If you want stop or change the way we communicate with you, please contact us at
Who are ‘we’?
In this policy, whenever you see the words ‘we’, ‘us’, ‘our’, ‘Dorset Scrapstore’ it refers to Dorset Scrapstore – Company Number 3870643 | Registered Charity Number 1081569. We will process your personal data on the basis of a variety of lawful bases, which we outline below.
● To be clear about why we need to collect your personal information and what we are going to use it for
● To make it easy for you to tell us how you would like us to keep in touch
● To only collect the information we need to make sure we deliver the best service
● To never sell or share your personal information, or let other organisations use it for marketing
● To take good care of your personal information, and make sure it is up to date, safe and secure at all times
● To make sure that any suppliers or partners who process your personal information on our behalf meet the same high standards that we adhere to when handling your personal information
The policy in brief
It’s important that you read the full policy to understand what information we hold, how we may use it, and what your rights are – but if you don’t have time to read it all now, here’s a quick summary:
● We collect information that is either personal data or non-personal data (such as IP addresses, pages accessed etc)
● We collect information about members, supporters, users, volunteers and employees.
● We collect information to provide services or goods, to provide information, to fundraise, for
administration, research, profiling, analysis, and for the prevention/detection of crime.
● We only collect the information that we need or that would be useful to provide the best possible service.
● We do our very best to keep personal information secure.
● We never sell your data and we will never share it with another company or charity for marketing purposes.
● We only share data where we are required by law or with carefully selected partners who do work for us. All our partners have been screened to ensure they will treat your data as carefully as we would.
Please make sure to read the policy in full for more detail.
This policy applies to our websites, use of emails, and any other methods we use for collecting
What personal data do we collect?
Your personal data (any information which identifies you, or which can be identified as relating to you personally for example, name, address, phone number, email address) will be collected and used by us.
We’ll only collect the personal data that we need, and only hold this information for as long as reasonably necessary to carry out services and administer your relationship with us. Typically this is one year since your last interaction with us unless we are required to hold it longer for legal or taxation reasons. If we dispose of your information it will always be done securely.
We collect personal data in connection with specific activities such as registration or membership requests, donations, volunteering, conducting research, employment etc.
You can give us your personal data by filling in forms on our website, subscribing to take part in research on our website or other social media functions, entering a competition, promotion or survey or by corresponding with us (by phone, email or by joining as a member/ supporter/ customer/ supplier/ applicant/ employee).
This personal data you give us may include name, title, address, date of birth, age, gender, employment status, demographic information, email address, telephone numbers, personal description, photographs, attitudes, opinions.
Personal data provided by you
This includes information you give when interacting with us, for example joining or registering, placing an order or communicating with us. For example:
● Personal details (name, date of birth, email, address, telephone, and so on) when you join as a
member or supporter
● Financial information (payment information such as credit or debit card or direct debit details, and whether donations are gift-aided)
● Your opinion and attitudes about, and experiences with Dorset Scrapstore.
● If you register a child for a workshop, the child’s name, your details, and your relationship to that child will be recorded.
● Information about your purchases including but not limited to revenue figures and the types of products purchased.
Personal data created by your involvement with us
Your activities and involvement with us will result in personal data being created. This could include details of how you’ve helped us by volunteering or being involved with our campaigns and activities. If you decide to donate to us then we’ll keep records of when and how much you give to a particular campaign. Information about your purchase history will also be recorded.
Information we generate
We conduct research and analysis on the information we hold, which can in turn generate personal data. For example, by analysing your interests and involvement with our work we may be able to build a profile which helps us decide which of our communications are likely to interest you. The sections Research and Profiling gives more detail about how we use information for profiling and targeted advertising, including giving you more relevant digital content.
If you’re a volunteer then we may collect extra information about you (e.g. references, criminal records checks, details of emergency contacts, medical conditions etc.). This information will be retained for legal or contractual reasons, to protect us (including in the event of an insurance or legal claim) and for safeguarding purposes.
