Please ensure Javascript is enabled for purposes of website accessibility

Privacy and Data Protection

Last updated August 2026

Privacy Notice: Lloyds Bank Foundation 

Who we are?

“We” and “us” means Lloyds Bank Foundation for England and Wales. We are a charity with registered charity no. 327114 and a registered company with Company No.1971242 .  Lloyds Bank Foundation for England and Wales is an independent charitable foundation, backed by Lloyds Banking Group and the people within it. We want everyone to be in a good place - personally, in a home that’s a good place to live, and in a community that’s a good place to belong.  

Your privacy matters

At Lloyds Bank Foundation, we are committed to keeping your personal data safe and secure. 

This notice sets out in detail the purposes for which we process information about you, who we share it with, what rights you have in relation to that information and everything else we think it’s important for you to know. 

For the purposes of UK data protection law, we will usually be the controller of the personal information described in this notice. This means that we decide why and how that information is used. In some activities, we may act jointly with another organisation or process information on behalf of another controller. Where this applies, we will explain the arrangement. 

“Personal information” means any information relating to an identified or identifiable living individual. Some particularly sensitive information is known as “special category data”. This includes information about health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric identification data, sex life and sexual orientation.  

In this notice we may refer to “personal information”, “personal data”, “data” or similar terms. For the purposes of UK data protection law, when we use these or similar terms in this notice, we mean “personal information” as defined above. 

If you have any questions about the processing of your personal information, or you would like to exercise any of your rights, please reach out to us with the details mentioned below:

Email us: enquiries@lloydsbankfoundation.org.uk 

How we process your information

To understand how we process your personal information and to understand your rights, please visit the relevant appendix below:

Appendix 1: Grant Applicants

Appendix 2: People and Culture 

Appendix 3: Investing in the Power of Civil Society Pilot

Appendix 4: Fundraising and Marketing

Appendix 5: General Information

Appendix 6: Complaints Procedure

We may also provide additional privacy information when we collect personal information for a particular programme, event, research project, recruitment exercise or other activity. That information should be read with this notice. 

Changes to this Privacy Notice

We aim to keep this privacy notice regularly updated. This privacy notice is kept under regular review.  If we make any significant changes to the way in which we process your information or the law materially changes, we will let you know by either reaching out to you or posting a banner on the website. This was last updated in August 2026.

Appendix 1: Grant Applicants

How and when do we collect information about you?

We collect data when you apply for grants with our organisation. This includes the contact details of the lead contact, the contacts named on the application or contacts otherwise provided to us by you, job title and IP address, and correspondence, meeting notes and records of our relationship with you or your organisation.

We usually collect this information directly from you or your organisation. We may also obtain it from other people named in an application, other funders, public registers such as Companies House and the Charity Commission, publicly available sources, fraud prevention services, regulatory bodies or law enforcement agencies. 

How is the information used?

We use this information to: 

  1. Assess your application for securing funding
  2. Communicate with you, manage your grant and provide development support
  3. Meet our legal, regulatory, charitable and governance obligations 
  4. Monitor the work and conduct research
  5. Publicise the work we are funding and/or evaluate our grant programmes

What is our lawful basis for processing this information? 

Depending on the activity, we rely on one or more of the following lawful bases: 

Legitimate interests: including assessing grant applications, administering and monitoring grants, undertaking due diligence, fraud prevention, etc. We consider that these activities support our charitable purposes and effective administration. We balance these interests against the interests, rights and freedoms of the individuals concerned.

Legal obligation: including where processing is necessary to meet our obligations relating to charity governance, financial reporting, or regulatory compliance.

Who do we share your data with?

Where necessary for the purposes described above, we may share personal information with: 

  • Lloyds Banking Group;
  • other funders and public bodies where programmes are delivered jointly or information sharing is reasonably necessary;
  • 360Giving, where information is published in accordance with applicable standards; 
  • service suppliers acting on our behalf;
  • our auditors, insurers, legal and other professional advisers; 
  • the Charity Commission, HMRC, law enforcement agencies and other regulators or public authorities where disclosure is required or permitted by law; and 
  • a prospective successor or partner organisation in connection with a restructuring or transfer of an activity. 

How we store your information and for how long?

We retain the personal data of all service users for a period of in line with our retention periods. If you would like to know more about this, please contact us at the email address above.  

Appendix 2: People and Culture 

This appendix applies to job applicants, former prospective and current employees, workers, volunteers, consultants, trustees, referees and individuals whose information is otherwise processed in connection with our workforce administration.

