2018.

​

The lawful basis for each category of data is recorded in our Information Asset Register.

 

HOW WE USE YOUR INFORMATION

We use personal data to:

• Deliver our services and support

• Communicate with clients, volunteers, staff, donors, supporters, and partners

• Manage safeguarding responsibilities

• Process donations and Gift Aid

• Improve our website and services

• Meet legal and regulatory requirements

• Manage recruitment, staff and volunteering

• Monitor and evaluate our work

We do not use personal data for purposes that are incompatible with those described in this policy.

 

COOKIES AND WEBSITE ANALYTICS

Our website uses cookies and analytics tools to understand how visitors use our site.

Cookies are used only with your consent, which can be managed via our cookie banner or browser settings.

For full details, please see our Cookie Policy.

​

SHARING YOUR DATA

We may share personal data with:

• Staff and trustees on a need-to-know basis

• Approved UK based IT and system providers

• Referral and signposting with permission

• Regulators or authorities where legally required

• Safeguarding agencies where necessary to protect individuals

All third-party processors are required to handle data securely and in line with data protection law.

We do not sell personal data.

 

 INTERNATIONAL TRANSFERS

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place in accordance with UK GDPR, such as Standard Contractual Clauses or equivalent protections.

 

HOW LONG WE KEEP YOUR DATA

We retain personal data only for as long as necessary to meet legal, operational, and safeguarding requirements.

We do not keep personal data longer than necessary.

Safeguarding concerns and complaints may be retained for up to 25 years where required for legal, insurance, or safeguarding purposes.

Full retention periods are set out in our Data Retention Policy.

 

DATA SECURITY

We take appropriate technical and organisational measures to protect personal data, including:

• Secure systems and password protection

• Restricted access on a need-to-know basis

• Locked storage for paper records

• Controlled access to digital systems

• Secure deletion and destruction of data

• Regular review of access permissions

In the event of a data breach that poses a risk to individuals, we will notify affected individuals and the ICO where required by law.

While we take reasonable steps to protect data, no online system is completely secure and data transmission over the internet carries inherent risk.

 

YOUR RIGHTS

Under UK data protection law, you have the right to:

• Access your personal data

• Request correction of inaccurate data

• Request deletion where applicable

• Restrict processing

• Object to processing

• Authorise data portability if transferring to a new/alternative service

• Withdraw consent where processing is based on consent

You have the right to complain to the Information Commissioner’s Office (ICO):

Contact details:
Website: ico.org.uk
Address Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0404 123 1113

Requests should be made in writing using the contact details above. We may ask for proof of identity. We aim to respond to requests within one month

​

CHILDREN’S DATA

We do not knowingly collect personal data from children without appropriate consent and safeguards.  As part of the Cotswold Friends Young Volunteer Programme 14-16, we request parental consent and as part of the Young Volunteer Programme 16-18 we encourage those who take part in the programme that they include their parents/guardians in the decision making process.

 

AUTOMATED DECISION MAKING

We do not use automated decision making or profiling.

 

THIRD-PARTY WEBSITES

Our website may contain links to other websites. We are not responsible for their privacy practices and encourage you to read their privacy policies.

 

CHANGES TO THIS POLICY

We may update this policy from time to time. The latest version will always be available on our website.

 

OTHER RELEVANT POLICIES

This policy should be considered alongside the following Charity policies:

• Data Handling Code

• Data Retention Policy

• Cookie Policy

• Information Asset Register Policy

• Data Breach Procedure

• Secure Storage Controls

 

POLICY MONITORING AND REVIEW

Compliance with this policy will be monitored through supervision, audits, incident reviews, complaints, training records and governance processes.

 

This policy will be reviewed annually and following any relevant incident, or sooner where there are changes to legislation, regulation, guidance or organisational practice.

 

CF Privacy Policy September 2026

Next Review September 2027