Privacy Policy

• The Policy in Brief
• The Policy in Full
  • Who are we
  • What information we collect
  • How we use information
  • Disclosing and sharing data
  • Researching and profiling
  • How we protect your data
  • How we store your data
  • Keeping you in control
  • Cookies and links to other sites

The Policy in Brief

LHCRT is committed to protecting your privacy and security. This policy explains how and why we use your personal data, to ensure you remain informed and in control of your information.

We store your data securely and will never sell your personal data, and if we share your personal data, it will only ever be with our partner organisations where necessary to provide services, and only then if we are certain that its privacy and security are guaranteed.

It’s important that you read the full policy to understand what information we hold, how we may use it, and what your rights are – but if you don’t have time to read it all now, here’s a quick summary:

• We collect information that is either; personal (eg. email address, name, telephone number, postal address, medical information) or non-personal (such as IP addresses, website pages accessed, etc)
• We collect information about members, 500 Club members, supporters, volunteers, donors and website users.
• We collect information to provide goods, to provide information, to fundraise, for administration.
• We only collect information that is necessary for our charitable purposes.
• We do our very best to keep personal information secure. (See sections 7 and 8 on how we protect and store your data.)
• We never sell your data and we will never share it with another company or charity for marketing purposes.
• We will not share your data, unless we are required by law or to organisations we work with where necessary to provide LHCRT services (such as for mailing of our magazine), and only then provided that the privacy and security of data is guaranteed. (See section 4.)
• Our website uses cookies – for more information check our cookies policy below.

You can decide not to receive communications or change how we contact you at any time. If you wish to do so, please contact info@lhcrt.org.uk.

The policy in full

1. Who are we?

“We” and “Us” is LHCRT and our trading subsidiary. Your personal data (i.e. any information which identifies you, or which can be identified as relating to you personally) will be collected and used by LHCRT (charity no. 702429), for the purposes of data protection law, LHCRT is the data controller for all personal data processed by the Trust and its trading subsidiary.

Data protection contact

LHCRT does not require a Data Protection Officer, but all data protection enquiries can be directed by email to companysecretary@lhcrt.org.uk or by post to: LHCRT Data Protection, Gresley Suite, Stowe House, Netherstowe,  Lichfield WS13 6TL.

LHCRT is registered with the UK Information Commissioner’s Office (ICO) as a data controller. Our registration number is ZC104355 and our details are publicly available on the ICO register.

2. What information we collect

Personal data you provide

We collect data you provide to us. This includes information you give when joining or registering, placing an order or communicating with us. There are several means by which LHCRT collects personally identifiable data, for example:

• personal details (name / date of birth / email address / postal address / telephone number etc.) when you join as a member, donate as a supporter or sign-up as a volunteer;
• personal details (health, next of kin, ethnic origin (optional, for equality monitoring), DBS checks and age for under 18s) when you sign up as a volunteer
• financial information (payment information such as bank details or debit/credit card details, and whether donations are gift-aided. Please see Section 7 for more information on payment security); and
• details of your interests and preferences (such as campaigns and the ways you support us).

Information created by your involvement with LHCRT

Your activities and involvement with LHCRT will result in personal data being created. This could include details of how you’ve helped us by volunteering or being involved with our campaigns and activities.

If you decide to donate to us then we may keep records of when and how much you give to a particular cause.

Information we generate

We may conduct research and analysis on the information we hold, which can in turn generate personal data. For example, by analysing your interests and involvement with our work we may be able to build a profile which helps us decide which of our communications are likely to interest you.  (Section 6 Research and profiling) contains more information about how we may use information for profiling and targeted advertising.

Information from third parties

We sometimes receive personal data about individuals from third parties. For example, if we are partnering with another organisation (e.g. you provide your information to another charity we’re collaborating with on a restoration project).

We may also receive information from third‑party fundraising platforms such as the Lichfield District Community Lottery. This may include your name, contact details, the amount raised for LHCRT through your ticket purchases. LHCRT does not receive or process your payment card details, which are handled solely by the lottery operator under its own privacy policy.

We may collect information from social media where you have given us permission to do so, or if you post on one of our social media pages.

Sensitive personal data

We do not normally collect or store sensitive personal data (such as information relating to health, beliefs or political affiliation) about supporters and members. However, there are some situations where this will occur (e.g. if you volunteer with us or if you have an accident on one of our volunteering activities). If this does occur, we’ll take extra care to ensure your privacy rights are protected.

Accidents or incidents

If an accident or incident occurs on our property, at one of our events or involving one of our volunteers then we’ll keep a record of this (which may include personal data and sensitive personal data).

Volunteer data

If you are a volunteer then we may collect extra information about you (e.g. criminal records checks, details of emergency contacts, medical conditions, driving licence for plant operators where required). This information will be retained for legal reasons, to protect us (including in the event of an insurance or legal claim) and for safeguarding purposes.

We may ask volunteers to provide optional information about their ethnic origin for equality and diversity monitoring. This helps us ensure fair access to volunteering opportunities. Providing this information is entirely voluntary and not required to volunteer with LHCRT.

Children’s data

We only collect information about children where necessary for volunteering or safeguarding. For anyone under 18, we require parental or guardian consent. Children’s data is handled with additional care and is never used for marketing.

Photography and images

We may take photographs or video at LHCRT events, volunteer sessions and public activities to record our work, celebrate volunteer contributions and promote our charitable objectives. These images may include identifiable individuals. Images may be used in our publications, on our website, on social media, in fundraising materials or in press releases. We will always seek consent from identifiable individuals where required, and we will obtain written parental or guardian consent before using images of anyone under 18. If you prefer not to appear in photographs, please inform the event organiser or photographer. We will make reasonable efforts to respect your preference, although this may not always be possible in large group or crowd images. Where required by law, we will seek consent before using identifiable images. At public events, signage may be used to inform attendees that photography is taking place.

Our lawful basis for using general event photography is our legitimate interests in promoting and recording our charitable work.

Individuals may request that we stop using their image in future publications by contacting us using the details in Section 1.

3. How we use information

CCTV

Some of our sites may be monitored by CCTV for the purposes of security, safety and the prevention and detection of crime. Our lawful basis for processing CCTV images is our legitimate interests in protecting our property, volunteers, members and the public. CCTV recordings are retained for a limited period (normally no longer than 30 days) unless required for investigation purposes. Access to footage is restricted and may be shared with law enforcement where necessary.

We only ever use your personal data with your consent, or where it is necessary in order to:

• enter into, or perform, a contract with you;
• comply with a legal duty;
• protect your vital interests;
• for our own (or a third party’s) lawful interests, provided your rights don’t override these.
• In any event, we’ll only use your information for the purpose or purposes it was collected for (or else for closely related purposes).

We follow the principles of data minimisation and accuracy. This means we only collect information we genuinely need, and we take reasonable steps to keep it accurate and up to date.

Marketing

We use personal data to communicate with people, to promote LHCRT and to help with fundraising. This includes keeping you up to date with our news, updates, campaigns and fundraising information. For further information on this please see Section 5 on marketing.

Administration

We use personal data for administrative purposes (i.e. to carry out our charity work). This includes:

• receiving donations (e.g. Direct Debits or gift-aid instructions)
• maintaining databases of our volunteers, members and supporters
• performing our obligations under membership contracts, including membership renewal reminders (these may be by email, letter or SMS)
• fulfilling orders for goods or services (whether placed online, over the phone or in person)
• helping us respect your choices and preferences (e.g. if you ask not to receive marketing material, we’ll keep a record of this)
• Internal research and analysis
• We may, in the future, carry out research and analysis on our supporters, donors and volunteers, to determine the success of campaigns and appeals, better understand behaviour and responses and identify patterns and trends. This will help inform our approach towards campaigning and makes LHCRT a stronger and more effective organisation. Understanding our supporters, their interests and what they care about also helps us provide a better experience (e.g. through more relevant communications).

Volunteer communication groups (WhatsApp)

LHCRT uses WhatsApp group chats to share volunteer updates, and if you choose to join one of these groups your phone number and profile name (if used) will be visible to other members; separate groups are maintained for adults and under‑18s for safeguarding purposes. We ask volunteers not to share sensitive personal information in WhatsApp groups, as these platforms are not controlled by LHCRT. Volunteers are free to leave these groups at any time.

Supporter research and profiling

We may occasionally evaluate, categorise and profile personal data in order to tailor materials, services and communications (including targeted marketing) and prevent unwanted material from filling up your inbox. This also helps us understand our supporters, improve our organisation and carry out research. Further information on profiling can be found in Section 6 research and profiling.

Lawful basis for using your data

The table below explains the lawful basis we rely on for different types of processing:

Purpose	Data used	Lawful basis
Membership administration	Contact details, payment information	Contract
Volunteer management	Health data, date of birth, ethnic origin (optional – for equality monitoring), emergency contacts, DBS, training details.	Legal obligation / vital interests
Fundraising and event communications	Contact details	Consent
Gift Aid	Name, address, donation history	Legal obligation
Photography for charitable and promotional purposes	Images of individuals	Legitimate interests (general event photography) Consent (where required, including children)
Website analytics	IP address, cookies	Legitimate interests
Site security	CCTV images	Legitimate interests

Where we rely on legitimate interests, we have carried out an assessment to ensure that our interests do not override your rights and freedoms.

4. Disclosing and sharing data

We will never sell your personal data. If you have opted-in to marketing, we may contact you with information about our partners, or third-party products and services, but these communications will always come from LHCRT and are usually incorporated into our own marketing materials (e.g. advertisements in magazines or newsletters).

We may share personal data with subcontractors or suppliers who provide us with services. For example, our quarterly magazine Cut Both Ways is printed and mailed by a mailing house and so your name and address is shared with the delivery company.

Occasionally, where we partner with other organisations, we may also share information with them (for example, if you register to attend an event being jointly organised by us and another charity). We will inform you where appropriate and where we are legally required to do so.

We will only ever share your data with such organisations where necessary to provide services and if the privacy and security of your data are guaranteed. All third‑party suppliers who process personal data on our behalf do so under written agreements that require them to keep your data secure and act only on our instructions.

Marketing

We will only send you marketing communications where you have chosen to receive them. You can select how you would like to hear from us (post or email or both), although not all communications are available in every format.

You can decide not to receive communications or change how we contact you at any time. If you wish to do so please contact us by email (info@lhcrt.org.uk) or by post see section 1.

What does ‘marketing’ mean?

Marketing does not just mean offering things for sale, but also includes news and information about:

• our charity, campaigns, restoration and protection work;
• LHCRT offers;
• volunteering opportunities and how you can help restore our canals;
• appeals and fundraising (including donations and also competitions, raffles etc.);
• our events and activities
• products, services and offers (our own, and those of third parties which may interest you);
• leaving a legacy; and

When you receive a communication, we may collect information about how you respond to or interact with that communication, and this may affect how we communicate with you in future.

Newsletters and magazines

Cut Both Ways magazine is a membership benefit and is sent to all members by post or email (unless you specifically ask us not to). However, please be aware that our member magazine does include advertisements, inserts, competitions and fundraising information.

Towpath Times e-newsletter is a membership communication and is sent to all members by email as part of their membership.

Fundraising

As a charity, we rely on donations and support from others to continue our campaign work. From time to time, we will contact members and supporters with fundraising material and communications. This might be about an appeal, a competition we’re running, or to suggest ways you can raise funds (e.g. a sponsored event or activity, or even buying a product if LHCRT for which LHCRT will receive the proceeds).

As with other marketing communications, we’ll only contact you specifically about fundraising if you’ve opted in to receiving marketing from us (and you can, of course, opt out at any time).

You may withdraw your consent for any activity that relies on consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. Researching and profiling

We do not currently use profiling but we may in the future as it would enable us to understand our supporters, improve our relationship with them, and provide a better supporter experience.

