Document Control
- Version:1.0
- Document owner: Board of Directors, The Good Apple Effect CIC
- Approved by: Board of Directors
- Approval date: To be completed
- Review date:12 months from approval
- Document classification: Public
- Applies to: Directors, Ambassador Advisers, Strategic Advisers, volunteers, contractors and anyone acting on behalf of The Good Apple Effect CIC who processes personal information on its behalf.
1. Statement of Intent
The Good Apple Effect is committed to respecting and protecting the privacy of everyone who interacts with us.
We recognise that people place their trust in us when they share their personal information. We take that responsibility seriously and are committed to collecting, using, storing and protecting personal information responsibly, transparently and in accordance with UK data protection law.
We only collect the information we genuinely need to carry out our work, support our activities and meet our legal obligations. Wherever possible, we minimise the amount of personal information we hold and retain it only for as long as it is necessary.
This policy explains what personal information we collect, why we collect it, how we use it, how we protect it and the rights individuals have in relation to their personal information.
2. Purpose
The purpose of this policy is to ensure that The Good Apple Effect CIC handles personal information fairly, lawfully and securely.
It explains our approach to privacy, data protection and compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other relevant legislation.
The policy also provides clear guidance for directors and anyone acting on behalf of The Good Apple Effect on their responsibilities when handling personal information.
3. Scope
This policy applies to all personal information processed by The Good Apple Effect CIC in connection with its activities.
This includes:
- people who contact us through our website or by email
- newsletter subscribers
- donors and supporters
- business supporters and partners
- directors, Ambassador Advisers and Strategic Advisers
- individuals who make enquiries
- visitors to our website
- contributors to anonymised Real Life Stories
The policy applies regardless of whether personal information is held electronically, in cloud-based systems or in paper records.
4. Data Controller
The Good Apple Effect CIC is the data controller for the personal information covered by this policy. This means we are responsible for deciding how personal information is collected, used, stored and protected.
Our details are:
- The Good Apple Effect CIC
- Company Number: 17001477
- Registered Office: 26 Portland Square, Wapping, London, E1W 2QR
Email: hello@thegoodappleeffect.co.uk
If you have any questions about this policy or how we handle your personal information, please email us using the address above and include“GDPR” in the subject line.
We are committed to handling personal information responsibly, transparently and in accordance with UK data protection law. Where appropriate, we will work with individuals to resolve any questions or concerns about the way their personal information is handled.
5. The Information We Collect
The Good Apple Effect only collects personal information that is necessary to carry out our activities, communicate with people who engage with us and meet our legal and regulatory responsibilities. We are committed to collecting the minimum amount of personal information needed for each purpose.
Depending on how you interact with us, we may collect:
- your name and contact details, such as your email address, when you contact us through our website or by email
- information you provide when subscribing to our newsletter
- information provided when making a donation or supporting our work
- contact information relating to business supporters, partners and organisations we work with
- information provided when registering for future events or activities organised by The Good Apple Effect
- information relating to directors, Ambassador Advisers and Strategic Advisers to support the governance and operation of the organisation
- correspondence and other information you choose to share with us
- technical information collected through our website, including analytics and cookies, to help us understand how our website is used and how it can be improved
Real Life Stories
Where individuals choose to contribute to our Real Life Stories project, we deliberately minimise the personal information we collect and retain.
Interviews are conducted without being recorded. Working transcripts and interview notes are used solely to prepare the story and are securely destroyed once the final version has been completed. Published stories are anonymised unless an individual has explicitly agreed otherwise.
We retain only the minimum information necessary to manage the publication of a Real Life Story, including a record of the contributor’s consent and limited identifying information where required.
Some Real Life Stories may include sensitive personal information, such as experiences of bullying, harassment or mental health. This information is handled with particular care, anonymised wherever possible and processed in accordance with UK data protection law.
Donations and Payment Information
When you make a donation through our website, we collect the information necessary to process and administer your donation.
Depending on the payment method and information requested through our donation forms, this may include your name, email address, donation amount, payment frequency, billing information and transaction details.
