Privacy Policy

At Quartet Community Foundation (Quartet) we’re committed to protecting any personal data you share with us, or that we receive from other organisations and keeping it safe. This policy governs all pages hosted at www.quartetcf.org.uk. It does not apply to pages hosted by other organisations to which we may link and whose privacy policies may differ. Please read the following policy to understand how your personal information will be treated. For the purposes of the Data Protection Act 2018 (the UK DPA [Data Protection Act] 2018 which modifies the EU GDPR by filling in the sections of the Regulation that were left to individual member states to interpret and implement) and in 2021 converted to the UK GDPR. The data controller is Quartet Community Foundation (“Quartet”). Any questions regarding this policy should be sent for the attention of the Head of Operations by emailing info@quartetcf.org.uk or by writing to Quartet Community Foundation, Royal Oak House, Royal Oak Avenue, Bristol BS1 4GB.

Quartet Community Foundation recognises and will protect your privacy. The following policy describes how we will do this in relation to the UK GDPR.

Who we are

Quartet is the local community foundation for the region, covering the former Avon area: Bath & North East Somerset, Bristol, North Somerset and South Gloucestershire. We help ordinary people do extraordinary things that make our local communities thrive and improve the lives of people who live here. We encourage local giving, invest in local communities and foster civic collaboration.

Why we need your information

Quartet is committed to working with philanthropists and philanthropic funds to meet the needs of some of the most disadvantaged in our society. To be effective in its role, it has accumulated knowledge, the use of which is key to our ability to work effectively. This work falls firmly within the definition of personal data, and we recognise our responsibilities as stewards of that data, to use it, only for the purpose of furthering the work of the foundation and respecting the rights of individuals, now and in the future. 

How do we collect information from you?

We obtain information about you directly for one of the following reasons.

When you:

• Enquire about our activities
• Register to receive our e-newsletter
• Donate
• Sign up to become a friend of Quartet / pay your Friends subscription
• Apply online for a grant, and any follow-up grant-related communications
• Apply for a vacancy
• Complete an online survey
• Register for and attend events organised by Quartet
• Set up a fund

When we collect your contact details during a donation, event registration, fund setup, or similar interaction, we will tell you if we intend to use those details for similar charitable updates under the soft opt‑in. You will have a clear choice to opt out immediately, and you can change your preference at any time thereafter.

We also collect information in the public domain. Examples include information gathered from a news article or online media, including social media like LinkedIn or Instagram. We may also use publicly available directories and similar information such as the Royal Mail’s National Change of Address database and Companies’ House.

We may also receive information about you from third parties. For example, when we are sent personal data from charitable organisations where we are the data processor acting in your interest.

What type of information is collected

Depending on how you are engaging us, the personal data we collect may include your name, address, telephone number and email address. It also might include things like your IP address, personal data you provide of your employer, your next of kin or any health conditions you declare when applying for a vacancy. If you donate online or purchase a product from us (e.g. an event ticket), your full card information is not held by us, it is collected by our PCI DSS accredited third-party payment processors, who specialise in the secure online capture and processing of credit/debit card transactions. 

We will keep data for as long as is needed to complete the task for which it was collected and in accordance with our data retention policy. Relationships between donors, grantees and Quartet are often very long-term, and so we expect to keep donors’ data for as long as the relationship exists, or until we no longer need it. We provide information to HMRC on Gift Aided donations since we have a legal obligation to provide this information.

How do we use your data

• To provide you with the services, products or information you have requested
• To administer your donation including processing Gift Aid
• To administer your fund
• To keep a record of your relationship with us
• To ensure we know how you wish to be contacted
• To understand how we can improve our services, products or information
• Information on grantees
• To recruit staff and volunteers
• To send marketing communications to existing supporters

Soft opt‑in for supporters (PECR):

Where we have obtained your contact details in the course of a donation, ticket transaction for one of our events, fund setup, or another similar interaction, we may send you news and fundraising updates about similar charitable activities under the “soft opt‑in” (as permitted by the Privacy and Electronic Communications Regulations). We will always give you a clear opportunity to opt out at the point your details are collected, and you will find an opt‑out link or instructions in every message we send by this method. You can opt out at any time by using the link in our emails or by contacting us at info@quartetcf.org.uk.

We collect the information described below to solicit and process applications for grants from Quartet as well as applying for our ProHelp service:

• Basic personal and demographic information, such as your name
• Contact information, such as your address, email, phone number and other relevant contact details and preferences
• Grant application information, such as purpose and details
• Grant assessment information, such as financial, family, education and employment information
• Grant information, including details about any grants
• Interaction and communication data, such as our relationship with you, correspondence, meeting notes, attendance at events etc.

Who has access?

You have the right to ask for a copy of the information we hold about you and to have inaccuracies in your information corrected. We will not sell or rent your information to third parties. We will not share your information with third parties for marketing purposes. We will only disclose your information where required by law. When donating you are using our secure online facility, your donation is processed by a third party who specialise in the secure online capture and processing of credit/debit card transactions. In principle we do not share your data with anyone else or any other organisation unless it is necessary for the purpose for which you have given us the data. Examples are given below.

• We will provide information to HMRC on Gift Aided donations as we have a legal obligation to provide this information.
• We will share information on grant applicants with grant panel members and donors. These are volunteers working with Quartet. 
• We will also publish data on grant recipients for  groups/ organisations (amounts/name of group/purpose), but we anonymise details for any individual grantees.
• We may share basic information on the attendees at an event or function or meeting with the host or other person who is a volunteer with Quartet.
• We may pass data to other organisations, known as Data Processors, to provide specific services to us. An example would be providing data to a mailing house to send a newsletter. A data protection agreement is always in place with a Data Processor, and they are not allowed to do anything with your data other than that which we have requested.

Some of our suppliers run their operations outside of the European Economic Area (EEA). Although they may not be subject to the same data protection laws as companies based in the UK, we will take steps to make sure they provide an adequate level of protection in accordance with UK data protection law such as the Standard Contractual Clauses (SCCs). By submitting your personal information to us you agree to us transfer, storing or processing at a location outside of the EEA.

If you have any questions regarding secure transactions, please contact us using the details provided under the Contacting Us section for further information.

Security of your data

Non-sensitive details (your email address etc) when transmitted normally over a combination of technologies over the internet cannot be guaranteed to be 100% secure. Whilst we take all possible means to protect your personal information – such as relying on the latest encryption techniques –  we cannot guarantee the security of any information you transmit electronically to us, and you do so at your own risk. Where we have given you a password to access certain parts of our website, you are responsible for keeping this password confidential, we ask you not to share this password with others. We keep your data secure in our database with appropriate security mechanisms in place and training for our staff.

The law requires us to tell you the basis on which we process your data.

Some activities (for example sending you emails which promote Quartet) require your consent (Article 6a). If the law requires consent to process your data, then we will obtain your consent before carrying out that activity. In limited circumstances, where you are an existing supporter (for example, you have donated, obtained an event ticket, applied to us for our services, or set up a fund with us), and the content relates to similar charitable purposes, we may send you marketing or fundraising communications without explicit consent in reliance on legitimate interests (UK GDPR Article 6(1)(f)), as permitted by the ‘soft opt‑in’ under PECR. We assess that this processing is non‑intrusive and in your reasonable expectations, and we provide an opt‑out at collection and in every message. You can opt out of such processing at any time by using the unsubscribe link in our emails or by contacting info@quartetcf.org.uk.

Other activities are carried out to fulfil a contract or agreement (Article 6b). Examples include holding funds which are subject to a Fund Agreement or delivering an organised ticketed event. Each requires us to have an agreement in place, stating who you are and to process your information to do the thing you have asked us to do. If a contract is in place, then we will process your data based on that contract.

In all other cases the law allows us to process your data if it is in our legitimate interest (Article 6f) to do so, but only so long as we need to and your “interests or your fundamental rights and freedoms are not overridden”. We carry out appropriate legitimate interest assessments to check that we will not cause you harm by processing your data and verify the processing is in your interest, that the processing is not overly intrusive and that we will only do so in accordance with this privacy notice.

We keep your personal data for as long as reasonably necessary to fulfil the purposes set out in this Privacy Notice based on our business needs and legal requirements.

When we no longer need your personal data, we de-identify or aggregate the data or securely destroy it based on our retention policy. Please note that de-identified or aggregated data is not treated as personal data under this Privacy Notice and may be used for analytics purposes.

We have a detailed retention policy that governs how long we hold different types of information. Please contact us using the details provided under the Contacting Us section for further information regarding how long we keep your personal data.

The law requires us to tell you that you have a variety of rights about the way we process your data. These are as follows:

• The Right to be Informed: You have the right to know the purposes for which your personal data is collected and processed by us in accordance with the UK GDPR.
• The Right of Access: You have the right to request access by receiving a copy of your personal data in a common format through the Data Subject Access Request (DSAR) process.
  • If you wish to submit a DSAR, please use the contact details below in the ‘Contacting Us’ section. Please describe accurately the parameters of your request including the dates, the location of the data and if possible, the reason for the request. We have one calendar month following acknowledgement of the DSAR and may extend this for up to a further two months if the request is particularly complex. In limited circumstances we may refuse to act on the request on the basis that the request is excessively repetitive or vexatious.
• The Right to Rectification: If you believe your personal data to be inaccurate you have a right to request rectification, and we must respond within one calendar month.
• The Right to Erasure: Otherwise known as the right to be forgotten, you may request that all personal data collected and processed be erased. We will advise where this is possible and if there is an impact on the services provided to you.
• The Right to Restrict Processing: In some circumstances you may request that processing is restricted for certain activities. We must consider this request and restrict processing in certain circumstances.
• The Right to Data Portability: You have the right to re-use your personal data that we have collected or processed for your own purposes or across different services.
• The Right to Object: You have the right to object to processing of personal data in some circumstances. You can object at any time to our use of your personal data for direct marketing, including where we rely on the soft opt‑in and legitimate interests. If you object, we will stop sending you marketing communications. Use the unsubscribe link in our emails or contact info@quartetcf.org.uk.
• The Right Related to Automated Decision-Making Including Profiling: You have the right to challenge decision making made purely by automated means and profiling in certain circumstances.

Concerns or complaints

If you have any concerns about our use of your personal information, you can contact us at:  FAO Head of Operations, Quartet Community Foundation, Royal Oak House, Royal Oak Avenue, Bristol BS1 4GB.

T: 0117 9897700
E: info@quartetcf.org.uk.

You can also complain to the ICO if you are unhappy with how we have used your data. The ICO’s address:           

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

If you have any questions about this privacy notice, about the way in which we process your data, or if you wish to change the way we use your data, including how we communicate with you, then please contact:

Head of Operations
Quartet Community Foundation
Royal Oak House
Royal Oak Avenue
Bristol
BS1 4GB

T: 0117 9897700
E: info@quartetcf.org.uk  

Privacy Policy updated April 2026.