At We’re Good CIC, we respect your privacy. This notice explains what personal information we collect, why we use it, how we look after it and your rights.
It applies when you visit our website, contact us, register interest in a project such as Golden Memories, book or attend an activity, volunteer, support our work or sign up for updates.
We’re Good CIC is responsible for deciding how the personal information covered by this notice is used. For data protection purposes, this makes us the “controller”.
We’re Good CIC
Registered office: 61 Bridge Street, Kington, HR5 3DJ
Company number: 17469741
Privacy enquiries: [email protected].
You can use these contact details to ask questions or exercise your data protection rights.
Depending on your involvement with us, we may collect:
Where agreed, we may also collect photographs, recordings, personal stories and quotations.
We only ask for information relevant to the activity or purpose involved. Please avoid including medical records, bank statements or detailed information about other people in general enquiry forms.
Most information comes directly from you through forms, conversations, emails, telephone enquiries, bookings or participation in our activities.
We may also receive information from a relative, friend, carer or community organisation helping you take part, or from a booking or payment service you use.
People registering someone else should have their knowledge and permission, or appropriate authority to act for them. We may check this before discussing personal circumstances or making arrangements.
Where someone else provides your information, we will explain who supplied it and why we hold it, normally when we first contact you and no later than one month after receiving it, unless a legal exception applies.
UK data protection law requires us to have a lawful basis for using personal information.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and administering expressions of interest | Legitimate interests in responding to requests and organising our community activities |
| Managing bookings, purchases and requested steps towards a booking | Contract, where the information is necessary to fulfil the agreement or take those steps |
| Planning activities, coordinating volunteers and arranging practical support | Legitimate interests in delivering well-organised, accessible activities |
| Understanding participation, gathering feedback and evaluating our work | Legitimate interests in improving activities and understanding their community benefit |
| Managing relationships with organisations, suppliers and supporters | Legitimate interests in coordinating our work, or contract where applicable |
| Keeping accounting records and meeting statutory requirements | Legal obligation |
| Sending optional promotional emails or text messages | Consent |
| Publishing identifiable photographs, recordings, stories or quotations | Consent |
When relying on legitimate interests, we consider whether the use is necessary and proportionate and balance our interests against your rights and reasonable expectations.
You may object to uses based on legitimate interests by contacting us.
Information about disability, mobility, allergies or support needs can reveal health information. Some dietary information may also reveal religious beliefs. These receive additional protection under data protection law.
For optional sensitive information supplied to help us plan or arrange participation, we rely on your consent under Article 6 and your explicit consent under Article 9 of the UK GDPR. We ask for this separately from marketing permission.
We explain why we need the information and who may need to receive it. Only relevant staff, volunteers or service providers should have access.
You can choose not to provide this information or withdraw consent by contacting us. This does not automatically prevent you from attending, although it may limit the arrangements we can make. We will discuss this with you.
If someone completes a form for you, their permission does not automatically replace yours. We will normally seek your explicit consent directly, or establish that someone has appropriate authority to act on your behalf.
Our registration forms help us understand who would like to attend, where people are travelling from, their interests and what might make participation easier.
We may use answers to plan music, catering, seating, accessibility, Befriender support and possible transport arrangements, and to assess demand for Community Access places.
Where funded places have eligibility requirements, we will explain these and how information is used to assess requests. We will explain any evidence needed before asking for it. Wherever possible, we will record the outcome of an eligibility check rather than retain copies of supporting documents.
Required fields will be marked. We need a usable contact route to follow up a registration; this can be your telephone number or email, or an agreed representative’s details. Where necessary, we can discuss postal contact.
Optional questions can be left unanswered. Registration does not guarantee a ticket, funding or a particular support arrangement.
We may contact you to answer an enquiry, manage your registration or booking, discuss requested support or communicate essential changes to an activity.
We ask for permission to send promotional emails or texts, including ticket announcements and broader We’re Good news. You can choose the updates you want.
You have the right to object to direct marketing at any time. Use the unsubscribe option, reply using the method provided or contact us.
Opting out of marketing does not stop essential messages about an existing booking or requested support. We may retain a minimal record of your opt-out to ensure we respect it.
Calling us, being referred to us or completing a support questionnaire does not automatically subscribe you to marketing.