Children’s personal data
Children aged under 16 can attend workshops held by Dorset Scrapstore. We collect their names and association with an adult member. We will, from time to time, take photos of workshops for marketing purposes. The adult accompanying the child will be asked to sign a photo permission form, and when used, the photo will not include a child’s name unless additional consent has been given to do so. We don’t market to children under age 16.
How we use your personal data
We’ll only use your personal data on a relevant lawful basis as permitted by the EU General Data Protection Regulation (from 25 May 2018)/UK Data Protection Act and Privacy of Electronic
Personal data provided to us will be used for the purpose or purposes outlined in any fair processing notice in a transparent manner at the time of collection or registration where appropriate, in accordance with any preferences you express. If asked by the police, or any other regulatory or government authority investigating suspected illegal activities, we may need to provide your personal data. Your personal data may be collected and used to help us deliver our charitable activities, help us raise funds, or complete your order or request. Below are the main uses of your data which depend on the nature of our relationship with you and how you interact with our various services, websites and activities.
Marketing communications (lawful basis: consent)
Your privacy is important to us, so we’ll always keep your details secure. We’d like to use your details to keep in touch about things that may matter to you. This could include a newsletter containing information about workshops, offers, stock, etc. Or could include information about how to support Dorset crapstore as a volunteer, supplier, or donor.
We’ll only send these to you if you agree to receive them and we will never share your information with companies outside Dorset Scrapstore for inclusion in their marketing. If you agree to receive marketing information from us you can change your mind at a later date.
We may sometimes use third parties to capture some of our data on our behalf, but only where we are confident that the third party will treat your data securely, in accordance with our terms and inline with the requirements set out in the GDPR.
Membership (lawful basis: contract)
We use the personal data you provide as a member provide to service your membership. This includes sending membership confirmation and renewal information, workshop confirmations, changes to our hours or service, and notice of our Annual General Meeting. We check membership cards to confirm that your membership is valid. We may contact you for feedback on your visit.
Fundraising, donations (lawful basis: consent and legal obligation)
Where we have your permission, we may invite you to support Dorset Scrapstore by making a donation, getting involved in fundraising activities, or leaving a gift in your will. If you support us in one or more of these ways, we’ll send you updates on the impact that you make, unless you tell us not to.
If you make a donation, we’ll use any personal information you give us to record the nature and amount of your gift, claim gift aid with HMRC where you’ve told us you’re eligible and thank you for your gift. If you interact or have a conversation with us, we’ll note anything relevant and store this securely on our systems.
If you tell us you want to fundraise to support our cause, we’ll use the personal information you give us to record your plans and contact you to support your fundraising efforts. If you’ve told us that you’re planning to, or thinking about, leaving us a gift in your will, we’ll use the information you give us to keep a record of this – including the purpose of your gift, if you let us know this. If we have a conversation or interaction with you (or with someone who contacts us in relation to your will, for example your solicitor), we’ll note these interactions throughout your relationship with us, as this helps to ensure your gift is directed as you wanted.
Suppliers (lawful basis: consent, contract, and vital interests)
To manage our relationship with you, we will collect contact information and details about your role as a supplier of goods for Dorset Scrapstore. This could include what, how much, how often you supplied the goods, and will be used to thank you for your donation to determine if there are other ways we can work together.
Where you have provided consent, we will share information about Dorset Scrapstore and how to further support us using the personal information we have collected.
Management of volunteers (lawful basis: consent, legal obligation, and vital interests)
We need to use your personal data to manage your volunteering, from the moment you enquire to the time you decide to stop volunteering with us. This could include: contacting you about a role you’ve applied for or we think you might be interested in, expense claims you’ve made, shifts you’ve booked and to recognise your contribution.
