Privacy Policy

This Privacy Policy explains how The Duchy Foundation collects, uses and protects personal information when you visit www.theduchyfoundation.org or contact us through the website.

The Duchy Foundation is currently an informal, unincorporated, non-profit organisation operated by a small team of volunteers. It is not currently a registered charity.

1. Who is responsible for your information?

The Duchy Foundation is responsible for deciding how and why personal information submitted through this website is used. This means that The Duchy Foundation acts as the data controller for that information.

You can contact us about privacy or your personal information using the following details:

The Duchy Foundation
128 City Road
London
EC1V 2NX
United Kingdom

Email: empowerment@theduchyfoundation.org

Please use the subject line “Data protection request” when contacting us about your personal information.

2. What this policy covers

This policy applies to personal information collected when you:

• visit our website;

• complete our contact form;

• contact us using the email address published on the website; or

• correspond with us following an enquiry.

The website is currently provided to explain The Duchy Foundation’s work and allow people to contact us.

The website does not currently:

• sell products or services;

• accept payments;

• process donations;

• provide online programme applications;

• provide public user accounts;

• make automated decisions about visitors; or

• intentionally collect sensitive personal information.

3. Information we collect

Information you provide

When you complete the contact form, we may collect:

• your first name;

• your last name;

• your email address;

• the contents of your message; and

• any other information you choose to provide.

If you contact us directly by email, we will also receive your email address and any information contained in your message.

Please do not include unnecessary sensitive information in a general enquiry. This includes information about your health, ethnicity, religion, criminal history, safeguarding circumstances or financial position.

If we need sensitive information for a particular legitimate purpose, we will explain why it is required and provide appropriate privacy information at that time.

Information collected automatically

When you visit the website, Wix and related website technologies may automatically process limited technical information, including:

• your IP address;

• browser type;

• device type;

• operating system;

• approximate location derived from your IP address;

• the pages you visit;

• the date and time of your visit;

• referring website information;

• cookie identifiers; and

• website security and diagnostic information.

Some of this information is necessary to deliver and protect the website. Other information must not be collected through non-essential cookies or similar technologies unless you have provided valid consent.

4. Why we use your information

Activity

Purpose

Lawful basis

Receiving an enquiry

To receive and understand your message

Legitimate interests

Responding to an enquiry

To provide information or communicate with you about your message

Legitimate interests

Managing correspondence

To keep an appropriate record of the enquiry and our response

Legitimate interests

Taking steps at your request

To explore a possible partnership, opportunity or other arrangement you have asked about

Steps requested before entering into an agreement, where applicable

Operating the website

To display the website and provide its basic functions

Legitimate interests

Website security

To protect the website, prevent misuse and investigate technical or security problems

Legitimate interests

Legal matters

To meet legal obligations and establish, exercise or defend legal claims

Legal obligation or legitimate interests

Our legitimate interests include:

• communicating with people interested in our work;

• responding to questions;

• exploring potential partnerships;

• maintaining appropriate organisational records; and

• operating and protecting the website.

We consider whether using information is necessary and whether our interests are outweighed by the individual’s rights and reasonable expectations.

Submitting an enquiry does not automatically add you to a marketing or mailing list.

5. What happens when you contact us?

Messages submitted through the contact form are received and reviewed by authorised members of The Duchy Foundation’s volunteer team.

We use the information to:

• understand your enquiry;

• identify the appropriate person to respond;

• communicate with you;

• take any action you have requested where appropriate; and

• maintain a limited record of the correspondence.

We will not use your contact details to send unrelated promotional messages unless we have an appropriate legal basis and have provided the relevant information at the time.

6. Who can access your information?

Personal information may be accessed by members of The Duchy Foundation’s volunteer team where access is necessary to respond to an enquiry or manage the website.

Volunteers are expected to:

• treat personal information confidentially;

• access only the information needed for their responsibilities;

• avoid using information for personal purposes; and

• store and communicate information securely.

We may also share information with:

• Wix, which provides the website platform and associated services;

• email, website or IT service providers;

• professional advisers where necessary;

• public authorities where disclosure is legally required;

• law-enforcement bodies where disclosure is lawful and necessary;

• courts or parties involved in legal proceedings; or

• another appropriate organisation where disclosure is necessary to protect someone from serious harm.

We do not sell personal information.

7. Wix and other service providers

The website is currently created and hosted using Wix.

Wix may process information on our behalf to:

• display and host the website;

• transmit contact-form submissions;

• protect the website;

• prevent spam and misuse;

• maintain technical logs;

• provide essential website functions; and

• support the operation of the website.

