Food And Solidarity Limited — Privacy Policy

ICO Registration Reference: ZB537641 Last updated: 3 October 2026

1. Who we are

Food And Solidarity Limited ("we", "us", "our") is a community organisation based in Newcastle upon Tyne. We operate a food parcel service, housing rights support, community solidarity activities, campaigning and community organising. We also act as a fiscal host on the Open Collective platform for community groups.

We are registered as a data controller with the Information Commissioner's Office (ICO) under reference ZB537641.

Registered address: The Shieldfield Centre, 4-8 Clarence Walk, Newcastle, NE2 1AL General enquiries: organiser@foodandsolidarity.org Data protection enquiries: legal@foodandsolidarity.org Phone: 07393 101018

Data Protection Officer assessment

We have assessed whether we are required to designate a Data Protection Officer under Article 37 UK GDPR.

Based on the nature and scale of our current processing activities, and our current assessment of the relevant Article 37 criteria, we do not consider that we are required to appoint a formal Data Protection Officer. We have nonetheless designated legal@foodandsolidarity.org as our primary data protection contact.

We review this assessment if the nature, scale or circumstances of our processing change materially.

2. What this policy covers

This policy explains what personal data we collect, either directly from you or indirectly through third parties and platforms, why we collect and use it, the lawful bases and other legal conditions we rely on, who we share it with, how long we keep it, how we protect it, and your rights under UK data protection law.

It applies to personal data we hold electronically and, where applicable, in paper or other manual records.

It covers information relating to people who:

  • request food parcels or other support;
  • seek housing rights or community support;
  • become or enquire about becoming members;
  • volunteer with us;
  • participate in campaigns or community organising;
  • attend our events or activities;
  • communicate with us through email, telephone, SMS, WhatsApp or social media;
  • make donations or payments;
  • interact with our website;
  • contribute to, or submit expenses through, collectives we host on Open Collective; or
  • otherwise communicate or interact with Food & Solidarity.

A separate section at the end covers the Food & Solidarity WhatsApp Community Privacy Agreement.

Our data protection principles — Article 5 UK GDPR

In all our processing activities we aim to comply with the seven data protection principles:

  • Lawfulness, fairness and transparency — we process data lawfully and explain how we use it.
  • Purpose limitation — data is collected for specific, explicit and legitimate purposes and is not used for incompatible purposes.
  • Data minimisation — we collect information that is adequate, relevant and limited to what is necessary.
  • Accuracy — we take reasonable steps to keep information accurate and up to date.
  • Storage limitation — we retain personal data only for as long as necessary, subject to legal and other legitimate retention requirements.
  • Integrity and confidentiality — we protect personal data against unauthorised access, loss, destruction or other unlawful processing.
  • Accountability — we take responsibility for compliance and maintain appropriate records and processes to demonstrate it.

3. Personal data we collect

The information we collect depends on how you interact with us. We apply the data minimisation principle and do not seek to collect information that is unnecessary for the relevant purpose.

3a. Information you give us directly

Depending on the service or activity involved, we may collect:

  • first name and last name;
  • email address;
  • telephone or mobile number;
  • home or correspondence address;
  • membership information;
  • membership or contribution level;
  • information about whether you wish to receive food-parcel or other support;
  • information you provide when making a food parcel or support request;
  • information about housing or tenancy circumstances where you ask us for housing rights support;
  • information you provide when contacting us with a question, complaint or request;
  • information supplied when you volunteer with us;
  • information about your volunteering interests, availability or activities;
  • information supplied when participating in campaigns, community organising or events;
  • donation and payment information;
  • communications preferences;
  • photographs, recordings, testimonials or other content you voluntarily provide or agree that we may use; and
  • any other information you choose to provide to us where it is relevant to the purpose for which you provide it.

We do not necessarily collect all of these categories from every person.

Information contained in support or housing cases

If you ask us for food, housing or other community support, you may choose to tell us about your circumstances so that we can understand your situation and provide appropriate assistance.

Depending on the nature of the matter, this may include information about:

  • your housing or tenancy;
  • your landlord or letting agent;
  • rent or other housing-related payments;
  • eviction notices or other correspondence;
  • property or accommodation circumstances;
  • household or family circumstances;
  • financial hardship;
  • correspondence with landlords, councils or other organisations;
  • the support you are seeking; and
  • other information that you provide because you believe it is relevant to your request.

