Privacy Notice

Purpose:

The BOWRA Foundation is committed to protecting the personal information of our beneficiaries, supporters, volunteers, staff and partners. This Privacy Notice explains how and why we collect, use and store personal data, ensuring it is handled responsibly, securely and in line with data protection laws.

Our purpose is to be transparent about the information we hold, how we use it to deliver our charitable aims, and the rights individuals have in relation to their personal data.

We have prepared this Privacy Notice to ensure that we communicate to you, in the clearest way possible, how we treat your personal information

We are committed to ensuring that your personal information remains confidential and secure in accordance with applicable Data Protection Legislation.

This notice sets out how we look after your personal data if you are a:

• A member of staff
• A donor
• A volunteer of BOWRA
• A beneficiary/service user
• A visitor to our website
• Supplier, retailer or business contact of BOWRA
• Our partners and third-party healthcare practitioners
• Any third-party organisation that uses BOWRA

This Privacy Notice describe the types of information that we collect from you, and how that information may be used or disclosed by us and the safeguards we use to protect it. The personal information that we collect is used for providing and improving our services to you. We will not use or share your information with anyone except as described in this Privacy Notice.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

We may update this notice from time to time, and you can find our latest notice on our website or by asking us for a copy.

The BOWRA Foundation

The BOWRA Foundation is a registered charity in England and Wales, with its charity number 1185395 referred to as “we” “us” “our” and “BOWRA” in this notice.

This Privacy Notice applies to any personal data we collect through our charity to enable us to fundraise and raise awareness of the charity.
Our contact address is England & Co, Faulkner House, 31 West Street, Wimborne, BH21 1JS

If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact us at:

info@bowra-foundation.org

We will only process personal information about you in accordance with the UK Data Protection Legislation which for the purposes of this Privacy Notice shall mean: all applicable data protection and privacy legislation in force from time to time in the UK including without limitation the UK GDPR; the Data Protection Act 2018 (and regulations made thereunder) and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended; and all other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of personal data (including, without limitation, the privacy of electronic communications); and the guidance and codes of practice issued by the Commissioner or other relevant regulatory authority and which are applicable to a party (“Data Protection Legislation”).

1. What does BOWRA do?

As a registered charity, our purpose is to promote and pursue the physical and psychological wellbeing, rehabilitation and recovery of those suffering from brain injury by;

• directly and working with partners to distribute the BOWRA BAG to aid recovery and support for the rehabilitation pathway of beneficiaries from brain injury
• planning, designing and delivering activities which help beneficiaries, their families and carers and that promote recovery and add meaningfully to their wellbeing and quality of life.
• utilising the skills and experience of members of the armed forces community to organise, support and deliver activities for our beneficiaries and their families and carers.

2. The data we collect and how we collect it

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together depending on your relationship with us as follows:

• Identity Data: includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
• Financial Information: We typically use a third-party payment provider for donations currently JustGiving, details of which are on our website. However, it may be necessary to collect financial data directly from you such as bank account details or debit / credit card information for donation information when you elect to pay this way. If required for payment information, we may also ask for a postal address.
• Contact Data: your email address, telephone number and postal / billing address for gift aid purposes, payment for services where appropriate.
• Technical Log Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access the website for fraud screening.
• Usage Data includes information about how you use the website.
• Cookies Data like many websites, we may use some “cookies” to enhance your experience and gather information about the visitors and number of visits to the Website. Please refer to our website about cookies, how we use them and what kind. We use Cookiebot for management of cookies and how you consent to these.
• Special Category and Sensitive Data: We may collect data relating to health and medical history, specifically when supporting vulnerable adults during the course of our charitable work.
• Third Parties and Information we receive from other sources: We may receive information about you if you use any of the other websites we may recommend or provide links to. We may also receive your personal information if you engage with us on social media.
• Analytics: includes third-party analytics services (such as Google Analytics) to evaluate your use of the Website, compile reports on activity, collect demographic data, analyse performance metrics, and collect and evaluate other information relating to our website and internet usage. These third parties use cookies and other technologies to help analyse and provide us the data. By accessing and using the Website, you consent to the processing of data about you by these analytics providers in the manner and for the purposes set out in this Privacy Notice.

You can withhold your personal data from us, but we may not be able to provide our services to you if you do so.

We may collect your personal data from different sources:

• We collect all the types of data listed above directly from you when you interact with us.
• We collect Technical Data automatically when you interact with the website, by using cookies and other similar technologies.

