Privacy notice

Introduction

Gatsby Africa (“GA/we/us/our”) is funded and supported by The Gatsby Charitable Foundation, one of a number of different independent, grant-making trusts established by members of the Sainsbury family. We share offices located at The Peak, 5 Wilton Road, London SW1V 1AP with other trusts that comprise the Sainsbury Family Charitable Trusts (SFCT).

Our overall objective is to create jobs and improve incomes for poor people in East Africa (primarily in Kenya and Tanzania) and we achieve this through sector development programmes.

GA provides funding support and is a trustee of a Tanzanian trust called The Forestry Development Trust. We also provide funding support and are a member in two Kenyan organisations: Msingi and Kenya Markets Trust (KMT).

Keeping your personal information safe is very important to us. Gatsby Africa is registered as a data controller with the Information Commissioner’s Office (registration number ZB049111). GA is also registered with Companies House (registration number 09360833) and with the Charity Commission for England and Wales (charity number 1168223). We are committed to the protection of your personal data we process in line with the data protection laws applicable to the UK (namely the UK General Data Protection Regulation (the UK GDPR) and the Data Protection Act 2018.

We have policies, procedures, and training in place to help our employees understand their data protection responsibilities and our data protection principles. We have a nominated member of SFCT staff who serves as our Data Protection Manager. If you have any questions regarding how we collect, store and process your personal data, please email dataprotection@sfct.org.uk. We have also appointed an independent Data Protection Officer at data protection consultants, Evalian Limited, who can be contacted by email at dpo@evalian.co.uk.

This privacy notice explains what personal data we collect from individuals who visit our offices or contact us by email, phone, receive funding from us or send us other communications (“you/your”).

We place great importance on ensuring the quality, confidentiality, integrity and availability of the data we hold and in meeting our data protection obligations when processing personal data. GA is committed to protecting the security of your personal data. We use a variety of technical and organisational measures to help protect your personal data from unauthorised access, use or disclosure.

If you have applied for a job with us or submitted your CV (or similar employment information) to us, we process your personal data as set out in our privacy notice for job applicants.

We update this privacy notice from time to time in response to changes in applicable laws and regulations, to our processing practices or other services we offer. When changes are made, we will update the date at the bottom of this document. Please review this privacy notice periodically to check for updates.

What information do we process?

Information you provide to us

We process all information you give us, either through corresponding with us by post, telephone, email or otherwise, to become an independent advisor or consultant, a co-funder, partner organisation or a contractor. This may include,

Your name (first and last)
Employer or Institutional name and address
Your email address
Your telephone number
Your specialisms or areas of interest
Message (web form)
CV (including Home Address, Date of Birth, Education, Work history).

Information processed by us when you subscribe to receive updates or information from GA (e.g. newsletter, case studies or Horizon reports).

We process the following information you give us when you submit a web subscription form to us.

Name (First and surname)
Email address
Organisation / Company name

Information we gather about you from public records and independent research

In fulfilling our charitable objectives we undertake our own research and identify practitioners, peers and specialists in their fields in specific topics of interest to GA. We will process information about you that is available from public sources, generally limited to:

Your name (first and last)
Organisation/Company name and address (if any)
Your email address
Your telephone number
Your specialisms or areas of interest.

Information processed by us when you participate in visits or activities that are funded, organised or facilitated by GA.

Name (First and second)
Email address
Position
Company name and address
Company phone number
Passport details (for flight bookings, visas and logistical support)
Personal phone number
Date of Birth
Next of Kin and emergency contact
Emergency medical information e.g., blood type
Allergies
Images, photographs or recordings of the visits and activities

Information processed by us when you accept an invitation to attend one of our GA- organised events.

Events could be award ceremonies, other celebratory occasions, workshops on a particular topic, meetings of grant holders and other stakeholders, etc. We process the following information:

Your name (first and last)
Your professional affiliation (employer or institution you represent)
Your position
Your email address
Your phone number
Your dietary requirements
Images, photographs or recordings of the visits and activities

Information we may obtain from other sources

Indirectly, we may record or receive additional details about you from

Public information sources, such as your website, Facebook page, LinkedIn page, Twitter handle, or from news articles and public registers, such as The Charity Commission.
People who think that you may be interested in GA activities.

If you are awarded a grant

We may already hold personal information from the application stage but we may now collect the following additional information:

Bank details to award and administer the grant
Grant spend information
Annual and end of grant information
Information relating to post-award issues such as requests for supplements or extensions
Information collected (e.g. project progress) during or after completion of the award

Cookies & CCTV

We use a limited number of cookies on our websites listed below to analyse traffic to the site. Cookies are small text files that are downloaded to your device when you visit a website, unless you have set your browser to reject them.

We use cookies to remember your preferences, display content that is more relevant to you and improve your overall experience of our site. To learn more about cookies and what you can do to opt out of receiving them, please view our Cookies Notice here. Our website may contain links to other websites, such as LinkedIn and Twitter. Please read the privacy notices provided by the other websites before posting any personal information.

To ensure the safety of all our visitors, contractors and staff, SFCT and the Landlord’s property managers capture and record CCTV images at the main entrances and reception to our office buildings.