How and when do we collect information about you?

You provide several pieces of data to us directly during the recruitment period and subsequently during your employment or engagement with us. 

We may also receive information from recruitment agencies and recruitment service providers, referees, previous employers, background-check providers, disclosure and barring bodies, occupational health providers, pension and benefit providers, HMRC, government agencies, and publicly available sources.

What types of information is collected about you and who provides it? 

We keep several categories of personal data to carry out effective and efficient workforce administration. Specifically, depending on your type of engagement with us, we may process the following types of data: 

  1. personal details such as name, address, phone numbers, marital status
  2. name and contact details of your next of kin  
  3. footage of the organisation events where you may appear 
  4. information of any disability or other medical information you have disclosed
  5.  right to work documentation, National Insurance number, bank account details
  6. information gathered via the recruitment process such as that included in a CV, cover letter or application form, references, interview notes, assessment results, recruitment correspondence, eligibility checks, details on your education and employment history etc  
  7. information relating to your employment with us (e.g. job title, job description, salary, terms and condition of the contract, annual leave records, appraisal and performance indication, formal and informal proceedings involving you such as letters of concern and disciplinary, disciplinary and grievance proceedings)
  8. your biography and picture for the website (if applicable). 
  9. equality, diversity and inclusion monitoring information if you choose to provide it; 

We may also process special category of data which include health information, sexual orientation, race, ethnic origin.  Where necessary, we may process information about criminal convictions, offences, allegations or relevant background checks.

How is the information used?

We are required to use your personal data for various legal and practical purposes for the administration of your contract of employment or your agreement with us, without which we would be unable to employ you or engage with you. Holding your personal data enables us to meet various administrative tasks, legal obligation or contractual/agreement obligation. 

In addition to processing your personal data where required to administer the engagement between us, we also use it to:  

  • support health and wellbeing, and provide reasonable adjustments; 

  • enable equality, diversity and inclusion; 

  • protect our personnel, premises, equipment, systems and information; and 

  • prevent and investigate fraud, misconduct, security incidents and legal claims. 

Artificial Intelligence (AI) and Recruitment

We may use AI-assisted tools and systems to support administration, assessment and shortlisting when recruiting. 

These systems may assist us to organise applications, compare application information against the published criteria, identify relevant content or summarise information.

We do not permit an AI system to make a final recruitment decision without human review.

What is our lawful basis for processing this information?

We mainly use ‘contractual obligation’ as a lawful basis for processing personal data for job applicants, employees and consultants. We mainly use ‘legitimate interest’ for trustees. We may also have legal obligation in order to process and share your data, for example we need to share salary information to HRMC, check your eligibility to work in the UK or use some of your data to enrol a new employee on a pension scheme.

We may rely on our legitimate interest for processing activity such as keeping supervision and appraisal records; using your image, bio and videos/pictures of the organisations’ events where you may appear on our website or marketing/fundraising materials to promote the charity. 

Some special categories of personal data, such as information about health or medical conditions is processed in order to carry out employment law obligations and for health and social care obligations (such as those in relation to colleagues with disabilities and for health and safety purposes).

We may also process other special categories of personal data, such as information about ethnic origin, sexual orientation, health or religion or belief on the basis of substantial public interest for the purposes of equal opportunities monitoring.  

  • Depending on the circumstances, relevant conditions for using special category data include: employment related purposes, including management of absence, reasonable adjustments, and workplace health and safety; 

  • establishment, exercise or defence of legal claims; 

  • substantial public interests, including equality of opportunity or treatment, safeguarding, preventing or detecting unlawful acts, preventing fraud or dishonesty, and protecting the public against dishonesty, malpractice or seriously improper conduct; 

  • explicit consent, where appropriate.

Who do we share your data with?

Personal Data may be shared with: 

  • payroll, pension, benefits, occupational health, wellbeing, HR and workforce-management providers; 

  • recruitment partners, applicant-tracking and recruitment-platform providers,  

  • referees, previous employers, recruitment agencies, background-check providers and disclosure and barring bodies where relevant; 

  • professional advisers, auditors, insurers; 

  • the Charity Commission, Companies House, HMRC, law enforcement agencies, courts and other public or regulatory bodies where required or permitted by law; and 

  • other parties where necessary to manage a legal claim, safeguarding concern, emergency or organisational change 

Where a recipient processes information on our behalf, they do so on the basis of a written contract with us, and only on our written instructions.

How long do we keep your data?

