Privacy Notice

This notice explains how Fund Gloucestershire uses personal information when organisations apply for funding through us receive a grant, or submit monitoring and impact information.

Most of the information we collect is about organisations. However, some information is personal information because it relates to an identifiable person, such as an applicant contact, trustee, director, employee or other person named in an application or report.

Who is responsible for your information?

Fund Gloucestershire is responsible for personal information that we decide how and why to use. For some funding programmes, the funder may also be responsible for some or all of the information submitted.

Contact

Contact: hello@fundglos.org.uk

Data protection contacts: Co-Directors Sally Byng and Claire Foote

Registered address for the charity: Fund Gloucestershire, c/o Hazlewoods, Windsor House, Bayshill Road, Cheltenham GL50 3AT

What information do we collect?

• Names, roles and contact details for people connected with applicant, grantee and funding organisations;
• Information included in funding applications and supporting documents;
• Information needed for eligibility and proportionate due diligence checks;
• Grant administration information, including correspondence and payment-related records; and
• Information submitted through grant monitoring and impact reports.

As a user of our services, please do not include personal information about individual beneficiaries unless the application or reporting requirements specifically ask for it. Where possible, monitoring and impact information should be anonymised or provided in aggregate.

Occasionally, an applicant or grantee may send us identifiable sensitive information that we have not asked for, such as information about health, disability, ethnicity, religion or sexual orientation. We will only retain or use it where necessary and lawful; otherwise we will delete, redact or anonymise it where appropriate.

Why do we use your information?

We use personal information only where it is needed to provide our services or meet our responsibilities. This includes:

• Receiving, reviewing and administering funding applications;
• Checking whether an organisation meets a fund's eligibility and due diligence requirements;
• Administering grants, payments, monitoring and impact reporting;
• Communicating with applicants, grantees, funders and other organisations involved in a funding programme;
• Maintaining appropriate financial, governance and audit records; and
• Keeping our platform, users and services secure.

Our lawful basis for using personal information

UK data protection law requires us to have a lawful basis for each use of personal information. Depending on the purpose, we rely on:

• Legitimate interests: for operating the platform, administering applications and grants, carrying out proportionate eligibility and due diligence checks, maintaining appropriate records and keeping our services secure. Our legitimate interests are in providing an effective, proportionate funding service and supporting the proper administration of funds.
• Legal obligation: where we need to use information to meet legal, regulatory, financial or charity-governance requirements.
• Contract: where processing is necessary to enter into or perform a contract with an individual.
• Consent: only where we ask for genuinely optional information and make clear that providing it is optional.

Where do we get personal information from?

Most personal information is provided directly by applicants, grantees and funders through the platform or in correspondence with us. We may also receive information from another person within your organisation, from a funder involved in the relevant programme, or from publicly available sources where this is necessary for proportionate eligibility or due diligence checks.

Who do we share information with?

Information submitted for a fund will normally be available to Fund Gloucestershire and the funder responsible for that programme. Where necessary, it may also be shared with organisations involved in administering or assessing the fund.

We use trusted suppliers for services such as technology, hosting and professional support, with appropriate contracts and safeguards in place. We do not sell personal information.

We may use organisational information collected through the Fund Gloucestershire platform, in an aggregated or anonymised form wherever possible, to understand patterns in funding need, access and distribution and to help improve the design and delivery of future funding opportunities through the platform.

This may include analysing information about organisations, applications and funding outcomes to identify trends, gaps and opportunities for improvement. We will not use this information to disadvantage an organisation in relation to a current or future funding application.

Automated checks and AI

We may use limited automated or AI-supported checks to help with due diligence, eligibility checking or assessing information against fund criteria. These tools support the funding administration process and do not have independent authority to make funding decisions. Where automated processing could significantly affect someone, we will provide the information and safeguards required by data protection law.

How long do we keep information?

We keep personal information only for as long as it is needed for the purpose for which it was collected, or where we need to retain it for legal, financial, regulatory or governance reasons.