Some information contained in support cases may amount to special category data or criminal offence data. We will only process such information where there is an applicable lawful basis and, where required, an appropriate Article 9 or Article 10 condition under UK data protection law.

We will seek to avoid collecting sensitive information that is not necessary for the support we are providing.

3b. Special category data — union membership and other sensitive information

Some information we process may fall within the special categories of personal data under Article 9 UK GDPR.

These categories include information revealing, among other things:

  • racial or ethnic origin;
  • political opinions;
  • religious or philosophical beliefs;
  • trade union membership;
  • health;
  • sex life or sexual orientation;
  • genetic data; and
  • certain biometric information.

Trade union membership and political opinions are expressly recognised as special category data under Article 9.

Striker solidarity food parcels

We collect union membership information only where it is necessary to assess an application for a striker solidarity food parcel.

We will identify:

  1. an appropriate Article 6 lawful basis for the processing; and
  2. a separate Article 9 condition for processing the special category data.

Where we rely on explicit consent under Article 9(2)(a), we will seek that explicit consent separately and make clear what information is being processed and why.

We will collect only the minimum information necessary to assess the application and will delete the information when the assessment purpose has ended, subject to any lawful reason requiring retention.

We will not use union membership information collected for striker solidarity parcel assessment for unrelated purposes.

Other potentially sensitive information

Information provided during housing support, food support, campaigning, organising, volunteering or other activities may sometimes reveal special category data.

We do not assume that all information associated with a particular activity is special category data. We assess the nature of the information actually being processed and document the applicable lawful basis and Article 9 condition where required.

Where special category data is processed, we apply appropriate safeguards, including limiting access and considering whether a shorter retention period is appropriate.

3c. Campaigning and community organising data

If you participate in our campaigns, organising activities, petitions, events or other community activities, we may process information such as:

  • your name and contact details;
  • your membership or supporter status;
  • campaign or event participation;
  • information about actions you have taken or asked us to take;
  • communications with organisers;
  • attendance at meetings or events;
  • information necessary to organise activities; and
  • photographs, video or other material where applicable.

Participation in a campaign or community activity may in some circumstances reveal political opinions, trade union membership or other special category information.

We will not intentionally create or use sensitive profiles about individuals for unrelated purposes.

Where campaigning or organising involves direct marketing to individuals, we will comply with applicable UK data protection and electronic-marketing rules. Direct marketing can include communications promoting the aims or ideals of a not-for-profit organisation, not only commercial advertising.

We will not use special category data for targeted campaigning unless we have identified an appropriate Article 6 lawful basis and Article 9 condition and have complied with applicable safeguards.

3d. Volunteer information

If you volunteer with Food & Solidarity, we may collect information necessary to organise and support your volunteering, including:

  • name and contact details;
  • availability;
  • volunteering interests or preferred activities;
  • information about your role;
  • attendance or participation information;
  • training information;
  • information necessary for safeguarding;
  • accessibility information where you choose to provide it;
  • emergency contact information where appropriate;
  • expenses information; and
  • information relating to incidents, complaints or concerns involving volunteering where necessary.

We only collect additional sensitive information where it is necessary and there is an appropriate lawful basis and, where required, an Article 9 or Article 10 condition.

Where volunteering requires checks or information concerning criminal convictions or offences, we will process that information only where lawful and where the additional requirements applicable to criminal offence data are satisfied.

3e. Photographs, video, testimonials and other media

We may photograph or record activities, events, campaigns or community activities.

Where we intend to use an identifiable person's photograph, video, interview, testimonial or other personal content for publicity or communications, we will consider the appropriate lawful basis and, where consent is used, seek consent in a clear manner.

We may use such material on:

  • our website;
  • social-media channels;
  • campaign materials;
  • newsletters;
  • reports;
  • printed materials; or
  • other communications about our work.

Where appropriate, we will explain the intended use at the point the material is collected.

If you have questions about the use of your image, recording or testimonial, contact legal@foodandsolidarity.org.

3f. Information received from other people or organisations

We may receive personal information indirectly rather than directly from you.

