Privacy Policy

1. Purpose and Scope

Food Train is committed to protecting the privacy and security of personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). This policy explains why we collect personal data, how we process and protect it, and your rights regarding your data.

2. Data Protection Principles

Personal data must be:

  • Processed lawfully, fairly and transparently
  • Collected for specific, explicit and legitimate purposes
  • Adequate, relevant, and limited to what is necessary
  • Accurate and, where necessary, kept up to date
  • Kept only as long as necessary
  • Processed securely

Food Train is accountable for these principles and demonstrates compliance accordingly.

3. Who We Collect Personal Data From

We collect personal data from:

  • Members (service users)
  • Volunteers
  • Employees and prospective staff
  • Directors
  • Donors
  • Referrers, emergency contacts, and member-identified contacts
  • Professionals supporting older people
  • Grant applicants/holders
  • Training participants
  • Research participants

4. What Data We Collect and Why

Each category of data subject is informed of what data is collected, why it is required, and the lawful basis for processing, typically based on:

  • Contractual necessity
  • Legal obligation
  • Consent
  • Legitimate interest

Data collected may include personal identifiers, contact information, health/accessibility data, financial details, employment history, and photographs (with consent).

Sensitive data is only collected where strictly necessary and always stored securely.

5. How We Collect Data

We collect data via:

  • In-person conversations
  • Telephone and email
  • Webforms and digital platforms (e.g., volunteer sign-up, referrals, grant submissions)
  • Surveys and research interviews

We inform individuals at the point of collection about data use and retention.

6. Data Storage and Security

Data is stored securely using:

  • Microsoft SharePoint (cloud-based, access-controlled)
  • Salesforce, Breathe, Jotform, and other secure third-party systems
  • Locked cabinets for hard copy records
  • Restrictions on mobile/home device access
  • Clear desk and no USB policies

Only authorised personnel have access, and all systems are subject to strong confidentiality and security controls.

7. Data Retention

Data is retained only as long as necessary:

  • Employees and directors: 7 years after departure
  • Prospective employees: 6 months if not appointed
  • Volunteers: Deleted after disengagement unless justified
  • Members: Deleted upon membership end unless a valid reason exists
  • Donors: Gift Aid data retained per HMRC requirements
  • Research and grant data: Retained during the relationship and up to 7 years post-project

8. Data Sharing

Data is shared only where necessary and with strict safeguards in place. This includes:

  • Health/social care partners
  • Disclosure Scotland
  • HMRC and pension providers
  • Legal advisers and IT support
  • Approved service providers including Salesforce, GoCardless, Mailchimp, SurveyMonkey, Microsoft 365, PayPal, and Zoom

Some providers may be based outside the UK. In such cases, we ensure data transfers comply with UK adequacy regulations and contractual safeguards.

9. Your Rights

You have rights under UK GDPR, including:

  • To be informed
  • To access your data
  • To rectify inaccuracies
  • To erase data (right to be forgotten)
  • To restrict or object to processing
  • To data portability
  • To withdraw consent
  • To object to automated decision-making or profiling

To exercise your rights, contact our Data Protection Officer:
Email: Everything@thefoodtrain.co.uk

Telephone: 01387 270800

10. Data Breaches

Food Train maintains procedures to identify, report, and investigate data breaches. Any significant breach that may impact your rights will be reported to the ICO within 72 hours.

11. Food Train Marketing

We will, with your consent, text or email you to provide you with information about our work or provide you with our email newsletter, which is used to inform you about appeals, activities and services supplied by us. You can unsubscribe at any time by calling us on 01387 270800 or emailing everything@thefoodtrain.co.uk

We will also communicate with you through postal marketing or telemarketing when it is in our legitimate interests to do this and when these interests do not override your rights. Those legitimate interests include providing you with information on our appeals, services, activities, fundraising, newsletter requests, feedback, competitions and other activities undertaken by us. However, you have the right to contact us at any time opt out of receiving postal or telephone communications by instructing the person calling you, or by contacting the Food Train directly on 01387 270800, by emailing  everything@thefoodtrain.co.uk or by writing to us at The Food Train, 118 English Street, Dumfries, DG1 2DE.

12. Complaints

If you are dissatisfied with our data handling:

  1. Contact our Data Protection Officer.
  2. If unresolved, contact the Information Commissioner’s Office (ICO):

Telephone:  0303 123 1113             Website: www.ico.org.uk