1. Introduction
This privacy notice provides you with details of how Cumbria Connect collects and protects your personal data through your use of our website www.connectfornature.org.uk and that you may provide us in the course of our work. We are committed to ensuring that your privacy and personal details are protected.
The General Data Protection Regulation and the UK Data Protection Act 2018 governs how we can communicate with you. As a result, we rely on you giving us your consent about whether you want to receive communications from us, how we can contact you in connection to marketing and select how you want to receive them (email, phone, SMS, WhatsApp or post). We may use other lawful grounds for processing your personal data, depending on the relationship we have with you (please see Section 3 on How We Use Your Information).
You can decide not to receive communications or change how we contact you at any time. It is very important that the information we hold about you is accurate and up to date. If you wish to do so please contact The Cumbria Connect Team by emailing cumbriaconnect@connectfornature.org.uk or writing to Cumbria Connect, Old Lowther College, Lowther, Penrith, CA10 2HH.
We will never sell your personal data.
Questions?
Any questions you have in relation to this policy or how we use your personal data should be sent to cumbriaconnect@connectfornature.org.uk or addressed to Cumbria Connect, Old Lowther College, Lowther, Penrith, CA10 2HH.
2. What information we collect
We collect data you provide to us.
Your activities and involvement with Cumbria Connect will result in personal data being created. This could include details of how you’ve helped us by volunteering, when booking and attending an event, or being involved with our campaigns and activities, as well as when you engage in our social media or digital advertising.
Examples include personal details (name, date of birth, email, address, telephone etc.) when you apply for a job or to volunteer with us; financial payment information such as credit/debit card or direct debit details (Please see section 5 for more information on payment security); and details of your interests and preferences (such as your interest in nature-friendly farming, events or campaigns).
Sensitive personal data
We do not normally collect or store sensitive personal data (such as information relating to health). However, there are some situations where this will occur (e.g. if you volunteer with us, if you have an accident at one of our events). If this does occur, we’ll take extra care to ensure your privacy rights are protected.
Accidents or incidents
If an accident or incident occurs on our property, at one of our events or involving one of our staff (including volunteers) then we’ll keep a record of this (which may include personal data and sensitive personal data).
Volunteering
If you are a volunteer (whether for specifically Cumbria Connect, or if you are helping us for other reasons – for example you work for another organisation which is running an event with us) then we may collect extra information about you (e.g. references, criminal records checks, details of emergency contacts, medical conditions etc.). This information will be retained for legal reasons, to protect us (including in the event of an insurance or legal claim) and for safeguarding purposes. You may also receive communications from us providing you with information about your duties as a volunteer, including your local group duties.
Website Cookies
A cookie is a small text file which is placed onto your computer or electronic device when you access our website. It is used to identify your computer and how you move about our website. This enables use to understand how you use our website and improve your visit experience.
When someone visits www.connectfornature.org.uk we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone, and we do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.
In most cases we require your consent in order to use cookies on this website. The exception is where a cookie is essential to the function of the website. For non-essential cookies we will ask for your consent via the cookie banner at the bottom of the page when you first visit.
You may choose to reject our cookies by disabling them in the cookie banner.
Embedded content from other websites
Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
Mailing Lists
As part of the registration process for our newsletter updates, we collect personal information. We use that information to tell you about news and activities you’ve asked us to tell you about. We don’t rent or trade email lists with other organisations and businesses.
We use a third-party provider, MailerLite, to deliver our newsletters and email updates. We gather statistics around email opening and clicks using industry standard technologies to help us monitor and improve our newsletters. For more information, please see MailerLite’s privacy notice. You can unsubscribe to general mailings at any time of the day or night by clicking the unsubscribe link at the bottom of any of our emails or by emailing cumbriaconnect@connectfornature.org.uk
Photographs and video
We often take images of multiple participants at our public events. It is our legitimate interest to do so for publicity purposes and as a record of our work. We will ensure that people participating in our group events are given advance notice of our intention to collect images and reminders on the day. They will have the right to object to our use of them.
In the event that we are taking specific, close-up images of individuals whose names may be included in our use of those images, we may secure and retain the individual’s written consent.
If we are taking readily identifiable images of children, we will take extra care to ensure their privacy rights are respected. If under 16 years of age, we will secure written parental consent for the taking and use of the photograph or video. If 16 to 18 years of age, we secure consent from the child. Consent can be withdrawn at any time.
Children’s data
Whilst children over the age of 13 can give their own consent to marketing, we have decided not to process the data of anyone under the age of 18 for marketing purposes, in order to best protect the privacy of children. We will not knowingly send marketing information to anyone under the age of 18.
On occasion, we may hold the data of children who are taking part in events. This may include health data as well as name, address and date of birth. In these circumstances, the data will need to have been provided by the parent or guardian. In all cases, children are required to be accompanied at our events by a responsible adult
3. How we use information
We only ever use your personal data with your consent, or where it is necessary in order to enter into, or perform, a contract with you; where you have given us your consent to do so, to keep you informed about: visiting our sites, volunteering with us, events, nature restoration work;
- comply with a legal duty;
- protect your vital interests;
- to enable trusted partner organisations to perform services on our behalf;
- to better understand how we can improve our services for you.
