Privacy Policy

Last updated: August 2026

​

Community Roots CIC is committed to protecting and respecting your privacy and to handling personal information responsibly, fairly and transparently.

This Privacy Policy explains what personal information we may collect, why we collect it, how we use and protect it, who we may share it with, how long we keep it and the rights you have in relation to your information.

​

Community Roots CIC is a Community Interest Company registered in England and Wales.

Company number: 08432598

​

This Privacy Policy should be read alongside our Data Protection Policy, which sets out in more detail how Community Roots CIC manages personal information and complies with data protection legislation.

​

1. Who we are

Community Roots CIC works with communities across Gloucestershire.

Our work includes community organising and community conversations, community projects and activities, training, community hubs and food projects, volunteering and partnership work.

For the purposes of UK data protection legislation, Community Roots CIC will normally be the data controller for personal information that we collect directly.

In some commissioned projects we may work with another organisation which has commissioned or funded the work. In these circumstances, our respective responsibilities for personal information will depend upon the arrangements for that particular project.

​

2. When we may collect information about you

We may collect personal information when you:

• take part in a community conversation, consultation, survey or engagement activity;

• take part in one of our projects, activities or events;

• take part in training;

• volunteer with Community Roots CIC;

• contact us by email, telephone, social media, a website form or in writing;

• register an interest in our work or ask us to keep in contact with you;

• visit or use our website;

• make a purchase, payment or donation where these facilities are available;

• make an enquiry about working, volunteering or partnering with us;

• supply goods or services to Community Roots CIC; or

• otherwise provide information to us in connection with our work.

We do not collect personal information simply because it may be useful. We aim to collect only the information that we reasonably need for the purpose for which it is being collected.

​

3. What information we may collect

Depending upon how you interact with us, the information we collect may include:

• your name;

• email address;

• telephone number;

• postal address;

• postcode or general area in which you live;

• information you give us when taking part in a community conversation, survey, project or evaluation;

• information relating to training, volunteering or participation in our activities;

• correspondence between you and Community Roots CIC;

• information necessary to administer a payment, purchase, donation or other transaction;

• photographs or video where appropriate permission has been obtained; and

• technical information generated when you use our website, such as information about how the website is used.

We will only collect information that is relevant to the particular activity.

​

4. Community conversations and engagement

Listening to communities is central to our work.

When you take part in a community conversation, you may normally choose to take part anonymously unless there is a particular reason why contact information is required.

The information gathered through conversations is primarily used to understand:

• what people value about their community;

• the concerns or issues people identify;

• ideas and opportunities within communities;

• priorities identified by residents; and

• actions, projects or changes that communities may wish to develop.

We may analyse conversations and combine the information people give us to identify themes, trends and priorities.

Reports produced from community conversations will normally present information in an anonymised or aggregated form. We will not normally identify an individual in a report without their knowledge and appropriate permission.

Where a person provides their contact details because they would like further involvement, information or contact from us, those details will be used for that purpose.

​

5. Equality and other sensitive information

Occasionally, projects, funding agreements or evaluation activities may require us to collect equality, demographic or other information which could include special category personal data.

This can include information about matters such as health, ethnicity, religious or philosophical beliefs or other protected characteristics.

Where we collect this information, we will explain why it is being requested.

We will collect only what is necessary and will apply additional safeguards where appropriate.

Where equality or demographic information is collected for research, monitoring or evaluation, we will normally seek to separate it from information that identifies an individual and use anonymised or aggregated information in reports.

​

6. Why we use your information

We may use personal information to:

• respond to enquiries and requests;

• deliver community projects, services and activities;

• undertake community conversations and engagement;

• provide training;

• administer volunteering;

• communicate with people who have asked to remain involved in our work;

• organise events and activities;

• manage purchases, payments or donations;

• administer contracts and relationships with partners, funders and suppliers;

• monitor and evaluate our projects;

• understand the communities in which we work;

• improve our services and activities;

• produce anonymised or aggregated reports;

• meet funding or contractual reporting requirements;

• manage and improve our website;

• keep appropriate financial and organisational records;

• meet our legal and regulatory responsibilities; and

• protect the safety, security and legitimate interests of Community Roots CIC and the people with whom we work.

