Privacy notice

Cardiff Foodbank is a data controller registered with the UK Information Commissioner’s Office registration number Z2683804.

Keeping your personal information safe is very important to us. We are committed to complying with privacy and data protection laws and being transparent about how we use personal data.

We have policies, procedures and training in place to help our people understand their data protection responsibilities and follow the principles of data protection.

We have a nominated member of staff who is responsible for oversight of our Data Protection responsibilities. If you have any questions regarding our Privacy Policy, please email info@cardiff.foodbank.org.uk

This privacy policy relates to personal information that Cardiff Foodbank collects and uses. We are an independent organisation which is part of the Trussell Foodbank Network. We share personal information about food bank use with Trussell which is a separate data controller. Trussell directly supports over 1400 food bank centres throughout the UK which together represent the Foodbank Network. For more information about who we share your personal data with please visit the “Sharing personal information” section below.

How we collect personal information

We may collect your personal information from you directly when:

communicate with us for any reason, by post, telephone, text, email or via our website
make a donation
visit a food bank or are referred to a food bank for support
participate in a survey or research
work or make an application to work or volunteer for us
agree to help us promote our work
interact with us as a supplier, contractor, consultant or in any other capacity.

We may also collect personal information about you from other organisations. For example, from a referral agency like a doctor’s surgery, when you are referred to the food bank.

The personal information that we collect

We only collect personal information that we genuinely need.

This may include:

For people referred to the food bank:

We will keep the data that you provided when referred for a foodbank voucher(s) including your name; address; and year of birth;
information about your household, including the number of other adults and children living with you;
the reason you were referred and your explicit consent where appropriate.
We will also keep a record of who gave you the foodbank voucher;
With your consent, your phone number so the food bank can contact you about any support available.
where you give your explicit consent any dietary requirements;
With your explicit consent, Ethnicity information for equalities monitoring purposes
Financial information that you provide to us, for example, payment information when making a donation, including any gift aid declaration you make

Contact information you provide when donating food, support one of our campaigns, or signup to receive communications from us.

For job and volunteer applicants:

your bank account details, tax and residency status
references from previous employers or educational institutions
contact details for your family members and next of kin
qualifications
information concerning your health and medical conditions
information about your race, ethnicity and sexual orientation
details of unspent criminal convictions.

Our legal basis for processing personal information

Our legal basis for processing personal information is usually for our legitimate interests, or your consent, for the performance of a contract or to meet our legal obligations.

We may collect and use your personal data if it is necessary for our legitimate interest and so long as its use is fair, balanced and does not unduly impact your rights.

We will ask you to opt in to receiving marketing emails and text messages from us. You can unsubscribe from this at any time.

Usually we will only process sensitive personal data if we have your explicit consent. In extreme situations, we may share your personal details if we believe someone’s life is at risk.

We may process personal information because it is necessary for the performance of a contract to which you are a party (or to take steps at your request prior to entering a contract), or because we are legally obliged to do so, for example to meet employment or charity laws.

We collect and use personal information about people who use food banks, supporters, job applicants and volunteers for a number of reasons.

Why we collect personal information

Assisting people that use food banks

Developing relationships with supporters

Processing donations

Dealing with complaints and appeals

Promoting our cause

Carrying out surveys and research

Health, safety and security

Employee and volunteer administration and development

Recruitment

Undertaking safeguarding activities including DBS checks

Processing expenses

Governance

Cookies, web beacons and other storage technologies used on our website

Sharing personal information

We will only share your personal information where we need to, where someone’s life is at risk or we are required to do so by law.

We may share your personal information with Trussell which is a separate data controller. Trussell directly supports over 1400 food bank centres throughout the UK which together represent the Foodbank Network. Where we share your personal information with Trussell we will inform you as outlined in the section “Why we collect personal information” above. We have a data sharing agreement in place with Trussell which sets out what information is shared, and why we share your data. View Trussell’s privacy notice here.

