Community Power Privacy Statement
Last updated: August 2026
Our commitment to your privacy
Community Power is committed to protecting your privacy and treating your personal information with care, respect and transparency.
This Privacy Statement explains how Community Power collects, uses, stores and shares personal information about people who engage with us, use our services, participate in our projects, volunteer with us, support our charity, work with us or visit our website.
We will only collect and use personal information where we have a clear reason and a lawful basis for doing so.
We handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations 2003 (PECR) and other relevant legislation.
We aim to make information about how we use personal data clear and easy to understand.
1. Who we are
Community Power is a Charitable Incorporated Organisation (CIO), registered charity number 1210729.
Our purpose is to empower and enable communities to reach their potential, reduce inequality, improve health and wellbeing and enable people and communities to have a meaningful voice in the services and decisions that affect them.
Our work includes community engagement and research, Healthwatch Herefordshire, community development, health inequality programmes, volunteering, training, community-based projects and services, and support for people experiencing disadvantage, including through Lee's Place.
Our contact details are:
Community Power
6 St Peter's Square
Hereford
HR1 2PG
Telephone: 01432 277044
Email: [email protected]
Website: www.communitypower.org.uk
2. Who is responsible for your information?
Community Power is the Data Controller for personal information collected and used for Community Power's activities.
This means that we are responsible for deciding why and how personal information is used and for making sure it is protected.
Our Data Protection Lead can be contacted at:
DPO – Christine Price
Community Power
6 St Peter's Square
Hereford
HR1 2PG
Telephone: 01432 277044
Email: [email protected]
Where information is collected specifically through Healthwatch Herefordshire, the Healthwatch Herefordshire Privacy Statement applies. Further information about this is provided later in this statement.
3. What personal information might we collect?
The information we collect depends upon how you are involved with Community Power.
We will only collect information that is relevant and necessary for the purpose for which it is being used.
This may include:
- your name;
- address;
- telephone number;
- email address;
- date of birth or age range;
- preferred method of contact;
- emergency contact details;
- information about your involvement with Community Power;
- information you provide when contacting us;
- feedback, views and experiences;
- survey and questionnaire responses;
- records of participation in engagement, research, training or community activities;
- information relating to volunteering;
- employment and recruitment information;
- donation and fundraising information;
- financial information where necessary to make or receive payments;
- photographs, video or audio recordings where appropriate;
- information relating to safeguarding or welfare concerns; and
- information needed to administer our services, projects, events and programmes.
We will not routinely collect information simply because it might be useful at some point in the future.
4. Sensitive or special category information
Some Community Power projects involve people sharing personal experiences relating to their lives, health, circumstances or use of services.
We may therefore sometimes need to process information that the law describes as special category personal data.
This can include information about:
- physical or mental health
- disability
- racial or ethnic origin;
- religious or philosophical beliefs;
- sexual orientation;
- sex life;
- political opinions;
- trade union membership; or
- genetic or biometric information used for identification.
We will only collect this information where it is genuinely necessary.
Where we process special category information, we will identify both an appropriate lawful basis under Article 6 of UK GDPR and an additional condition for processing under Article 9.
Depending on the circumstances, this may include explicit consent, vital interests, substantial public interest, health or social care purposes, or research and statistical purposes where the relevant legal requirements are met.
Where necessary, we will put additional safeguards in place.
5. Criminal offence information
There may occasionally be circumstances where Community Power needs to receive or process information relating to criminal convictions or alleged offences.
For example, this could arise through:
- safeguarding;
- Disclosure and Barring Service checks;
- recruitment or volunteering;
- risk management;
- partnership working; or
- information voluntarily shared with us by an individual.
We will only process this type of information where it is necessary and lawful to do so and will apply additional safeguards where required.
6. How we obtain personal information
Most information we hold is provided directly by the person it relates to.