We only keep your data for as long as we need it for, which will be at least for the duration of your employment/engagement with us though in some cases, we will keep your data for a period of 6 years after your employment/engagement has ended. If you’ve applied for a vacancy but your application hasn’t been successful, we will keep your data only for 12 months.

Some data retention periods are set by the law. Retention periods can vary depending on why we need your data. Please get in touch by contacting us using the details above if you want to know more about retention period. 

Data is destroyed or deleted in a secure manner as soon as the retention date has passed. 

Appendix 3: Investing in the Power of Civil Society (IIPCS) Pilot participants 

How and when do we collect information about you?

We collect data when you are referred to the IIPCS pilot by the National Lottery Community Fund. Alongside basic information about your organisation and the reason you are being referred, we collect the contact details of the relevant senior representative(s) of your organisation such as name(s), job title(s) and professional email address(es).

How is the information used?

We use this personal information, together with what you share directly with us to facilitate communication and oversee the delivery of the pilot including:   

  1. Invite you to an information session about the pilot, so you can learn more about it 

  2. Refer you to the partner(s) you selected to provide you with relevant development support  

  3. Seek your feedback about your experience so we can improve the delivery of the pilot  

  4. Conduct research and evaluation about the pilot  

  5. Monitor the delivery of the pilot and communicate with you about matters related to the pilot

Where optional feedback or research involves special category data, vulnerability or sensitive experiences, we will explain the processing more specifically.

What is our lawful basis for processing this information?

To process the contact details of the relevant senior representative(s) of your organisation, we rely on legitimate interests, namely to administer and evaluate the pilot, communicate with organisational representatives, coordinate development support and improve the programme. 

We may also rely on legal obligation where processing is required by law.

Who do we share your data with? 

Once referred we share your personal information with appropriate parties such as the IIPCS consortium partners, Lloyds Bank Foundation Development partners to deliver the pilot, including referring you to your chosen development support provider and sharing your contact details with IVAR our learning partner for the purpose of research. 

We may share your personal information with the Charity Commission, other regulatory bodies, or law enforcement agencies when we are required to do so by a legal or regulatory obligation. 

How we store your information and for how long?

We retain the personal data of all service users for a period of in line with our retention periods. If you would like to know more about this, please contact us at the email address above. 

Research and Evaluation Ethics 

We apply proportionate ethical review and safeguarding measures for research and evaluation. Participation materials explain what data we collect, why, how long we keep it, and your rights. We prefer pseudonymised or anonymised data for reporting wherever possible.  

Appendix 4: Fundraising and Marketing 

This appendix explains how we process personal data for fundraising and marketing, including individual giving, major donors, corporate partnerships, trusts and foundations, events, and communications. 

What We Collect

  1. Identity and contact data; communication preferences.  

  1. Donation history, Gift Aid status, event registrations and attendance.  

  1. Engagement information (e.g., email opens/clicks), where permitted.  

  1. For major donor/corporate fundraising: publicly available information (e.g., from Companies House, the Charity Commission, press and your organisation’s website) to understand interests and align opportunities, in line with Legitimate Interests and your rights.  

  1. Payment information processed securely by our payment service providers; we do not store full card details.  

  1. Records of consent, objections, opt-outs.

How We Use Your Data  

  1. To process and acknowledge donations and manage Gift Aid.  

  1. To manage events and volunteering opportunities.  

  1. To send you marketing about our work and ways to support us, in line with your preferences and PECR.  

  1. To develop supporter relationships, including segmentation and profiling to tailor messages, under Legitimate Interests; you can object at any time.  

  1. To comply with legal and regulatory requirements and prevent fraud.  

Lawful Bases (Fundraising & Marketing) 

For email marketing to individuals where required by PECR we rely on Consent (Art 6(1)(a)). For postal marketing, or soft opt-in related email communications when you have expressed an interest we rely on Legitimate Interests (Art 6(1)(f)). We will provide an opportunity to opt out when information is collected and in every subsequent communication. You may object to marketing at any time.

To administer event bookings we rely on Contract (Art 6(1)(b)). For Gift Aid and financial record‑keeping we rely on Legal Obligation (Art 6(1)(c)). For processing dietary requirements or any other optional EDI information we rely on Explicit Consent (Art 9 (2)(a).

We may group supporters according to factors such as relationship with us, previous engagement, donation history, communication preferences or likely interests. We use this to make communications more relevant and to use our resources effectively.

Who We Share Your Data With

We may share data with payment processors and fundraising platforms (as independent controllers). We may also share data with regulators (e.g., HMRC for Gift Aid) and auditors where required by law. We may also share data with event partners and venues where necessary for attendance and safety.

