GRANT MANAGEMENT SYSTEM PRIVACY NOTICE
The Rochester Bridge Trust (the Trust) uses the BenefactorCloud Application to process and manage applications for Scholarships and Grants Programmes. The BenefactorCloud Application is hosted on a cloud-based server by The Gallery Partnership Ltd (TGPL).
The Trust is the ‘data controller’ and TGPL is the ‘data processor’ on behalf of the Trust, for personal data submitted to the BenefactorCloud Application.
For more information, please contact the Data Protection Manager: pippa.parfitt@rbt.org.uk.
What personal data is being processed and why?
The Trust collect the following personal data to facilitate the processing of your grant or scholarship application:
- Names and contact details
- Addresses
- Date of birth
- Payment details (including bank information for making payments of awards)
- Website user information (including cookies tracking)
What are my rights as a data subject? What is your lawful basis for processing my personal data in this way?
Under UK data protection law, the Trust must have a “lawful basis” for collecting and using your personal information. Which lawful basis the Trust rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
- Your right of access - You have the right to ask the Trust for copies of your personal information. You can request other information such as details about where the Trust get personal information from and who the Trust share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
- Your right to rectification - You have the right to ask the Trust to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
- Your right to erasure - You have the right to ask the Trust to delete your personal information. Read more about the right to erasure.
- Your right to restriction of processing - You have the right to ask the Trust to limit how your personal information is used. Read more about the right to restriction of processing.
- Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
- Your right to data portability - You have the right to ask that the Trust transfer the personal information to another organisation, or to you. Read more about the right to data portability.
- Your right to withdraw consent – When the Trust use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.
If you make a request, the Trust must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact the Trust using the contact details at the top of this privacy notice.
Our lawful basis for collecting or using your personal data as described in this privacy notice is consent. The Trust have permission from you to use your personal data in this way after the Trust gave you all the relevant information. All of your data protection rights may apply, except the right to object. You have the right to withdraw your consent at any time.
Access to data
Your information may be shared internally, including with staff with responsibility for our grants and scholarship programmes. Your data is also shared with our data processor, TGPL, who host the BenefactorCloud Application.
How long is my data retained?
For grant applications, personal data is retained in the grant management system for a minimum of two years. After this time, some of the grant application data may be kept permanently to form part of our historic archive. For scholarship applications, personal data is retained within the grant management system for a maximum of four years. After this time, some of the scholarship data may be kept permanently to form part of our historic archive. Any personal data relating to unsuccessful applications will be destroyed after six months. For more information on how long the Trust store your personal data and the criteria the Trust use to determine this, please contact the Data Protection Manager.
If you have any concerns about our use of your personal data, you can make a complaint to the Trust using the contact details at the top of this privacy notice.
If you remain unhappy with how the Trust have used your data after raising a complaint, you can also complain to the ICO.