Growing Well Privacy & Cookie Policy

This privacy policy sets out how Growing Well Limited (“Growing Well”, “we”, “our”, “us”) uses and protects any information that you give Growing Well when you use this website.

Growing Well takes personal information, security and communication preferences seriously, and is committed to respecting and ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website, then you can be assured that it will only be used in accordance with this privacy statement and current domestic legislation – the United Kingdom General Data Protection Regulation (UK-GDPR), the Data Protection Act 2018 (DPA), and the Privacy and Electronic Communications Regulations (PECR). Growing Well reserve the right to change the terms of this policy at any time and will not specifically notify you of any changes. With this in mind, we recommend that you periodically check this policy.

Who we are

We are Growing Well Limited, a registered charity in England and Wales (no. 1182018) and a private company limited by guarantee without share capital (no. 11446092). Our aim is to improve individual mental health and strengthen communities through personalised support and physical activity within a commercial scale growing enterprise.

What we collect

We collect and process personal data to help us fulfil our charitable purpose. We may collect and process the following information:

• Name, address, and contact details (phone and email), and contact preferences.
• Demographic information such as postcode, preferences, and interests.
• Information needed for enquiries and referrals, including date of birth, gender, next of kin, medical and dietary details, and any allergies.
• Information related to Crop Share participation, site visits, and use of our services.
• Information relevant to job or volunteer applications.
• Any additional information needed to support wellbeing and safety.
• Information required for funder transparency, including contact details and sensitive data such as NI number, date of birth, medical history, mental health notes, and other personal details (shared only with your explicit signed consent).

If you donate, we normally collect your:

• Bank account details (name, sort code, account number) when you set up a regular gift (e.g., a direct debit) or send us a cheque.

Where appropriate, we may also collect:

• Credit/debit card details for processing card payments. These will not be stored by Growing Well. Details taken over the phone will be inputted immediately into the card payment system and will not be recorded elsewhere.
• Tax-payer status for claiming Gift Aid.
• Your donation history.
• Data that may be required for legacy administration when a supporter leaves a legacy gift.
• Correspondence between supporters and ourselves (whether by post, email or phone).
• Information when you complete a form on our website.
• Your posts and messages when you interact with us by social media (for example, Facebook, Instagram, YouTube and LinkedIn)
• Information through your website us (e.g., the IP address and details of pages visited).

We may collect and record any other relevant information you share with us about yourself. If you are not yet one of our donors, we might have obtained some information that is in the public domain. This may include published biographical information, philanthropic interests, open postings on social media sites and data from Companies House. We do this to evaluate what support we should ask you for and to help us to engage you in activities that are relevant to your known interests. We use this information in our legitimate interest as a charity that depends on fundraising. We will not use third parties to conduct wealth screening. We will not retain publicly available data relating to donors without their consent, which will be sought at the earliest practical opportunity.

What we do with the information we collect

We require this information to understand your needs and provide you with a better service, and for the following reasons:

• Keep accurate internal, financial, beneficiary and supporter records, including donations and Gift Aid claims.
• Assess enquiries and referrals, provide appropriate care and support, and respond to questions about our work and services.
• Recruit and manage staff and volunteers.
• Improve our services and website, including tailoring website content to user interests.
• Record and use individuals’ contact preferences, and communicate for administrative, donation‑related, fundraising, marketing, or research purposes.
• Create case studies, send event invites, campaigns and activity updates, with consent.

Any sensitive data is treated in the strictest confidence.

How we share personal data

We will not share the personal information you provide us with anyone else unless you have given us your written permission, or when we are required to do so by law or when we have reason to believe that the disclosure of such information is necessary to identify, contact or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other users or anyone else that could be harmed by such activities. If you make a Gift Aid donation to us, we will share data with HM Revenue and Customs to enable us to claim Gift Aid. We will only share your data with carefully selected service providers and sub-contractors, for example for fulfilling donations in line with our charitable purposes. These data processors have access to personal information needed to perform their functions, but they may not use it for other purposes. In addition to our supporter database, your data may be loaded into other software such as email marketing platforms.

Security

We are committed to ensuring that your information is secure. To prevent unauthorised access or disclosure we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online. Most data will be kept electronically on a secure, encrypted, storage solution – any hard copy files are secured in a locked cabinet. We will keep your data only to fulfil the purpose in which it was initially collected for, and only for the duration we are required by law to do so. Data will be destroyed after the following time periods:

• Enquiry and referral forms: kept for 7 years.
• Medical information and consent forms: kept for 12 years.
• Beneficiary records: retained from initial enquiry/referral through your time with us, and for 7 years after last contact; includes progress notes.
• Volunteer records: retained from induction and include training, policy updates, event information, roles, skills, and offers of help.
• Crop Sharer records: kept for 7 years.
• Donor and supporter records: kept for 7 years after last donation or contact. Major donations over £2,000 are held indefinitely. Legacy‑related records are kept until the donor confirms no gift will be left, or four financial years after notification of death.
• Financial records (e.g., invoices): kept for 7 years.

Our online giving platform offers secure payment processing which is conducted by providers who specialise in the secure capture and processing of online transactions. We do not retain any card payment information. We review the data protection policies of any external companies we use to store and process data, for example MailChimp and Donorfy.

Cookies and how we use them

A cookie is a small file which asks permission to be placed on your computer’s hard drive or mobile device. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The website may tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences. We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to provide a better service for visitors. We only use this information for statistical analysis purposes, and then the data is removed from the system. Overall, cookies help us provide you with a better website and user experience, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the browsing data you choose to share with us. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Complianz

We may use a website plugin called Complianz which helps us meet compliance requirements and fulfils permissions for Google Analytics, Google Maps and Google.

Links to other websites

This website includes links to other websites. These links are provided for your convenience to provide further information. They do not signify that we endorse the website(s). We have no responsibility for the content of the linked website(s). Once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Responsibilities

We undertake regular reviews into who has access to information we hold to ensure that your information is only accessible, processed and managed by appropriately trained staff and volunteers. We will not sell, distribute or lease your personal information to third parties.

Controlling your personal data

You may choose to restrict the collection and/or use of your personal data in the following ways:

• Whenever you are asked to fill in a form on the website, you can indicate that you do not want the information to be used for marketing purposes.
• If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by writing to us or emailing.
• You can also unsubscribe from our emails using the link provided in such emails.

You may request details of personal information which we hold about you under the Data Protection Act 1998. A small administration fee may be payable. If you would like a copy of the information held on you, please write to us or email.

If you believe that any information we are holding on you is incorrect or incomplete, please write to at the registered address below or email us at [email protected] as soon as possible, using the contact details below. We will promptly correct any information found to be incorrect.

You also have the right to make a complaint with the data protection regulator, the Information Commissioner’s Office (ICO). For further information on your rights and how to complain to the ICO, please refer to the ICO website – https://ico.org.uk 

You can write to the Information Commissioner’s Office at: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or phone: 0303 123 1113.

Growing Well Ltd. Registered address: Low Sizergh Farm, Sizergh, Kendal, Cumbria LA8 8AE. If you have any questions about privacy on our website, please contact us.

Disclaimer

This website has security measures in place to protect the loss of, misuse of or unauthorised access to data. We take this responsibility very seriously and make every effort to ensure your personal information is secure. However, no data transmission over the Internet can be guaranteed to be 100% safe. With this in mind, whilst Growing Well strive to protect your personal information and privacy, we cannot guarantee the security of any information you disclose or transmit to us online and cannot be responsible for its theft, disclosure or subsequent misuse.