Privacy Policy
Updated August 2026
Introduction
Friends of the Ullswater Way (“FOUW”, “we”, “us”) is committed to operating openly, responsibly, and in line with good governance practice.
This policy explains how we collect, use and protect your personal data, and the standards we follow as a volunteer-led charity. All trustees, volunteers and partners acting on behalf of FOUW are expected to follow this policy.
FOUW is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 (DUAA), and the Privacy and Electronic Communications Regulations (PECR).
This policy may be updated from time to time.
1. What personal data we collect
Personal information is any data that can be used to identify you. We only collect, store and use it when we have a specified reason to do so. We will usually collect the following basic information about you from you directly if you are making a donation, booking events, registering as a volunteer or buying merchandise:
name and title
postal address
telephone number (for resolving administrative issues)
photographs or video of event attendees.
We may also collect information submitted through online forms, event registrations, website interactions or digital communication tools.
We may also collect, store and process information about your interactions with us. This may include the date, time, content, and method of contact (including face-to-face meetings), details about donations you make to us, events or activities you register for or attend, and how you’ve helped us through volunteering or any requests for support.
We may also collect and record other relevant information that you share with us about yourself, such as your interests or affiliations with other charities, community or campaign groups, local Council or planning team.
We sometimes receive personal data about individuals, such as volunteers, from third parties, for example, when we partner with another organisation for volunteering
2. Sensitive personal data
We do not usually collect or store sensitive personal data such as information about your health, beliefs or politics but there are some exceptions to this.
If you work for us as a volunteer, then we may collect additional information about you, including emergency contact details and information about medical conditions. We only hold health information which you have provided to us, unless you have an accident whilst volunteering for us, in which case we may collect additional sensitive personal data in the event of an insurance or legal claim.
We follow the Age-Appropriate Design Code (AADC) when processing children’s data.
3. How we use your personal information
We set out below the lawful bases on which we may process your personal data and the purposes for which we may process your personal data.
We may process your personal data on the lawful basis that it is in our legitimate interests and/or the legitimate interests of a third party to do so. We do not believe that the processing of your personal data on the basis of our legitimate interests as described below is likely to prejudice your rights and freedoms or your own legitimate interests.
Our legitimate interests include the following:
where the processing enables us to enhance, modify, personalise or otherwise improve our services and communications to supporters to benefit our charitable objectives
to identify and prevent fraud
to ensure the safe and appropriate handling of personal data
to better understand how people interact with our websites
to provide postal communications to you which we think will be of interest to you as someone who is supporting our objectives
to determine the effectiveness of our appeal campaigns, advertising and other promotions
to provide a personalised service to you when you visit our website.
to ask you what you think of us
using images for external marketing and publicity purposes via social media, our website, in presentations or printed materials.
We also use personal data for administrative and operational purposes, including:
the processing of donations
the fulfilment of orders for goods or services
to respect your choices and preferences (e.g. if you ask not to receive marketing material, we will keep a record of this to ensure we respect your choice).
In some cases we may also process data to:
comply with a legal duty (e.g. for regulatory purposes)
perform a contract (we may process your personal data to discuss, enter into and/or fulfill our obligations under a contract with you)
help protect your health and wellbeing whilst you are volunteering with us (e.g. to provide a safe environment).
We may carry out research and analysis on our supporters’ data to help us better understand them, improve the relevance and effectiveness of our marketing, and provide a better service to supporters. This may include using demographic or other information to identify common characteristics, interests and preferences.
We may also occasionally use publicly available information about individuals, such as media reports or information on Companies House about business interests, or information available from internet searching, to inform our communications.
We may aggregate, anonymise or pseudonymise personal data before we analyse it so that it can no longer be linked to an identifiable person.
We may occasionally send you information about the activities of third parties which we consider to be directly relevant to our charitable objectives.
We do not make any solely automated decisions which produce legal or significant effects on individuals.
