Privacy Policy Version 02 

Created: 10th April 2023 

Maintaining your privacy and your trust is very important. We strive to be especially clear on how we use your personal information if and when we collect it, and how we can work together to protect your privacy. 

Data Protection Act 1998 & General Data Protection Regulation (also known as Regulation (EU)2016/679 or “GDPR”) (enforced from 25th May 2018) 

This Privacy Policy explains the following: 

• Identity and contact information of the data controller 
• Purpose of the processing and the lawful basis for the processing 
• Legitimate interests of the data controller or third party (if applicable) 
• Categories of personal data to be processed 

• Details of whether personal data came from direct or indirect sources 
• Recipients or categories of recipients of the personal data 
• Details of data transfers to a third country and safeguards 
• Length of time personal data is processed and any criteria used to establish the length of time the data is processed 
• Data Subject’s Rights (Your rights) 

• Right to complain to the supervisory authority/regulator 
• Details of any part of a statutory or contractual requirement and possible consequences of failing to provide the personal data 
• The existence of any automated decision-making, including profiling and information about how decisions are made 

What products and services are covered by this policy? 
This Privacy Policy applies to the information that we may obtain from you through your use of our catering services (sit-down lunches, meals on wheels, cafe venue, catering events), group activities, advice and information service, exercise classes, wellbeing services, home support service, training workshops, support groups, meetings, events or website(s), collectively called the “Services”. If you have any questions or need more information about these Services, please contact us at the email address in the section below. 

Data Controller 
For the purposes of data protection & privacy legislation, the Data Controller is: 
Kingsbridge Care Hub (“I”, ”we”, “us,” “our”) 

Legal Status: 
Charitable Organisation (283954). 

Postal Address: 
Kingsbridge Care Hub (Age Concern) 
Ilbert Road 
Kingsbridge 
TQ7 1DZ 

Email:  hello@kingsbridgecare.org mailto:info@kingsbridgeageconcern.org.uk 

Purpose and lawful basis 
How do we use the information we collect? 
We may use the information we collect for a variety of purposes, including to: 

Make our Services work for you 
Provide, operate, maintain, improve, personalise, and promote our Services; 
Develop new products, services, features, and functionality; 
Process and complete transactions and send you related information, including donation/purchase confirmations and invoices; 
Communicate with you, including responding to your comments, questions, and requests; providing customer service and support; 
Providing you with information about services, transmitting technical notices, updates, security alerts, administrative messages, or advertising or marketing messages; 
Providing other news or information about us; 
Monitor and analyse trends, usage, and activities in connection with our Services; 
Investigate and prevent fraudulent transactions, unauthorised access to our Services and other illegal activities; 
We may also use the information we collect for other purposes about which we notify you in subsequent versions of this document. 

Legitimate Interest 
How do we get your consent for collecting and storing your information? 

We only process personal data because such processing is necessary to enter into or perform a contract for our service(s). 
Personal data is only processed on the basis that the data subject has consented to such processing. 
Personal data is only processed on the basis we have a legitimate interest which is not overridden by the rights or freedoms of the affected data subjects. 

Categories of personal data and Sources 
What information do we collect from you, and how is it used? 

Direct: 
You can complete a manual data collection form which can be obtained from the data controller.  You can also visit our website without telling us who you are and without revealing any personal information about yourself. To provide full service, however, we often need to collect personal information. For instance, we collect information about you when you submit a contact form. The types of Information we collect may include email address, country of residence, and (optionally) your name and phone number. 

We may process sensitive/special personal data, such as medical details, for exercise classes or home support service purposes.  We do not process the personal data of data subjects under the age of consent (children). 

Indirect: 
From cookies: We may also collect “cookie” information that we may save to your computer or mobile device. Cookies are small data files stored on your hard drive or in device memory. We use cookies to improve and customise our Services and your experience, to allow you to access and use our Services without re-entering your username or password; to log visits and to understand which areas and features of the Services are most popular. 

We may also associate the information we store in cookies with personal information you submit while using our Services. You can instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie from websites you visit. If you do not accept cookies, however, you may not be able to use all aspects of our Services. 

