Privacy

PRIVACY NOTICE 

About us

We are Greenwich Foodbank, an independent charitable organisation part of the Trussell Trust Foodbank Network. We are registered as a charitable incorporated organisation and a registered charity with registration number 1152007. Moreover, we are registered with the Information Commissioner’s Office as a “data controller” with a registration number ZA234690. Please note that important terms are underlined throughout this notice, and their descriptions can be found in the “More information” section at the end of this document.

Keeping your data safe is very important to us and we at Greenwich Foodbank are committed to ensuring we comply with privacy and data protection regulations. We have policies and procedures in place to support our teams and ensure they abide by the principles of data protection. Our teams are also trained to ensure they play their part in protecting your data.

What Information do we collect about our clients?

Your Name and Contact Details
If you have been referred to us by the referral organisation, you will have been informed by them that your Name, Address and Contact details (email and/or telephone number) will be shared with us.

Background Information
The referral organisation will also provide us with background information associated with your personal household circumstances to enable us to provide you a better service.

Usage Information
We will also record information about your visits to and other dealings with us.

Feedback and survey information
Information provided where you have chosen to participate in surveys or to provide any other feedback.

Special Category Data

We do not need any Special Category Data  about you for the provision of our services or the receipt of donations. On occasion Special Category Data may be volunteered to a member of our team where special circumstances require this to be taken into consideration or acted upon, for example information regarding a client’s health, including dietary requirements. In these situations, we may ask to note those special circumstances but will not seek to retain the information beyond its utilisation in connection with those special circumstances.

What we do with your Personal Information 

  • To support you to use our services and ensure an appropriate service level is maintained
  • To contact you when information regarding your service is available
  • To administer your engagement with us and other service providers.
  • To provide the agreed service.
  • To provide further assistance if needed and check how many times you have been to
    a foodbank.
  • Improving our services: we may use opinions you express, including any verbal or
    written feedback and opinion, to improve our client experiences, including:
  • To ensure our staff constantly gives a highly professional service.
  • To receive and act on feedback, including grievances.
  • To assess the use and needs of the local community
  • We may with your agreement use your personal information to promote our work. For example, we may use it, including photographs or videos, in case studies and stories that we publish or share with the media. We will only use your personal information for this purpose if you have given your consent for us to do so; our lawful basis for this is therefore your informed consent.
  • Protecting against misuse of our services which has an impact on all Client’s as it decreases the services we are able to offer to those truly in need. We may use your personal information to ensure that our services are not being misused.
Our Legal Basis for Processing Personal Information

Our lawful basis for these uses is our legitimate interests in lawfully and efficiently responding to your need for help and in ensuring that we and other foodbanks are providing help when and where it is most needed. We can use your personal information this way because it is in our legitimate interests to provide the services most efficiently. We will always ensure that we keep the amount of your personal information we collect and the extent of any processing to the absolute minimum to achieve this efficiency.

Who Do We Share Your Data With?

Other Food Banks
This information may be shared with other foodbanks you visit and/or the agency that referred you to us. We may use your personal information in this way because it is in our interests to detect fraudulent behaviour and in all our clients’ interests to ensure that we are able to provide services to those who truly need our services the most in a transparent manner.

Third Party Service Providers
In addition to the services, we provide directly to you, we may have arrangements with third-party service providers who are able to provide you with additional or alternate support. When there is a relevant third-party service provider in place, we will inform you and seek your consent to share your personal information with them to make use of their service.

Statistical Reporting and Analysis
We use information about your visit to the food bank for statistical, research and monitoring purposes. This information cannot be used to identify you but helps us to campaign for a future where no one needs to use a food bank.

Emergency situations
We may also use your personal information to assist where your, and/or another person’s, life or health is in danger and obtaining your permission is not possible (e.g. seeking emergency assistance where immediate action is required).

What Information do we collect about our donors, supporters and others?