For example, you may provide information when you:
- contact Community Power;
- use one of our services;
- attend Lee's Place;
- participate in a project or programme;
- complete a survey or questionnaire;
- take part in an interview, focus group or community conversation;
- attend an event;
- undertake training;
- volunteer with us;
- apply for employment;
- make a donation;
- fundraise for Community Power;
- subscribe to communications;
- complete an online form; or
- contact us through our website, email, telephone or social media.
We may also receive information about people from other organisations or individuals.
This could include:
- statutory organisations;
- health and social care organisations;
- voluntary and community organisations;
- funding or commissioning organisations;
- referral partners;
- family members, friends or carers;
- employers or referees;
- event or fundraising platforms; or
- information already lawfully available in the public domain.
Where we obtain personal information from another source, we will handle it in accordance with data protection legislation and provide privacy information where required.
7. Why we use your information and our lawful bases
Data protection law requires us to have a lawful basis for processing personal information.
Different lawful bases may apply to different activities.
Consent
We may use your information where you have freely given us clear permission to use it for a particular purpose.
For example, this may include:
- taking part in some research projects;
- use of identifiable photographs or case studies;
- particular communications; or
- sharing identifiable experiences where you have specifically agreed to this.
Where we rely on consent, you can withdraw your consent at any time.
Withdrawing consent will not affect anything we have lawfully done with your information before you withdrew it.
Contract
We may use information where this is necessary to enter into or fulfil a contract with you.
This could include employment, consultancy, training, purchasing or supplier arrangements.
Legal obligation
We may process information because we are legally required to do so.
Examples can include employment, taxation, charity administration, financial reporting and certain safeguarding requirements.
Vital interests
In exceptional circumstances, we may use or share personal information where this is necessary to protect someone's life or physical safety.
Legitimate interests
We may process personal information where this is necessary for the legitimate activities of Community Power and where those interests do not override your rights and freedoms.
This may include:
- administering our charity;
- responding to enquiries;
- managing relationships with partners and stakeholders;
- improving our services;
- evaluating the impact of our work;
- communicating with people with an established relationship with Community Power;
- preventing fraud;
- maintaining security;
- fundraising; and
- supporting our charitable aims.
Where we rely on legitimate interests, we consider the impact on the individual and whether they would reasonably expect their information to be used in this way.
8. Community engagement, research and lived experience
A significant part of Community Power's work involves listening to communities and enabling people to share their experiences.
This may include:
- surveys;
- interviews;
- focus groups;
- community conversations;
- consultation;
- workshops;
- outreach;
- lived-experience research;
- case studies; and
- evaluation
Before collecting information we will explain, in a way appropriate to the project:
- why we are collecting the information;
- how it will be used;
- whether participation is voluntary;
- whether information will be recorded;
- who it may be shared with;
- how long it will be retained; and
- whether individuals may be identifiable in the resulting work.
Where possible, reports and publications will use anonymised or aggregated information so that individuals cannot be identified.
Where we want to use an identifiable case study, quotation, image, recording or personal story, we will explain this clearly and seek appropriate permission where required.
We recognise that people may share sensitive and sometimes distressing experiences with us. We therefore aim to conduct our research and engagement in a respectful, person-centred and trauma-informed way.
People participating in voluntary research or engagement can normally choose not to answer particular questions or stop participating.
9. Lee's Place and direct support
Where people use Lee's Place or other Community Power support services, we aim to collect the minimum personal information necessary.
People will not normally be expected to provide unnecessary personal information simply to access basic community support.
There may be circumstances where information is collected to:
- provide support requested by an individual;
- make a referral with their agreement;
- provide continuity of support;
- manage safety or risk;
- respond to safeguarding concerns;
- demonstrate the reach and impact of a funded service; or
- meet legal or contractual requirements.
Where information is provided to funders or commissioners for monitoring purposes, we will use anonymised or aggregated information wherever reasonably possible.
10. Safeguarding and serious risk
Community Power works with people who may sometimes be experiencing difficult or vulnerable circumstances.