For specific information on cookies, please read our cookie policy. 

Logs: 

We may record certain information and store it in log files when you interact with our Services. This information may include Internet protocol (IP) or other device addresses or ID numbers as well as browser type, Internet service provider, URLs of referring/exit pages, operating system, date/time stamp, the information you search for, locale and language preferences, your mobile carrier, and system configuration information. 

Analytics: We, and our analytics providers, also collect and store analytics information when you use our Services to help us improve our Services. We make sure this data is anonymous by not connecting any analytics data to personally identifiable data such as a name, email address, physical address, or phone number. 

How might we share information? 

We are not in the business of selling your personal information. We consider this information to be a vital part of our relationship with you. There are, however, certain circumstances in which we may share your personal information with third-party data processors, as set forth below: 

With your consent: We will not share your personal information with companies, organisations, or individuals who are not associated with us unless we have your affirmative consent to do so. 

Payment Processing: We use a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing. 

Newsletter Service: We use a commercial application to facilitate our newsletter service. 

Compliance with Laws and Law Enforcement Requests; Protection of Our Rights: We may disclose your information (including your personal information) to a third party if: 

We believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process or governmental request 
To protect the security or integrity of our products and services 
To protect our property, rights, and safety and that of our customers or the public from harm or illegal activities. 
To respond to an emergency which we believe in good faith requires us to disclose information to assist in preventing the death or serious bodily injury of any person; or 
To investigate and defend ourselves against any third-party claims or allegations. 
Business Transfers: 
We may share or transfer your information in connection with, or during negotiations of, any merger, transfer of charity assets, financing, or acquisition of all or a portion of our business to another charitable or non-profit organisation. We will notify you of such a change in ownership or transfer of assets by posting a notice on our website. 

Data Transfers 
The data controller does not transfer personal data outside of the United Kingdom or European Union, apart from the following exceptions, which are indicated below.  All data processors acting on behalf of the data controller have appropriate safeguards in place. 

Data Processor Information 
The following third-party service providers are used by us and only process data in accordance with the instructions from the data controller: 

Mail Chimp 
Privacy Statement           
Sign up for activities, services, events, advice, well-being services and group sessions 
 
PayPal (Europe) 
Privacy Statement 
Payment Processing 
 

Square 
Privacy Statement 

Stripe 
Privacy Statement 

 
Zooming Websites 
Privacy Policy 
Website Hosting, Email Hosting & Contact Form 
 

How long will we keep the personal data? 

Retaining some data may be subject to a statutory retention period and this must be adhered to, (to keep certain data for a minimum period of time). This may include personal data (name, address, contact details), but on expiry of such statutory requirement, such data will be destroyed securely. Where possible any personally identifiable data will be anonymised or pseudonymised. 
Your information we use for marketing purposes will be kept with us until you notify us that you no longer wish to receive this information. Our backup routine keeps data for a rolling 30 day period after which time the data is removed from all systems. 

Statutory or other requirements 
The data controller does not process personal data in respect of any statutory requirement, nor require personal data to be supplied as part of any contractual agreement, however in respect of the controller’s services, certain communications may not be possible without such personal data being supplied, for example an email to furnish with updates information etc. 

Profiling and Automated Decision Making 

No profiling or automatic decision-making processes are undertaken by the data controller in respect of any personal data processing activities. 

Your rights 

Your rights as a Data Subject are: 

The right to be informed 
The right of access 
The right of rectification 
The right of erasure (often known as the right to be forgotten) 
The right to prevent processing 
The right to data portability 
The right to object 
Rights in relation to automatic decision making and profiling 
Under the right of access (2), you have the right to obtain: 

– confirmation that your data is being processed; 
– access to your personal data; and 
– other supplementary information 

So that you are aware of and can verify the lawfulness of the processing 
Your right to access can be exercised by contacting the data controller as above. 

Your right to complain to the supervisory authority/regulator 

You have the right to complain about organisations processing your personal data.  You can exercise this right by contacting the supervisory authority of the data controller as follows: 

Head office 

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number