In certain circumstances, we may process your personal data on your consent. We will ask for your consent when the law outlines consent as the appropriate lawful basis for the relevant processing activity, for example, when you opt in to receiving certain materials from us. You can withdraw your consent for processing activities carried out on the lawful basis of consent, as set out below.
4. Photographs and video
We often take images of multiple participants at our public events. It is our legitimate interest to do so for publicity purposes and as a record of our work. We will ensure that people participating in our group events are given advance notice of our intention to collect images and reminders on the day. They will have the right to object to our use of them.
If we are taking specific, close-up images of individuals whose names may be included in our use of those images, we may secure and retain the individual’s written consent, including by electronic communications.
If we are taking readily identifiable images of children, we will take particular care to ensure their privacy rights are respected. If under 16 years of age, we will secure written parental consent for the taking and use of the photograph or video. If 16 to 18 years of age, we secure consent from the child. Consent can be withdrawn at any time.
5. Marketing information by email
When providing us with email information via our website, you may receive marketing communications under the charity “soft opt-in” rules, where:
you have provided your email while engaging with us, and
it is reasonable to expect updates about our work, and
you can unsubscribe at any time.
If you sign up online specifically for email updates, this will be treated as explicit consent.
You can object or unsubscribe from marketing emails at any time by emailing info@friendsoftheullswaterway.org.
6. Telephone
We do not make unsolicited marketing calls to numbers registered with the Telephone Preference Service or Corporate Telephone Preference Service without consent. You may receive other types of telephone calls from us which are administrative or in response to a request from you for information, such as regarding an order or volunteering or event booking.
7. Supporter profiling
We may occasionally conduct supporter profiling to better understand engagement and improve our fundraising and communications. You can object to profiling at any time, and we do not carry out solely automated decision‑making that has legal or significant effects on individuals.
The original activities we undertake remain unchanged and are outlined below:
Analysis of supporters by group, postcode or area to target resources effectively
Collecting career information, affinity to our cause, or connections with staff/Trustees.
Reviewing publicly available information such as trusteeships, previous donations, or CSR involvement
Researching publicly available networks or affiliations relevant to our objectives
Ensuring information is collected from sources where individuals reasonably expect it to be public
Creating short biographies for meetings where relevant
Carrying out due diligence on significant donations, as required by the Charity Commission
Screening supporters if there is a risk of reputational harm through association.
If you do not wish your data to be used for profiling, please contact us at info@friendsoftheullswaterway.org.
8. Retaining and storing your data
We are committed to ensuring that your information is secure. In order to prevent the loss, misuse or alteration of personal information under our control we have put in place physical, electronic and managerial procedures to safeguard and secure the information we hold.
We store data using reputable cloud providers (such as Google), which may process data inside the UK, the EEA, or other countries with appropriate safeguards such as Standard Contractual Clauses (SCCs) or the UK IDTA.
When donations are made through People’s Fundraising, FOUW receives the donor’s name, email address (if provided), and the donation amount. We use this information for thanking donors, financial reconciliation, and audit purposes.
FOUW does not receive or store any payment card or bank details. These are processed securely by People’s Fundraising in accordance with their own privacy policy.
Duplication of data will be minimised and any personal information you supply to us will not be retained for longer than necessary. Retention periods for different categories of data are as follows:
These retention periods form part of our internal Record Retention Schedule, which we review regularly.
We regularly review what information we hold and delete any that is no longer required.
9. Archiving
Where our work is of public interest we may archive it in order to secure the permanent availability of recorded memory, i.e. evidence and information in order to enable research, accountability, the discovery and availability of FOUW’s identity, memory and history, the establishment of precedent decisions and educational use. We minimise the amount of personal data included in archives.