3. How we use your personal data

We (or third-party data processors, agents and sub-contractors acting on our behalf) may collect, store and use your personal information by way of different methods to collect data from and about you including through:

Direct interactions. This is information (including Identity and Contact Data) you consent to giving us about you when you fill in forms through the website or send to us directly, or by corresponding with us (for example, by telephone, email or chat). It includes information you provide when you visit or use the website. If you contact us, we will keep a record of that correspondence.

Information we collect about you and your device either automated or otherwise. Each time you visit or use the website, we will automatically collect personal data including Technical Log Data. We collect this data using cookies and other similar technologies including server logs.

We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions, which include strict confidentiality and contractual terms.

We will only use your personal data when the law allows us to. Most commonly we will use your personal data in the following circumstances:

• Where you have consented before the processing.
• Where we need to perform a contract, we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

When we are acting as a data controller, we will use your personal data for the purposes set out in the table below.

The law sets out several different reasons for which we can collect and use your data. The legal grounds on which we collect and use your data are also set out in the table below.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground, we are relying on to process your personal data where more than one ground has been set out in the details below.

How We Use Personal Information and Our Lawful Bases

Whose data we use – Service Users (people accessing BOWRA services)

PURPOSES

• Assess eligibility and register for services
• Deliver programmes, activities, and support
• Communicate about sessions, changes, and updates
• Monitor progress, outcomes, and impact
• Safeguard wellbeing and safety
• Manage referrals and signposting with trusted partners
• Collect feedback and evaluations
• Comply with legal and regulatory obligations
• Report to funders (using anonymised/aggregated data)
• Maintain accurate records (attendance, consent, emergency contacts)

• Contract – providing services
• Consent – optional uses (e.g. photos, feedback)
• Legal obligation – safeguarding, health & safety
• Legitimate interests – delivering and improving services, reporting anonymised data

Whose data we use – Supporters and Donors

PURPOSES

• Process and acknowledge donations, including Gift Aid
• Communicate about fundraising, events, and campaigns
• Manage donor relationships and thank supporters
• Administer pledges, regular giving, and sponsorships
• Report back on donation impact
• Maintain accurate financial and administrative records
• Comply with charity and financial regulations

LAWFUL BASIS

• Contract – processing donations
• Consent – marketing communications (where required)
• Legal obligation – Gift Aid, finance
• Legitimate interests – thanking donors, reporting impact

Whose data we use – Volunteers

PURPOSES

• Process applications and assess suitability
• Provide induction, training, and support
• Manage rotas, activities, and responsibilities
• Communicate about opportunities and updates
• Safeguard beneficiaries and volunteers
• Recognise and celebrate contributions
• Comply with legal, safeguarding, and health & safety obligations
• Keep accurate records of involvement

LAWFUL BASIS

• Contract – volunteering agreements
• Consent – optional uses (e.g. photos, stories)
• Legal obligation – safeguarding, DBS checks, health & safety
• Legitimate interests – volunteer management

Whose data we use – Staff and Trustees

PURPOSES

• Manage recruitment, contracts, payroll, pensions, and benefits
• Provide training, development, and support
• Ensure compliance with safeguarding, health & safety, and employment law
• Communicate about organisational matters
• Support governance, accountability, and regulatory reporting
• Maintain accurate records of roles and responsibilities

LAWFUL

• Contract – employment and trustee agreements
• Legal obligation – employment, tax, pensions, safeguarding
• Legitimate interests – governance, organisational management

Whose data we use – Special Category Data (e.g. health information relating to beneficiaries with brain injuries)

PURPOSES

• Understand needs and tailor support or programmes
• Safeguard wellbeing and ensure appropriate care
• Monitor outcomes and impact (anonymised/aggregated where possible)
• Comply with health & safety and safeguarding requirements

LAWFUL 

• Explicit consent – where we ask permission to record or share health-related details
• Vital interests – where information is needed to protect someone’s life/safety
• Health & social care provision – delivering rehabilitation or support activities
• Substantial public interest – safeguarding individuals at risk

Where you have consented to receive direct marketing from us, we will use your personal data, preferences and details of your transactions to keep you informed about relevant fundraising events. You are free to opt out of this at any time. Please refer to section 10 for more information.