If you have donated to us (food or money), support us by receiving newsletters or similar updates or are otherwise in contact with us, we may retain the following information:

  • Basic identifiers: Your name and contact details such as email address or telephone number.
  • Usage and donation information: information about your dealings with us and, if you make a money donation, we retain account records showing your name and the date and amount of the donation; we may also have your bank account details. This information is stored securely and information on how long we keep this information can be found below in the section titled ‘how long we keep your personal data’.
What we do with your personal information

Donation records

If you have made a financial donation, we will use your payment information to keep track of your payment. Our lawful basis for this is our legitimate interest in maintaining appropriate and lawful records of our activities.

If we are able to reclaim Gift Aid in respect of your donation, we will also keep Gift Aid forms, so that we can prove the amount of Gift Aid we are entitled to reclaim from HMRC.

Our lawful basis for this is our legal obligation to collect relevant personal information in respect of Gift Aid.

Important Updates, your identification and contact details may be held as part of our record of donors and supporters, which we use to keep in contact, including through distribution of
our newsletter and similar updates.

Recording our Dealings: we may use the personal information we hold about you to process and record our dealings with you and any organisation that you represent. Our lawful basis for this is our legitimate interest in developing a close relationship with those who support us, including for fundraising purposes.

We ensure we are processing your data appropriately, lawfully and efficiently with the issues in relation to which you are in contact with us.

Marketing communications

We will only send you marketing communications via email or text where you have opted in to receiving them. Our lawful basis for this is your informed consent. You can unsubscribe at any time by contacting us at:  [email protected].

How long we keep your Personal Information

We will hold your personal information only for as long as is necessary; generally, this will not be longer than 7 years from last use of our service. Access to information is removed over time to ensure only those that need access to your personal information have access to it. In some circumstances, we may legally be required to retain your personal information, for example for finance, employment or audit purposes.

Sharing your personal information, we share personal information in these ways, in addition to those mentioned above:

  • With Trussell who supports over 1200 food bank centres in the UK which together represent the Foodbank Network. We share personal information about clients, volunteers and employees with Trussell, with whom we have a data sharing agreement. Trussell works to support the Foodbank Network and uses anonymised statistical data to campaign nationally to challenge structural issues locking people into poverty.
  • Our lawful basis for this sharing with Trussell is our legitimate interests in operating lawfully and efficiently, in cooperating with Trussell to help ensure that we and other members of the Foodbank Network can provide help when and where it is most needed and more generally in supporting the work of Trussell around the UK.
  • With the authorities, to comply with our legal obligations: for example, to assist the police and other competent authorities with investigations including criminal and safeguarding investigations and to keep our details up-to-date with Companies House and the Charity Commission.
  • With our bank and professional and other advisers, for example, providing payment details to our bank to process payments and sharing personal information with our professional advisers and with our IT support and data storage providers. Our lawful basis for this sharing and for our sharing with third party processors is our legitimate interest in operating lawfully and efficiently.
Transferring your Personal Information outside the UK

UK data protection law places controls on the transfer of your personal information outside the UK. For countries, such as those in the EU, which have a similar standard of data protection law to that which applies in the UK, there may be “adequacy regulations” in place which permit the transfers; for other countries, the transfers may only be made if certain conditions are satisfied.

We seek to comply with UK data protection law in this regard, including by putting in place appropriate contracts and arrangements with TT and other third-party processors that we use requiring them to transfer or permit the transfer of your personal information only to countries or territories in respect of which there are adequacy regulations in place or if the requisite conditions are otherwise satisfied.

Your rights

You have various legal rights in relation to your personal information. They include the right to be given the information set out above and the following:

  • Right of access: you can request us to give you a copy of the personal information that we hold about you and supplementary information about how we are using it. If it helps, we will give you this copy in a computer file.
  • Right to rectification of inaccurate personal information: you can request us to correct your personal information if it is incomplete or inaccurate.
  • Right to be forgotten, in you can request us to erase your personal information. One example is that if our only lawful basis for our use of your personal information is your consent, you may withdraw that consent. You can also object to our using your personal information for direct marketing purposes.
  • Right to object, you can object to our use of your personal information. One example is if we are relying on having a legitimate interest as our lawful basis for doing so. Another is that you can object to our using your personal information for direct marketing purposes.
  • Right to restriction of our use,you can request us to restrict our use of your personal information. You can also check the information we hold on you is accurate.
  • Right to data portability,you can request that we provide you with the personal information we hold about you which you have provided to us, in a reasonable format specified by you, so that you can provide it to another organisation.
Subject Access Request

