Privacy Policy

Herefordshire Resilience Forum

Last updated: 28 October 2026

1. Introduction
 

Herefordshire Resilience Forum ("the Forum", "we", "us" or "our") is an independent, community-led initiative dedicated to promoting emergency preparedness, self-reliance, education, wellbeing and community resilience across Herefordshire.
 

We are committed to respecting and protecting the privacy of everyone who interacts with us, including website visitors, community members, volunteers, event participants, individuals seeking assistance and representatives of partner organisations.
 

This Privacy Policy explains how we collect, use, store, share and protect personal information, together with your rights under applicable UK data protection legislation.
 

We aim to handle all personal information fairly, lawfully, transparently and securely.

2. Who We Are

For the purposes of applicable data protection legislation, the data controller responsible for personal information collected and processed by the Forum is:

Organisation: Herefordshire Resilience Forum

Data Controller / Responsible Person: [Insert full name of the individual or legal entity operating the Forum]

Contact Email: [Insert email address]

Correspondence Address: [Insert postal contact address]

Website: [Insert website address]

The data controller determines how and why personal information is processed.

3. Information We Collect

Depending on how you interact with the Forum, we may collect the following categories of personal information:

Personal and Contact Information

• Full name

• Email address

• Telephone number

• Town, village or general location

• Postal address, where necessary for a specific activity or support request

• Preferred method of communication

Volunteer Information

Where you express an interest in volunteering, we may collect:

• Relevant skills, qualifications and experience

• Areas of interest and preferred volunteering activities

• Availability and geographical area

• Details of resources or equipment you may be willing to offer

• Relevant training and safeguarding information

• DBS eligibility and check information, where appropriate and lawful

Community Support Enquiries

Where you contact us requesting assistance, we may collect information necessary to understand your enquiry, including the nature of the assistance requested, relevant contact details and your general circumstances.

Where essential to arranging appropriate support, we may also need to understand accessibility requirements, mobility difficulties or other relevant needs.

Events and Activities

Where you register for or attend a community event, educational session or activity, we may collect your name, contact information, booking details and any relevant accessibility requirements.

Website and Technical Information

When you access our website, certain technical information may be collected, including:

• IP address

• Browser and device information

• Website usage and navigation information

• Cookies and similar technologies

• Information submitted through website forms

Communications

We may retain communications submitted through email, website contact forms and other communication channels where necessary to respond to enquiries or administer Forum activities.

We will only collect information that is relevant and reasonably necessary for an identified purpose.

4. How We Use Personal Information

We may process personal information for the following purposes:

Community Engagement

To respond to enquiries, communicate with members and supporters, share relevant information and encourage participation in community initiatives.

Volunteer Recruitment and Coordination

To receive volunteer registrations, assess relevant skills and interests, coordinate opportunities and undertake appropriate safeguarding and suitability procedures.

Community Support

To consider requests for assistance, communicate with individuals, identify appropriate resources and, where suitable arrangements exist, coordinate practical support or signpost individuals to relevant organisations.

Educational Events and Activities

To administer registrations, communicate event information, arrange accessibility requirements and manage participation in workshops, talks and community activities.

Partnerships and Collaboration

To communicate with local organisations, businesses, charities, public services and potential funding partners about opportunities for collaboration.

Website Administration

To maintain website functionality, protect website security, respond to technical problems and understand website usage where permitted.

Legal and Safeguarding Responsibilities

To maintain appropriate records, respond to lawful requests, address legitimate complaints and fulfil applicable legal or safeguarding obligations.

We will not use personal information for purposes that are incompatible with those for which it was originally collected unless permitted by law.

5. Our Lawful Basis for Processing Information

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely upon:

Legitimate Interests – Article 6(1)(f)

Where necessary for our legitimate interests in administering the Forum, responding to enquiries, developing community initiatives, communicating with interested individuals and coordinating appropriate community activities, provided those interests are not overridden by individuals' rights and freedoms.

Consent – Article 6(1)(a)

Where individuals have freely provided valid consent for specific activities, such as receiving optional newsletters or other communications requiring consent.

Consent can be withdrawn at any time.

Legal Obligation – Article 6(1)(c)

Where processing is necessary to comply with an applicable legal obligation.

Vital Interests – Article 6(1)(d)

In exceptional circumstances, where processing is necessary to protect someone's life or vital interests and the legal requirements for relying upon this basis are satisfied.

Contract – Article 6(1)(b)

Where processing is necessary for a contract with an individual or to take steps requested by that individual before entering into a contract, where applicable.

