Privacy Notice
Grow Cardiff is a registered charity based in Wales that supports people of all ages and backgrounds to develop and sustain community gardens and shared growing spaces for health, well-being and wildlife.
This privacy notice provides information about what personal information Grow Cardiff collects. It applies to information we collect about:
- Visitors to this website
- Volunteers and Lead volunteers who take part in sessions and workshops with us or who are referred to Grow Cardiff
- Employees (current and former) and job applicants
- People who visit, attend our events/workshops, or who contact us
- People from partner organisations
The data controller is Grow Cardiff with our registration address at: 460 Cowbridge Road West, Cardiff CF5 5BZ. If you have any questions about this privacy notice or how and why we process personal data, please contact us at: [email protected] marking Privacy Notice in the Subject box of your email.
What information do we collect about you?
The personal data we collect about you will vary depending on the service you request from us. As a rule we only collect the data we need to support you in the way that you have asked us to. As a minimum we will usually collect:
- your name
- your email address
If for example, you have got in touch with a query about a workshop or training we will collect your name and email address so that we can contact you with further details. We may also email you with information about similar workshops or events in the future that may interest you.
From time to time, depending on the service you require, we may also request the following additional information and use this in the following ways:
- Mobile/Telephone number: If your query is more complex or detailed, we may ask for your mobile phone number so that we can talk to you directly about your query.
- Equal Opportunities: If you take part in our projects or services, we may ask you to complete an equal opportunities monitoring form. This records an individual’s gender, age, sexual orientation, employment status, whether you consider you have a disability or health condition, ethnicity, accommodation status, religion. You reserve the right not to complete this form or to answer any questions you do not wish to. All data is anonymised in order for Grow Cardiff to monitor our openness and accessibility to people of all backgrounds. You retain the right to withdraw the information you have provided at any point.
- Payment Details: If you make a payment to Grow Cardiff, we may collect payment information from you such as credit or debit card details or bank information for the purposes of taking payment.
- Referrals to the Grow Well project: If you are referred to the Grow Well project we will ask for further personal information about you. This will include your address and may include information about your health. We collect this information in order to ensure that we can keep anyone who is referred to the project safe and that the service we provide is appropriate and recognises individual need.
- Other information we collect: If you correspond with us generally, for example to raise a query, comment or complaint about any of our projects or services, we will also collect any other information you choose to send to us in that correspondence.
What the Law says about protection of personal information
The Law on Data Protection is derived from various pieces of legislation. These include the General Data Protection Regulation (GDPR) which comes into force in May 2018. The GDPR states that personal data (information relating to a person that can be individually identified) can only be processed if there is a legal ground to do so. Activities such as collecting, storing and using personal information would fall into the GDPR’s definition of processing. The GDPR provides six legal reasons under which personal information can be processed or used in a lawful way. For the processing to be permitted by law, at least one of the legal grounds must apply.
The five legal grounds that are most relevant to Grow Cardiff’s use of your personal information are:
- Consent
- Legitimate Interest
- Contract
- Legal Obligation
- Vital Interests
How do we use the information you provide?
Grow Cardiff will only process or use your personal information if we have:
- asked you and have a record of your express and recent consent for us to do so, or
- a ‘legitimate interest’ to do so in order to support our charitable purposes. Our use will be fair and balanced and never unduly have an impact on your rights, or
- a contract with you that we can only fulfil by using your personal information, for example to send you an item that you have requested, or
- a legal obligation to use or disclose information about you, for example we are required by law to keep records of donations that are given to us with Gift Aid for 4 years, or
- in extreme situations, such as an accident or medical emergency, we may share your personal details with the emergency services if it is essential for the preservation of life (yours or another person’) for us to do so. This is the ‘vital interest’ ground for using your personal information. After the emergency, we will always try to inform you about how we had to use your information in that extreme situation
The GDPR prioritises the careful consideration of the legal basis for processing of all personal data, above reliance on consent. We will therefore not generally rely on consent as a basis for processing personal data. In the limited circumstances where we may rely upon consent, e.g. for some marketing purposes, we will specifically obtain this in the course of collecting the data and the nature of any such consent will be fully explained.
