Privacy Policy

Privacy policy & data subject rights

Identity and contact details

Please click here to find out more about the Organic Research Centre (ORC). Our postal address is Trent Lodge, Stroud Road, Cirencester, England, GL7 6JN.  Our telephone number is +44 (0) 1488 658298.  You can contact us by email using dataprivacy@organicresearchcentre.com. We are Progressive Farming Trust Limited, a registered charity in England and Wales (281276), and a limited company registered no. 1513190 (England and Wales).

Our designated supervisory authority under the General Data Protection Regulation (GDPR) is the Information Commissioner’s Office (ICO). We are based in the United Kingdom.

To contact the individual in charge of Data Protection in our company please use dataprivacy@organicresearchcentre.com.

What data we collect

The ORC processes data on:

  • Supporters and those interested in ORC
  • Those involved in ORC services and projects carried out by ORC
  • Those using ORC services and products
  • Staff (employees, contractors and members of and advisors to the board)
  • Suppliers and partners of ORC

1. Supporters and those interested in ORC

For supporters that make financial donations to ORC (‘donors’), we record information that enables us to process donations, such as name, contact details and financial details.  We will assume consent for us to process the data in this manner when a donation form is completed.

We use the data on donors to communicate electronically with them for fundraising purposes using a lawful basis of consent. We will retain an audit of where and when we received the consent to communicate with the donor about fundraising.

We use the data on donors to communicate in other ways apart from electronically for fundraising purposes using a lawful basis of legitimate interests, as it is in our interests to raise money for running the ORC. We have completed the specification, gate analysis and balancing tests specified under GDPR for this data.  We do not capture special category information on data in this category.  We note that we should consult the MPS when using this mechanism to evaluate legitimate interests in alignment with the Fundraising regulator’s code of practice.

We will also process data to enable us to engage with individuals in our knowledge sharing, research and the promotion of our services and ideals.  Being able to contact individuals in this context is in the legitimate interests of the ORC so that we can fulfil the goals of our constitution.  We have completed the specification, gate analysis and balancing tests specified under GDPR for this data.  We do not capture special category information on data in this category. 

Where regulations mandate that that we must obtain consent from individuals, for example if the data subject is not an employee of a business (a ‘corporate subscriber’) and we intend to use email to communicate, then we will use the lawful basis of consent to process data on knowledge sharing, research and the promotion of our services and ideals. This lawful basis of consent can include the use of a ‘soft opt-in’. If we use a soft opt-in, then we will not use this soft opt-in for fundraising or promotion of our ideals.

Where we hold data on individuals who we have identified as potential donors (which can include previous donors), we may profile these individuals so that we can evaluate their potential for giving to ORC.  We may use additional information such as geographical information and measures of affluence where available from external sources to assist us. This will be a combination of publicly-available information with what data we already hold, such as past donations. We may use the services of external screening or profiling companies, and publicly available data from social media.  It is in ORC’s legitimate interests to do this, and our interest is specifically in aiming to get the largest donation from the lowest overhead.  We have completed the specification, gate analysis and balancing tests specified under GDPR for this data.  We do not capture special category information on data in this category.

2. Those involved in ORC services and projects

We process information on individuals that are involved in our projects, and we can use this in our literature, newsletters and social media. This information may include names, personal stories, photos, audio and video. We use a lawful basis of consent to capture, store and publish this information.

3. Users of ORC services and products

We process information on individuals that attend conferences, other events, or who consume ORC publications and information for the purposes of providing the individuals with the services or products. We use a lawful basis of contract to process this data.

We will also process data to enable us to communicate with users of ORC services and products about topics apart from the services and products.  Being able to contact individuals in this context is in the legitimate interests of the ORC so that we can fulfil the goals of our constitution.  We have completed the specification, gate analysis and balancing tests specified under GDPR for this data.  We do not capture special category information on data in this category.

Where regulations mandate that that we must obtain consent from individuals, for example if the data subject is not an employee of a business (a ‘corporate subscriber’) and we intend to use email to communicate, then we will use the lawful basis of consent to process this data. This lawful basis of consent can include the use of a ‘soft opt-in’. If we use a soft opt-in, then we will not use this soft opt-in for fundraising or promotion of our ideals.

We process information on individuals that we provide loans to so that we can support their goals where they align with the organisations aims. We use a lawful basis of contract to process this data.