We will identify the appropriate lawful basis before undertaking the relevant processing activity.

6. Sensitive Personal Information

Certain information, including details relating to health, disability or medical conditions, may constitute special category personal data and is subject to additional legal protections.
 

We recognise that individuals seeking community assistance, or volunteers requiring reasonable adjustments, may sometimes disclose sensitive personal information.
 

We will seek to minimise the collection of such information and restrict access to those with a genuine need to know.

Where processing special category data is necessary, we will identify both an appropriate lawful basis under Article 6 UK GDPR and a valid condition under Article 9 UK GDPR, such as explicit consent where appropriate, or another condition permitted by law.
 

Sensitive information will not be routinely shared with volunteers, other community members or external organisations.

Where sharing is necessary, it will be limited to relevant information and undertaken only where an appropriate legal basis and any additional safeguards are in place.
 

We ask individuals not to provide unnecessary medical histories or sensitive personal information through general website enquiry forms.

7. Volunteer Screening and Safeguarding

As the Forum develops organised volunteering opportunities, certain activities may require identity verification, references, training, safeguarding procedures or Disclosure and Barring Service (DBS) checks.
 

DBS checks will only be requested where the role and applicable legal requirements permit them.

Any information relating to criminal convictions, cautions or other criminal offence data will only be processed where an appropriate lawful basis and the necessary additional legal conditions are satisfied.
 

Access to safeguarding and screening information will be restricted, and records will be retained only for as long as necessary.

8. Sharing Personal Information

We will not sell personal information to third parties.

However, it may be necessary to share limited personal information in certain circumstances, including with:

• Authorised Forum administrators or coordinators

• Approved volunteers involved in an agreed activity

• Organisations delivering activities or events in collaboration with us

• Relevant community support organisations

• Website hosting, email and other technology service providers

• Professional advisers where necessary

• Public authorities or statutory services where disclosure is required or otherwise permitted by law

Where practical support involves a volunteer contacting or assisting an individual, we will seek to agree appropriate contact and information-sharing arrangements before disclosing their details.
 

We will not routinely disclose information about vulnerable individuals to the wider community.
 

Where necessary, we will establish suitable information-sharing arrangements with external organisations.
 

Information may be disclosed without consent where another lawful basis applies, including where required by law or justified by relevant safeguarding circumstances.

9. Website Hosting and Third-Party Platforms

Our website is developed and hosted using Wix.

Wix may process certain personal information on our behalf in connection with website hosting, contact forms, technical functionality and other services that we choose to use.
 

You can review Wix's privacy information at:

https://www.wix.com/about/privacy

We may also maintain a presence on third-party platforms, including Facebook.

When you interact with us through these platforms, the relevant platform may separately process your information in accordance with its own privacy arrangements.

Information posted in public or group discussion areas may be visible to other users, depending on the platform's settings.

We encourage members not to publish sensitive personal details, private contact information or information about other individuals without appropriate permission.

10. International Data Transfers

Some technology providers and online platforms used by the Forum may process or store personal information outside the United Kingdom.

Where an international transfer is restricted by UK data protection law, we will ensure an appropriate transfer mechanism or safeguard is in place, such as applicable adequacy regulations or approved contractual safeguards.

Information about relevant transfer arrangements may be requested using the contact details in this policy.

11. How Long We Keep Information

We will retain personal information only for as long as reasonably necessary for the purposes for which it was collected, or where retention is required or justified by law.

Our intended retention arrangements include:

• General enquiries: Normally up to 12 months following resolution, unless continued retention is justified.

• Volunteer registrations: For the duration of an individual's involvement and normally up to 12 months afterwards, unless a longer period is necessary.

• Community support records: Normally up to 12 months after the relevant enquiry or activity has concluded, subject to safeguarding, incident-management or legal requirements.

• Event registrations: Normally up to 12 months after the event, unless further retention is justified.

• Newsletter subscriptions: Until the individual unsubscribes or the information is otherwise no longer required, subject to retaining minimal suppression records where necessary.

• Legal, safeguarding or incident records: For an appropriate period determined by the circumstances and applicable requirements.

We will review information periodically and securely delete or anonymise records when no longer required.

12. How We Protect Your Information

We recognise the importance of maintaining appropriate security, particularly where information relates to vulnerable individuals or volunteer activities.