We respect people's confidentiality, but confidentiality cannot always be absolute.
There may be circumstances where we need to share relevant information without consent because we believe this is necessary and lawful to:
- protect a child;
- protect an adult at risk of abuse or neglect;
- protect someone from serious harm;
- respond to an immediate risk to life;
- prevent or detect serious crime; or
- comply with a legal requirement.
Any such decision will be made carefully and we will only share information that is relevant and necessary.
Where appropriate and safe to do so, we will explain the situation to the person concerned.
11. Volunteers
If you volunteer with Community Power, we may collect information including:
- contact details;
- emergency contact details;
- application and interview information;
references; - training records;
- supervision and support records;
availability; - relevant skills and experience;
- equality and monitoring information;
- DBS information where a role requires it; and
- information relating to reasonable adjustments or support needs.
We will only use this information to recruit, support and manage volunteers and to meet our legal and safeguarding responsibilities.
12. Employees, trustees, contractors and applicants
Community Power processes personal information relating to staff, trustees, job applicants, contractors and associates for purposes including:
- recruitment;
- employment;
- payroll;
- pensions;
management and supervision; - training;
- occupational requirements;
- health and safety;
- reasonable adjustments;
- governance;
- safeguarding;
- contractual arrangements; and
- compliance with legal obligations.
More detailed privacy information may be provided separately to staff, applicants or trustees where appropriate.
13. Fundraising, donations and supporters
If you donate to Community Power, participate in fundraising or otherwise support our work, we may process information such as your:
- name;
- contact information;
- donation history;
- fundraising activity;
- communication preferences; and
- Gift Aid information where applicable.
We use this information to administer donations, comply with our financial and legal obligations, thank supporters and, where appropriate, keep people informed about Community Power's charitable work.
We will never sell personal information to another organisation for marketing purposes.
14. Newsletters, fundraising and marketing communications
We may contact people about Community Power's activities, events, fundraising opportunities, campaigns and other charitable work where we have a lawful basis to do so.
Where consent is required, we will ask for it.
Data protection and electronic communications law also allows charities, in certain circumstances, to contact people who have directly expressed an interest in or offered support to their charitable purposes without obtaining separate marketing consent. This is known as the charitable purposes soft opt-in.
Where Community Power uses this provision, we will:
- have obtained your contact information directly from you;
- have obtained it when you expressed an interest in or offered support to our charitable purposes;
- use the communication only to further Community Power's charitable purposes;
- give you a clear opportunity to opt out when we collect your information; and
- provide a simple way to opt out in every subsequent communication.
You can ask us to stop sending you direct marketing at any time.
We will respect your preferences.
We may retain a minimal suppression record after you unsubscribe so that we can make sure we do not accidentally contact you again for marketing purposes.
15. Photographs, video and audio recordings
Community Power may take photographs, video or audio recordings as part of our activities, events, research or communications.
We will consider the circumstances and the reasonable expectations of those involved.
Where an individual is the identifiable focus of publicity or promotional material, we will normally obtain appropriate permission.
Particular care will be taken when images or recordings involve children or adults who may be vulnerable.
16. Who we may share information with
We do not routinely share identifiable personal information with other organisations unless there is a legitimate and lawful reason for doing so.
Depending on the circumstances, information may be shared with:
- organisations delivering services or projects with us;
- funders and commissioners;
- local authorities;
- NHS organisations;
- voluntary and community organisations;
- safeguarding organisations;
- police or emergency services where necessary;
- HM Revenue & Customs;
- the Charity Commission or other regulators;
- auditors and professional advisers;
- insurers;
- IT and digital service providers;
- payroll, finance or HR providers;
- survey, research or event-management providers;
- fundraising and payment-processing providers; or
- other organisations where you have asked or agreed that we make a referral.
We will only share the information necessary for the purpose concerned.
Where possible, information shared for research, evaluation, commissioning or reporting will be anonymised or aggregated.
