Data protection and privacy notice

  1. About
  2. Data protection and privacy notice

This privacy notice explains what personal data is collected by The National Lottery Community Fund through our grant making activities and how and why we use this data.

Who are we?

When you interact with us online, over the phone or face-to-face, The National Lottery Community Fund will collect your personal data and are responsible for how we store and use it.

Your personal data – what is it?

Personal data is any information that relates to a living individual who can be identified from that data. Personal data which we collect includes your name, address, date of birth, telephone number, email address or photograph.

How do we collect and use your personal data?

If you contact us or apply for a grant, we will collect personal data about you and other people connected to your organisation. We may do this through conversations, at events or during visits to your organisation, or if you call our staff or advice line to discuss funding applications. If your organisation applies for funding, we will also collect personal data on application forms. Sometimes our grant holders and evaluators also send us information about individuals who benefit from projects funded by our grants.

We will keep your personal data up to date and store it securely. We will put appropriate technical measures in place to protect it from loss, misuse, unauthorised access and disclosure, and not collect or retain excessive amounts of personal data. When we have held your personal data for the maximum period of time allowed by data protection laws, we will destroy it securely.

We may keep in contact with you throughout the life of your grant and we will send you regular advice about your grant. These will contain useful information on a range of things including how to publicise your grant, information on other funding available and project ideas and tips from other grant holders.

If you provide us with personal data of people who benefit from your project’s work, we will treat this in the same way. You must tell the individuals and if they have any questions about this, you must refer them to this notice.

What is the purpose and legal basis for storing and using your personal data?

The National Lottery Community Fund is a public body with a statutory duty to distribute National Lottery and other funds for good causes. We process your personal data as a necessary part of exercising this official authority vested in us.

For example, we may use your personal data to help your organisation apply for grants and to assess its applications. We may carry out checks on your personal data as described below. If a grant is awarded, we use your personal data to manage and monitor the grant and to check the money is being used appropriately. If you don’t provide this personal data, we may not be able to process your application or award a grant to your organisation.

We may also use your personal data to evaluate and research the impact of our grants and to let you know about our grants and other activities. The results of our evaluations and research may be published but we won’t publish your personal data without your agreement.

We will not collect and use personal data for purposes beyond our statutory duties except where we have your consent or notified you of the relevant legal basis for processing.

Sharing your personal data

We may share your personal data with organisations which help us to carry out our grant making activities. For example, we share personal data with organisations which help evaluate the impact of our grants on communities. Organisations which support our IT software and systems may also have access to personal data. In each case, we will only share personal data needed to carry out their work, and will do so subject to appropriate safety measures that are designed to ensure your personal data remains secure and is only used for the intended purpose.

We may also share personal data with government departments or other third parties who have funded the grants where this is a condition of their funding. We may also share your organisation’s contact details with your local parliamentary representative as they may want to contact you about the grant.

How long do we keep your personal data?

We keep your personal data for no longer than is necessary for the purposes described in this notice or otherwise allowed by law. Please read our retention policy for more details about how long we retain different types of data.

Fraud prevention and identity checks

If you apply for a grant or receive a grant from us, we may undertake checks on your information. The personal information we have collected from you will be shared with fraud prevention agencies who will use it to prevent fraud and money-laundering and to verify your identity. These checks require us to process personal data you have provided about you and your nominated representatives and data we have received from third parties.

We and fraud prevention agencies may also enable law enforcement agencies, regulators, Government, Lottery distributors and other funders to access and use your personal data to detect, investigate and prevent crime. Fraud prevention agencies can hold your personal data for different periods of time. If you are considered to pose a fraud or money laundering risk, your personal data can be held for up to six years.

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to award a grant and we may withdraw existing grants. A record of any fraud or money laundering risk will be retained by us and the fraud prevention agencies. If fraud is detected, you could be refused certain services, finance, or employment.

Further details of how your information will be used by us and these fraud prevention agencies, and your data protection rights, can be found in the fair processing notices for Cifas' databases. Cifas is a fraud prevention service.

If you have any questions about this, please contact us on the details at the end of this page.

Your rights around your personal data

Your personal data is protected by legal rights. These include the right in certain circumstances to:

  • request a copy of your personal data held by the Fund;
  • ask for your personal data to be erased, for example, if we no longer need it for the purpose we collected it;
  • request that we suspend the processing of your personal data, for example if you want us to establish whether it is accurate or the reason for processing it;
  • object to the processing of your personal data where we are processing it in the exercise of our official authority.

If our processing of your personal data relies on your consent, you also have the right to withdraw your consent at any time and the right to ask for your personal data to be transferred to another organisation (known as the right to data portability).

For more information or to exercise your data protection rights please contact our Data Protection Officer using the contact details below. There are other rights not listed here and exemptions may apply in some circumstances.

If you are unhappy about how your personal data has been used please refer to our complaints policy. You also have a right to complain to the Information Commissioner's Office – contact details below - which regulates the processing of personal data.

Transfer of data abroad

If your personal data is transferred to a country outside of the European Economic Area, we will ensure it is transferred in accordance with this policy and subject to appropriate safety measures. Organisations which receive your personal data from us must accept contractual obligations, or subscribe to international standards, designed to protect your personal data to European standards. Further details about the safeguards in place to protect your personal data in these circumstances can be obtained from the Data Protection Officer.

Automated decision making

Your personal data will not be subject to any automated decision making

Contact details

Contact the Fund’s Data Protection Officer

If you have any questions, queries or complaints, and to exercise your personal data rights, please in the first instance email our Data Protection Officer at data.protection@tnlcommunityfund.org.uk.

Or write to:

The Data Protection Officer
The National Lottery Community Fund
Apex House
3 Embassy Drive
Birmingham
B15 1TR.

Contact the Information Commissioner’s Office

You can contact the Information Commissioner’s Office on 0303 123 1113.

You can find other ways to contact the Information Commissioner’s Office on their website.

Or write to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF.

Privacy notice for the Stakeholder Relationship Management System (SRMS)

We use the SRMS to:

  • keep an accurate record of, manage and prioritise our stakeholder engagement and relationships
  • securely hold stakeholder information.

This Privacy Notice explains how, and on what legal basis, we:

  • collect
  • create
  • receive
  • store
  • use

your personal information on our SRMS.

Read the full privacy notice for the Stakeholder Relationship Management System (SRMS).