For recurring donations, we also process information relating to your subscription, including its status, payment schedule and associated transaction history.
Payment card details are processed securely by Stripe. We do not ordinarily receive or store full payment card numbers or security codes within our WordPress website.
We retain appropriate donation and transaction records to administer donations, respond to enquiries, manage recurring payments and meet our financial and legal obligations.
6. How We Use Personal Information
The Good Apple Effect uses personal information only where it is necessary to support its work, communicate with people and organisations, manage its activities and meet its legal and regulatory responsibilities.
Depending on the nature of our relationship with you, we may use your personal information to:
- respond to enquiries and requests for information
- communicate with supporters, donors, partners and other individuals who engage with our work
- send newsletters and other updates where you have asked to receive them
- process donations and maintain appropriate financial records
- administer future events, meetings and activities
- manage relationships with business supporters, partners and suppliers
- support the governance and administration of The Good Apple Effect
- improve our website, communications and services through the use of website analytics
- comply with legal, regulatory and financial obligations
- protect the security and integrity of our systems and information
Real Life Stories
Where individuals choose to contribute to our Real Life Stories project, personal information is used only for the purpose of preparing, reviewing, publishing and, where appropriate, maintaining their anonymised story.
We are committed to minimising the amount of personal information used throughout this process. Sensitive personal information is handled with particular care and only used where it is necessary and appropriate to do so.
Where an individual asks for support or guidance, we will normally provide information about appropriate specialist organisations rather than sharing their personal information with those organisations on their behalf.
We do not sell personal information or use it for automated decision making or profiling.
Donations and Payment Information
- process and administer one-off and recurring donations
- manage recurring donation subscriptions, including payment schedules, payment updates, cancellations and related enquiries
- provide donation confirmations, payment receipts and relevant
- administrative communications
- maintain accurate donation and financial records
- manage refunds, failed payments and payment-related queries
- meet our legal, accounting and regulatory obligations
7. Lawful Bases for Processing Personal Information
UK data protection law requires organisations to have a lawful basis for collecting and using personal information. The Good Apple Effect only processes personal information where there is a valid legal reason for doing so.
Depending on the circumstances, we may rely on one or more of the following lawful bases:
Consent
We rely on consent where individuals have given us clear permission to use their personal information for a specific purpose. This includes, for example, subscribing to our newsletter, agreeing to the use of non-essential cookies or contributing to our Real Life Stories project.
Where we rely on consent, individuals may withdraw that consent at any time, although this will not affect the lawfulness of any processing carried out before consent was withdrawn.
Contract
We may process personal information where it is necessary to fulfil a contract or take steps requested before entering into a contract. This may include administering donations, organising future events or providing services that have been requested.
Legal Obligation
We may process personal information where it is necessary to comply with legal or regulatory obligations. This includes, for example, maintaining financial records, complying with company law and responding to lawful requests from regulators or public authorities.
Legitimate Interests
We may process personal information where it is necessary for our legitimate interests, provided those interests do not override an individual’s rights and freedoms.
This may include responding to enquiries, managing relationships with supporters and partners, administering the organisation, improving our website and protecting the security of our information and systems.
Special Category Data
Where we process special category data, such as information relating to mental health or experiences of bullying shared as part of our Real Life Stories project, we will only do so where there is a lawful basis under UK GDPR and an additional condition for processing has been met. This will normally be with the individual’s explicit consent.
Donations and Financial Records
We process personal information relating to donations where necessary to administer donations, manage recurring payments, respond to donor enquiries and maintain appropriate financial records.
Depending on the purpose, we rely on legitimate interests in administering and supporting our charitable activities, and legal obligation where processing is necessary to meet our accounting, financial or regulatory responsibilities.
Where we rely on legitimate interests, we consider the impact on individuals’ rights and freedoms and ensure that their interests do not override our legitimate interests.
Where we request consent for optional activities, such as receiving newsletters or other marketing communications, we rely on consent for those purposes. Consent can be withdrawn at any time.
