Privacy Notice

This privacy notice describes how Forests With Impact collect, uses and shares personal information.

Who we are

Forests With Impact is a Community Interest Company (CIC). We are a ‘data controller’, which means we decide why and how personal information is processed.

How to contact us

As a CIC, we operate outside of the requirement to appoint a Data Protection Officer, however, we fully understand our data protection obligations, and we have adequately trained people who advise us on data protection compliance.

If you have a question about how we process your personal information, please contact us by emailing

What is a Privacy Notice?

A Privacy Notice describes how we collect, use, and share personal information for the purpose of delivering the services and goals of the CIC.

Why issue a Privacy Notice?

Data protection law, especially in the UK, requires that a data controller make details of personal data processing available, and often, the best way to do that is within a Privacy Notice. The benefits of a privacy notice is that we remain transparent and open about how we use personal information.

Data Protection Law

We process your personal data in accordance with the U.K. General Data Protection Regulations (U.K. GDPR), the Data Protection Act 2018 (DPA 2018) and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

Data Protection law is based upon principles which set out the approach and considerations needed when processing personal information. Any processing must:

1. Be conducted in a manner that is lawful, fair and transparent.

2. Be undertaken for specific and valid purposes that we have clearly explained to individuals.

3. Remain appropriate and aligned to the purposes we have told you about.

4. Ensure that personal information is kept accurate and up to date.

5. Only be used for as long as necessary to achieve the original reason the data were collected.

6. Be kept secure, be available when it’s needed, and is untampered with.

7. Have appropriate records to be able to demonstrate our data protection compliance to individuals and data protection regulators.

The type of information we collect and how we might use it

We collect, use and share personal information about you which will be used to facilitate your relationship with us, which we expect to be limited information dependant on your interaction with us.

· Your full name, so that we know who you are.

· Your contact details like email and phone number, so that we know how to contact you.

· The company you work for, so that we know which companies are interested in and supportive of Forests With Impact.

· An understanding of your interests in our programs, this helps us develop our understanding of you.

· Photos and video footage, if you were involved in a photo or video opportunity at one of our locations.

· We use cloud-hosted sign-up forms to collect your information, which is then secured within our Microsoft 365 environment.

· We share the information you provide so that our partners can help us administer your involvement with Forests With Impact.

· We may need to share your information with entities like HM Prison Service, for example, if access to a secure site is required.

Our legal basis for processing your data

Our primary lawful bases for processing personal data under the UK GDPR are:

· Article 6(1)(f)– the processing of personal data is necessary for the purposes of the legitimate interests pursued by Forests With Impact or by a third party, except where such interests are overridden by the

interests or fundamental rights and freedoms of the individual whose data it is.

· Article 6(1)(c)- processing is necessary for compliance with our legal expectations, for example to meet our legal obligations.

· Article 6(1)(a)– the individual has given clear consent for us to process their personal data for a specific purpose.

· Article 6(1)(d) – in order to protect your vital interests or those of another person, for example in a medical emergency where your information needs to be shared with the ambulance services.

Special category information

Ordinarily we wouldn’t expect to collect or use personal data that is classed as special category/sensitive data – this type of personal data includes health, racial or ethnic origin, sexual orientation, political views, amongst others.

Criminal records information

The only category of personal data we might process that is sensitive is nature, would be data relating to criminal records. We wouldn’t actively ask for this type of personal data, but we would safeguard and process that type of data in accordance with data protection law. If in future we assess that it would be beneficial to collect personal data relating to criminal records, we’ll either ask for consent or we’ll apply an appropriate lawful basis for the processing.

How is information retained and kept safe?

Information is retained in secure electronic records and access is restricted to only those who need to know. It is important that information is kept safe and secure, to protect your confidentiality. There are a number of ways in which the protection of your personal data is ensured, like only collecting the minimal data we need to achieve its purpose, only allowing those who

have a genuine need to access your information, and we implement organisational measures such as data sharing agreements.

We use Microsoft 365, which is a cloud hosted system to manage our emails, internal communications and to help us administer the CIC. Our data storage locations will usually be within the UK, but we may share information with other organisations who are a part of the CIC and they might use data storage within the European Union. In recent years, the UK and the EU have agreed that their respective locations provide adequate protections for personal data, so storing UK data within the EU is ok.