It could also include information about your volunteering, including asking for your opinions on your volunteering experience. We may also share this with funders to help them monitor how their funding is making a difference. Normally this would be in an aggregated form, unless you have provided a testimonial.
Research (lawful basis: consent)
We carry out research with our supporters, customers, staff and volunteers to get feedback on their experience with us. We use this feedback to improve the experiences that we offer and ensure we know what is relevant and interesting to you. If you choose to take part in research, we’ll tell you when you start what data we will collect, why and how we’ll use it. All the research we conduct is optional and you can choose not to take part. For some of our research we may ask you to provide sensitive personal data (e.g. ethnicity). You don’t have to provide this data and we also provide a ‘prefer not to say’ option. We only use it at an aggregate level for reporting (e.g. equal opportunities monitoring).
Profiling (lawful basis: consent)
We know it’s important to our supporters to use our resources in a responsible and cost-effective way. So we use automated profiling and targeting to help us understand our supporters and make sure that:
● our communications (e.g. emails) and services (e.g. our website) are relevant, personalised and interesting to you
● our services meet the needs of our supporters
● we only ask for further support and help from you if it’s appropriate
● we use our resources responsibly and keep our costs down
To do this we’ll analyse how you interact with us (e.g. on our website, and in-store). We use specific tools to profile how you interact with us online, for example, Google Analytics. Much of the information we collect is aggregated, however we may also collect some personal data for the use of personalising your experience, optimising our marketing campaigns, and to ensure the site is functioning as intended.
The personal information that is collected includes transactional information for things such as
memberships, donations, renewals, and workshop bookings This information take the form of an encrypted string.
Recruitment and employment (lawful basis: consent, vital interests, and legal obligation)
In order to comply with our contractual, statutory, and management obligations and responsibilities, we process personal data, including special category personal data, from job applicants and employees. Such data can include, but isn’t limited to, information relating to health, racial or ethnic origin, and criminal convictions. In certain circumstances, we may process personal data or sensitive personal data, without explicit consent. Further information on what data is collected and why it’s processed is given below.
Contractual responsibilities: Our contractual responsibilities include those arising from the contract of employment. The data processed to meet contractual responsibilities includes, but is not limited to, data relating to: payroll, bank account, postal address, sick pay; leave, maternity pay, pension and emergency contacts.
Statutory responsibilities: Our statutory responsibilities are those imposed through law on the organisation as an employer. The data processed to meet statutory responsibilities includes, but is not limited to, data relating to: income tax, national insurance, statutory sick pay, statutory maternity pay, annual leave, work permits, equal opportunities monitoring.
Management responsibilities: Our management responsibilities are those necessary for the
organisational functioning of the organisation. The data processed to meet management responsibilities includes, but is not limited to, data relating to: recruitment and employment, training and development, absence, disciplinary matters, e-mail address and telephone number.
Disclosure of personal data to other bodies
In order to carry out our contractual and management responsibilities, we may, from time to time, need to share an employee’s personal data with one or more third party suppliers.
To meet the employment contract, we are required to transfer an employee’s personal data to third parties, for example, to pension providers and HM Revenue & Customs.
In order to fulfil our statutory responsibilities, we’re required to give some of an employee’s personal data to government departments or agencies e.g. provision of salary and tax data to HM Revenue & Customs.
Special category personal data (lawful basis: consent, vital interests, and legal obligation)
The Act defines ‘special category personal data’ as information about racial or ethnic origin, political opinions, religious beliefs or other similar beliefs, trade union membership, physical or mental health, sexual life, and criminal allegations, proceedings or convictions.
In certain limited circumstances, we may legally collect and process sensitive personal data without requiring the explicit consent of an employee.
(a) We will process data about an employee’s health where it is necessary, for example, to record absence from work due to sickness, to pay statutory sick pay, to make appropriate referrals to the Occupational Health Service, and to make any necessary arrangements or adjustments to the workplace in the case of disability. This processing will not normally happen without the employee’s knowledge and, where necessary, consent.