8. Who We Share Personal Information With
The Good Apple Effect does not sell or rent personal information to other organisations.
We only share personal information where it is necessary to support our work, meet our legal obligations or work with trusted organisations that help us operate effectively.
Depending on the circumstances, personal information may be shared with trusted third-party providers including:
- Microsoft 365, which supports our email and business communications
- Airship, which manages our newsletter subscriptions and email communications
- WP Simple Pay, our WordPress payment form plugin, which facilitates donations through our website and maintains associated transaction records, payment references and information submitted through our donation forms
- Stripe, our payment processing provider, which processes donation payments and manages associated customer, payment method and recurring subscription information
our banking providers, which receive and process payments and transfers - Xero and our accountant, to maintain our financial records and meet our accounting obligations
- Dropbox, where documents are securely stored
- Google Analytics, which helps us understand how visitors use our website so that we can improve it
When you make a donation, relevant personal information is transmitted to Stripe to facilitate payment processing and manage any recurring donation arrangements. Information submitted through our donation forms may also be stored within our WordPress website through WP Simple Pay.
These providers process personal information in accordance with their respective roles and applicable data protection obligations. We only share information necessary to administer donations, process payments and meet our legal and financial responsibilities.
Personal information may also be shared, where appropriate, with:
- our solicitor, insurers and insurance broker
- directors and authorised individuals acting on behalf of The Good Apple Effect where access is necessary for them to carry out their responsibilities
- regulators, law enforcement agencies or other public authorities where we are legally required to do so
Where we use third-party organisations to process personal information on our behalf, we only use organisations that provide appropriate safeguards for protecting personal information and that process information in accordance with UK data protection law.
Where individuals contact us seeking support or guidance, we normally provide information about appropriate specialist organisations so they can contact those organisations directly. We do not routinely share an individual’s personal information with those organisations on their behalf unless we have their permission or are required to do so by law.
9. Cookies and Website Analytics
Our website uses cookies to help it function effectively and to improve the experience of people visiting our site.
Cookies are small text files stored on your device when you visit a website. Some cookies are essential for the website to operate correctly, while others help us understand how visitors use our website so that we can improve it over time.
The Good Apple Effect uses:
- essential cookies, which are necessary for the operation and security of our website
- Google Analytics, which helps us understand how visitors use our website by collecting anonymous information about website activity and performance
When you first visit our website, you will be given the opportunity to accept or reject non-essential cookies through our cookie banner. You can also manage or delete cookies through your web browser settings at any time.
Further information about the cookies we use is available through our website’s cookie settings.
10. How Long We Keep Personal Information
The Good Apple Effect retains personal information only for as long as it is necessary to fulfil the purpose for which it was collected, meet legal or regulatory requirements and support the effective operation of the organisation.
Our general approach to retaining personal information is as follows:
- correspondence and general enquiries are retained only for as long as necessary to deal with the enquiry and meet any legal or operational requirements
- newsletter subscription information is retained until an individual unsubscribes or asks us to remove their details
-
donor and financial records, including donation amounts, transaction references, payment records and associated correspondence, are normally retained for six years to meet legal, accounting and financial record-keeping requirements
-
records relating to recurring donations and subscriptions are retained for the duration of the subscription and for an appropriate period afterwards to meet financial, legal and operational requirements
-
personal information held within WP Simple Pay and Stripe is retained in accordance with our retention requirements and the relevant providers’ data retention arrangements
- business supporter information is retained for the duration of the relationship and for up to 12 months afterwards
- governance records relating to directors, Ambassador Advisers and Strategic Advisers are retained permanently as part of the organisation’s corporate record
- website analytics information is retained in accordance with the retention settings within Google Analytics
- information relating to Real Life Stories is retained only for as long as necessary. Working transcripts and interview notes are securely destroyed once the final story has been completed. Records of consent and limited identifying information are retained for as long as the story remains published and for up to three years after publication ceases, unless there is a legal reason to retain them for longer. Where personal information is no longer required, it will be securely deleted, destroyed or anonymised, as appropriate.