For example, this may happen where:

  • another person contacts us on your behalf;
  • an organisation refers you to us;
  • you are involved in a support matter involving another organisation;
  • information is provided through a service or platform we use;
  • someone provides information relevant to a complaint, safeguarding matter or incident; or
  • information is provided through Open Collective or another third-party service.

Where Article 14 UK GDPR applies, we will provide the information required by law within the applicable timeframe, subject to any relevant exception or exemption.

3g. Data received via Open Collective — Article 14 UK GDPR

Food And Solidarity Limited acts as a fiscal host on the Open Collective platform.

Open Collective, operated by OFi Technologies LLC, USA, may share personal data with us concerning individuals who contribute to, or submit expense claims through, collectives we host.

The categories of data may include:

  • name and email address;
  • contribution amounts and dates;
  • expense reimbursement information;
  • supporting information associated with an expense;
  • organisation or collective affiliation; and
  • other information necessary for fiscal hosting.

We use this information to:

  • receive, hold and disburse funds on behalf of hosted collectives;
  • process expenses;
  • maintain financial records;
  • meet applicable accounting, tax and legal requirements; and
  • administer our fiscal-hosting responsibilities.

Because this information may reach us indirectly, Article 14 UK GDPR may apply. Where it applies, we will provide the required privacy information within the applicable period, subject to any applicable exception or exemption.

If you believe we hold your data through Open Collective and have not received appropriate privacy information, contact legal@foodandsolidarity.org.

3h. Information collected automatically through our website

When you visit foodandsolidarity.org, Squarespace and other services we use may automatically collect technical information such as:

  • IP address;
  • browser type and version;
  • device type;
  • operating system;
  • pages visited;
  • approximate visit duration;
  • referral source; and
  • other technical information necessary for security or analytics.

Where applicable, analytics data is collected only after the relevant consent has been obtained.

We may retain IP addresses in server logs for security purposes for a limited period.

4. Lawful basis for processing

We identify an appropriate lawful basis for each processing activity.

Where special category data is involved, an Article 6 lawful basis is not sufficient on its own. We also identify an applicable Article 9 condition.

Our principal Article 6 lawful bases are:

  • consent;
  • performance of a contract;
  • legitimate interests; and
  • legal obligation.

The applicable basis depends on the processing activity.

Consent — Article 6(1)(a)

We may rely on consent for:

  • marketing or promotional communications where consent is required;
  • non-essential cookies and analytics;
  • certain WhatsApp community participation;
  • use of photographs, recordings or testimonials where consent is the chosen lawful basis;
  • processing special category data where explicit consent is the applicable Article 9 condition; and
  • other activities where consent is genuinely appropriate.

Consent must be freely given, specific, informed and unambiguous.

Where we rely on consent, you can withdraw it at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Where consent is used for electronic marketing, we will keep appropriate records of the consent, including what was consented to and when and how it was obtained. ICO guidance recommends keeping clear records demonstrating marketing consent.

Performance of a contract — Article 6(1)(b)

Where applicable, we may rely on this basis for processing necessary to perform an agreement with you.

This may include:

  • processing membership payments;
  • processing certain donations or transactions where necessary to complete the transaction; and
  • administering services you have requested where the contractual basis genuinely applies.

Not every interaction with Food & Solidarity creates a contract. Where a contractual basis does not apply, we will consider another appropriate lawful basis.

Legitimate interests — Article 6(1)(f)

We may rely on legitimate interests where the processing is necessary for our legitimate interests, or those of a third party, and those interests are not overridden by the individual's interests, rights or freedoms.

Depending on the activity, this may include:

  • managing food parcel and support requests;
  • providing housing rights and community support;
  • sending transactional or service communications;
  • administering membership;
  • organising volunteers;
  • organising community activities and campaigns;
  • maintaining appropriate records of participation;
  • dealing with enquiries and complaints;
  • administering our fiscal-hosting responsibilities;
  • maintaining website security;
  • preventing fraud or misuse;
  • protecting our organisation, staff, volunteers and service users;
  • maintaining appropriate records for accountability; and
  • improving our services using appropriately anonymised or aggregated information.

Where we rely on legitimate interests, we consider the necessity of the processing and balance our interests against the rights and freedoms of the people affected.

