Privacy and Data Protection
Last updated June 2025
Privacy Notice: Lloyds Bank Foundation
Who we are?
“We” and “us” means Lloyds Bank Foundation for England and Wales. We are a charity with registered charity no. 327114 and a registered company with Company No.1971242 . We work in partnership with small and local charities, other organisations and communities so that people facing complex issues and barriers have the support and opportunities to overcome them.
Your privacy matters
At Lloyds Bank Foundation, we are committed to keeping your personal data safe and secure.
This notice sets out in detail the purposes for which we process information about you, who we share it with, what rights you have in relation to that information and everything else we think it’s important for you to know.
If you have any questions about the processing of your personal information, or you would like to exercise any of your rights, please reach out to us with the details mentioned below:
Email us: enquiries@lloydsbankfoundation.org.uk
How we process your information
To understand how we process your personal information and to understand your rights, please visit the relevant appendix below:
Appendix 1: Grant Applicants
Appendix 2: People and Culture
Appendix 3: Event Attendees
Appendix 4: Newsletter Subscribers
Appendix 5: General Information
Changes to this Privacy Notice
We aim to keep this privacy notice regularly updated. This privacy notice is kept under regular review. If we make any significant changes to the way in which we process your information, we will let you know by either reaching out to you or posting a banner on the website.
This was last updated in May 2025.
Appendix 1: Grant Applicants
How and when do we collect information about you?
We collect data when you apply for grants with our organisation. This includes the contact details of the lead contact, the contacts named on the application or contacts otherwise provided to us by you, job title and IP address.
How is the information used?
We use this information to:
1. Assess your application for securing funding
2. Manage your grant and provide development support
3. Monitor the work and conduct research
4. Publicise the work we are funding and/or evaluate our grant programmes
What is our lawful basis for processing this information?
To process your lead contact’s information when you apply for funding, we rely on legitimate interest.
Who do we share your data with?
If you are successful in your funding application, we reserve the right to share your information with appropriate parties, such as The Charity Commission, Lloyds Bank and other funders, to manage the grant and with 360 giving and our learning partners for the purposes of research.
How we store your information and for how long?
We retain the personal data of all service users for a period of in line with our retention periods. If you would like to know more about this, please contact us at the email address above.
Appendix 2: People and Culture
(Job applicants, employees, consultants, trustees etc)
How and when do we collect information about you?
You provide several pieces of data to us directly during the recruitment period and subsequently upon the start of your employment or engagement with us. Lloyds Bank Foundation will seek information from third parties only once a job offer to you has been made and will inform you that it is doing so.
What types of information is collected about you and who provides it?
We keep several categories of personal data to carry out effective and efficient processes. Specifically, depending on your type of engagement with us, we may process the following types of data:
a. personal details such as name, address, phone numbers, marital status
b. name and contact details of your next of kin
d. footage of the organisation events where you may appear
e. information of any disability or other medical information you have disclosed
f. right to work documentation, National Insurance number, bank account details
g. information gathered via the recruitment process such as that included in a CV, cover letter or application form, references, details on your education and employment history etc
i. information relating to your employment with us (e.g. job title, job description, salary, terms and condition of the contract, annual leave records, appraisal and performance indication, formal and informal proceedings involving you such as letters of concern and disciplinary, disciplinary and grievance proceedings)
m. your biography and picture for the website (if applicable).
We may also process special category of data which include health information, sexual orientation, race, ethnic origin.
How is the information used?
We are required to use your personal data for various legal and practical purposes for the administration of your contract of employment or your agreement with us, without which we would be unable to employ you or engage with you. Holding your personal data enables us to meet various administrative tasks, legal obligation or contractual/agreement obligation.
What is our lawful basis for processing this information?
We mainly use ‘contractual obligation’ as a lawful basis for processing personal data for job applicants, employees and consultants. We mainly use ‘legitimate interest’ for trustees. We may also have legal obligation in order to process and share your data, for example we need to share salary information to HRMC, check your eligibility to work in the UK or use some of your data to enroll a new employee on a pension scheme.
