Data Protection

Privacy Notice

The Elmgrant Trust is committed to protecting your personal data. This privacy notice explains how we collect, use, and store your information in accordance with the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA).

1. Information We Collect

We collect personal information when you contact us, apply for a grant, or interact with our website. This may include:

  • Contact details (name, address, email, phone number).
  • Financial information (bank details for paying grants).
  • Application data (information provided in your grant application).

2. How We Use Your Information

We use your personal data to:

  • Process and assess your grant applications.
  • Administer and monitor grant payments.
  • Respond to your enquiries and communicate with you.
  • Comply with legal obligations (such as Charity Commission or HMRC reporting).

3. Our Legal Basis for Processing

We process your data because it is necessary for our legitimate interests in assessing and managing grants, or to fulfil a legal obligation. If we fund your organisation, we process data to fulfil our contractual agreement with you.

4. Data Sharing

We do not sell or rent your data. We only share your information with:

  • Trustees and assessors who review applications.
  • Regulatory bodies (like the Charity Commission) if required by law.
  • Third-party service providers (like our website host or IT support) who handle data securely on our behalf.

5. Data Retention

We only keep your personal data for as long as necessary.

  • Unsuccessful applications: Destroyed within 2 years of the decision.
  • Successful applications: Retained for 6 years after the grant ends for financial and auditing purposes.

6. Your Rights

Under UK data protection law, you have the right to:

  • Access the personal data we hold about you.
  • Correct any inaccuracies in your data.
  • Request erasure of your data (in certain circumstances).
  • Restrict or object to our processing of your data.

7. Data Protection Complaints Procedure (DUAA)

If you have a concern or complaint about how we handle your personal data, you have a statutory right to complain directly to us before escalating the matter.

To make a complaint, please contact us via our main administration email with COMPLAINT in the subject line, this will ensure that your email is prioritised in our part-time administrative hours:

info@elmgrant.org.uk

or write to us at The Elmgrant Trust, The Elmhirst Centre, Dartington Hall, Totnes. Devon TQ9 6EL with COMPLAINT written on the back of the envelope.

Upon receiving your complaint, we will:

  • Acknowledge receipt of your complaint within 30 calendar days.
  • Investigate your concerns and make appropriate enquiries without undue delay.
  • Keep you informed of our progress and explicitly notify you of the formal final outcome.

If you remain dissatisfied with our response or how we handled your complaint, you can then escalate your concern to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

8. Contact Us

If you have any questions or want to exercise your rights, please contact our Data Protection lead at the email and address in section 7 above. Please address your email or envelope to The Data Protection Lead so that we can prioritise your communication in our part-time administrative hours.