- for our own (or a third party’s) lawful interests, provided your rights don’t override these.
In any event, we’ll only use your information for the purpose or purposes it was collected for (or else for closely related purposes):
Administration
We use personal data for administrative purposes (i.e. to carry out our nature restoration work and in providing support to the farmers and landowners with agricultural scheme applications). This includes:
- maintaining databases of our volunteers
- processing bookings for events and workshops (whether placed online, over the phone or in person);
- helping us respect your choices and preferences (e.g. if you ask not to receive marketing material, we’ll keep a record of this).
- Internal research and analysis
Marketing
We use personal data to communicate with people, to promote Cumbria Connect and its partners and nature restoration work. This includes keeping you up to date with our news, updates and campaigns.
Social media
We use a third-party provider, Meta Business, to manage our social-media interactions. If you send us a private or direct message via social media, it will be stored by Meta Business. It will not be shared with any other organisations.
We see all this information and decide how we manage it. For example, if you send a message via social media that needs a response from us, we may process it as an enquiry or a complaint or a request for information.
When contacting Cumbria Connect through a social media platform, we suggest you also familiarise yourself with the privacy information of that platform. The social media platforms we currently use are:
- YouTube
4. How long we keep information
We only retain data for as long as is necessary to fulfil the purpose we collected it for (analytics) and to satisfy any legal or accounting requirements.
By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.
5. Payment security
All electronic Cumbria Connect forms that request financial data will use the Secure Sockets Layer (SSL) protocol to encrypt the data between your browser and our servers.
RSPB complies with the payment card industry data security standard (PCI-DSS) published by the PCI Security Standards Council, and will never store card details.
Of course, we cannot guarantee the security of your home computer or the internet, and any online communications (e.g. information provided by email or our website) are at the user’s own risk.
6. Who we share information with
We will never sell your personal data. If you have opted-in to marketing, we may contact you with information about our partners, or third-party products and services, but these communications will always come from Cumbria Connect and are usually incorporated into our own marketing materials (e.g. advertisements in magazines or newsletters).
As we operate as a partnership, we work closely with our partners (Lowther Estates, RSPB, United Utilities, Natural England) and delivery partners ( e.g. Ernest Cook Trust, Orton Fells Farm Cluster, Eden Rivers Trust, Lune Rivers Trust, Cumbria Wildlife Trust), we may also share information with them (for example, if you register to attend an event being jointly organised). We’ll only share information when necessary and we’ll make sure to notify you first.
We also use the following organisations and platforms to process your data:
- Endangered Landscapes & Seascapes Programme, part of the Cambridge Conservation Initiative
Cumbria Connect is part of the Endangered Landscapes & Seascapes Programmes funded by Arcadia and managed in partnership with the Cambridge Conservation Initiative. We share information in accordance with the delivery of our contract with them.
RSPB
Cumbria Connect is managed by the RSPB ((charity no. 207076 in England). In this way, the RSPB is a data processor that manages our recruitment process, our payroll information, they manage our IT systems and they store our HR records.
Mailerlite
This data processor does the following activities for us: Uses MailerLite to Process Customer Data to provide newsletter and marketing subscription and distribution services.
This data processor does the following activities for us: Uses MailerLite to Process Customer Data to provide newsletter and marketing subscription and distribution services as well as providing an email service for our general enquiries.
JotForm
We use Jotform online secure forms to collect photo and filming consent. These forms are encrypted for added security. For more information on the security of these forms please visit: Secure Online Forms | Form Security | Jotform
Microsoft
Some of our systems use Microsoft products. As a US company, it may be that using their products result in personal data being transferred to or accessible from the US. However, we’ll allow this as we are certain personal data will still be adequately protected (as Microsoft is certified under the USA’s Privacy Shield scheme).
7. Sharing information outside the UK
Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place. Please contact us for more information.
8. Your data protection rights
We want to ensure you remain in control of your personal data. Part of this is making sure you understand your legal rights, which are as follows:
- Your right of access – You have the right to ask us for copies of your personal data.
- Your right to rectification – You have the right to ask us to rectify personal data you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure – You have the right to ask us to erase your personal data in certain circumstances. This does not include any data we are obliged to keep for administrative, legal, or security purposes.
- Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal data in certain circumstances.
- Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.
- Your right to data portability – You have the right to ask that we transfer the personal data you gave us to another organisation, or to you, in certain circumstances.
- Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent.
You don’t usually need to pay a fee to exercise your rights. If you make a request, we have one calendar month to respond to you.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
9. How to complain
If you have any concerns about our use of your personal data, you can make a complaint by emailing cumbriaconnect@connectfornature.org.uk.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. Details of how to do this can be found at www.ico.org.uk
10. Changes to this privacy policy
We’ll amend this Privacy Policy from time to time to ensure it remains up-to-date and accurately reflects how and why we use your personal data. The current version of our Privacy Policy will always be posted on our website.
This Privacy Policy was last updated on 1 May 2024