How do we collect personal information?
We collect personal information directly from you when you:
• Contact us
• Register with us
• Enquire about our activities
• Make a donation
• Participate in an event
• Buy from our online shop
• Apply to work or volunteer with us
• Visit our website
• or otherwise provide us with your personal information.
We may also receive personal information indirectly from you, for example through specialist companies carrying out work on our behalf, such as surveys or event bookings, partner organisations for our projects or website and social media platforms which you use to engage with us.
What personal information do we collect?
When you choose to interact with us we may collect the following personal information about you, where we have a lawful reason:
- contact information: including name, postal address, email address, phone number, place of work and job title
- financial information (for donors): including bank details, payment details and if you are a taxpayer
- background information (in the case of applicants for paid and volunteer roles): including employment history, eligibility checks and training records
- sensitive personal information: including age, gender, health, and other diversity information
- your opinions on our services and the routes near you
- how you interact with our website and record which pages you visit when you follow links from our emails through the use of cookies.
Where possible we will use anonymous or aggregated data that does not identify you.
How do we use personal information?
We use the personal information collected from you for a number of purposes, where we have a lawful reason. These include:
- providing you with services, products or information you have requested
- providing further relevant information about our work, services, activities or products
- analysing, managing and improving our services, products and information
- furthering our charitable aims, including for fundraising activities
- processing donations or payments we have received from you
- fulfilling sales you place through our online shop
- processing your application to work or volunteer with us
- inviting voluntary participation in research or surveys.
We will also process your personal information as required by law or regulation
Our lawful basis for processing
As Sustrans generally processes personal data for specific and stated business reasons as specified above, we use “legitimate interests” as our lawful basis, unless it is determined that your rights outweigh our business need.
However, where necessary, Sustrans uses different lawful bases as set out in Article 6 of the GDPR.
For applications to work or volunteer for Sustrans, we use the lawful bases of “consent”, “contract”, and “legal obligation”
Do we share your personal information?
We will never sell your personal information to any third parties.
We may share your personal information with partner organisations, such as local authorities or funders where mentioned, when you provide us with your personal information.
In order to deliver the services we offer, we may share your personal information with carefully selected third parties working with us or on our behalf, for example delivery companies for our online shop.
We will share your personal information when legally required to do so.
We will not transfer your personal data to any 3rd country (i.e. outside the European Economic Area) without either appropriate standard contractual clauses, or an EU Data Protection Adequacy Agreement.
How do we keep your personal information secure?
We adopt appropriate technical and organisational measures to make sure your personal information is secure and protected against unauthorised or unlawful processing, accidental loss, destruction or damage, from the point of collection to the point of destruction.
Access to your personal information is restricted to those people who are required and authorised to process it. Appropriate background checks and training are mandated for our staff, contractors and volunteers processing personal information.
Your personal information will only be shared with another organisation if they agree to ensure sufficient safeguards, including appropriate data sharing agreements, are in place to protect your personal information.
How long do we keep your personal information?
While you are actively engaged with our work we will retain your personal information. Beyond that, we will generally keep your personal information for up to six years, or as legally required. We will remove your personal information earlier if it is no longer required, we no longer have a lawful basis for processing it, or you ask us to remove it.
Your rights
Your personal information belongs to you. You have rights over how we use your personal information:
- the right to be informed
- the right of access
- the right to rectification
- the right to erasure
- the right to restrict processing
- the right to data portability
- the right to object
- rights in relation to automated decision making and profiling.
For further information about your rights, and when they apply, see the Information Commissioner’s Office website: https://ico.org.uk/your-data-matters/
You may opt-out of any marketing communications at any time, by clicking on the unsubscribe link in marketing emails or responding with an “opt out” email. If you ask to stop receiving marketing communications we will retain minimal personal information on our suppression lists to help ensure that we do not contact you.
Registering with the free Telephone Preference Service gives you the opportunity to opt out of receiving unsolicited calls. The Mailing Preference Service will enable you to register to have your name taken off direct mailing lists.
If you are unhappy with our use of your personal information, you have the right to complain to the Information Commissioner’s Office. We would encourage you to contact us in the first instance so we can attempt to resolve any concerns.
Contact us
If you have any questions, comments or feedback about how we use your personal information, or would like to exercise your rights, then please contact our Data Protection Manager, at:
Email: dataprotection@sustrans.org.uk
Post: Sustrans, 2 Cathedral Square, College Green, Bristol, BS1 5DD
This privacy information was issued in May 2021, and has a review date of May 2023. This information will still apply beyond the review date, until the next version is issued.