We maintain appropriate records of our legitimate-interest assessments where required.

You have a right to object to processing based on legitimate interests in the circumstances set out in Article 21 UK GDPR.

Legal obligation — Article 6(1)(c)

We may process personal data where necessary to comply with a legal obligation applicable to us.

This may include obligations relating to:

  • tax;
  • accounting;
  • financial records;
  • corporate records;
  • regulatory requirements;
  • legal claims;
  • safeguarding; and
  • other applicable legal requirements.

We do not describe a particular retention period as legally required unless we have identified the relevant legal requirement.

5. Electronic communications and PECR

The Privacy and Electronic Communications Regulations 2003 (PECR) operate alongside UK data protection law.

PECR regulates, among other things:

  • electronic marketing;
  • certain telephone marketing; and
  • cookies and similar technologies.

Direct marketing includes advertising or promotional material and can include communications promoting the aims or ideals of an organisation.

Marketing communications

Where PECR requires consent for electronic marketing, we will obtain appropriate consent before sending the relevant messages.

Depending on the communication and circumstances, electronic communications may include:

  • email;
  • SMS;
  • WhatsApp;
  • other electronic messaging;
  • direct messages through social-media platforms; or
  • similar electronic communications.

Consent must be appropriate to the communication and sufficiently specific.

You can withdraw marketing consent or object to direct marketing at any time.

You can opt out by:

  • using the unsubscribe facility in an email;
  • replying STOP where that mechanism is available;
  • using the relevant WhatsApp or messaging opt-out;
  • changing your communication preferences; or
  • contacting legal@foodandsolidarity.org.

The ICO confirms that individuals have an absolute right to object to direct marketing.

Service and transactional communications

Some messages are necessary to provide a service or respond to a request and are not direct marketing.

Examples may include:

  • confirming a food parcel arrangement;
  • responding to a housing-support enquiry;
  • communicating about a membership administration matter;
  • responding to a complaint; or
  • communicating necessary information about an event or service someone has requested.

We will not describe promotional campaign messages as service messages merely to avoid applicable marketing rules.

WhatsApp Business API and SMS

We may send individual or broadcast WhatsApp messages and SMS messages using Brevo or another communications provider.

WhatsApp Business API messages are separate from participation in our WhatsApp Community groups.

Where such messages constitute direct marketing, we will comply with applicable PECR requirements.

Meta may process information transmitted through WhatsApp under its own terms and as an independent controller.

6. Cookies and tracking technologies

Our website uses cookies and similar technologies.

We classify cookies according to their purpose and obtain consent for non-essential cookies where required.

Strictly necessary cookies

Strictly necessary cookies may be used where they are necessary for a service requested by the user or otherwise fall within an applicable PECR exemption.

For example, our website may use Squarespace security cookies required to protect forms or sessions.

Analytics

We may use:

  • Google Analytics 4; and
  • Squarespace analytics.

Where consent is required, these services are activated only after the relevant consent is given.

Marketing

We may use the Meta Pixel to measure the effectiveness or reach of social-media campaigns.

Where the Pixel is used, it will be configured so that it is not activated until the relevant consent has been obtained where consent is required.

We do not use the Pixel to intentionally infer or target people based on their financial hardship, housing insecurity or other sensitive circumstances.

Embedded content

Our website may contain:

  • YouTube videos;
  • Instagram content;
  • Action Network forms or petitions; and
  • other third-party embedded content.

Where required, embedded content is configured to load only after appropriate consent.

Because third-party providers may change their technologies, the precise cookies or similar technologies used may change.