We will use reasonable technical and organisational measures appropriate to the risks involved, which may include:

• Restricting access to authorised individuals

• Using appropriate account security and access controls

• Protecting electronic records against unauthorised access

• Limiting the information shared with volunteers and partners

• Maintaining appropriate confidentiality arrangements

• Securely deleting information when no longer required

• Reviewing suspected data breaches and reporting them where legally necessary

No internet-based system can be guaranteed to be completely secure. However, we will take proportionate steps to protect the information entrusted to us.

13. Cookies and Website Analytics

Our website may use cookies and similar technologies to support essential functionality, remember preferences, maintain security and, where enabled, help us understand website performance.

Some cookies are necessary for the operation of the website. Other cookies may require consent, depending on their purpose and applicable legal exemptions.

Where consent is legally required, we will provide an appropriate choice before setting those cookies.

Visitors may also be able to manage certain preferences through their browser settings or the website's cookie controls.

Further information about the cookies used on our website, including their purposes and relevant choices, will be provided through our website's cookie information or consent management facility.

14. Marketing and Community Updates

Where we offer optional newsletters or email updates, individuals will be informed about what they are signing up to receive.

We will obtain consent where required under applicable data protection and electronic communications legislation.

Individuals may unsubscribe from optional communications at any time through the method provided or by contacting us.

We may separately send necessary administrative communications relating to an enquiry, event registration, volunteer involvement or requested activity where an appropriate lawful basis applies.

15. Photographs and Community Events

From time to time, the Forum may wish to photograph or record educational sessions, community gatherings or other activities for awareness, promotional or reporting purposes.

Where individuals are identifiable, we will establish an appropriate lawful basis and provide relevant information about how images may be used.

We will seek permission where consent is required or appropriate, and apply additional safeguards where photographs involve children or vulnerable individuals.

Individuals who have concerns about photography at an event should contact the event organiser.

16. Children's Personal Information

The Forum aims to make community education and activities accessible to a wide range of people, including families.

Where activities involve children, we will take additional care to protect their personal information.
 

We will only collect information about children where reasonably necessary, use age-appropriate privacy information where relevant and obtain parental or guardian permission where legally required or otherwise appropriate.
 

Children's personal information will not be published or disclosed unnecessarily.

17. Your Data Protection Rights

Under UK data protection legislation, you may have the following rights, depending on the circumstances:

• Right of access: To request a copy of personal information we hold about you.

• Right to rectification: To request correction of inaccurate or incomplete information.

• Right to erasure: To request deletion of personal information in applicable circumstances.

• Right to restriction: To request that processing of your information be restricted in certain situations.

• Right to object: To object to certain processing, including processing based upon legitimate interests.

• Right to data portability: To receive certain information in a portable format where the legal conditions apply.

• Rights relating to automated decision-making: To receive applicable protections where decisions are made solely by automated means and have legal or similarly significant effects.
   

You have the right to object to processing based on legitimate interests. We will consider any objection in accordance with applicable law.

Where we rely upon consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing already undertaken.

Requests concerning your personal information may be submitted using the contact details provided above.
 

We may request information reasonably necessary to verify your identity before disclosing personal information.
 

We will respond to requests within the timeframes required by law, normally within one month, subject to applicable extensions and exceptions.

18. Data Protection Complaints

If you have concerns about how the Forum collects, uses, stores or shares personal information, you may submit a data protection complaint using the contact details provided in Section 2.
 

We will acknowledge receipt of a data protection complaint within 30 days, investigate the matter appropriately, keep you informed of progress and communicate the outcome without undue delay.
 

If you remain dissatisfied, you may complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Information Commissioner's Office

Website: https://ico.org.uk

Telephone: 0303 123 1113
 

You have the right to complain to the ICO, although we welcome the opportunity to address your concerns directly.

19. Information Provided About Other People

Where an individual provides information about another person, such as a relative, neighbour or someone who may require community assistance, we ask that they only provide information they are entitled to share.
 

We may need to verify the circumstances and determine whether further information can lawfully be obtained or used.
 

The fact that someone has been referred to the Forum does not automatically authorise us to share their personal information with volunteers or other individuals.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our activities, website functionality, volunteering arrangements, legal requirements or information-handling practices.
 

The latest version will be published on our website, together with the date of the most recent update.
 

Where changes materially affect the way we use personal information, we will take appropriate steps to bring those changes to the attention of affected individuals.

If you have questions about this Privacy Policy, wish to exercise your data protection rights or have concerns about the use of your personal information, please contact:
 

Herefordshire Resilience Forum

Email: [Insert email address]

Website: [Insert website address]

Correspondence Address: [Insert address]

We are committed to handling personal information responsibly and maintaining the trust of the individuals and communities we aim to support.