C360 Data Privacy Notice

C360 Data Privacy Notice

Community360 is committed to protecting your privacy when you use our services.  The Privacy Notice below explains how we use information about you and the ways in which we protect your privacy. 

Your personal data – what is it?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession.  The processing of personal data is governed by the Data Protection Act 2018.

Who are we?

Community360 is the data controller. This means it decides how your personal data is processed and for what purposes.  Community360 is an incorporated registered charity (Registered with the Charity Commission in England & Wales under No. 1092567).  We are registered in England and Wales with company number 04426567. Our registered office is Winsley’s House, High Street, Colchester, Essex, CO1 1UG.   

How do we process your personal data?

Community360 complies with its obligations under the Data Protection Act 2018 by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data. All personal data is kept on central IT systems and is not stored or transported on portable electronic devices.

We use your personal data for the following purposes: –

  • To enable us to provide a voluntary service for the benefit of the public and of charities and community groups in a particular geographical area as specified in our constitution
  • To administer citizen records
  • To fundraise and promote the interests of the charity
  • To manage our employees and volunteers
  • To maintain our own accounts and records (including the processing of gift aid applications)
  • To inform you of news, events, activities and services, and to survey your views on matters relevant to the charitable and voluntary sector
  • To fulfil specific requirements of service delivery contracts with government agencies local government, other charities and private providers
  • To operate commercially in trading

What is the legal basis for processing your personal data?

  • Explicit consent of the data subject as part of our services so that we can keep you informed about news, events, activities and services and process your gift aid donations and keep you informed about events, training and other matters relevant to the charitable sector. Under the contract with our software provider, data is shared between the two parties to ensure access to the relevant electronic systems is maintained, but only anonymised data is used for reporting and monitoring. 
  • Processing is necessary for carrying out obligations under employment, health and safety, social security or social protection law, or a collective agreement. Such protection and justification for processing applies to personal data relating to volunteers internally for Community360 and for the outreach organisations we serve
  • Where personal data is collected relating to attendance at an event or training, unless specific consent is given, that data will only be used in communications around the administration, running and follow-up for that event under legitimate interest.
  • Where personal data is collected relating to calls to our Community Transport Scheme, personal data is only collected to enable service delivery and for reporting purposes (with the exception of contact information which may be used to call back if messages are left). All such personal data is deleted in accordance with our retention schedule, leaving only anonymised statistical data for reporting to the commissioner under the contract.
  • Where personal data is collected relating to projects on secondment, only information required for service delivery or for prioritisation is collected, and all sensitive personal data (whether electronic or hard copy) is securely stored and access restricted only to staff who need it. For reasons of continuity of service delivery, and to ensure that relevant information about repeat clients or volunteers is available, data is retained for longer than the period stated below. Only data necessary to direct service delivery is shared with, for example, an employee volunteer group or delivering third party. Any personal data shared with the commissioner is either anonymised, or specific consent is sought to enable this sharing.
  • Where personal data is collected relating to trading activity, only necessary data is collected, and any sensitive information is securely stored and access restricted only to staff who need it.
  • Where personal data is collected relating to any other short term project, only data that is needed will be collected, and the other considerations made clear elsewhere in this Privacy Notice will apply.

Sharing your personal data

Your personal data will be treated as strictly confidential and will not be shared except where specifically required by contractual agreements. We will only share your data with third parties outside Community360 and our subsidiaries with your explicit consent. Any such cases where partnership working agreements require data sharing, specific consent will be obtained.

How long do we keep your personal data?

We keep data in accordance with the Data Protection Act 2018, and with our Data Retention Schedule.  Such personal data is timestamped in our database, and we have systems in place to ensure that personal data is not retained indefinitely without the relevant consent or another relevant legal basis for processing.

Your rights and your personal data

Unless subject to an exemption under the Data Protection Act 2018, you have the following rights with respect to your personal data:

  • The right to request a copy of your personal data which we hold about you.
  • The right to request that we correct any personal data if it is found to be inaccurate or out of date.
  • The right to request your personal data is erased where it is no longer necessary for us to retain such data.
  • The right to withdraw your consent to the processing at any time.
  • The right to request that the data controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability)[1].
  • The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.
  • The right to object to the processing of personal data[2].
  • The right to lodge a complaint with the Information Commissioners Office.

Further processing

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will publish a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

Measuring website usage (Google Analytics)

We use Google Analytics to collect information about how people use the Community360 website. We do this to make sure it’s meeting its users’ needs and to understand how we could do it better. 

Google Analytics stores information about what pages you visit, how long you are on the site, how you got here and what you click on. We do not collect or store your personal information (e.g. your name or address) so this information cannot be used to identify who you are.

We also collect information on the number of times particular search terms are used and the number of failed searches. We use this information to improve access to the site and to identify gaps in the information content so we can plan appropriate expansion of the system.

Unless the law allows us to, we do not:

  • Share any of the information we collect about you with others
  • Use this information to identify individuals.


Cookies are text files placed on your computer to collect standard internet log information and visitor behaviour information.  This information is used to track visitor use of the website and to compile statistical reports on website activity.

How do we use cookies?

Some cookies are necessary to help our site function correctly.  Other cookies are for analytical purposes and helps us develop our website by collecting and reporting information on how you use it.  Analytical information may include your IP address, geographic location of the device, browser type, date and time of your visit(s), page views and links that you click.  This information is used to provide better more relevant content on our website, to help identify any issues and to enhance your overall experience.

How to manage cookies

You can set your browser not to accept cookies and the links below will help you remove cookies from your browser.  However, in a few cases, some of our website features may not function as a result.

For further information visit www.aboutcookies.org or www.allaboutcookies.org

Other websites

Our website contains links to other websites.  This Privacy Notice only applies to our organisation so when you link to other websites you should read their own privacy policies.

Changes to our privacy notice

We keep our Privacy Notice under regular review and we will place any updates on our website. 

How to contact us

Please contact us if you have any questions about our privacy notice or information we hold about you:

Email: information@community360.org.uk 

Tel: 01206 505250

Or write to us at Winsley’s House, High Street, Colchester, Essex CO1 1UG

You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.


[1] Only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means.

[2] Only applies where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics