Privacy Notice

Last updated: 9 December 2025

  1. Introduction

Gorgie Community Farm (“we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Notice explains how we collect, use, store and safeguard your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We collect personal data in order to operate the farm, manage volunteers, communicate with supporters, deliver events, handle enquiries, and maintain a safe and welcoming community space.

  1. Who We Are

Data Controller:
Gorgie Community Farm
51 Gorgie Road, Edinburgh, United Kingdom EH11 2LA
Registered charity number: SC053659

If you have any questions about this Privacy Notice or would like to exercise your data rights, you can contact us at:
Email: info@gorgiecommunityfarm.co.uk

  1. The Data We Collect

We may collect, use and store the following categories of personal data:

Identity & Contact Data

  • Name
  • Email address
  • Phone number
  • Postal address

Volunteer & Participation Data

  • Skills, experience and availability
  • Emergency contact information
  • Attendance records
  • Safeguarding information where legally required

Donation & Transaction Data

  • Donation amount and frequency
  • Gift Aid declarations
  • Payment information (processed securely by third-party payment providers – we do not store card details)

Event & Activity Data

  • Event registrations
  • Group visit information (e.g. schools, community groups)

Technical & Website Usage Data

  • IP address
  • Browser type and device information
  • Cookie and analytics data
  • Interactions with our website and digital platforms

Communications

  • Correspondence with us by email, web forms or social media

If we collect any information relating to children (e.g. school visit details), it will be processed with additional care and only where necessary for the service being provided.

  1. How We Collect Your Data

We collect data in the following ways:

  • Directly from you when you contact us, register for events, volunteer, donate, or complete forms on our website
  • Automatically through cookies and analytics tools when you browse our website
  • Through third-party services such as donation platforms, email marketing tools, or event booking systems
  • From partners or community groups who arrange visits or activities with us
  1. Legal Basis for Processing

We rely on one or more of the following lawful bases under UK GDPR:

Consent

For example:

  • Sending you marketing emails or newsletters
  • Collecting Gift Aid declarations
  • Using optional cookies/analytics

Contract

When processing your data to:

  • Manage your donations
  • Register you for an event
  • Respond to a service you have requested

Legal Obligation

For example:

  • Financial record keeping
  • HMRC Gift Aid requirements
  • Safeguarding obligations

Legitimate Interests

For purposes such as:

  • Improving our website and services
  • Maintaining the safety and security of visitors and volunteers
  • Managing enquiries
  • Running community and outreach activities

We always balance our legitimate interests against your rights and freedoms.

  1. How We Use Your Data

We may use your personal data to:

  • Respond to your enquiries and provide support
  • Manage volunteering programmes and community activities
  • Organise events, workshops and group visits
  • Process donations, recurring gifts and Gift Aid
  • Send you updates or marketing communications (with your consent)
  • Maintain and improve our website and digital services
  • Ensure compliance with legal and regulatory requirements
  1. Data Sharing

We only share your personal data with trusted third parties where necessary to provide our services. These may include:

  • Website hosting and IT service providers
  • Email and communication platforms
  • Donation/payment processors (e.g. GoodHub)
  • Analytics services (e.g. Google Analytics)
  • Event booking and ticketing platforms
  • Legal, regulatory or safeguarding authorities where required

All third parties act on our instructions and must comply with UK GDPR.

  1. International Transfers

Some of our service providers operate outside the UK. Where this occurs, we ensure that:

  • An adequacy decision is in place, or
  • Standard Contractual Clauses (SCCs) or equivalent safeguards are used

We ensure all transfers meet UK GDPR requirements for protecting your data.

  1. Data Retention

We retain your personal data only for as long as necessary for the purposes outlined in this notice or as required by law.

Indicative retention periods may include:

  • Volunteer records: 3 years after last volunteering activity
  • Contact form enquiries: 12 months after submission
  • Mailing list data: until you unsubscribe
  • Donation and Gift Aid records: 6 years (per HMRC requirement)
  • Event registration records: 2 years after event date

Full retention schedules are available upon request.

  1. Your Rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Request corrections to inaccurate data
  • Request erasure of your data
  • Restrict or object to processing
  • Request a copy of your data (data portability)
  • Withdraw consent where consent is the legal basis
  • Lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise your rights, please contact us at:
 Email: info@gorgiecommunityfarm.co.uk

  1. Cookies

We use essential cookies to make our website function and may use optional analytics cookies with your consent.
For full details, please see our Cookie Notice.

  1. Changes to This Notice

We may update this Privacy Notice from time to time. The most recent version will always be available on our website.

  1. Contact Us

Gorgie Community Farm
51 Gorgie Road, Edinburgh EH11 2LA
Email: info@gorgiecommunityfarm.co.uk