We will not unduly prioritise our interests as a Charity over your interests as an individual. We will always balance our interests with your rights. We will only use personal information in a way and for a purpose that you would reasonably expect in accordance with this Policy.
Grow Cardiff will not rent, swap or sell your personal information to other organisations for them to use in their own marketing activities.
Job applicants
If you apply to work at Grow Cardiff, we will use the information you supply to us to process your application and to monitor recruitment statistics. We may disclose personal information to a third party, for example where we want to take up a reference or obtain a check from the Disclosure and Barring Service, but would only do so, having first informed you and gained your consent.
About the information we collect and hold
Up to and including the shortlisting stage:
| The information we collect | How we collect the information | Why we collect the information | How we use and may share the information |
| Your name and contact details (ie address, home and mobile phone numbers, email address) | From you | Legitimate interest: to carry out a fair recruitment processLegitimate interest: to progress your application, arrange interviews and inform you of the outcome at all stages | To enable Grow Cardiff to contact you to progress your application, arrange interviews and inform you of the outcome |
| Details of your qualifications, experience, employment history (including job titles, salary and working hours) and interests | From you, in the completed application form and interview notes (if relevant) | Legitimate interest: to carry out a fair recruitment processLegitimate interest: to make an informed decision to shortlist for interview and (if relevant) to recruit | To make an informed recruitment decisionThe person making the shortlisting decision will receive pseudonymised or anonymised details only; if you are invited for interview, the interviewer will receive non-anonymised details |
| Your racial or ethnic origin, sex and sexual orientation, religious or similar beliefs | From you, in a completed anonymised equal opportunities monitoring form | To comply with our legal obligations and for reasons of substantial public interest (equality of opportunity or treatment) | To comply with our equal opportunities monitoring obligations and to follow our equality and other policies |
| Information regarding your criminal record | From you, in your completed application form | To comply with our legal obligationsFor reasons of substantial public interest (preventing or detecting unlawful acts, and protecting the public against dishonesty) | To make an informed recruitment decisionTo carry out statutory checksInformation shared with DBS and other regulatory authorities as required |
| Details of your referees | From your completed application form | Legitimate interest: to carry out a fair recruitment processIn the regulated sector, to comply with our legal obligations to request references | To carry out a fair recruitment processTo comply with legal/regulatory obligationsInformation shared with relevant managers, and the referee |
Before making a final decision to recruit:
| The information we collect | How we collect the information | Why we collect the information | How we use and may share the information |
| Information about your previous academic and/or employment history, including details of any conduct, grievance or performance issues, appraisals, time and attendance, from references obtained about you from previous employers. | From your referees (details of whom you will have provided) | Legitimate interest: to make an informed decision to recruitTo comply with our legal obligationsLegitimate interests: to maintain employment records and to comply with legal, regulatory and governance obligations and good employment practice | To obtain the relevant reference about youTo comply with legal/regulatory obligationsInformation shared with relevant managers |
| Information regarding your academic and professional qualifications. | From you, from your education provider, from the relevant professional body | Legitimate interest: to verify the qualifications information provided by you | To make an informed recruitment decision |
| Information regarding your criminal record, in criminal records certificates (CRCs) and enhanced criminal records certificates (ECRCs) | From you and from the Disclosure and Barring Service (DBS) | To perform the employment contractTo comply with our legal obligationsLegitimate interest: to verify the criminal records information provided by youFor reasons of substantial public interest (preventing or detecting unlawful acts, and protecting the public against dishonesty) | To make an informed recruitment decisionTo carry out statutory checksInformation shared with DBS and other regulatory authorities as required |
| Your nationality and immigration status and information from related documents, such as your passport or other identification and immigration information. | From you and, where necessary, the Home Office | To enter into/perform the employment contractTo comply with our legal obligationsLegitimate interest: to maintain employment records | To carry out right to work checksInformation may be shared with the Home Office |
| A copy of your driving licence (if applicable) | From you | To enter into/perform the employment contractTo comply with our legal obligationsTo comply with the terms of our insurance | To make an informed recruitment decisionTo ensure that you have a clean driving licenceInformation may be shared with our insurer |
Your rights
You have a number of rights in relation to your personal data. These include the right to:
- find out how we process your personal data;
- request that your personal data is corrected if you believe it is incorrect or inaccurate;
- obtain restriction on our, or object to, processing of your personal data;
- ask us not to process your personal data for our own marketing purposes;
- withdraw your consent to our processing of your personal data; and
- obtain a copy of your personal information which we hold about you. We will take steps to verify your identity before responding to your request and will respond as soon as possible
You can exercise your right to prevent such processing at any time by contacting us at: [email protected]
Disclosure of your information
The personal data you give Grow Cardiff is held securely. We will not sell your information to any third party. However, in some circumstances it is necessary for Grow Cardiff to give relevant staff at our services providers’ access to your personal information. This access is only granted to the extent necessary for them to perform their services for us. Any of the companies that access your information while providing services on our behalf will be governed by strict contractual restrictions to make sure that they protect your information and keep to data-protection and privacy laws which apply. Our third-party suppliers are listed below, with links to their own privacy policies.
