At Granite Heart, we are committed to maintaining the trust and confidence of our customers, sponsors, donors and clients. In particular, we want you to know that Granite Heart is not in the business of selling, renting or trading email lists with other companies and businesses for marketing purposes. We just don’t do that sort of thing. But just in case you don’t believe us, in this policy we’ve provided lots of detailed information on when and why we collect your personal data, how we use it, the limited conditions under which we may disclose it to others, and how we keep it secure.

Who are we?

The organisation responsible for your personal data (called ‘the controller’ in the GDPR legislation) is Granite Heart, a Scottish Charitable Incorporated Organisation (SCIO) regulated by the Scottish Charity Regulator (OSCR), Scottish Charity Number: SC053411, whose registered address is Knapperna House, Udny, Ellon, AB41 6SA.

What personal data do we collect, and when?

Website Cookies

A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser. We may use both “session” cookies and “persistent” cookies on our website. Session cookies will be deleted from your computer when you close your browser. Persistent cookies will remain stored on your computer until deleted, or until they reach a specified expiry date.

We may use session cookies to: keep track of you whilst you navigate our website; keep track of items in your shopping basket; and prevent fraud and increase website security. We may use persistent cookies to: enable our website to recognise you when you visit; and keep track of your preferences in relation to your use of our website.

Third-party platforms

When you interact with us on social media or online platforms such as Google, WordPress, Facebook, WhatsApp, Twitter or Instagram, both Granite Heart and the platform may collect some personal data about you. The data we receive will depend on the privacy preferences you have set on each platform and the privacy policies of each platform: see their respective policies for further details. Please note that some platforms may process your personal data outside the UK, including in the US. Our understanding is that insofar as they store and process personal data on behalf of Granite Heart the third-party platforms that we use are GDPR-compliant.  You will understand that Granite Heart, as a small charity, has to rely on third-party platforms to maintain the security and integrity of your personal data, and risk should be assessed accordingly.

Other websites

Our website and social media channels may contain links to other websites. Granite Heart is not responsible for the privacy policies or practices of any third party.

Google Analytics

We use a third-party service, Google Analytics, on our website to collect standard internet logging information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. We process that data only in a way which does not identify anyone. We do not make any attempt to find out the identities of those visiting the site.

Examples of personal data we collect

We may collect and store personal data about you when you interact with us, both online and in person. For example, this could be when you:

Depending on our relationship with you we may ask for such things as your name, address, electronic contact details, telephone number, donation details, interests and skills. If you are seeking a volunteer or a paid role we may need more information such as your date of birth, previous experience, details of your education and career, special requirements, why you are interested in Granite Heart.  

We may also collect other information relating to you personally which you choose to provide to us. You don’t have to provide us with everything we ask for, but if you don’t that may limit the ways in which we can engage with you.

‘Special category’ personal data

Data protection law recognises that certain types of personal data are more sensitive, including those relating to racial or ethnic origin, religious or philosophical beliefs and political opinions, trade union membership, genetic or biometric data, health data and data concerning a person’s sex life or sexual orientation. We do not as a rule collect any ‘special category’ personal data at all, but we may occasionally need to enquire about your health when that is relevant to some activity you are doing for or with us – for example if you register for a challenge event or to deliver a service on our behalf. Clear notices will be provided at the time we collect any special category data, stating what data is needed, and why.

If you are under 16

If you are aged under 16, we must have your parent/guardian’s permission in writing before you provide any personal data to us.

How do we use your personal data?

Statement of purpose

Granite Heart uses the personal data it collects in furtherance of its charitable objectives. Within that purpose, we might for example use your data for

Legal bases for processing

We process personal data on the following legal bases. The periods in square brackets show when the data is normally deleted (subject to any outstanding legal or other queries which may require us to keep it for longer):

•  Based on your consent: for example, to communicate in connection with Granite Heart’s services and charitable work.  Your consent may be withdrawn at any time without affecting the lawfulness of processing up to the date of withdrawal. [While we still have your consent, e.g. while you voluntarily follow us or continue to be part of any of our social media groups]

•  To comply with legal requirements: for example, to comply with company and charity laws, tax and audit, and to make mandatory disclosures to law enforcement. [Six years]

•  For transactional purposes:  in order to carry out our obligations arising from any contracts entered into, for example processing an order and payment for an item from our online auction/sale. [Six years]

•  Where necessary to protect someone’s vital interests: for example, where we reasonably think that there is a risk of serious harm or abuse to you or someone else. We may record your image on CCTV to prevent crime and keep our people and the public safe. [While the need for protection remains]

•  For Granite Heart’s legitimate interests: for example, where we need the data in order to carry out our work, for staff, donor and volunteer management, or to manage our relationship with you. [Normally, while you remain actively involved, and then for three years in case of later legal query.]

Sharing personal data

Your personal data will be retained in confidence by Granite Heart and will not be used for any purpose other than those stated above. However, we may disclose data when we are required to do so by law, in connection with prospective or active legal proceedings, and in order to establish, exercise or defend our legal rights. In addition to the board of Granite Heart, personal data may be processed by a limited number of volunteers. Such volunteers have committed to handling all personal data in compliance with the GDPR and the UK Data Protection Act 2018.

Your rights

You retain the rights of full access to your personal data, to require Granite Heart to rectify any errors, and to object to any processing that you do not agree with. You also have the right to require us to delete any personal data where consent provides the legal basis for processing. Using those rights will not affect the lawfulness of the processing of your data prior to that date.

You have the right to lodge a complaint about the manner in which Granite Heart is handling your personal data with the UK supervisory authority, namely the Information Commissioner’s Office (ico.org.uk).

Contact Granite Heart

If you have any questions about this privacy policy or Granite Heart’s treatment of your personal data, please send an email to contact@graniteheart.org

Changes to this policy

We may update this policy periodically by posting a new version on our website. You should check this page occasionally to ensure you are familiar with any changes – www.graniteheart.org If the changes made to the policy are significant, we may also at our discretion post a notice on the website prior to the effective date of the change, or, in some cases, we may provide notice of the changes by email.