We may rely on our legitimate interest for processing activity such as keeping supervision and appraisal records; using your image, bio and videos/pictures of the organisations’ events where you may appear on our website or marketing/fundraising materials to promote the charity.
Some special categories of personal data, such as information about health or medical conditions is processed in order to carry out employment law obligations and for health and social care obligations (such as those in relation to colleagues with disabilities and for health and safety purposes). We may also process other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief on the basis of substantial public interest for the purposes of equal opportunities monitoring.
Who do we share your data with?
Personal Data in relation to your salary is shared with HRMC as part of our legal obligation. Personal Data may be shared with third parties for the following reasons:
1. for the administration of payroll, pension, People and Culture functions (for example the online holiday booking system), administering other employee benefits.
2. When sharing information with third parties, we have data sharing agreements, data processing agreements or contracts in place to ensure data is not compromised. These third parties implement appropriate technical and organisational measures to ensure the security of your data.
How long do we keep your data?
We only keep your data for as long as we need it for, which will be at least for the duration of your employment/engagement with us though in some cases, we will keep your data for a period of 6 years after your employment/engagement has ended. If you’ve applied for a vacancy but your application hasn’t been successful, we will keep your data only for 12 months.
Some data retention periods are set by the law. Retention periods can vary depending on why we need your data. Please get in touch by contacting us using the details above if you want to know more about retention period.
Data is destroyed or deleted in a secure manner as soon as the retention date has passed.
Appendix 3: Event Attendees
If you attend one of our events, we will capture your contact details (name, organisation, job title, email address) and any dietary and accessibility requirements. We will use this information to contact you with important details about the event you have registered for, ensure we have the correct support in place for everyone to participate fully, and ensuring our catering fulfils everyone’s dietary requirements. For processing your personal data, we rely on legitimate interest. When we collect other information such as dietary information, we rely on your explicit consent.
Appendix 4: Newsletter Subscribers
If you choose to subscribe to our newsletter we will capture and store your contact details (name, organisation, email address) and add you to our circulation list. We rely on your consent to process your contact details.
You can unsubscribe from our newsletter at any time via our website or the ‘unsubscribe’ link in our newsletter.
Appendix 5: General Information (Complaints Procedure, Your rights)
Your rights as a Data Subject
You have the following rights:
• ‘Right to be informed’, which means we will be completely clear and transparent about how we plan to use your personal information.
• ‘Right of access’, which means you can request details of the personal information we hold about you and how we use it. We will provide this within one month.
• ‘Right to rectification’, which means you can ask us to update or amend the personal information we hold about you, if it is incorrect.
• ‘Right to restrict processing’, which means you can ask us to change, restrict or stop the way we are using your personal information.
• ‘Right to erasure’ (or ‘right to be forgotten’), which means you can ask us to remove your personal information from our records.
• ‘Right to object’, which means you can object to us using your personal information for marketing purposes.
• ‘Right to data portability’, which means you can obtain the personal information we hold about you and reuse it for your own purposes.
• ‘Right not to be subject to automated decision making’, which means if we use systems to make a decision about you, you have the right to ask for a person to intervene, which may change the outcome.
• Right to lodge a complaint with a supervisory authority, such as the Fundraising Regulator or the Information Commissioner’s Office (ICO), if you are not satisfied with our response to a request you make to us, or you feel we are not using your information correctly.
International Data Transfers
Where personal data is stored outside of the UK and the EEA, safeguards to protect personal data may include but are not limited to the UK Addendum used in conjunction with the EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreement (IDTAs). Such safeguards will be subject to Transfer Risk Assessments (TRAs).
Complaints procedure
If you are unhappy with the way we process your data, please get in touch with the Data Protection Lead using the contact details mentioned above. You may stop certain communications from us. If you would prefer not to receive communications from Lloyds Bank Foundation, please get in touch with: media@lloydsbankfoundation.org.uk.
You can also make a complaint to the Information Commissioner’s Office (ICO), which regulates the use of information in the UK. They can be contacted at 0303 123 1113 or, you can write to them at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