| Third party supplier | Type of activity | Link to privacy notice |
| Microsoft | Email and office systems | Microsoft |
| Eventbrite | Event registration | Eventbrite |
| Survey Monkey | Online surveys | Survey Monkey |
| Google Forms | Online surveys | Google Drive |
| Paypal | Payments and donations | Paypal |
| Just Giving | Donations | Just Giving |
| Stripe | Donations | Stripe |
| Optimum | Pre-paid Cards | Optimum |
| Xero | Accounting and payroll | Xero |
| Elemental | On-line social prescribing platform | Elemental |
| Barclays | Banking / payments | Barclays |
In keeping with modern technological advances and best practice, where Grow Cardiff utilises cloud storage which have servers based outside the EEA, we take all reasonable steps to ensure compliance with the GDPR and the relevant legislation.
We may also share your personal data with third parties if we are required to do so by law or contract, to respond to legal process, to protect our customers or staff, to protect lives, to complete a transaction, or to protect the rights or property of Grow Cardiff.
Photography
All photography on this site is reproduced with kind permission of the photographers concerned.
Generally, we may use photographs/videos in our promotional and marketing materials (including on social media), if you have given us consent to do so. Please note that any unrestricted online websites can be viewed throughout the world and not just in the United Kingdom where UK law applies; once on the internet, these images may be copied by third parties. In giving your consent you understand that images may be used in printed and electronic form.
Visitors to our websites
Most websites you visit will use cookies to help customise your experience. Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.
| Name | Expires | Reason |
| Cookie Yes Consent | 1 year | Functional |
| Google Analytics | 2 years | Analytics and Tracking |
Use of cookies on our website
Third party cookies
We sometimes embed video content and photos from websites such as YouTube and flickr. Pages with this embedded content may present cookies from these websites. Similarly, when you use one of the share buttons on our website, a cookie may be set by the service you have chosen to share content through. You should check the relevant third party website for more information about these cookies.
How to manage cookies
If you wish to restrict, block or delete cookies from our website – or any other website – you can use your browser to do this. Each browser is different so check the ‘Help’ menu of your particular browser to learn how to change your cookie preferences. Please bear in mind that if you do this, certain personalised features of this website cannot be provided to you.
Keeping your personal information secure
We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Changes to this notice
We keep this notice under regular review and will update this Privacy Notice from time to time. Any substantial changes that affect how we process your personal data will be notified on our website and to you directly, as far as practicable.
If you believe that we have not complied with this notice or have acted otherwise than in accordance with the GDPR, or, if you have any queries or concerns about this privacy statement or use of your personal data, please get in touch with us at: [email protected]
You can also make a referral to or lodge a complaint with the Information Commissioner’s Office (ICO), although the ICO recommends that steps are taken to resolve the matter with us before involving them.
Grow Cardiff Privacy Statement
May 2023