Purposes and bases for processing your data

We will only use your personal information for the purpose which it was provided to us for and in ways that you would reasonably expect. We may use your data for the following purposes and on the following lawful bases:

Purpose	Lawful Bases for Processing
Responding to correspondence from you or other type of enquiry.	It is in our legitimate interest to respond to enquiries made by phone, by email, through our social channels or any other means.
Sending you information such as newsletters, research reports, insights and other news about GA activities and information which may be of interest.	When you agree to be contacted for general or specific (e.g. newsletter) information about us, we will rely on our legitimate interests or your consent, which may be withdrawn at any time by emailing dataprotection@sfct.org.uk.
For managing our relationships with co- funders, development funded institutions and other partners, and fulfilment of our obligations, as set out in our budget awards, or other contractual agreements.	This is necessary for the performance of the development funding programme or other agreement we have entered with you. It is in our legitimate interest to process your data in the course of managing our development funding programmes.
For managing our business relationship when you provide advice or supply services to us in connection with our development funding activities.	This is necessary for the performance of the contract or other agreement we have entered with you. It is in our legitimate interest to process your data in the course of managing our development funding programmes.
For managing the grant making process and fulfilment of our obligations, as set out in our grant awards, or other contractual agreements.	This is necessary for the performance of the grant award or other agreement we have entered with you.
For Gatsby Africa management, forecasting and statistical purposes.	It is our legitimate interest to identify areas for improving relationships, developing new award opportunities, and managing the development funds.
Publicising the positive impact of GA funding activities, e.g. by publishing case studies, reports, etc.	Publication of your details, including photographs and recordings, is in our legitimate interest to publicise our activities or if you are uniquely identifiable we may do so with your consent which may be withdrawn at any time by emailing dataprotection@sfct.org.uk.
Publishing our annual reports, which may contain development funding case studies.	Publication of your personal details in our case studies is with your consent which may be withdrawn at any time by emailing dataprotection@sfct.org.uk.
For managing overseas travel arrangements for consultants, advisers or other individuals invited by GA to take part in GA overseas activities.	Processing your personal details including passport, visa information, vaccination records, and other relevant health data is with your explicit consent which may be withdrawn at any time by emailing dataprotection@sfct.org.uk.
Invitation and attendance at our events.	It is our legitimate interest to publicise and celebrate the work of GA by holding publicity events. If you attend a catered event we will collect and use your dietary information with your consent. If you attend the event we may collect and use photographs and recordings and where you are uniquely identifiable we do so with your consent which may be withdrawn at any time by emailing dataprotection@sfct.org.uk.

Sharing your information

We will not sell or exchange your personal information. We will only share your personal information where we are required to fulfil our development funding agreement with you, or legitimate interest, where we have your consent, or we are required to do so by law. This may involve the participation of other collaborative partners, such as co-funders, funding partners or project partners outside of the Sainsbury Family Charitable Trusts.

We may share your personal information with third party organisations who will process it on our behalf. This is strictly governed by data processing terms which confirms that the personal information we provide will only be used for the purposes we specify and will be processed in line with data protection legislation.

Other third parties we may share your personal data with include:

Public bodies such as the UK Companies House, Inland Revenue, or the police. The legal basis in these cases is compliance with our legal obligations.
In case of an emergency we may also share your information with the relevant public health and emergency services and contact your next of kin. The legal basis for processing in such cases is to protect your vital interests.

International transfers

GA provides centralised support services from our London office to our branch offices and affiliates in East Africa.

GA works with several advisors and suppliers and it is possible that we will share your data with other third-party suppliers that process your data in countries outside the UK where the data protection laws are not equivalent to those within the UK. Where this applies, we do so, either based on an ‘adequacy decision’ or using Standard Contractual Clauses approved by the European Commission and recognised by the UK which contractually oblige companies in those countries to meet the same standard expected within the EEA.

How does GA protect personal data?

GA takes the security of your data seriously. We have internal policies and controls in place to ensure that your data is not lost, accidentally destroyed, misused, or disclosed, and is not accessed except by its employees in the performance of their duties. Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of the data.

Your rights

The GDPR provides you with certain rights in relation to the processing of your personal data, including to:

Request access to personal data about you (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you, and to check that we are lawfully processing it.
Request rectification, correction, or updating to any of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request personal data provided by you to be transferred in machine-readable format (“data portability”).
Request erasure of personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove personal data where you have exercised your right to object to processing (see below).
Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you (e.g. if you want us to establish its accuracy or the reason for processing it).
Object to the processing of your personal data in certain circumstances. This right may apply where the processing of your personal data is based on the legitimate interests of GA.

These rights are not absolute and are subject to various conditions under applicable data protection and privacy legislation and the laws and regulations to which we are subject.

If at any time you decide that you no longer wish to be contacted for marketing purposes, or if you would like to exercise any of your rights as set out above, you can contact us by email. See ‘Contact Us’.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

In addition to the above, please note that you have the right to make a complaint at any time to the Information Commissioner’s Office if you are concerned about the way in which we are handling your personal data.

Data retention period

We will retain your personal data for as long as it necessary for the purpose of our relationship or until you object to us processing it or withdraw your consent. We will not retain your personal information if it is no longer required. In some circumstances, we may legally be required to retain your personal information, for example for finance or audit purposes.

Contact us

You can contact GA in relation to data protection and this privacy notice by writing to:

Data Protection Manager
Gatsby Africa
c/o Sainsbury Charitable Family Trusts
The Peak,
5 Wilton Road, London
SW1V 1AP

Alternatively, you can email us at dataprotection@sfct.org.uk

Last updated: 3 June 2021