We may share your personal information with third party organisations who will process it on our behalf, for example a mailing house, our IT hosting or support service providers. We have data processing agreements or clauses in place with any data processors that we may use, ensuring they will not use your information for their own purposes and that they protect your personal information to the same standards as set out in our policies.

We may also share your information with our bank to process a payment; our professional advisers (such as our legal advisers) where it is necessary to obtain their advice.

Where required, we will process personal information to comply with our legal obligations. In this respect we may share your personal data to comply with subject access requests; tax legislation; for the prevention and detection of crime; and to assist the police and other competent authorities with investigations including criminal and safeguarding investigations.

In some situations, the organisation may transfer some or all its assets as part of a merger or acquisition. If another organisation acquires the food bank, they will hold substantially all the same information and will assume the rights and obligations with respect to the personal information as described in this privacy policy.

International transfers of data

We may need to transfer some personal data to the third parties described above who are located outside of the UK. In such cases, we will take appropriate measures to ensure your personal data remains protected. If the receiving organisation is based outside of the UK and in a country that is not protected by an adequacy decision (providing an adequate level of data protection) we will take appropriate safeguards, such as implementing International Data Transfer Agreements as part of our contracts with our processors.

If you have any questions or need more information regarding international transfers of your personal data, please contact us at info@cardiff.foodbank.org.uk.

Your rights

If you no longer wish to receive communications about products and services from us, please contact info@cardiff.foodbank.org.uk

You can also unsubscribe at any time to emails that we may send to you about the products and services that we think will be of interest to you. A link to unsubscribe from all direct marketing will be included in any communications.

You also have the right to:

Ask us for copies of your personal information.
Tell us to change or correct your personal information if it is incomplete or inaccurate.
Ask us to restrict our processing of your personal data or to delete your personal data if there is no compelling reason for us to continue using or holding this information.
Receive from us the personal information we hold about you which you have provided to us, in a reasonable format specified by you, so that you can send it to another organisation.
Object, on grounds relating to your specific situation, to any of our processing activities where you feel this has a disproportionate impact on you.

For all requests please contact us at info@cardiff.foodbank.org.uk. We will respond to any request within 30 days.

Please note that we may be entitled to refuse requests where exceptions apply, for example, if we have reason to believe that the personal data we hold is accurate or we can show our processing is necessary for a lawful purpose set out in this Privacy Policy.

How long we keep your personal information

We will hold your personal information only for as long as is necessary. We will not retain your personal information if it is no longer required. In some circumstances, we may legally be required to retain your personal information, for example for finance, employment or audit purposes. We have in place a personal data retention schedule which sets out how long we keep your personal information for. A summary of our retention periods is available below.

People who need help from the food bank	Your personal information is stored in a secure database for seven years from the date you last received support.
People who donate food	Where you provide personal information alongside your food donation, your personal information is stored in a secure database for three years from the date you last donated.
People signing up to a campaign	Your personal information is stored in a secure database for up to two years from the date you last took an action.
Financial donors	Your personal information is stored in a secure database for seven years from the date you last donated.
Volunteers (inc. people engaged in our participation projects)	If your application is unsuccessful, or if you stop volunteering, your information will be held for twelve months unless we’re obliged to keep it longer. In which case, we only keep necessary information.
Survey and research participants	Twelve months after survey is completed. Then results are anonymised.
Promoting our work through sharing your story, photographic images and videos	Up to five years after consent was obtained, unless you withdraw your consent sooner.
Representatives of referral agency partners	Two years after the date of the last referral made.
Complainants	Six years if the complaint is upheld, three years if the complaint is not upheld.
Employees	Seven years after employment ceases.
Website users	See our cookie policy

Changes to this Privacy Notice

This Privacy Notice was last updated on 10 October 2024 and may change from time to time. We recommend that you please visit this webpage periodically to keep up to date with the changes in our Privacy Notice.

Making a complaint to the Information Commissioner’s Office

If you are not satisfied with our response to any query you raise with us, or you believe we are processing your personal data in a way which is inconsistent with the law, you can complain to the Information Commissioner’s Office whose helpline number is: 0303 123 1113. 