Cookie table

Cookie / technology Provider Purpose Typical duration Category
crumb Squarespace Security / CSRF protection Session Strictly necessary
ss_cid Squarespace Visitor analytics Up to 2 years Analytics
ss_cvr Squarespace Conversion/visitor analytics Up to 2 years Analytics
ss_cvisit Squarespace Visit/session analytics Up to 30 minutes Analytics
ss_cvt Squarespace Visit analytics Up to 30 minutes Analytics
_ga Google Analytics Analytics/visitor distinction Up to 2 years Analytics
_ga* Google Analytics Analytics/session state Up to 2 years Analytics
_gid Google Analytics Analytics Up to 24 hours Analytics
_fbp Meta Campaign measurement Provider-dependent Marketing
fr Meta Campaign measurement Provider-dependent Marketing
datr Meta Security/fraud prevention Provider-dependent Third-party/security
VISITOR_INFO1_LIVE YouTube Video functionality/analytics Provider-dependent Embedded content
YSC YouTube Video session information Session Embedded content
ig_did Instagram/Meta Embedded-content functionality Provider-dependent Embedded content
csrftoken Instagram/Meta Security Provider-dependent Embedded content
_anon_id Action Network Embedded forms / visitor identification Provider-dependent Embedded content

The exact cookies and durations may change as third-party services change. We will review the cookie information periodically against the website's actual configuration.

Cookie choices

Our cookie banner allows visitors to accept or reject non-essential cookies where consent is required.

Where the banner is used to obtain consent:

  • choices are presented clearly;
  • consent is not obtained through pre-selected options;
  • non-essential cookies are not activated before the relevant consent is obtained; and
  • preferences can be changed where the website provides a cookie-settings facility.

You can also control cookies through your browser settings.

7. How we use your data

Depending on the circumstances, we may use personal data to:

  • respond to food parcel requests;
  • provide food parcels;
  • respond to housing rights and other support requests;
  • understand and assist with support cases;
  • communicate with people about services they have requested;
  • administer membership;
  • process membership contributions;
  • organise volunteers;
  • communicate with volunteers;
  • organise campaigns and community activities;
  • administer events and meetings;
  • respond to enquiries;
  • investigate and respond to complaints;
  • process donations and payments;
  • administer Gift Aid where applicable;
  • receive, hold and disburse funds for collectives hosted through Open Collective;
  • maintain appropriate financial and administrative records;
  • send community news or campaign information where lawful;
  • send direct marketing where the applicable requirements are satisfied;
  • operate and secure our website;
  • analyse website use where appropriate consent has been obtained;
  • measure campaign reach using permitted analytics or advertising technologies;
  • publish photographs, recordings or testimonials where appropriate;
  • protect people, our organisation, staff and volunteers;
  • comply with legal and regulatory obligations;
  • establish, exercise or defend legal claims; and
  • improve our services using appropriately anonymised or aggregated information.

We do not sell personal data.

We do not use automated decision-making to determine whether someone receives our food or housing support. Eligibility or support decisions are subject to human involvement.

Campaigns, profiling and sensitive information

We do not intentionally use personal data to create profiles of individuals based on sensitive characteristics such as financial hardship, housing insecurity, political opinions, trade union membership or health for unrelated purposes.

Where campaign communications constitute direct marketing, we comply with applicable UK data protection and PECR requirements.

We will not use special category data for targeted direct marketing unless we have identified an appropriate lawful basis, special-category condition and any necessary safeguards.

Meta Pixel

Our organisation serves people who may be experiencing financial hardship, housing insecurity or other difficult circumstances.

We have therefore considered the privacy implications of using the Meta Pixel and have carried out a Data Protection Impact Assessment in relation to this processing.

The Pixel is used for campaign measurement and not to intentionally infer financial circumstances, housing status or other sensitive characteristics.

Where consent is required, the Pixel is activated only after consent.

We do not intentionally use Pixel data to create Custom Audiences or retarget people based on their use of our support services.

We review this processing if the Pixel's configuration or purpose changes materially.

8. Who we share your data with

We do not sell personal data.

We may share personal data with service providers and other organisations where necessary for the purposes described in this policy or where otherwise permitted or required by law.

Where we appoint a processor, we put appropriate contractual arrangements in place as required by applicable data protection law.

Some third parties act as independent controllers rather than processors. In those circumstances, the third party determines its own purposes and means of processing and is responsible for its own compliance.