4. Who has access to your personal data and who do we share it with?

We may need to share your personal data when using your personal data as set out in the table above. We may share your personal data with the following third parties:

• Our professional advisers, including lawyers, auditors and insurers.
• Service providers who provide IT and system administration services, or who store data on our behalf.
• Activity providers, training providers

Where any of your personal data is required for such a purpose, we will take all reasonable steps to ensure that your personal data will be handled safely, securely, and in accordance with your rights, our obligations, and the obligations of the third party under the Data Protection Legislation. This type of external data processing is always subject to contractual assurances that personal data will be kept securely and used only in accordance with our specific directions.

5. International Transfers

Subject to us complying with the Data Protection Legislation and ensuring appropriate safeguards are in place, we may transfer your personal data to third parties providing services to us who are based outside of the UK without obtaining your specific written consent. This may include parties providing IT administration services and hosting services, and other organisations which have products or services that are essential in the delivery of our Services; and finally, organisations providing assistance with managing our marketing databases.

We take our responsibilities seriously with regards to data protection. As such, whenever we transfer your personal data outside of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

a) the personal data is transferred to or processed in a territory which is subject to adequacy regulations under the Data Protection Legislation that the territory provides adequate protection for the privacy rights of individuals such as the EEA; or

b) we participate in a valid cross-border transfer mechanism under Data Protection Legislation, so that we can ensure that appropriate safeguards are in place to ensure an adequate level of protection with respect to the privacy rights of individuals as required under the Data Protection Legislation; or

c) the transfer otherwise complies with Data Protection Legislation.

6. Retention period

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

For more details of our specific retention periods, please contact us.

7. Data Security

Data security is of great importance to us, and to protect your data we have put in place suitable physical, electronic and managerial procedures to safeguard and secure data collected through Bowra and the Website.

We have implemented significant security measures to maintain a high level of security.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Notwithstanding the security measures that we take, it is important to remember that the transmission of data via the internet may not be completely secure and that you are advised to take suitable precautions when transmitting to us data via the internet and you take the risk that any sending of that data turns out to be not secure despite our efforts.

8. How do we protect personal information?

We implement a variety of security measures to protect and maintain the safety of your personal information. Your personal information is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems and are required to keep the information confidential.

9. How to opt out?

You have the right at any time to opt out of any marketing services we may provide to you and you can exercise these rights or change your preferences by sending us an email at info@bowra-foundation.org or by updating your preferences via the website.

10. Your rights as a data subject

Under certain circumstances, you have rights under the Data Protection Legislation in relation to your personal data. These rights are set out below. If you wish to exercise any of the rights set out below, please contact us.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

Your rights are as follows:

• Right of access – you have the right to request a copy of the personal data that we hold about you and to check that we are lawfully processing it.
• Right of rectification – you have a right to request that we correct personal data that we hold about you that is inaccurate or incomplete.
• Right to be forgotten / erasure – in certain circumstances you can ask for the data we hold about you to be erased from our records i.e., when there is no good reason for us continuing to process it.
• Right to restriction of processing – where certain conditions apply, you have a right to restrict or suspend the processing, for example if you want us to establish its accuracy or the reason for processing it.
• Right of portability – you have the right to have the data we hold about you transferred to another organisation.
• Right to object – you have the right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms.

There are some exceptions to the above rights.

• Right to withdraw consent. In the limited circumstances where you have provided your consent to the collection, processing and transfer of the personal data referred to above, you may withdraw that consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent, or to processing carried out on other legal grounds. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

All the above requests will be forwarded to the relevant party should there be a third party involved in the processing of your personal data.

11. Complaints to the Information Commissioner’s Office

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance by emailing us at info@bowra-foundation.org

12. Sensitive and Special Category Personal Data

We recognise that there are strict rules of access and security surrounding sensitive and special category personal data.

From time to time, it may be necessary for us to collect these types of personal data in the use of our Services. For example, our fundraising activities may require a detailed history of those participating. We may also require access to this data to determine eligibility for our BOWRA Bags, an assessment as to either physical or mental capacity to conduct or participate in any BOWRA activities including the appropriate risk management of Bowra activities.

Such data may be classed as sensitive and special category personal data under the Data Protection Legislation in the provision of our services.

We will only do this where we have a lawful basis to do so and extra care will be taken when collecting, processing and using this type of data.

13. Third Party Websites

Our website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check their data protection policies and satisfy yourself before you submit any personal data.