Our standard retention periods are:

• unsuccessful applications and associated due-diligence information: 12 months after the funding decision; successful applications, grant administration records and related due-diligence information: 6 years after the grant or funding relationship ends;
• monitoring and impact reports: 6 years after the grant ends, although unnecessary identifiable beneficiary information will be removed earlier where practicable;
• inactive platform accounts: 24 months after the account becomes inactive; and
• financial and payment records held by Fund Gloucestershire: normally 6 years, or longer where a specific legal or contractual requirement applies.

Information that has been genuinely anonymised may be retained for longer for research, learning and analysis because it no longer identifies individuals.

When personal information is no longer required, we will delete it securely or anonymise it where appropriate.

Where is information stored?

Data held on the Fund Gloucestershire platform is hosted on Amazon Web Services (AWS) servers in London, UK. If another service provider accesses or processes personal information outside the UK, we will ensure that an appropriate legalsafeguard is in place.

Your rights

Depending on the circumstances, you may have the right to ask us for a copy of your personal information, correct it, delete it, restrict how it is used, object to certain uses, or receive certain information in a portable format. Where we rely on consent, you can withdraw it at any time. Some rights do not apply in every situation.

Your right to object

Where we rely on legitimate interests, you have the right to object to our use of your personal information. We will consider your objection and stop the processing unless we have compelling legitimate grounds to continue, or need the information for legal claims.

Questions, requests and complaints

If you have a question, want to exercise one of your rights or wish to complain about how we have handled your personal information, email hello@fundglos.org.uk.

We will acknowledge a data protection complaint within 30 days and investigate and respond without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO).

Changes to this notice

We will review this notice regularly and update it when our services or the way we use personal information changes. Where a change affects how we use information already collected, we will bring the change to the attention of the people affected where required.

Registered Charity 1216856  |  Version: August 2026  |  Review: August 2027

Fund Gloucestershire is committed to protecting the personal information entrusted to us. Most of the information we hold is about organisations, but some relates to identifiable people connected with funders, applicants, grantees and the organisations we work with. This policy sets out the principles we follow when handling personal information. More detailed information about what we collect, why we use it, who we share it with and individual rights is set out in our Privacy Notice.

1. Our approach

When we handle personal information, we will:

• be clear about what we collect and why;
• collect only information that is relevant and necessary;
• use information fairly, lawfully and only for appropriate purposes;
• take reasonable steps to keep information accurate and up to date;
• keep information only for as long as it is needed;
• protect information with appropriate technical and organisational safeguards; and
• take responsibility for, and be able to demonstrate, our compliance with data protection law.

2. How we put this into practice

We design our funding processes to minimise the personal information we collect. In particular, we ask for monitoring and impact information to be anonymised or aggregated wherever possible and do not seek identifiable information about individual beneficiaries unless it is genuinely needed. Access to personal information is limited to people who need it for their role. Where information is shared with funders, suppliers or other organisations involved in administering a fund, we put appropriate arrangements in place and make clear who will be able to see it. We may use limited automated or AI-supported checks to support parts of the funding administration process. These tools do not have independent authority to make funding decisions, and we provide appropriate human involvement and safeguards where required.

3. Security, retention and accountability

We use proportionate measures to protect personal information against loss, misuse or unauthorised access. We have procedures for responding to suspected data breaches and will make any notifications required by law. We keep personal information only for as long as it is needed for the purpose for which it was collected, or where there is a legal, financial, regulatory or safeguarding reason to retain it. We maintain and review an internal retention schedule. Fund Gloucestershire's Board of Trustees has overall responsibility for data protection. Day-to-day responsibility is delegated to our designated data protection leads, and we maintain appropriate internal records, procedures and supplier arrangements to support compliance.

4. Questions and further information

Our Privacy Notice explains in more detail how we use personal information and the rights people have under UK data protection law.

If you have a question, want to exercise a data protection right or wish to make a complaint, please contact: Email: hello@fundglos.org.uk

Data protection contacts: Co-Directors Sally Byng and Claire Foote

We will acknowledge a data protection complaint within 30 days and investigate and respond without undue delay.

You also have the right to raise a concern with the Information Commissioner's Office (ICO).

Registered Charity 1216856  |  Version: August 2026  |  Review: August 2027