 

7. Our lawful bases for using personal information

UK data protection law requires us to have a lawful basis for processing personal information.

The basis we use will depend upon why the information is being processed.

Consent

We may rely on your consent where you have made a genuine choice to allow us to use your information for a particular purpose.

For example, this may apply where you ask to receive particular communications from us or give permission for a photograph or personal story to be used.

Where we rely on consent, you can withdraw it at any time.

Contract

We may process information where this is necessary to enter into or fulfil a contract with you.

Legal obligation

We may process and retain information where we are legally required to do so, for example in relation to financial, employment or regulatory records.

Legitimate interests

We may use information where it is necessary for the legitimate activities of Community Roots CIC and where those interests are not overridden by your rights and interests.

This may include activities such as administering our projects, responding to enquiries, maintaining appropriate records, evaluating our work and protecting the organisation and its systems.

We will consider whether the use of the information is necessary and proportionate before relying upon legitimate interests.

Vital interests

In exceptional circumstances, information may be used where this is necessary to protect someone's life.

Where we process special category information, we will also identify an appropriate additional condition for processing that information.

​

8. Information collected through our website

When you use our website, information may be collected when you:

• complete a contact or enquiry form;

• register for an activity or service;

• complete another online form;

• make a purchase, payment or donation, where these facilities are available; or

• interact with features provided through the website.

We may also receive technical information about use of the website.

We use this information to operate the website, respond to enquiries, provide requested services, understand how the website is being used and improve its usefulness.

​

9. Cookies and similar technologies

Our website may use cookies and similar technologies.

Some cookies are necessary for the website to function properly. Other cookies or technologies may be used to help us understand how people use the website or to provide additional functionality.

Where consent is legally required for a cookie or similar technology, it will not be used until you have made a choice through the website's cookie controls.

You can change your cookie preferences using the controls provided through the website where available.

Further information about the cookies currently used by the website should be provided through our cookie settings or Cookie Policy.

​

10. Payments and financial information

Where you make an online payment, purchase or donation, payment card information may be collected and processed by the payment provider used to process the transaction.

Community Roots CIC does not normally receive or store your complete payment card details.

We may retain information about the transaction where this is necessary for accounting, administration, contractual or legal purposes.

​

11. Photographs, video and personal stories

We sometimes take photographs or video at Community Roots CIC projects, activities and events or use stories and quotations to demonstrate the impact of our work.

Where an individual is identifiable and consent is required, we will seek appropriate permission before using the material.

We will explain how we intend to use photographs, video, quotations or personal stories when consent is sought.

You may withdraw consent for future use where consent is the basis on which we are using the material. This will not necessarily enable us to withdraw material that has already been lawfully published or distributed.

​

12. Social media

Community Roots CIC uses social media to communicate about our work and engage with communities.

If you interact with us through a social media service, the provider of that service may also process information about you under its own privacy policy.

Community Roots CIC is not responsible for the way an independent social media provider processes information through its own platform.

We recommend that you review the privacy settings and privacy information provided by any social media service you use.

​

13. Who we share information with

We do not sell your personal information.

We do not provide personal information to other organisations for their own direct marketing purposes.

We may share information where this is necessary with:

• organisations working with us to deliver a project or activity;

• an organisation which has commissioned or funded a particular piece of work, where appropriate;

• organisations providing services to Community Roots CIC, such as website, IT, email, payment, accounting or other administrative services;

• professional advisers where necessary;

• regulators, public bodies or law-enforcement organisations where we are legally required to do so; or

• another organisation where you have specifically asked or agreed that we should share your information.

Where organisations process personal information on our behalf, we expect them to protect that information appropriately and only use it for the agreed purpose.

Information from community engagement which is shared with funders, commissioners, partners or the wider public will normally be anonymised or aggregated unless there is an appropriate reason and lawful basis for identifying an individual.

​

14. International transfers

Some organisations providing website, email, IT, cloud or other digital services may process or make information accessible outside the United Kingdom.

Where this amounts to a restricted international transfer under UK data protection law, Community Roots CIC will take reasonable steps to ensure that an appropriate lawful transfer mechanism and safeguards are in place.