Greenwich Foodbank recognises the right of individuals to access their personal data under the UK General Data Protection Regulation (UK GDPR). A Subject Access Request (SAR) may be made verbally or in writing to our Data Protection Officer at: [email protected].

We will respond to Subject Access Requests promptly and in line with the UK GDPR. You can request a copy of the personal data we hold about you; we will acknowledge and respond within the statutory timescales and explain any redactions or refusals.

We will respond to a SAR within one month of receipt. Where a request is complex or involves a large volume of information, we may extend the deadline by up to two further months; we will notify you of any extension and explain the reasons within the initial one-month period.

A SAR covers personal data about the requester that we hold, including the source of the data, purposes of processing, and recipients. If a request is broad or unclear, we may ask you to clarify or narrow the scope to enable a proportionate and timely response; you are not obliged to do so, and we will still consider the original request in good faith.

We will provide the personal data requested unless an exemption applies. Where documents contain mixed personal data (information about the requester and third parties), we will balance the requester’s rights against the privacy rights of others and may redact or withhold third-party information where disclosure would be unfair or unlawful. We will also withhold information subject to legal professional privilege or other statutory exemptions, and we will explain the legal basis for any redactions or refusals in our response.

We will provide the information in a commonly used electronic format where possible if requested. We do not normally charge for complying with a SAR; however, we may charge a
reasonable fee or refuse to comply with manifestly unfounded or excessive requests, particularly if they are repetitive.

We will keep a record of SARs received, searches conducted, decisions made about redactions or refusals, and communications with the requester to demonstrate compliance with the UK GDPR.

If you are unhappy with our response, you may request an internal review. You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe we have not handled your SAR in accordance with data protection law; the ICO provides guidance for employers and organisations on handling SARs.

Contact
To submit a SAR or for further information about this policy, contact our Data Protection Officer at [email protected]. We will aim to assist you and explain any steps we take in handling your request.

Right to complain to the Information Commissioner’s Office

You can complain to the Information Commissioner’s Office if you are not satisfied with our response to any query you raise with us or if you believe we are using your personal information in an unlawful way. Their helpline number is 0303 123 1113.

Cookies

Cookies are small text files sent from our Website to your device to ensure the site functions correctly and personalise your browsing experience. The only cookies we use are essential cookies that are necessary for our website’s functionality which will enhance your experience. To find out more about cookies and how you can disable them in your browser settings, please visit https://allaboutcookies.org.

Changes to this Notice

We may change this Notice from time to time. We recommend that you visit our website periodically to keep up to date with the changes in this Notice.

Contacting us

You can contact us about anything related to this Notice by emailing us at [email protected].

—–

Download our Privacy Policy in full, here.

—–

Appendix: More information 
Adoption Date: the date on which this Notice as most recently updated; currently 16th July 2026.

Lawful basis a legal justification for our use of your personal information.

The permissible legal justifications are listed in the data protection legislation.

Legitimate interest: a lawful basis for our use of your personal information – that the use must be necessary for legitimate interests which we have that are not overridden by your interests and rights.

Personal information: information we hold about you on our IT systems and in our files from which you can be identified. It’s “personal” because it’s about you as an individual – not information about any organisation you’re connected to.

The legislation calls this personal “data”, but we think “information” is clearer.

Sensitive Personal Information: your personal information relating to particularly sensitive matters identified by the data protection legislation for additional protections, including your
race, ethnic origin, religious or philosophical beliefs, health, sex life, sexual orientation or criminal record.

Use, using: this includes collecting, storing, using, disclosing or doing anything else with your personal information. The legislation calls this “processing”, but we think “using” is clearer.