Service providers and third parties

Our service providers may include:

Service Purpose Location Typical role / safeguard
Google Document storage / analytics International Processor/controller depending on service; appropriate transfer safeguards where required
Meta / WhatsApp Community communications International Independent controller for its own WhatsApp processing
Meta / Facebook Pixel Campaign measurement International Separate controller arrangements may apply; appropriate safeguards where required
Brevo SMS / WhatsApp Business communications EU / international Processor; appropriate contractual and transfer safeguards
Action Network CRM, campaigning and organising USA / international Processor; appropriate contractual and transfer safeguards
Open Collective / OFi Technologies Fiscal hosting USA / international Platform relationship; role depends on processing; appropriate safeguards
YouTube / Google Embedded video International Third-party provider
Instagram / Meta Embedded content International Third-party provider
Squarespace Website hosting International Processor / provider
GoCardless Payment processing UK / international Payment processor/provider
Stripe Payment processing International Payment processor/provider
Wise Payment processing UK / international Payment provider
Square Payment processing International Payment processor/provider
CallHub SMS / telephone communications International Processor/provider

The precise locations, roles and transfer mechanisms of providers may change. We will maintain appropriate supplier and data-processing records.

International transfers

Some providers may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we will rely on:

  • a UK adequacy decision where applicable; or
  • another lawful transfer mechanism recognised under UK data protection law.

Where appropriate, this may include International Data Transfer Agreements, UK Addendums to Standard Contractual Clauses, or other permitted safeguards.

Where required, we will consider the circumstances of the transfer and any supplementary measures or transfer-risk assessment required by applicable law.

Meta / WhatsApp

Meta Platforms, Inc. and other Meta entities may process WhatsApp information as independent controllers under their own terms and privacy information.

Food & Solidarity does not control Meta's independent processing.

Using WhatsApp therefore involves processing by Meta separately from processing carried out by Food & Solidarity.

Meta Pixel

Where the Meta Pixel is used, the respective legal roles of Food & Solidarity and Meta will depend on the actual processing and contractual arrangement in place.

We will maintain appropriate documentation of the controller relationship and responsibilities applicable to the Pixel.

Where an Article 26 joint-controller arrangement applies, we will maintain an appropriate arrangement allocating responsibilities and explaining the relevant responsibilities to individuals.

9. How long we keep your data

We retain personal data only for as long as necessary for the purpose for which it was collected, subject to legal obligations, legitimate organisational requirements and the establishment, exercise or defence of legal claims.

Our current retention schedule is:

Data type Retention period Reason
Food parcel / support request records Normally 2 years after last contact or request Managing queries, disputes, safeguarding organisational accountability and legitimate interests
Housing/support case records Normally 2 years after closure or last meaningful contact, unless a different period is justified Case administration, disputes, legal claims and accountability
Membership data Duration of membership + normally 1 year after leaving Membership administration and continuity
Volunteer data Duration of volunteering + normally 1 year Volunteer administration and accountability
Financial / payment records Normally 7 years from transaction date Tax, accounting, audit and legal requirements
Open Collective fiscal-host records Normally 7 years from transaction date Tax, accounting, audit and legal requirements
Union membership information collected for striker solidarity assessment Deleted when the assessment purpose is complete, unless a lawful reason requires retention Data minimisation and purpose limitation
Campaign / organising data Normally 2 years after last meaningful engagement Community organising and legitimate interests
WhatsApp community information held by us While membership continues; removed from our records within a reasonable operational period after leaving, subject to lawful retention requirements Community administration
Marketing consent records While relevant and for an appropriate period afterwards Demonstrating compliance and managing suppression/withdrawal
Cookie consent records Appropriate period necessary to demonstrate consent and manage preferences Accountability and compliance
Website security / IP logs Normally up to 90 days Security and fraud prevention
Complaints Normally 2 years after closure, unless a longer period is justified Complaint handling, accountability and legal claims
Photographs / recordings / testimonials For as long as reasonably necessary for the purpose for which they were obtained, subject to applicable consent or other lawful basis Communications and organisational history

Retention periods may be shortened where data is no longer necessary.

They may be extended where necessary to:

  • comply with law;
  • deal with a complaint;
  • establish, exercise or defend a legal claim;
  • investigate an incident; or
  • meet another legitimate legal or accountability requirement.

We periodically review retention periods.

10. How we protect your data

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, loss, destruction or disclosure.

Our measures may include:

  • password protection;
  • two-factor authentication;
  • access controls;
  • restricting access to authorised staff and volunteers;
  • appropriate supplier agreements;
  • secure account management;
  • deletion of information when it is no longer required; and
  • appropriate procedures for responding to suspected personal-data breaches.

