Policies

PRIVACY STATEMENT

  1. Introduction

The David Gibbons Foundation and The Gibbons Family Trust (The Gibbons Trusts) are committed to protecting the privacy and personal information of everyone with whom we interact. As a grant-making charitable trust, we recognise the importance of handling personal data responsibly and transparently.

This Privacy Policy explains how we collect, use, store, share and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to individuals and organisations who apply for grants from the Trust, beneficiaries of grants, trustees, advisers, and anyone else whose personal information we may process in the course of carrying out our charitable activities.

We encourage you to read this Privacy Policy carefully so that you understand how and why we use personal information and the rights available to you under data protection law.

  1. Who We Are

The Gibbons Trusts are private charitable trusts that provides grants in furtherance of their charitable purposes. In carrying out these activities, the Trusts acts as a data controller, meaning that it determines how and why personal information is processed.

If you have any questions about this Privacy Policy or wish to exercise any of your data protection rights, you may contact us using the details below.

  1. The Personal Information We Collect

Depending on your relationship with the Trust, we may collect and process the following information:

Grant Applicants and Beneficiaries

  • Name and contact details;
  • Postal address;
  • Email address and telephone number;
  • Information relating to financial circumstances;
  • Information relating to education, employment or charitable need;
  • Bank account details for grant payments for successful applicants
  • Information contained in application forms and supporting documents;
  • Correspondence with the Trust.

Trustees and Advisers

  • Contact details;
  • Professional qualifications and experience;
  • Conflict of interest declarations;
  • Identification and due diligence information where required.

Website Users

  • IP address;
  • Browser type and device information;
  • Website usage information collected through cookies or analytics tools.
  1. Special Category Data

In some cases, grant applications may include information relating to:

  • Health conditions or disabilities;
  • Other sensitive personal information.

We will only process such information where:

  • It is necessary for assessing an application;
  • The applicant has provided it voluntarily;
  • A lawful basis and additional condition under UK GDPR applies.
  1. How We Use Personal Information

We use personal information to:

  • Receive and assess grant applications;
  • Verify eligibility for funding;
  • Make grant-award decisions;
  • Administer grants and payments;
  • Communicate with applicants and beneficiaries;
  • Maintain governance and regulatory records;
  • Comply with legal and regulatory obligations;
  • Protect Trust assets and prevent fraud;
  • Manage and improve our website and services.
  1. Lawful Bases for Processing

Under UK GDPR, we rely on one or more of the following lawful bases:

Legitimate Interests

We process personal information where necessary for the legitimate interests of administering the Trusts and making charitable grants, provided those interests do not override your rights and freedoms.

Legal Obligation

We process data where necessary to comply with legal requirements, including charity law, tax legislation and record-keeping obligations.

Consent

Where appropriate, we may rely on your consent, particularly for processing certain sensitive information or for optional communications.

You may withdraw consent at any time by contacting us.

Contract

In limited circumstances, processing may be necessary to fulfil arrangements relating to a grant award or other agreement.

  1. Sharing Personal Information

We treat personal information confidentially and do not sell personal data.

We may share information with:

  • Trustees involved in grant assessment;
  • Professional advisers (such as accountants, legal advisers or consultants);
  • Regulatory authorities where required by law;
  • Service providers who assist with administration, IT support or document storage.

All third parties are required to keep personal information secure and use it only for authorised purposes.

In administering the Trust, we may use carefully selected third-party service providers to assist with activities such as email communication, cloud-based document storage, IT support, accounting and banking services. Where these organisations process personal data on our behalf, they act as our data processors and are required to process information only in accordance with our instructions, maintain appropriate security measures, and comply with applicable data protection laws.

  1. International Transfers

The Trust generally stores and processes personal data within the United Kingdom.

If personal information is transferred outside the UK, we will ensure appropriate safeguards are in place in accordance with UK data protection law.

  1. Data Security

We take appropriate technical and organisational measures to protect personal information against:

  • Unauthorised access;
  • Loss;
  • Misuse;
  • Alteration;
  • Disclosure; and
  • Destruction.

These measures include secure storage systems, access controls and confidentiality obligations.

  1. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal obligations.

Typical retention periods may include:

Record Type Retention Period
Unsuccessful grant applications (including applicant correspondence) Any data of a sensitive personal nature is deleted as soon as the application cycle is complete. The minimum amount of data is collected, to enable the Trustees to make grant decisions.

The remainder of the application is kept up to 7 years from the end of the financial year in which the application was received.
Successful grant applications and grant records (including beneficiary correspondence) Any data of a sensitive personal nature is deleted as soon as the application cycle is complete.

Electronic detailed applications are kept up to 7 years from the end of the financial year in which the application was received.

Payment records are kept indefinitely in the form of meeting minutes, both in paper and electronic form.

Bank identification for successful applicants is collected only when it is needed to pay a grant and is deleted once the payment has been acknowledged.
Financial and accounting records 7 years from the end of the financial year in which the transaction took place.

Financial information contained within minutes of Trustee meetings is kept indefinitely both electronically and on paper.
Trustee records Trustee minutes are kept indefinitely, both electronically and on paper.

Associated meeting documents are kept indefinitely electronically, the paper versions are kept for 7 years from the end of the financial year in which the meeting took place.

Trustee Deeds are kept indefinitely on paper and electronically. Other Trustee records are deleted 7 years after the end of the financial year in which they resigned.
Employee Records Personel, payroll, PAYE and taxation records are kept for 6 years after the end of the relevant tax year.

Pension records are retained in accordance with applicable pension legislation and scheme requirements.
General enquiries and correspondence not resulting in a grant application or employment relationship Up to 2 years

Where information is no longer required, it will be securely deleted or destroyed.

  1. Your Rights

Under UK GDPR, individuals have the right to:

  • Access their personal information;
  • Request correction of inaccurate information;
  • Request deletion of personal information in certain circumstances;
  • Restrict processing;
  • Object to processing based on legitimate interests;
  • Withdraw consent where consent is relied upon;
  • Request transfer of data in certain circumstances;
  • Lodge a complaint with the Information Commissioner’s Office (ICO).

Requests should be submitted using the contact details provided below.

  1. Complaints

If you have concerns about how the Trust handles personal information, please contact us first.

You also have the right to complain to:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Website: www.ico.org.uk
Telephone: 0303 123 1113

  1. Cookies and Website Information

If the Trust operates a website, cookies may be used to improve functionality and analyse usage.

Users can manage cookie settings through their browser preferences.

A separate Cookie Policy may be provided where required.

  1. Changes to This Policy

We may update this Privacy Policy from time to time.

Any changes will be published on our website or otherwise made available on request. The latest version will always show the effective date at the top of the policy.

  1. Contact Us

For any questions about this Privacy Policy or your personal information, please contact the Trustees:

Address: The Gibbons Trusts. Sula, 24 Philip Avenue, Barnstaple, Devon. EX31 3AQ

Email: enquiries@gibbonstrusts.org

Telephone: 07483 335759

Last updated: 20 October 2026