We will explain photography or recording arrangements before or at an activity.
We will seek permission before using identifiable photographs, recordings, stories or quotations in our publicity or publications. These may include our website, social media, printed materials, the Golden Memories Record Book and impact reports.
Participation is not conditional on agreeing to publicity. We will explain how to tell us if you do not wish to be photographed or recorded.
You may withdraw permission for future use. Withdrawal does not affect earlier lawful use. We will explain any practical limits, including printed materials already distributed and copies shared by others.
We may use registration information, attendance records and feedback to understand who we reached, what barriers mattered and what could be improved.
Where possible, reports for funders, partners and the public will use anonymous information or combined figures that do not identify individuals.
We will seek separate permission for identifiable stories or quotations. Funding a place does not give a supporter access to the guest’s personal circumstances.
We do not sell personal information.
We use service providers for website hosting and security, forms, email, telephone services, customer relationship management, automation between systems, cloud storage, ticketing and payments.
Our systems may include Brevo, Zapier, Yay and services supporting our WordPress website. Information may therefore be held in more than one system where needed to manage your enquiry or participation.
We may share relevant information with people helping deliver an activity, such as authorised event staff, Befrienders, venues, caterers or transport providers. We limit this to what they need for their role.
If Soowambar Ltd provides production services, any access to personal information must be necessary for its agreed role and covered by an appropriate data-handling arrangement. Information is not automatically shared for Soowambar’s own marketing.
Payment providers process information needed to complete transactions. We may receive payment confirmations and transaction references. Their own privacy information explains their processing.
We may also share information with professional advisers, regulators or public authorities where legally required or otherwise lawfully justified.
Some of the service providers we use may process or store personal information outside the United Kingdom. Where this happens, we will take appropriate steps to ensure that your information is protected in accordance with UK data protection law, for example by relying on recognised adequacy arrangements or approved contractual safeguards where required. You can contact us if you would like more information about these arrangements.
You can contact us if you would like more information about these arrangements.
How long we keep information
We use the following retention periods:
| Information | Normal retention period |
|---|---|
| General enquiries that do not lead to further involvement | Up to 12 months after the enquiry closes |
| Expressions of interest that do not lead to a booking | Up to 12 months after the relevant activity or our last meaningful contact |
| Event registration, attendance and routine correspondence | Up to 12 months after the activity |
| Health, dietary and individual support information | Normally deleted within three months after the activity, once related matters are resolved |
| Copies of eligibility evidence, where necessary | Deleted within three months after the eligibility decision unless a disclosed funding requirement requires longer |
| Volunteer, partner and supplier administration | Normally up to two years after the relationship ends; contracts and financial records may need longer |
| Accounting and transaction records | Normally six years after the end of the relevant company financial year |
| Marketing contact information | Until you unsubscribe, withdraw consent or we remove inactive contacts following review |
| Consented photographs, stories and recordings | Reviewed at least every two years and retained only while relevant to the agreed purpose |
We may keep relevant records longer where necessary for a complaint, incident, legal claim or specific funding obligation. We restrict their use to that purpose.
Consent records and minimal opt-out records may need to be retained to demonstrate and respect your choices. Information that has been genuinely anonymised may be kept for longer-term learning and reporting.
Deletion includes relevant copies in our operational systems. Backup copies are removed through the applicable backup retention cycle.
Our website and hosting providers may process technical information to deliver pages, maintain security and diagnose problems.
Cookies and similar technologies may also be used. Our Cookie Notice explains the technologies used, their purposes and how to manage your choices.
Where consent is required, we ask before enabling the relevant technologies. You can change your choices through the website’s cookie controls.
We use appropriate technical and organisational measures to protect personal information and limit access to people who need it for their work.
We select service providers with appropriate safeguards and put suitable arrangements in place when they handle information on our behalf.
Depending on the circumstances, you can:
Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Contact [email protected] to exercise your rights. We may need to verify your identity. We normally respond within one month and will explain if a lawful extension or exception applies.
Please contact [email protected] if you are concerned about our handling of personal information.
You also have the right to complain to the Information Commissioner’s Office:
Website: https://ico.org.uk/make-a-complaint/
We will update this notice when our activities or use of personal information change. The current version will be available on our website.
Where a change materially affects how we use your information, we will bring it to your attention as appropriate.