10. Sharing your data
We will never sell or rent your personal information to other organisations. We may occasionally share your data with third parties or individuals when obliged to by law, for purposes of national security, taxation, criminal investigations and the following:
If we have asked you if we can do so and you have given consent
Within the scope of our relationship with other organisations, such as service providers e.g. mailing or delivering orders, when using auditors/ advisors or processing credit or debit cards payments
If we merge with another organisation to form a new entity, information may be transferred to the new entity
If we run an event in partnership with another organisation we may need to share your details with that organisation. We will ensure that it is made clear to you what will happen to your data when you register for the event
We may share aggregated anonymised statistics about our supporters to potential partners, sponsors or other third parties that we trust but no individuals will be identifiable.
Where third parties are located outside the UK, we use approved safeguards such as the UK International Data Transfer Agreement (IDTA) or UK-approved Standard Contractual Clauses.
We are monitoring the developments in this area of law and will be making changes to our personal data safeguards when/if required.
11. Your data rights
You have legal rights for the control of your data, which includes:
the right for confirmation as to whether or not we hold your personal data
the right to obtain a copy of the information we hold (called a Subject Access Request, see below)
the right to have inaccurate data corrected
the right to have your data erased, except where it is necessary for us to continue to use the data for a lawful reason
the right to object to our processing of your data for marketing or profiling
the right to ask us to transfer your personal data to another organisation
the right to restrict the processing of your personal data in certain circumstances
the right to receive your data in a common electronic format where we hold it either on the basis of your consent or for the performance of a contract
the right to complain to a supervisory authority (usually, this is the supervisory authority in the country in which you reside), in the UK, this is the Information Commissioner which can be contacted here
the right to complain about how we handle your data
the right to escalate complaints to the Information Commissioner’s Office (ICO) if you are not satisfied with our response
our duty to acknowledge data-related complaints within 30 days (as required by the Data (Use and Access) Act 2025).
You can withdraw your consent for processing activities carried out on the lawful basis of consent. You can do this by emailing us at info@friendsoftheullswaterway.org.
You can contact us at any time to access, change or update the details we hold on you. You have the right to obtain a copy of your record, known as a Subject Access Request, free of charge. We will need to ask you to confirm your identity. We will not normally charge a fee for responding to a subject-access request. Where the law permits, we may charge a reasonable fee based on the administrative cost of responding to a manifestly unfounded or excessive request.
If you want to find out more about the information we hold about you or what we do with it, please contact:
Mr Tim Clarke,
Chair, FOUW,
5 Grassthwaite How,
Glenridding, Cumbria CA11 0PY
Email: info@friendsoftheullswaterway.org
We must provide you with the information without delay and at the latest within one month of receipt.
We may extend the period of compliance by a further two months where requests are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.
If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible.
12. Children’s data
Whilst children over the age of 13 can give their own consent to marketing, we have decided not to process the data of anyone under the age of 18 for marketing purposes.
We follow the Age‑Appropriate Design Code (AADC) when processing any children's data.
If you are under 18 and want to donate or buy merchandise, please obtain your parent/guardian’s permission before you provide any personal information to us and tell us your age.
When children participate in events, we may hold data provided by a parent or guardian, including health information, name, address and date of birth. All children must be accompanied by a responsible adult.
If we capture identifiable photographs or video of children, we will:
obtain parental consent (under 16) or the child’s own consent (16–18)
explain how images will be used
store them securely
retain them for no longer than 5 years unless consent is withdrawn
honour requests to withdraw consent wherever possible.
13. How we use cookies
We use cookies to ensure our website works properly, to understand how visitors use the site, and to help us improve our content and services. For more details on the specific cookies used and how you can control them, please see our separate Cookies Policy on our website.
14. Links to other websites
Our website may contain links to enable you to visit other websites of interest easily. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement.
When you follow a link to a third-party website (for example, People’s Fundraising, PayPal or Eventbrite), their own privacy policy will apply. We do not receive or store your payment information. We encourage users to review the privacy notice of any third-party site before providing personal data.
You do not need to disclose any personal information to simply browse our site.
15. Complaints
Complaints about how we handle personal data should be made using the contact details in Section 11 of this Privacy Policy. General organisational complaints should follow our separate Complaints Policy.