(b) We will process data about, but not limited to, an employee’s racial and ethnic origin, their sexual orientation or their religious beliefs only where they have volunteered such data and only for the purpose of monitoring and upholding our equal opportunities policies and related provisions.
(c) Data about an employee’s criminal convictions will be held as necessary.
How can I change my contact preferences?
We’d love to stay in touch, but we don’t want to out-stay our welcome. Choose how you would like us to get in touch by contacting Dorset Scrapstore via a Change Preferences link at the bottom of a newsletter or e-mail, by e-mailing email@example.com , or by calling Dorset Scrapstore.
E-mail is our main conduit for communication, and will be the only way to receive newsletters and written information about how to support Dorset Scrapstore once you opt-in to receive these items. However, there are some communications for which we need to make contact with you, and this could be done by either phone or e-mail. These are essential to fulfil our promises to you as a member, volunteer, donor, supplier, employee/applicant, or buyer of goods or services from Dorset Scrapstore.
Updating your data and marketing preferences
We want you to remain in control of your personal data. If, at any time, you want to update or amend your personal data or marketing preferences please contact us in one of the following ways:
E-mail us: firstname.lastname@example.org with your full name, full address and member number (where applicable).
Call us: 07565 577094. Open 11am-5 pm, Tuesday – Saturday.
Write to: Dorset Scrapstore, The Factory, 14 Alder Hills, Poole, Dorset, BH12 4AS
Verification, updating or amendment of personal data will take place within 30 days of receipt of your request.
Your data protection rights
Where Dorset Scrapstore is using your personal data on the basis of consent, you have the right to withdraw that consent at any time.
Subject access rights
If you would like further information on your rights or wish to exercise them, please write or e-mail Dorset Scrapstore. You will be asked to provide the following details:
● The personal information you want to access;
● Where it is likely to be held;
● The date range of the information you wish to access
We will also need you to provide information that will help us confirm your identity. If we hold personal information about you, we will give you a copy of the information in an understandable format together with an explanation of why we hold and use it.
Once we have all the information necessary to respond to your request we’ll provide your information to you within one month. This timeframe may be extended by up to two months if your request is particularly complex.
What to do if you’re not happy
In the first instance, please talk to us directly so we can resolve any problem or query. You also have the right to contact the Information Commissions Office (ICO) if you have any questions about Data Protection. You can contact them using their helpline 0303 123 113 or at www.ico.org.uk .
Cookies and links to third party websites
Links to other websites
Keeping your information
We will only use and store your information for as long as it is required for the purposes it was collected for. How long it will be stored for depends on the information in question, what it is being used for and, sometimes, statutory legal requirements.
How we secure your data
Information system and data security is important to us to ensure that we are keeping our customers, members, volunteers, employees and suppliers safe.
Our staff and volunteers complete mandatory information security and data protection training to reinforce responsibilities and requirements set out in our information security policies.
Disclosing and sharing information
When we allow third parties acting on behalf of Dorset Scrapstore to access to your information, we will always have complete control of what they see, how long they see it for and what they are allowed to do with it. We do not sell or share your personal information for other organisations to use.
Personal data collected and processed by us may be shared with the following groups where necessary:
● Dorset Scrapstore employees and volunteers
● Third party cloud hosting and IT infrastructure providers who host and provide IT support in
respect of the website, our database, and our marketing automation system
Storage of information
Dorset Scrapstore operates in the UK and we store most of our data within the European Union (EU). Some of our systems are provided by US companies and whilst it is our policy that we prefer data hosting and processing to remain on EU-based solutions, it may be that using their products results in data transfer to the USA. However we only allow this when we certain it will be adequately protected. (e.g. US Privacy Shield or Standard EU contractual clauses).
Payment Card Security
The Dorset Scrapstore has an active PCI-DSS compliance programme in place. This is the international standard for safe card payment processes.