Our data is stored using systems including Google Workspace/Drive and other service providers identified in this policy.

No electronic or physical storage system is entirely risk-free.

Personal data breaches

If we become aware of a personal data breach, we will assess the breach and take appropriate containment and remedial action.

Where the law requires notification to the ICO, we will notify the ICO without undue delay and, where required, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will notify affected individuals without undue delay where required by law.

We will maintain appropriate records of personal data breaches.

Data Protection Impact Assessments

Where our processing is likely to result in a high risk to individuals, we will consider whether a Data Protection Impact Assessment (DPIA) is required.

We have carried out a DPIA concerning our use of the Meta Pixel in light of the nature of the people who may use our website and services.

We review DPIAs where processing changes materially.

11. Children

Our services are not specifically directed at children under 13.

We do not knowingly collect personal data from children under 13 except where there is a lawful reason to do so and appropriate safeguards are in place.

If you believe that we have collected information from a child under 13 without an appropriate lawful basis, please contact legal@foodandsolidarity.org.

Where a particular service involves children or young people, we will consider the additional privacy and safeguarding requirements applicable to that service.

12. Your rights

Under UK data protection law, you may have the following rights, depending on the circumstances.

You can exercise your rights by contacting:

legal@foodandsolidarity.org

We normally respond to a valid request without undue delay and within one month.

Where permitted by law, this period may be extended by a further two months where a request is complex or numerous. We will tell you within the first month if an extension is necessary.

Right of access — Article 15

You can ask for a copy of the personal data we hold about you and information about how we use it.

Right to rectification — Article 16

You can ask us to correct inaccurate or incomplete personal data.

Right to erasure — Article 17

You can ask us to delete personal data where there is no compelling lawful reason for us to continue processing it.

This right is not absolute. For example, we may need to retain information to comply with a legal obligation or establish, exercise or defend legal claims.

Right to restriction — Article 18

You can ask us to restrict processing in certain circumstances, for example where you dispute the accuracy of data or object to processing based on legitimate interests.

Right to data portability — Article 20

Where applicable, you can ask to receive personal data that you have provided to us in a structured, commonly used and machine-readable format, or ask us to transmit it to another organisation.

This right applies only in the circumstances specified by law.

Right to object — Article 21

Where we rely on legitimate interests, you may have the right to object to the processing.

We will consider the objection in accordance with Article 21.

You have an absolute right to object to direct marketing, including profiling related to direct marketing.

Right to withdraw consent

Where we rely on consent, you can withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Rights relating to special category data

Where special category data is processed, additional legal conditions and safeguards may apply.

If you want to exercise a right in relation to information you believe is particularly sensitive, you can contact us using the details above.

Rights concerning Open Collective data

These rights also apply to personal data we hold in our capacity as a fiscal host, subject to the applicable legal basis, exemptions and responsibilities of the relevant organisations.

Rights concerning Meta

Where Meta independently processes your information, you may also need to exercise your rights directly with Meta.

We will assist with rights requests concerning processing for which Food & Solidarity is responsible.

13. Complaints and the right to complain to the ICO

If you have a concern about how we process your personal data, you can contact us at:

legal@foodandsolidarity.org

We may process information contained in a complaint in order to:

  • investigate the complaint;
  • respond to the person making the complaint;
  • improve our services;
  • keep appropriate records; and
  • establish, exercise or defend legal claims where necessary.

If you are unhappy with our response, or believe we are not complying with data protection law, you have the right to complain to the Information Commissioner's Office.

Information Commissioner's Office Website: ico.org.uk Telephone: 0303 123 1113 Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

We would welcome the opportunity to address concerns directly first, but you are not required to contact us before complaining to the ICO.

14. Changes to this policy

We may update this policy from time to time.

The current version will be published on our website.

Where changes are significant, we will provide additional notice where appropriate.

We will review this policy when there are material changes to:

  • our services;
  • the categories of personal data we collect;
  • our use of technology;
  • our suppliers or processors;
  • our campaigning or organising activities;
  • our legal obligations; or
  • our data-processing practices.