17. Organisations processing information on our behalf
Community Power sometimes uses specialist organisations and digital services to process information on our behalf.
These are known as data processors.
They may provide services such as:
- secure email and cloud storage;
- IT support;
- website hosting;
- online surveys;
- event booking;
- fundraising and donation processing;
- payroll;
- data analysis;
- transcription; or
- other digital tools used for particular projects.
Where another organisation processes personal information on our behalf, we take appropriate steps to make sure that it provides suitable security and data protection safeguards.
Where required, a written Data Processing Agreement or equivalent contractual arrangement will be in place.
Processors are not permitted to use Community Power's personal information for their own unrelated purposes.
Where a particular project uses specialist technology, including transcription or analysis tools, we may provide additional project-specific privacy information explaining how the technology is being used.
18. International transfers
Some organisations providing cloud, IT or other digital services may process information outside the United Kingdom.
Where personal information is transferred internationally, Community Power will take steps to ensure that the transfer complies with UK data protection law.
Depending upon the country and provider involved, safeguards may include:
- UK adequacy regulations;
- an International Data Transfer Agreement;
- the UK Addendum to approved contractual clauses; or
- another legally recognised transfer mechanism.
We will also consider the security and data protection arrangements of providers before using them to process personal information.
19. How we protect personal information
Community Power uses appropriate organisational and technical measures to protect personal information from:
- unauthorised access;
- accidental loss;
- inappropriate disclosure;
- alteration;
- destruction; or
- misuse.
Measures may include:
- restricted access to systems and records;
- password and account controls;
- secure cloud services;
- encryption where appropriate;
- physical security;
- secure disposal;
- staff and volunteer training;
- confidentiality requirements;
- information-sharing agreements;
- data-processing contracts;
- regular review of information risks; and
- Data Protection Impact Assessments where processing is likely to create a high risk to people's rights and freedoms.
Access to personal information is limited to people who have a legitimate reason to use it.
20. How long we keep information
We do not keep personal information for longer than necessary.
Different information needs to be retained for different periods depending on:
- why it was collected;
- legal requirements;
- contractual or funding requirements;
- safeguarding requirements;
- financial and audit requirements;
- the potential need to establish or defend legal claims; and
- whether information continues to have a legitimate operational purpose.
Community Power maintains a Retention and Disposal Schedule setting out how long different categories of information should normally be retained.
Project-specific information may have its own retention period, which will be explained to participants where appropriate.
When information reaches the end of its retention period, it will be securely deleted, destroyed or anonymised unless there is a lawful reason for keeping it longer.
Anonymised information that can no longer identify an individual may be kept for longer for research, evaluation, statistical or historical purposes.
21. Anonymisation and publication
Community Power frequently uses information to understand what communities are experiencing and to influence improvements.
Wherever reasonably possible, published reports, presentations and evaluation information will be anonymised.
This means removing or changing information that could identify an individual.
We recognise that simply removing someone's name may not always make a story anonymous. A combination of details about someone's circumstances could potentially identify them.
We will therefore consider this risk when preparing case studies, reports and publications.
Where someone's story is likely to make them identifiable, we will normally discuss this with them and obtain appropriate permission before publication unless another lawful basis clearly applies.
22. Your data protection rights
Depending upon the circumstances and the lawful basis we are using, you may have the following rights.
Right of access
You can ask whether Community Power holds personal information about you and request a copy of that information.
This is sometimes called a Subject Access Request.
Right to rectification
You can ask us to correct personal information that is inaccurate or incomplete.
Right to erasure
In some circumstances, you can ask us to delete personal information that we hold about you.
This right does not apply in every situation. For example, we may need to retain some information to comply with a legal obligation.
Right to restrict processing
In some circumstances, you can ask us to restrict how your information is being used.
Right to object
You may have the right to object to particular uses of your information, especially where we rely upon legitimate interests.
You have the right to object to the use of your personal information for direct marketing.