4. Staff

We process information on staff in several ways.  We use the lawful basis of contract to process data for the purposes of a contract of employment or other work for ORC, or if individuals are taking steps to enter into a contract (for example for recruitment).  This includes keeping track of the amount of time that staff spend on projects or performance evaluation or expenses claims.  We can capture special category information as the processing of this data is necessary for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection. 

We process information on staff and can pass data on to specific parties because we are legally obliged to.  For example, where we pass information to the HMRC on the amount that employees are paid.

We process information on staff and can pass data on to specific parties because we are acting as an intermediary to a contract between the member of staff and the third party.  For example, where we organise pension payments for staff. We use a lawful basis of contract to process this data. 

We process information on staff and their next of kin where it is in ORC’s interest to do so for operational purposes.  For example, to keep staff up to date with ORC news, to maintain a list of the staff’s next of kin for communication in the event of an emergency, or to create business cards for staff. We use the lawful basis of legitimate interests to process this data.  We have completed the specification, gate analysis and balancing tests specified under GDPR for this data.  We do not capture special category information on this data.

5. Suppliers and partners

We process information on suppliers and partners so that we can purchase goods and services from them.  We use a lawful basis of contract to process this data.  We do not capture special category information on this data. 

Any recipient or categories of recipients of the personal data

ORC passes data on to other data controllers for the following purposes:

  • For data relating to those applying to be members of staff or for staff who have found other employment after the end of a contract, we share data with third parties to obtain and provide references;
  • As the data controller of data, we may provide access to data processors that process data on our behalf, who will only process the data according to the written instructions in the Data Processing Agreements in place with them.

Details of transfers to third country and safeguards

We share data with organisations with which we have a legal obligation to share data (for example HMRC).

We share data on staff with organisations where we are acting as an intermediary between the staff and an organisation providing benefits to the staff member (for example pension providers).

We will not transfer your data to countries outside the European Economic Area and the UK to destinations that are not considered ‘adequate’ by relevant legislation without your permission.

Retention period or criteria used to determine the retention period

  • Data relating to donors will be retained for as long as it is useful to the ORC. We will not communicate electronically about fundraising with donors if they have not responded to our communications for 2 years. 
  • Data relating to those involved in ORC services or projects will be deleted 3 years after the end of the most recent record of involvement where the data is under our control.
  • Data relating to those using or consuming ORC’s services or products will be deleted 3 years after the end of the most recent record of communication in relation to the use of the services or products.
  • We will delete data relating to staff members 3 years after their contract is terminated or their application is unsuccessful.
  • Data relating to suppliers or partners will be deleted 3 years after the end of the most recent communication with the supplier or prospect.
  • Where we have obtained consent for communication with an individual, we will expect this consent to be valid for two years unless either extended by the individual, or withdrawn at any point by the individual.

If these data retention timescales clash with legal or contractual obligations then these other obligations will override the retention timescales outlined. For example, UK limited companies are required to retain records on tax paid for 6 years, and some contracts with the European Union oblige us to retain records on the projects for 10 years. 

We provide access to any personal data that exists in the documents in our knowledge base (research,  case studies), and because we consider that a historic perspective is useful to the users of the knowledge base, we do not delete these documents. 

All records are disposed of securely when deleted. 

How we look after data

We take reasonable technical and procedural precautions to prevent the loss, misuse or unauthorised alteration of personal data.

We store the personal data that we collect securely.

We do not publish the details of the safeguards we use to protect the personal data that we control as this could reduce the effectiveness of those safeguards.

Cookies

Cookies are text files placed on your computer to collect information about which pages you visit, and how long for. This information is used to track use of the website and to compile statistical reports on website activity.

When you visit our website you will be presented with a choice which will allow you to decide whether cookies are used or not. In a few cases some of our website features may not function if you choose not to allow cookies on our website.

Personal data may be shared with third parties to enable us to conduct web analytics to monitor use of our website. We use Google Analytics however, you can opt out of Google Analytics by using this link: https://tools.google.com/dlpage/gaoptout?hl+en=GB.

Other websites

Our website contains links to other websites. This privacy policy only applies to this website, so when you link to other websites you should read their own privacy policies.

Your rights

ORC recognises the rights of individuals as defined in the General Data Protection Regulation (GDPR).

We will always seek to uphold those rights and the links provided will enable you to communicate with us to exercise those rights, where relevant.

ORC recognises your right to lodge a complaint with a supervisory authority. You can access the ICO’s website from this link.

Version control

Last updated: 7th September 2020