1.   Policy statement

This is the privacy notice for Futureproof Cumbria. It explains the types of personal data we may collect about you when you interact with us. It also explains what we do with this information. Please read it carefully. We hope it will answer any questions you may have, but if not please do get in touch with us.

The current version of this policy is on our website and was last updated in September 2025.

2.   Background

Who we are:

Futureproof Cumbria helps people, communities, and organisations tackle the climate crisis by promoting action and supporting change.

Data controller

For the purposes of data protection, the data controller is Futureproof Cumbria This means that we decide the purposes for which and the way in which any personal data are processed

3.   Detail

Why we collect information about you

If anyone can be identified by any information that we collect, this information is called ‘personal data’.

Data protection law says that Futureproof Cumbria must have a reason or ‘purpose’ for collecting and using personal data.

Our purposes are to:

• Provide our services
• Manage our relationship with you
• Keep internal records
• Keep you informed of relevant activities and information
• Sell you products or collect donations online

Personal data we may collect about you:

• Your name and contact details
• Sensitive personal information (known as ‘special category’) including health details, ethnicity and religion
• Payment details

How we ensure that the processing we do is lawful

Futureproof Cumbria cannot use your personal data for any reason unless we have a legal basis to do so. Those that we use are:

Provide our services

• The data subject has given his or her explicit consent to the processing of the personal data for one or more specified purposes.
• The processing is necessary- for the performance of a contract to which the data subject is a party, or for the taking of steps at the request of the data subject with a view to entering into a contract.

Manage our relationship with you

• We have a legitimate interest in using your information. This information allows us to effectively process queries and improve delivery our services to you. We may use feedback given to us for these purposes.

Keep internal records

• The processing is necessary for compliance with any legal obligations to which the data controller is subject, other than an obligation imposed by contract.

Keep you informed of relevant activities and information

• The processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject.

Sell you our products or collect donations

• The processing is necessary – for the performance of a contract to which the data subject is a party, or for the taking of steps at the request of the data subject with a view to entering into a contract.
• The processing is necessary for compliance with any legal obligations to which the data controller is subject, other than an obligation imposed by contract.

Where we process special category personal data we use the following lawful bases for the processing:

• The data subject has given explicit consent to the processing of the personal data for one or more specified purposes.
• processing is necessary for the establishment, exercise or defence of legal claims or wherever courts are acting in their judicial capacity.
• processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1).

If you give consent, you have the right to withdraw this at any time by contacting us in writing using the address or contact details given in this privacy notice.

If you disagree with us using your personal data for one or more of our legitimate interests let us know in writing and we will stop using it for that purpose.

How long do we keep your information?

Whenever we collect or process your personal data, we’ll only keep it for as long as is necessary for the purpose for which it was collected.

At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.

We keep:

• Details of financial transactions and payments for a period of 7 years.
• Contact and other details of customers with whom we have/have had a working relationship and for organisations or individuals who contact us, 7 years after the last contact.

For more details see our Retention Schedule which is available on request.

Who do we share your personal information with?

We sometimes share your personal data with trusted third parties – a full list of whom is available on request.

When we share your personal data with these third parties who perform services for us, we require them to take appropriate steps to protect your personal information, and only to use the personal information for the purpose of performing those specific services.

We will never sell or distribute your personal information to any other third parties or make it public unless we have a legal obligation to do so.

Please be aware that some of these are data controllers in their own right, and by using them you are subject to their privacy notices.

Transferring personal data outside the United Kingdom 

 We transfer your personal data outside the UK when we pass data to trusted third parties (list available on request). We have procedures in place to make sure that these restricted transfers are made lawfully. To do this we use either a standard contractual data protection clause that is approved by the Information Commissioner’s Office or rely on an assessment of adequacy where this is appropriate.

When we are contracted to do work for another organisation

When Futureproof Cumbria acts under instruction from another organisation we are the data processor and the other organisation the data controller. There will be a contract in place which will tell us what to do with your information.  If any of your personal data is being used for a purpose that is not controlled by us, you will be given a different privacy notice by the data controller which will tell you all about it.

Your rights are unlikely to be affected if your information is used in this way.

What are your rights over your personal data?

You have rights in relation to the personal information we hold about you. These are:

• The right to be informed about the collection and use of your personal data. We do this by providing you with this privacy notice.
• The right of access. This is commonly referred to as ‘subject access’. You have the right to make a request to see all the personal data that Futureproof Cumbria holds about you. You can make this request verbally or in writing and we must respond within one calendar month.
• The right to rectification. If you believe that any information we are holding about you is incorrect or incomplete, please write to or email us as soon as possible at the above address and we will promptly record your request and amend our records if required.
• The right to erasure. This is also known as ‘the right to be forgotten’. You can make this request verbally or in writing. This right only applies in certain circumstances.
• The right to restrict processing. This right only applies in certain circumstances. If we agree to restrict your personal data for one or more purposes we will store it but not use it.
• The right to data portability. This allows you to obtain and re-use your personal data for your own purposes across different services. If you would like us to transfer your personal data electronically, we will do this. It only applies to information you have given us, which we hold electronically and where Futureproof Cumbria is the data controller.
• The right to object. You have the right to object to the processing of your personal data in certain circumstances. You can make an objection verbally or in writing. You have the absolute right to stop your personal data being used for direct marketing.
• Rights in relation to automated decision making and profiling. Futureproof Cumbria doesn’t use your personal data to make automated decisions, however we do create profiles of our clients/customers. You have the right to stop us doing this and can do so by contacting us in writing at the address given.

If we are unable to act upon your request we will explain to you the reasons for this.

How to complain

If you are unhappy about the way we handle your personal data please let us know verbally or in writing by contacting us at the address given at the beginning of this document.

We will explain how we have processed your personal information and if we have made a mistake will tell you how we will put this right.

If you are still dissatisfied, you may report your concern to the Information Commissioner’s Office (ICO) by contacting:

Wycliffe House,

Water Lane,

Wilmslow

SK9 5AF

Tel. 0303 123 1113

or go online to www.ico.org.uk/concerns