We will not rely on the fact that information is stored electronically as a reason to reduce the level of protection given to it.

​

15. How long we keep information

We do not keep identifiable personal information for longer than we reasonably need it.

Different types of information need to be retained for different periods.

For example:

• information provided for a specific enquiry may be deleted when the enquiry has been dealt with and there is no continuing reason to retain it;

• contact information provided for ongoing involvement will normally be retained while that involvement continues or until you ask us to stop contacting you;

• identifiable information associated with community conversations, projects and evaluation will normally be retained only for as long as it is needed for the project and its evaluation;

• anonymised community research, statistical information, reports and quotations which no longer identify an individual may be retained for longer;

• training, contractual, financial, employment and organisational records may need to be retained for longer periods in order to meet legal, contractual, funding or regulatory requirements.

We periodically review information that we hold and securely delete or destroy information that is no longer required.

More detailed retention arrangements may be set out in our internal Data Protection Policy and associated records.

​

16. Keeping your information secure

Community Roots CIC takes reasonable technical and organisational measures to protect personal information from:

• unauthorised access;

• inappropriate disclosure or use;

• accidental loss;

• alteration; and

• destruction.

Access to personal information is restricted to staff, volunteers, contractors or service providers who need access for an appropriate purpose.

No method of electronic storage or transmission can be guaranteed to be completely secure, but we take proportionate steps to manage the risks associated with the information we hold.

​

17. Your rights

Depending upon the circumstances and the lawful basis on which your information is being processed, UK data protection law gives you a number of rights.

These may include:

• the right to be informed about how your personal information is used;

• the right of access to personal information we hold about you;

• the right to rectification if information is inaccurate or incomplete;

• the right to erasure in certain circumstances;

• the right to restrict processing in certain circumstances;

• the right to data portability in circumstances where that right applies;

• the right to object to certain uses of your personal information;

• rights relating to certain forms of automated decision-making; and

• the right to withdraw consent at any time where we are relying upon consent.

Not every right applies in every circumstance.

Community Roots CIC does not currently use personal information to make solely automated decisions that have legal or similarly significant effects on individuals.

​

18. Accessing or correcting your information

If you would like to:

• ask what personal information we hold about you;

• request a copy of it;

• ask us to correct inaccurate information;

• ask us to delete information;

• object to or restrict its use; or

• exercise another data protection right,

please contact Community Roots CIC using the details below.

We may need to ask for information to confirm your identity before responding to a request.

​

19. Children and young people

Community Roots CIC works within communities and some of our activities may involve children and young people.

We recognise that children require particular protection when their personal information is used.

Where we collect personal information directly from children or young people, we will take account of their age, understanding and the nature of the activity and will provide information about the use of their data in a form that is appropriate to them.

Where parental or guardian permission is required, we will seek it.

Where an online service is likely to be accessed by children, we will take their needs and rights into account when deciding how their information is used.

​

20. Links to other websites

Our website may contain links to websites operated by other organisations.

This Privacy Policy applies to Community Roots CIC. Once you follow a link to another organisation's website, that organisation's privacy arrangements will apply.

We are not responsible for the privacy practices of independent third-party websites and recommend that you read their privacy information.

​

21. Raising a concern or making a complaint

If you have a concern about the way Community Roots CIC has collected or used your personal information, please contact us.

We would welcome the opportunity to investigate and resolve your concern.

We will acknowledge a formal data protection complaint within the period required by data protection legislation and respond without undue delay.

You also have the right to raise a concern or make a complaint to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.

Information about making a complaint is available from the ICO at ico.org.uk.

​

22. How to contact us

For questions about this Privacy Policy, the information Community Roots CIC holds about you or the exercise of your data protection rights, please contact:

Community Roots CIC
Company number: 08432598

Email: deb.baker@communityrootscic.org.uk
Telephone: 07803 264270

You can also contact us through the Community Roots CIC website.

​

23. Changes to this Privacy Policy

We may update this Privacy Policy when our activities, the services we use or data protection requirements change.

The latest version will be published on our website and the date at the beginning of the policy will be updated.

Last updated: August 2026