We may also use mailing, event-management, hosting, analytics, customer relationship management and communications suppliers acting on our behalf, and professional advisers, auditors and fraud-prevention providers where necessary.

We do not sell your personal information.

You can unsubscribe from our newsletter at any time via our website or the ‘unsubscribe’ link in our newsletter. 

Appendix 5: General Information (Complaints Procedure, Your rights)

Your rights as a Data Subject

You have the following rights: 

  • ‘Right to be informed’, which means we will be completely clear and transparent about how we plan to use your personal information.
  • ‘Right of access’, which means you can request details of the personal information we hold about you and how we use it. We will respond without undue delay and usually within one month after the applicable time period begins. The period may be paused or extended where data protection law permits.
  • ‘Right to rectification’, which means you can ask us to update or amend the personal information we hold about you, if it is incorrect.
  • ‘Right to restrict processing’, which means you can ask us to change, restrict or stop the way we are using your personal information.
  • ‘Right to erasure’ (or ‘right to be forgotten’), which means you can ask us to remove your personal information from our records. This is not an absolute right and does not apply where we need to retain information for an overriding reason.
  • ‘Right to object’. You have the (non-absolute) right to object to the use of your data where it is based on legitimate interest or public tasks. You also have the absolute right to object to the use of your data for direct marketing.
  • ‘Right to data portability’, which means you can obtain the personal information we hold about you and reuse it for your own purposes.
  • ‘Right not to be subject to automated decision making’, which means if we use systems to make a decision about you, you have the right to ask for a person to intervene, which may change the outcome.
  • Right to lodge a complaint with a supervisory authority, such as the Fundraising Regulator or the Information Commission(IC), if you are not satisfied with our response to a request you make to us, or you feel we are not using your information correctly. 

 International Data Transfers

Some organisations that process personal information for us, or their sub-processors, may be located outside the UK or permit access to information from outside the UK. Where this involves a restricted transfer, we will ensure that an appropriate transfer mechanism and safeguards are in place. These may include: 

  • UK adequacy regulations; 

  • the UK International Data Transfer Agreement; 

  • the UK Addendum to the European Commission’s Standard Contractual Clauses; 

  • binding corporate rules; or 

  • a derogation in Article 49 UK GDPR. 

Security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss or alteration and unauthorised disclosure or access. These measures include, as appropriate, access controls, authentication, encryption, staff training, supplier due diligence, backup and recovery arrangements and incident management procedures.

No method of transmission or storage is completely secure.

If we become aware of a personal data breach, we will assess it and notify the ICO and affected individuals where data protection law requires us to do so.

Automated decision-making

We may use automated tools to support administrative, recruitment, grant, research, fundraising or security activities. Unless we tell you otherwise in specific privacy information, we do not use your personal information to make decisions based solely on automated processing that produce legal or similarly significant effects.

Website Information

We use Google reCAPTCHA (a service provided by Google LLC) to help protect our website from spam, fraud, and automated abuse.

reCAPTCHA works by collecting information about your interaction with our website in order to determine whether you are a human user. This may include: 

  1. your IP address 

  1. device and browser information 

  1. information about how you interact with our website (such as mouse movements, typing patterns, and time spent on pages) 

This information is used to support our legitimate interests in ensuring the security of our website and preventing misuse.

In providing this service, Google may process personal data on our behalf. This may involve transferring data outside the UK. Where this happens, appropriate safeguards are in place to protect your information. 

Appendix 6: Complaints procedure 

If you are unhappy with the way we process your data, please get in touch with the Data Protection Lead using the contact details mentioned above. Please provide:  

  • Your name and contact details  

  • A clear description of your concern  

  • Any relevant dates or reference numbers 

What Happens Next?  

  • We will acknowledge your complaint within 30 days of receiving it.  

  • We will investigate your concerns.  

  • We may contact you if we need further information.  

  • We will respond as soon as possible and without undue delay.  

Our response will explain:  

  • What we have found  

  • Whether any action has been taken  

  • What happens next

You may stop certain communications from us. If you would prefer not to receive communications from Lloyds Bank Foundation, please get in touch with: media@lloydsbankfoundation.org.uk.

If you remain unhappy with our response, you have the right to make a complaint to the IC, which regulates the use of information in the UK.  

Sign up to our newsletter

Receive monthly updates on what we’ve been up to, what we have planned, news from the sector and access to free and helpful resources

Follow us

Close