WhatsApp Community Privacy Agreement

For Food & Solidarity members and community participants

This agreement supplements the main Privacy Policy and applies specifically to participation in the Food & Solidarity WhatsApp community.

W1. Data controller

Food And Solidarity Limited is the data controller for personal data that we process in connection with your participation in the Food & Solidarity WhatsApp community.

Our Business WhatsApp accounts include:

  • +44 7393 101018
  • +44 7598 566043

Data protection enquiries: legal@foodandsolidarity.org

Meta's role

Meta Platforms, Inc. and related Meta entities process WhatsApp information under their own terms and privacy policies.

Meta's independent processing is separate from Food & Solidarity's processing.

We do not control Meta's own systems or all of the information Meta holds about WhatsApp users.

W2. What data is collected

When you join our WhatsApp community, we may process:

  • your telephone number;
  • your WhatsApp profile name;
  • profile photograph;
  • other profile information you choose to make available;
  • your participation in relevant groups;
  • messages or information you voluntarily send to us; and
  • information necessary for administering the community.

Announcement groups

Depending on the configuration of the WhatsApp community, your details may be visible only to Food & Solidarity administrators or may be visible to other members.

We will configure announcement groups to minimise unnecessary disclosure where the WhatsApp platform permits.

Community sub-groups

If you join a sub-group, your telephone number and relevant WhatsApp profile information may be visible to other members of that group.

Other members may therefore be able to identify that you are participating in that particular group.

You should consider this before joining a sub-group, particularly where membership could reveal information about your interests, circumstances, political opinions, union membership or other sensitive matters.

W3. Purpose and lawful basis

We use WhatsApp information to:

  • communicate with members;
  • organise community activities;
  • provide service information;
  • administer groups;
  • communicate about campaigns and events;
  • respond to messages; and
  • facilitate community participation.

The lawful basis will depend on the particular processing activity and may include consent or legitimate interests.

Where a particular WhatsApp communication constitutes direct marketing, we will comply with applicable PECR and UK GDPR requirements.

Where we rely on consent, you can withdraw consent by leaving the relevant community or otherwise contacting us.

W4. Sensitive information in WhatsApp groups

Please do not share unnecessary sensitive personal information in WhatsApp groups.

Messages in group chats may be visible to other participants and may be copied, forwarded, screenshotted or otherwise shared by participants.

We cannot guarantee or control what other WhatsApp participants do with information they can see.

If you need to provide sensitive information to Food & Solidarity, please consider using a private communication channel rather than a group chat.

W5. Data security

We take appropriate technical and organisational measures to protect personal data within the systems we control.

We cannot control the security or privacy practices of WhatsApp or individual group participants.

You should use appropriate care when deciding what information to share through WhatsApp.

W6. Data retention

We retain WhatsApp-related personal data for as long as necessary for the purpose for which we process it.

Where you leave a WhatsApp community or group, we will remove information from our own records within a reasonable operational period where appropriate, unless:

  • retention is required by law;
  • the information is necessary for a legal claim;
  • the information is necessary for safeguarding or incident management; or
  • another lawful reason requires or permits retention.

Messages that remain within WhatsApp's systems are subject to Meta's own policies and systems.

W7. Your rights and complaints

You have the same data protection rights described in Section 12 of this Privacy Policy.

To exercise rights concerning data processed by Food & Solidarity:

legal@foodandsolidarity.org

To complain to the ICO:

ico.org.uk 0303 123 1113

For concerns about Meta's independent processing, you may need to contact Meta directly through its privacy and WhatsApp channels.

W8. Joining the community

Before joining a WhatsApp community or sub-group, you should consider:

  • what information other members may be able to see;
  • whether participation could reveal information about you;
  • whether you are comfortable with other participants knowing that you are a member; and
  • whether a particular discussion should instead take place privately.

Where Food & Solidarity relies on consent for your participation, you may withdraw that consent by leaving the relevant community or contacting us.

Contact

Food And Solidarity Limited The Shieldfield Centre, 4-8 Clarence Walk, Newcastle, NE2 1AL

Data protection: legal@foodandsolidarity.org General enquiries: organiser@foodandsolidarity.org Telephone: 07393 101018

ICO Registration Reference: ZB537641

Website: foodandsolidarity.org/privacy-policy