Privacy policy.

1. Who we are.

DEINIOLEN TRUST FUND is a registered charity in England and Wales (charity number 219993), governed by a Charity Commission Scheme of 22 May 1980. Our registered office is 9 Deiniol Road, Deiniolen, Caernarfon, LL55 3LL. We are the data controller for the personal data described in this policy. There is no data protection officer; we are too small to be required to appoint one. The four trustees (C Brian Price, Glyn Gruffudd, Gwyn Oliver Jones, Marina Marzelos) are jointly responsible for this policy.

2. What personal data we collect.

We collect personal data in the following circumstances:

• When you write to us (post, email, or via the website). Your name, postal address, email address, telephone number (if you give it), and the content of your message.
• When you apply for a grant. Anything you tell us in your application letter, plus (if relevant) the name and contact details of any referrer.
• When you donate. Your name, address, email, the amount, the date, and (if you have signed a Gift Aid declaration) confirmation that you are a UK taxpayer.
• When you subscribe to the dispatch. Your name (optional) and email address.
• When you volunteer. Your name, contact details, and the role of interest.
• When you visit the website. A standard server log (IP address, browser type, pages visited, timestamp), and one essential preference cookie to remember you have seen the cookie notice. We do not use advertising cookies.

3. Why we collect it, and our lawful basis.

• To respond to your enquiry or process your application — lawful basis: legitimate interests (responding to a person who has written to a charity is in both parties’ interests).
• To send you a grant cheque or a thank-you — lawful basis: contract (the implicit agreement that follows from us deciding to give you a grant).
• To claim Gift Aid on your donation — lawful basis: legitimate interests (recovering tax HMRC has already agreed we are entitled to claim).
• To send you the quarterly dispatch — lawful basis: consent (you have asked us to send it; you may withdraw consent at any time by unsubscribing).
• To meet our statutory reporting obligations — lawful basis: legal obligation (annual return to the Charity Commission, Gift Aid records for HMRC).

4. Who we share data with.

We share the minimum personal data necessary with:

• HMRC — when claiming Gift Aid, we are required to share your name and address and donation total.
• The Charity Commission for England and Wales — aggregated grant data (recipient organisation, amount); we do not share the names of individual grant recipients unless required.
• Our payment processor — we use the small Welsh-language credit-union account at HSBC Caernarfon to bank cheques. HSBC’s privacy notice applies to that bank account.
• Our email platform — if you subscribe to the dispatch, your email address is held in our Mailchimp (Intuit) account purely to send the dispatch.
• Safeguarding and statutory authorities — where there is a legal obligation, e.g. a safeguarding referral to Cyngor Gwynedd.

We do not share data for marketing purposes. We do not sell or rent personal data to any third party.

5. How long we keep it.

• Donor records and Gift Aid declarations — 7 years from the end of the relevant tax year, as required by HMRC.
• Grant application records — 7 years from the date of the application, then destroyed.
• General enquiries and contact-form messages — 24 months, then destroyed.
• Volunteer enquiry records — 24 months unless you become an active volunteer, in which case for the duration of your involvement plus 12 months.
• Newsletter subscribers — until you unsubscribe.
• Server logs and analytics — 14 months.

6. Your rights under UK GDPR.

You have the right to:

• Access the personal data we hold about you.
• Rectification of any inaccurate personal data.
• Erasure of your personal data, where we no longer need it for the purpose we collected it for (Gift Aid records are the main exception; we are legally required to keep them).
• Restriction of processing, in certain circumstances.
• Portability of your personal data, in a structured format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, write to us at [email protected] or by post to 9 Deiniol Road, Deiniolen, Caernarfon, LL55 3LL. We will respond within one calendar month.

7. Cookies.

We use one essential preference cookie (dtf-cookies) to remember that you have seen the cookie notice; it stores the value set in your browser’s localStorage and expires when you next clear your browser data. We do not run analytics or marketing cookies. Full detail is in our cookie policy.

8. Children’s data.

We do not knowingly collect personal data from anyone under thirteen. If a child writes to us (for example, applying for a Lle i Ddysgu bursary), we will reply via a parent or guardian where one is named in the letter. We do not market to under-13s. Our safeguarding policy applies to all interactions with children of the village.

9. Changes to this policy.

We will update this policy when we change our data practices, and we will update the Last updated date at the top of the page when we do. If the change is substantive, we will write to you (if you are a current donor, volunteer, or active grant recipient) and explain the change.

10. How to complain.

If you are unhappy with how we have handled your personal data, please write to us first; we will read your complaint ourselves and respond within fourteen calendar days. If you remain unhappy, you have the right to complain to the Information Commissioner’s Office:

• Web: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

A picture of where the records actually live.

For the avoidance of doubt, the personal data this policy describes is held in two places: the buff folder in the locked drawer at the Memorial Hall (paper records), and the encrypted laptop at 9 Deiniol Road (digital records). It is not held in any third-party CRM, donor-management platform, or cloud storage service. We do not use Google Workspace for trust correspondence; we use a small Welsh-hosted email account at [email protected].

A practical note about the ICO.

If you ever need to escalate a data-protection complaint about the trust, the route is simple and free: you may write to us at [email protected] or to 9 Deiniol Road, and you may also contact the Information Commissioner’s Office on 0303 123 1113 or at ico.org.uk. The ICO charges nothing for taking a complaint; you do not need a solicitor; and the ICO will write to us, in the language we work in, for our side of the matter. We have not had a complaint to date. If we do, we will write the response ourselves.