Wix may also process some information for its own purposes as explained in its privacy information.

Where another supplier processes personal information on our behalf, we will take reasonable steps to ensure that an appropriate data-processing agreement is in place.

8. International transfers

Wix and certain technical service providers may store or process information outside the United Kingdom.

Where personal information is transferred to a country that is not covered by UK adequacy regulations, the transfer must be protected using an appropriate legal safeguard. Depending on the provider and destination, this may include:

• the UK International Data Transfer Agreement;

• the UK Addendum to approved contractual clauses;

• the UK Extension to the EU–US Data Privacy Framework, where applicable; or

• another transfer mechanism recognised under UK data-protection law.

You may contact us if you would like further information about the safeguards associated with a particular provider.

9. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected.

We normally intend to apply the following periods:

Information

Normal retention period

General enquiries requiring no further action

Up to 12 months after the enquiry is closed

Enquiries leading to an ongoing working relationship

For the duration of the relationship and ordinarily for up to six years afterwards where necessary

Unwanted, spam or irrelevant messages

Deleted as soon as reasonably practical

Complaints or disputes

For as long as required to investigate the matter and ordinarily for up to six years after closure where necessary

Website security and technical logs

In accordance with Wix’s applicable settings and only for as long as reasonably necessary

We may retain information for longer where required by law or where necessary to establish, exercise or defend a legal claim.

We periodically review the information we hold and securely delete or anonymise information that is no longer needed.

10. Cookies and similar technologies

The website may use cookies and similar technologies.

Strictly necessary cookies

These technologies are required to:

• display the website;

• maintain security;

• balance network traffic;

• prevent misuse; and

• remember privacy choices.

Strictly necessary technologies do not normally require consent.

Optional cookies

Optional cookies may include analytics, functional or embedded-content technologies. These must not be activated unless:

• they are genuinely necessary for a service requested by the visitor; or

• the visitor has provided valid consent.

If optional cookies are active, the website should provide clear options to:

• accept them;

• reject them; and

• manage preferences.

Withdrawing consent should be as easy as giving it.

A technical cookie scan should be completed through Wix before publishing a separate Cookie Policy. This will identify the specific cookies, providers, purposes and durations present on the website.

11. Security

We take proportionate steps to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.

These measures include, where applicable:

• limiting access to authorised volunteers;

• using password-protected accounts;

• applying confidentiality requirements;

• using established website and email providers;

• reviewing access when volunteer responsibilities change;

• maintaining appropriate account-security settings; and

• responding to suspected personal-data breaches.

No method of transmitting information over the internet or storing it electronically can be guaranteed to be completely secure.

12. Your rights

Depending on the circumstances, you may have the right to:

• ask whether we hold personal information about you;

• request a copy of your information;

• have inaccurate or incomplete information corrected;

• request deletion of your information;

• request restriction of its use;

• object to processing based on legitimate interests;

• request transfer of certain information;

• withdraw consent where processing relies on consent; and

• complain about how your information has been handled.

These rights are not absolute. Their application may depend on the purpose and lawful basis for processing and any relevant legal exemptions.

To exercise a right, contact:

Email: empowerment@theduchyfoundation.org
Post: The Duchy Foundation, 128 City Road, London, EC1V 2NX

We may request proportionate information to verify your identity.

We will normally respond within one month. The law may permit an extension in certain circumstances. Requests are normally free, although a reasonable fee may be charged or a request refused where it is manifestly unfounded or excessive.

13. Complaints

If you are concerned about how we have handled your information, please contact us first:

Email: empowerment@theduchyfoundation.org
Post: The Duchy Foundation, 128 City Road, London, EC1V 2NX

Please use the subject line “Data protection complaint.”

We will acknowledge a data-protection complaint within 30 days and take appropriate steps to investigate and respond without undue delay.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: Make a data-protection complaint

14. Children’s information

The website and its general contact form are not intended to collect personal information directly from children without appropriate adult involvement.

If you are a parent or guardian and believe a child has submitted personal information through the website, please contact us. We will review the circumstances and delete or restrict the information where appropriate.

15. External websites

The website may contain links to external websites and social-media platforms.

Those organisations may process personal information under their own privacy policies. We encourage visitors to read the privacy information provided by an external website before submitting information to it.

The Duchy Foundation remains responsible for technologies that it chooses to embed or activate directly on its website.

16. Changes to this policy

We may update this Privacy Policy if:

• the website changes;

• we introduce a new form or website function;

• we appoint a new technology provider;

• our use of personal information changes;

• our organisational or legal status changes; or

• data-protection law or regulatory guidance changes.

The latest version will be published on this website with an updated review date.