How do we keep information confidential?

Our team at Forests With Impact are subject to confidentiality obligations set out in policy, and this is further strengthened by the overarching requirements to keep personal information confidential within data protection law.

We have implemented appropriate technical and organisational measures, which are appropriate to the risk that the nature of the data we process. We work to the following types of controls:

· Ensuring personal information is stored in secure locations.

· Restricting access to information to those who have a need to access or use personal information.

· Implementing encryption safeguards so that personal data is protected on laptops or other types of computer devices.

It’s our fundamental belief that information we are given should be kept secure and that your privacy should be safeguarded, so we do not sell, give, or rent your personal information. Of course, in the process of fulfilling the goals and objectives of Forests With Impact we might share your information with the organisations involved with Forests With Impact, but this would be as you would expect. There may also be occasion to share your information where we have been obliged or compelled by law to share it. If this were the case, we will aim to tell you about this before we share it, that is unless we are prohibited by law or a Court Order from telling you.

Who will the information be shared with?

There isn’t much of a requirement for us to share your information, other than, for the fulfilment of Forests With Impact activities. We will share your information with the other organisations that are a part of the CIC, but this is needed to achieve the goals of the CIC and to administer our relationship with you, and we don’t believe this is out of the ordinary.

The rights that individuals have relating to their data

Under data protection law, you have rights including:

Right to be informed

You have a right to be informed if your personal data is being used. Most of this right to be informed is met in this privacy notice, and similar information when we communicate with you directly and at our initial point of contact to discuss Forests With Impact with you.

Right of access

You have the right to obtain a copy of personal data that we hold about you and other information specified in data protection law (commonly known as a Data Subject Access Request or DSAR).

You will not have to pay a fee to access your personal information (or to exercise any of the other rights).

We may refuse to comply with the request in some circumstances.

To submit a Subject Access Request please contact us by email

Right to rectification

You have the right to ask us to rectify any inaccurate data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Right to erasure (‘right to be forgotten’)

You have the right to request that we erase personal data about you that we hold. This is not an absolute right, and depending on the legal basis that applies, we may have overriding legitimate or other legal grounds to continue to process and store your data.

Right to object

You have the right to object to the processing of personal data about you on some grounds. The right is not absolute, and we may continue to use the data if we can demonstrate compelling legitimate grounds.

Right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances.

Right in relation to automated individual decision-making

You have the right to object to being subject to a decision based solely on automated processing, including profiling.

Right to data portability

In limited circumstances you have the right to data portability which allows individuals to obtain and reuse their personal data for their own purposes across different services. We wouldn’t expect this right to apply to our relationship, but we’d happily support your rights where they apply.

It is important that the personal information we hold about you is accurate and current.

Please keep us informed if your personal information changes.

Your right to withdraw consent for us to share your personal information

Data protection law contains the right for you to withdraw consent that you may have given, this is the case where you’ve been asked for consent before your data was processed. Of course, we’d honour your request and work with you to either stop processing your information or understand any issues pertaining to our data processing. If you were to withdraw consent, it would affect the relationship you have with Forests With Impact, and we’d be unable to keep you involved in the CIC. interests and our legitimate interests to continue to share your personal data with other health and social care professionals where appropriate.

Data Retention

We understand the obligations we have around good data retention policies. We’re only interested in holding personal information of those that are actively involved in supporting or partnering with Forests With Impact.

If our relationship with you were to end, we’d keep a copy of your details within our secure systems for 12 months and then delete your information securely. In accordance with data protection law, we’d keep any information that would be required in any pursuit or exercising of legal claims, or where we are required by law to retain information.

Questions or concerns

If you have any questions or concerns regarding the information we process about you or how we use that information, please email us at

You have the right to complain to the Information Commissioner if you are not happy with any aspect of how we have processed your personal data or believe that we are not meeting our responsibilities as a data controller.

The contact details for the Information Commissioner are:

Information Commissioner’s Office 

Wycliffe House Water Lane, 

Wilmslow SK9 5AF 

Website: Helpline number: 0303 123 1113

Changes to this privacy notice

Any changes we may make to our privacy notice in the future will be posted on our website or you will be informed at the point of collection of your data if it is a significant change to how we use your data.