Where personal information is no longer required, we will securely delete, destroy or anonymise it, where appropriate and technically possible, unless we are legally required to retain it for longer.
11. Keeping Personal Information Secure
The Good Apple Effect is committed to protecting the personal information it holds against unauthorised access, loss, misuse, alteration or disclosure.
We take appropriate technical and organisational measures to safeguard personal information, including:
- limiting access to personal information to those who need it to carry out their responsibilities
- using secure systems and trusted service providers to store and process personal information
- protecting electronic information through appropriate passwords, security measures and access controls
- securely storing paper records containing personal information
- securely deleting, destroying or anonymising personal information when it is no longer required
Everyone acting on behalf of The Good Apple Effect is expected to handle personal information responsibly and in accordance with this policy.
Although we take appropriate steps to protect personal information, no method of electronic transmission or storage can ever be guaranteed to be completely secure. We regularly review our practices to help keep personal information safe.
12. International Transfers
Some of the trusted organisations that provide services to The Good Apple Effect, such as Microsoft 365, Dropbox, Google Analytics, Stripe and Airship, may process personal information outside the United Kingdom.
Where this happens, we will take reasonable steps to ensure that appropriate safeguards are in place to protect personal information in accordance with UK data protection law. This may include the use of approved contractual arrangements or other recognised legal safeguards.
We will only work with organisations that are committed to protecting personal information and complying with applicable data protection requirements.
13. Your Rights
Under UK data protection law, you have a number of rights in relation to your personal information.
These include the right to:
- know how and why your personal information is being used
- request access to the personal information we hold about you
- ask us to correct inaccurate or incomplete personal information
- request that we delete your personal information where there is no lawful reason for us to continue holding it
- ask us to restrict how we use your personal information in certain circumstances
- object to the processing of your personal information where we rely on legitimate interests
- receive certain personal information in a portable format where this right applies
- withdraw your consent at any time where we rely on your consent to process personal information
The Good Apple Effect does not carry out automated decision making or profiling using personal information.
If you would like to exercise any of your rights, please contact us using the details provided in this policy. We will respond in accordance with the requirements of UK data protection law.
14. Data Breaches
The Good Apple Effect takes any actual or suspected personal data breach seriously.
Where a personal data breach occurs, we will investigate promptly, take appropriate steps to contain and minimise its impact and, where required by law, notify the Information Commissioner’s Office (ICO) and any affected individuals.
We will keep appropriate records of personal data breaches and any action taken in response.
15. Links to Other Websites
Our website may contain links to external websites operated by other organisations, including organisations we recommend or work alongside.
We are not responsible for the privacy practices or content of external websites. We encourage you to read the privacy policies of any website you visit before providing your personal information.
The inclusion of a link does not mean that The Good Apple Effect accepts responsibility for the way another organisation collects, uses or protects personal information.
16. Contacting Us
If you have any questions about this policy or how The Good Apple Effect handles your personal information, please contact us by email at:
hello@thegoodappleeffect.co.uk
Please include“GDPR”in the subject line so that your enquiry can be directed appropriately.
We will deal with all enquiries respectfully, promptly and in accordance with UK data protection law.
17. Complaints
If you are unhappy with the way The Good Apple Effect has handled your personal information, we encourage you to contact us first so that we have the opportunity to understand your concerns and, where possible, resolve them.
If you remain dissatisfied, you have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s independent authority responsible for upholding information rights and data protection law.
Further information about making a complaint can be found on the ICO’s website at www.ico.org.uk.
18. Policy Review
This policy will be reviewed at least annually by the Board of Directors of The Good Apple Effect CIC to ensure it remains accurate, effective and compliant with current legislation and good practice.
The policy may also be reviewed sooner where there are significant changes to legislation, guidance, technology or the way The Good Apple Effect collects, uses or manages personal information.
Any significant changes to this policy will be published on our website, together with the date of the latest version.