Privacy Notice – Charitable Fund

Effective Date: 01 September 2025
Data Controller: Welcome Break Limited
Contact Email: dpo@welcomebreak.co.uk

Purpose of the Privacy Notice: This Privacy Notice explains how Welcome Break Limited (Welcome Break, “we”, “us”) handles your personal data when you apply for a charity grant or take part in a charity partnership. We use the Optimy platform to manage these applications.

It tells you what data we collect, why we collect it, how we use it, and what your rights are. If you share someone else’s personal information with us, please make sure they know about this Privacy Notice.

We don’t collect data from anyone under 18 or any information about criminal convictions.

Who We Are: Welcome Break Limited, headquartered at: 2 Vantage Court, Tickford Street, Newport Pagnell, MK16 9EZ, is the controller of your personal data for the purposes of our charitable grant applications and charity partnerships.

We are committed to protecting your information and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other relevant privacy laws.

If you have any questions about how we handle your data, or if you wish to exercise your rights, please contact our Data Protection Officer at dpo@welcomebreak.co.uk

What Personal Data We Collect and Why:  When you apply for a grant or take part in a charity partnership with Welcome Break, we collect and use personal data to manage your application, assess eligibility, communicate with you, and deliver funding or support if your application is successful.

We may collect the following types of personal data:

• Identity data – such as your name, job title, and organisation
• Contact data – including your email address, phone number, and postal address
• Financial data – such as income details or bank account information, used to assess eligibility and prevent fraud
• Profile data – including login details if you create an account on our platform
• Usage and technical data – such as IP address, browser type, and how you interact with the platform, used to improve our service

We collect this data to:

• Review and process your application
• Communicate with you about your application and related opportunities
• Provide grant funding and monitor its use
• Improve our charitable programmes and platform
• Meet legal and regulatory obligations

We only use your data when we have a lawful reason to do so, such as fulfilling a contract, meeting legal requirements, or pursuing our legitimate interests as a grant-making organisation. We do not use your data for unrelated purposes.

Special Category Data: We do not intentionally collect any details about your race or ethnicity, health and genetic data, religious or philosophical beliefs, sexual preferences, political group participation, trade union membership or criminal record. 

Third parties or publicly available sources: We will also receive Data about you from various third parties and public sources as set out below: 

• Identity and Contact Data from publicly available sources such as Companies House and the Charity Commission Register of Charities based in the United Kingdom (including Northern Ireland).

Cookies and tracking technologies: 
We may use cookies or similar technologies to enhance your browsing experience and analyse website traffic. For more information visit our Cookie Policy (access here). 
 

Purpose and Legal Basis for Processing: We collect and use your personal data to manage and assess your application for a charity grant or partnership. This includes reviewing eligibility, communicating with you, providing funding or support, and improving our charitable programmes.

We process your data under the following legal bases:

• To perform a contract – for example, when we assess your application or provide funding
• To comply with legal obligations – such as reporting to regulators or preventing fraud
• For our legitimate interests – including improving our services, maintaining records, and promoting our charitable work

We do not rely on consent as our primary legal basis, but if we ever ask for it, you can withdraw it at any time by contacting us.

Categories of Data Subjects Concerned:
We may collect and process personal data relating to the following individuals:

• Grant applicants – individuals applying for funding through our charitable programmes
• Charity partners – individuals involved in organisations we collaborate with
• Staff, volunteers, trustees, and referees – whose details may be provided as part of an application
• Platform users – individuals who access or interact with our grant management system

If you submit personal data about other people, you are responsible for informing them about this privacy policy before sharing their information with us.

Data Sharing:
We may share your personal data with trusted third parties who help us manage and deliver our charitable programmes. This includes:

• Other companies within our Group

• Service providers who support our grant application platform and related systems
• Individuals or organisations involved in assessing applications or managing partnerships
• Regulators, law enforcement agencies, or other authorities where required by law
• Other funders or partners, where relevant to your application or project

We only share data when necessary, and we ensure that anyone we share it with handles it securely and lawfully.

If your data is transferred outside the UK or European Economic Area, we take steps to ensure it remains protected in line with legal requirements.

International Data Transfers: Some of our external third parties may be based outside the UK, so their processing of your personal data will involve a transfer of data outside the UK.  Whenever we transfer your personal data out of the UK, we aim to afford a similar degree of protection to it by ensuring at least one of the following safeguards is implemented: 

• we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data. 

• where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK. 

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK. 

Your Rights and Queries: As a data subject, you have rights under the UK GDPR. If you would like more detailed information or wish to exercise any of the rights listed below, please contact our Privacy Team at dpo@welcomebreak.co.uk. We will respond promptly and assist you in a fair and transparent manner.
You may:

• Request access to your personal data
  Enables you to confirm whether we are processing your personal data and to receive a copy of the data we hold about you, along with related information.
• Request rectification of inaccurate or incomplete personal data
  You may ask us to correct or complete data we hold, though we may need to verify the accuracy of updated information.
• Request erasure of your personal data
  You can ask us to delete data where there is no lawful reason to continue processing. Please note that in certain cases, we may be legally required to retain specific data.
• Object to processing of your personal data
  You may object where we rely on legitimate interest and believe the processing impacts your fundamental rights and freedoms. We may override your objection if we can demonstrate compelling legitimate grounds. You may also object to any processing for direct marketing purposes (though marketing is not applicable in this case).
• Request restriction of processing
  You may ask us to temporarily suspend processing under certain conditions — such as where accuracy is disputed, processing is unlawful or pending resolution of an objection.
• Request data portability
  You may request that your data be provided to you or a third party in a structured, commonly used, machine-readable format — where processing is based on consent or contract and carried out by automated means.
• Withdraw consent
  If we rely on your consent, you have the right to withdraw it at any time. This will not affect processing carried out prior to withdrawal.
• Complain to the Information Commissioner's Office (ICO)
• If you believe your rights have been infringed, you have the right to lodge a complaint with the ICO: Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, Make a complaint | ICO, Helpline number: 0303 123 1113 

Before contacting the ICO, we encourage you to reach out to us at dpo@welcomebreak.co.uk . We are happy to address your concerns directly and work to resolve any privacy-related queries swiftly and respectfully.

No Fee Usually Required: You will not have to pay a fee to access your personal data or to exercise any of your rights. However, we may charge a reasonable fee or refuse a request where it is manifestly unfounded, excessive, or repetitive, in accordance with UK GDPR Article 12.

Data Retention: We will only keep your personal information for as long as it is needed for the purpose it was collected or to meet legal requirements. Once that time is up, we will either delete the data securely or make it anonymous so it can no longer identify you.

Data security:  We take appropriate technical and organisational measures to secure your personal information against accidental loss and unauthorised access, use, alteration, or disclosure. 
While we strive to protect your personal information, no transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security. 
 
Changes to this policy:  We may update this policy from time to time. Any changes will be posted here with a new “Effective date”. Please check back periodically for updates.