Privacy Policy

Version 1.0 (draft for trustee approval) · August 2026

1. Who we are

Insh Community Holdings (ICH) is a Scottish Charitable Incorporated Organisation (SCIO), charity number SC049955, registered in Scotland. Our address is Falachan, Insh, Kingussie, PH21 1NT. We care for the community woodland and grazings beside the village of Insh, in the Cairngorms National Park.

ICH is the data controller for the personal information described in this policy. References to "we", "us" and "our" mean the charity, acting through its trustees.

Website: inshcommunity.org.uk

2. What this policy covers

This policy explains how ICH collects, uses, stores and protects personal information given to us through our website, by email, on paper, or in person. It applies to everyone who interacts with the charity: members, volunteers, neighbours and visitors alike.

We are committed to handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. What personal data we collect

Depending on how you engage with us, we may collect:

3.1 Identity and contact information

Your name
Your email address
Your postal address
Your phone number, if you give it

3.2 Membership information

Whether you are a full or associate member
Whether you have asked us to Gift Aid your membership fee
Your confirmation that the membership fee has been paid
Any comments you add to your membership form

3.3 Correspondence

Messages you send us through the contact form, by email, or on paper

We do not collect sensitive personal data (known under UK GDPR as "special category data") such as health information, ethnicity, religion or political opinions, unless you choose to share it voluntarily in a free-text field. If you do, it will be treated with the same care as all other personal data.

4. How we collect your data

We collect personal data through:

The membership and contact forms on this website
Direct email or other correspondence you initiate with us
Paper forms and sign-ups at community events, meetings and work parties

5. Why we collect your data, and our legal basis

5.1 To administer your membership

We use your name and contact details to keep the membership register, to collect and record the annual fee, and to run the charity in line with its constitution. Our legal basis is that this processing is necessary for the membership agreement between you and the charity (UK GDPR Article 6(1)(b)).

5.2 To claim Gift Aid

If you ask us to Gift Aid your membership fee, we keep your declaration and the records HMRC requires us to hold. Our legal basis is legal obligation (UK GDPR Article 6(1)(c)): charities must keep Gift Aid records to support their claims.

5.3 To contact you about ICH business

We use your contact details to tell you about work parties, meetings, the firewood scheme and other charity business. We will use your data to contact you regarding ICH business only. Our legal basis is legitimate interests (UK GDPR Article 6(1)(f)): members and volunteers reasonably expect to hear from the charity they belong to, and this is unlikely to override your rights given the non-commercial nature of our activity.

5.4 To respond to your enquiries

If you write to us through the contact form or by email, we use what you send us to reply. Our legal basis is legitimate interests.

6. How we store your data

We use a small number of third-party services to run the charity and its website, each acting on our instructions:

Our website is hosted by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, who also provide content delivery, anti-bot verification (Turnstile) and security services. Cloudflare processes web traffic data (including IP addresses) as part of standard hosting and security operations. Cloudflare participates in the EU-US Data Privacy Framework and provides appropriate safeguards for international transfers of personal data.

When you submit the contact or membership form, the contents of your submission are delivered to us by email via Resend (operated by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), which acts as a data processor for the purposes of email transmission. Plus Five Five, Inc. is certified under the EU-US Data Privacy Framework and its UK Extension, and uses the EU and UK Standard Contractual Clauses as an additional safeguard for international data transfers.

The website's content and code are stored with GitHub, Inc. Nothing you submit through our forms is stored there: GitHub holds the pages of the site, not your data.

Membership records and correspondence are kept in the charity's email and document storage, with access restricted to the trustees. Paper forms are stored securely and transferred to digital form promptly; paper copies are destroyed once digitised.

7. How long we keep your data

We retain personal data only for as long as it is needed for the purpose it was collected for:

Membership records: for as long as you remain a member, and for up to six years afterwards where we need them for Gift Aid and charity accounting.
Gift Aid declarations: for the periods HMRC requires.
Contact-form messages and correspondence: only as long as we need them to deal with your enquiry.

8. Who we share your data with

We do not sell or rent your personal data to anyone.

We share personal data only where the running of the charity requires it:

HMRC, to support Gift Aid claims
Professional advisers, such as an independent examiner of the charity's accounts, where required
Public authorities, where the law requires us to

9. Your rights

Under UK GDPR, you have the following rights:

Right of access: you can ask us what personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate data.
Right to erasure: you can ask us to delete your personal data.
Right to restriction: you can ask us to limit how we use your data.
Right to data portability: you can ask for your data in a structured, machine-readable format.
Right to object: you can object to us processing your data on the basis of legitimate interests.
Right to withdraw consent: where we rely on consent, you can withdraw it at any time. You can also withdraw a Gift Aid declaration at any time.

To exercise any of these rights, contact us through our contact page. We will respond within one month.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Cookies and website data

Our website sets no cookies of its own and runs no analytics. The small amount of strictly necessary information stored by our hosting and anti-spam services is described in our separate Cookies Notice, which also explains why you will not see a cookie banner on this site.

11. Changes to this policy

We may update this policy from time to time. The current version and date are shown at the top of this page. Material changes will be communicated to members by email where we hold contact details.