Analysis and grouping

We occasionally analyse our supporters to determine common characteristics and preferences. We would do this by assessing various types of information including behaviour (e.g. previous responses) or demographic information (e.g. age or location).

By grouping people together on the basis of common characteristics, we can ensure that group is provided with communications, products, and information which is most important to them. This helps prevent your inbox from filling up, and also means we aren’t wasting resources on contacting people with information which isn’t relevant to them.

Profiling to help us understand our supporters

We may occasionally profile supporters in terms of financial and practical support. For example, we may keep track of the amount, frequency and value of each person’s support. This information helps us to ensure communications are relevant and timely.

We collect information on preferences and interests (e.g. whether you are interested in volunteering or attending events) so that we know what material you are mostly likely to be interested in.

Anonymised data

We may aggregate and anonymise personal data so that it can no longer be linked to any particular person. This information can be used for a variety of purposes, such as recruiting new supporters, or to identify trends or patterns within our existing supporter base.  This information helps inform our actions and improve our campaigns, products/services and materials.

Automated decision‑making
LHCRT does not make decisions that have legal or significant effects on individuals using solely automated processing. Any profiling we may carry out in future will not result in automated decisions about you.

7. How we protect your data

We employ a variety of physical and technical measures to keep your data safe and to prevent unauthorised access to, or use or disclosure of your personal information.

Payment security

All electronic LHCRT forms that request financial data will transfer to a third-party provider which use the Secure Sockets Layer (SSL) protocol to encrypt your data. If you use a credit card to donate, purchase a membership or purchase something online we will use third-party providers such as:

• Transactions: Paypal, Stripe, Square, SumUp for transactions
• Donations: TotalGiving, Just Giving, Donr, CrowdFunder, Big Give, Give Wheel and CAF

These payment methods comply with the payment card industry data security standard (PCI-DSS) published by the PCI Security Standards Council. We never store your card details.

For Direct Debits, we use GoCardless to process payments securely. LHCRT does not receive or store your bank account details. GoCardless manages all Direct Debit information in accordance with its own privacy policy and the Direct Debit Guarantee.

Of course, we cannot guarantee the security of your home computer or the internet, and any online communications (e.g. information provided by email or our website) are at the user’s own risk.

8. How we store your data

Where we store information

LHCRT’s operations are based in the UK and we store our data within the European Union.

Some organisations, which provide services to us, may transfer personal data outside of the EEA, but we’ll only allow them to do so if we believe your data is adequately protected. For example, some of our systems use Microsoft products. As a US company, Microsoft may process personal data outside the UK or EEA. Where this occurs, appropriate safeguards such as the UK–US Data Bridge or Standard Contractual Clauses ensure your data remains protected.

Some of our service providers may transfer personal data outside the UK or EEA. Where this happens, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), the UK–US Data Bridge, or Standard Contractual Clauses (SCCs). These measures ensure your data remains protected to UK GDPR standards.

All personal data that we store on personal electronic devices (laptops etc) will be password protected and only shared with officers who are acting on behalf of the Trust to provide a legitimate interest service. Physical copies, such as paper application forms, will be stored securely and destroyed securely as soon as possible.

How long we store information

We will only use and store information for so long as it is required for the purposes it was collected for. How long information will be stored for depends on the information in question and what it is being used for.

We may also be required to store data to satisfy legal requirements, for financial audit purposes or to satisfy insurance requirements. We continually review what information we hold and delete what is no longer required. We never store payment card information.

If you ask us not to send you marketing emails, we may retain your email address to ensure that we don’t send marketing material to that email address (though we’ll keep a record of your preference not to be emailed). We may also retain your email address for other purposes, such as for administration if you are a member of LHCRT.