Right to data portability
In certain circumstances, you can ask us to provide personal information you have supplied to us in a structured, commonly used and machine-readable format, or to transfer it to another organisation.
Right to withdraw consent
Where we rely upon your consent, you can withdraw it at any time.
Rights relating to automated decisions
Data protection legislation provides rights relating to significant decisions made about people using solely automated processing.
Community Power does not normally make decisions about people in this way.
Where we introduce processing involving automated decision-making that has a legal or similarly significant effect, we will provide appropriate information and safeguards.
Not every right applies in every circumstance. If we cannot meet a request, we will explain why.
To exercise your rights, please contact:
Email: [email protected]
Telephone: 01432 277044
or write to:
Community Power
6 St Peter's Square
Hereford
HR1 2PG
We may need to ask you for enough information to confirm your identity before releasing personal information.
23. Making a data protection complaint
If you are concerned about how Community Power has collected, used, shared or protected your personal information, we want you to tell us.
You can make a data protection complaint by email, telephone, in writing or in person.
Contact:
Data Protection Lead
Community Power
6 St Peter's Square
Hereford
HR1 2PG
Telephone: 01432 277044
Email: [email protected]
We will acknowledge a data protection complaint within 30 days, investigate it appropriately, keep you informed where necessary and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.
Information about raising a concern is available from:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
We would welcome the opportunity to address your concerns directly, but your right to contact the ICO is not affected.
24. Healthwatch Herefordshire
Community Power delivers Healthwatch Herefordshire.
Information collected specifically for the purposes of Healthwatch Herefordshire's statutory functions is managed in accordance with the Healthwatch Herefordshire Privacy Statement and associated information governance arrangements.
The Healthwatch Herefordshire Privacy Statement explains:
- how Healthwatch collects and uses people's experiences of health and social care;
- how information may be shared with Healthwatch England and relevant health and care organisations;
- how information is anonymised;
- circumstances involving safeguarding or serious concerns; and
- how individuals can exercise their data protection rights.
Where Community Power undertakes work outside the statutory Healthwatch function, this Community Power Privacy Statement will normally apply.
Where appropriate, we will make it clear at the point we collect information which organisation or service is acting as the Data Controller.
25. Our website
When you use the Community Power website, we may receive information that you actively provide to us through:
- contact forms;
- event or enquiry forms;
- newsletter subscriptions;
- surveys;
- donations; or
- other online services.
Our website and its hosting or security services may also process technical information such as an IP address, browser information or device information for security and operational purposes.
Our website may contain links or embedded content from other websites.
Community Power is not responsible for the privacy practices of external websites. You should read the privacy information provided by those organisations.
26. Cookies
Our website may use cookies and similar technologies.
Some cookies are necessary for the website to function correctly.
Where non-essential cookies or technologies require consent, we will provide appropriate information and choices through our website's cookie controls.
More detailed information may be provided through a separate Cookie Policy or cookie notice.
27. Children and young people
Where Community Power processes information about children or young people, we will take account of their age, understanding and particular privacy needs.
Privacy information will be provided in an accessible way where appropriate.
Where consent is the appropriate lawful basis, we will consider whether the child is able to give valid consent themselves or whether consent from a parent or person with parental responsibility is required.
The best interests and safety of the child will be an important consideration in how we use their information.
28. Changes to this Privacy Statement
We will review this Privacy Statement regularly and update it when:
- our activities change;
- we introduce significant new ways of processing personal information;
- relevant technology changes;
- our legal or regulatory obligations change; or
- updated guidance indicates that changes are necessary.
Where there is a significant change in how we use personal information, we will take reasonable steps to bring this to the attention of affected individuals.
The current version will be published on the Community Power website.
29. Contact us
If you have any questions about this Privacy Statement or how Community Power uses personal information, please contact us:
Community Power
6 St Peter's Square
Hereford
HR1 2PG
Telephone: 01432 277044
Email: [email protected]
Website: www.communitypower.org.uk
Registered Charity Number: 1210729