Retention schedule

Type of data	Typical retention period
Membership records	Duration of membership + 6 years
Gift Aid declarations	6 years (HMRC requirement)
Accident/incident reports	3 years (or longer for minors)
Volunteer records	Duration of volunteering + 6 years
Financial transactions	6 years (audit requirement)

These periods may be extended if required for legal or insurance purposes

Retention of images

Original photographs and video files are stored securely and retained only for as long as they are needed for LHCRT’s legitimate charitable purposes. Where photographs are taken on personal devices by volunteers or officers acting on behalf of LHCRT, images should be transferred to LHCRT’s secure storage systems as soon as reasonably practicable and deleted from personal devices once no longer required.

Once published (for example on social media, in printed materials or on our website), images may remain publicly available indefinitely. Individuals may request that we stop using their image in future publications, but this will not affect materials already published.

9. Keeping you in control

We want to ensure you remain in control of your personal data. Part of this is making sure you understand your legal rights, which are as follows:

• the right to confirmation as to whether or not we have your personal data and, if we do, to obtain a copy of the personal information we hold (this is known as a subject access request);
• the right to have your data erased (though this will not apply where it is necessary for us to continue to use the data for a lawful reason);
• the right to have inaccurate data corrected;
• the right to object to your data being used for marketing or profiling; and
• where technically feasible, you have the right to personal data you have provided to us which we process automatically on the basis of your consent. This information will be provided in a common electronic format.

Please keep in mind that there are exceptions to the rights above and, though we will always try to respond to your satisfaction, there may be situations where we are unable to do so.

How to exercise your rights

You can make a request to access, correct or erase your data by contacting us using the details in Section 1. We will respond within one month, in line with UK GDPR requirements. We may need to verify your identity before responding.

Complaints

If you have a complaint about the way your data is processed, you can complain to LHCRT. If you are not happy with our response, or you believe that your data protection or privacy rights have been infringed, you can complain to the UK Information Commissioner’s Office which regulates and enforces data protection law in the UK. Details of how to do this can be found at www.ico.org.uk.

10. Cookies and links to other sites

Cookies

Our website uses local storage (such as cookies) to provide you with the best possible experience and to allow you to make use of certain functionality (such as being able to shop online).

Cookies are small text files that are placed on a user’s computer hard drive by a website. There are several types of cookie and the most common are often referred to as ‘session’ cookies. These are used to keep track of information needed by a user as they travel from page to page within a website. These cookies have a short lifetime and expire within a few minutes of the user leaving the site.

LHCRT’s website uses benign, short lived ‘session’ cookies and ‘first party’ cookies to tell whether a website user has logged-in, where to find details that can be used to pre-fill parts of on-line forms and to personalise the user’s visit to the website. They are necessary for the e-commerce parts of the site to work correctly.

LHCRT’s website uses Google Analytics, a web analytics service provided by Google Inc. (Google). Google Analytics uses cookies to help the website analyse how visitors use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States of America. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for LHCRT and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. When you first visit our website, you will be asked to confirm your cookie preferences. Essential cookies are required for the site to function, but you can choose whether to allow analytics cookies.

You may refuse the use of cookies by selecting the appropriate settings on your browser. It is also important not to exclude the benign and useful session cookies or first party cookies. If you do decide to refuse the use of cookies LHCRT recommends that you choose an option that rejects all third parties. You can change your cookie preferences at any time via the cookie settings link on our website.

Further information about cookies is available at www.aboutcookies.org

Links to other sites

Our website contains hyperlinks to many other websites. We are not responsible for the content or functionality of any of those external websites (but please let us know if a link is not working by using the ‘Contact’ link at the top of the page).

If an external website requests personal information from you (e.g. in connection with an order for goods or services), the information you provide will not be covered by LHCRT’s Privacy Policy. We suggest you read the privacy policy of any website before providing any personal information.

11. Changes to this privacy policy

We’ll amend this Privacy Policy from time to time to ensure it remains up-to-date and accurately reflects how and why we use your personal data. The current version of our Privacy Policy will always be posted on our website.

This Privacy Policy was updated

• Version 1: 10 April 2018.
• Version 2: 14 February 2023.
• Version 3: 10 March 2026: includes updates to data protection contact details, lawful bases, retention periods, volunteer communication groups, and international data transfer safeguards.