Privacy Notice

Last updated: 22 April 2026 | Version: 2.0

Introduction

St Albans Old People’s Trust is committed to protecting your privacy. This Privacy Notice explains how we collect, use, share and safeguard your personal information when you apply for a grant, contact us, or use our website. It also describes your rights and how to exercise them.

Who we are

St Albans Old People’s Trust (Registered Charity No. 222522) is the data controller responsible for the personal information we collect and use.

Contact details:

Address: St Albans Old People’s Trust, c/o HILS, Jubilee Centre, Catherine Street, St Albans, AL3 5BU

Email: administration@staopt.org

Phone: 07541 659442 / 01727 260701

What information do we collect

From grant applications

We collect:

Your name, contact details (email, phone, postal address), date of birth, address, household circumstances.
Information about your financial situation (income, outgoings, savings, and supporting documents such as bank statements), and information you choose to provide about your needs.
Notes of our interactions with you during the application process, including any relevant observations made during contact with us where needed to manage the application safely and fairly.

If someone assists you with your application

We collect the supporter’s name, contact details, and their relationship to you.

Website usage

When you visit our website, we may automatically receive limited technical information, such as your IP address, device and browser details, and the pages you view. We use this information to operate the website securely and to fix errors if something goes wrong. We do not use analytics or advertising cookies.

For details on cookies and how to control them, please see our separate Cookie Notice [insert hyperlink]

Why we use your information

We use your personal information to:

Assess your eligibility for a grant and make fair, consistent decisions
Arrange delivery or payment of an approved grant item or service (where applicable)
Maintain an audit trail of decisions and manage repeat applications
Refer you to other support organisations that may be able to provide you with help (eg St Albans Citizens Advice and other local support providers)
Follow up with you from time to time, including after a grant decision or award, by phone or post to check how you are getting on, whether the grant met your needs, and whether further support from the Trust may be helpful (you can tell us at any time if you’d prefer we don’t contact you for this purpose)
Recognise, record and escalate safeguarding concerns and, where necessary, make referral to Hertfordshire County Council, the police, or another appropriate agency
Fulfil our legal, regulatory and accounting obligations
Respond to questions, complaints and data subject rights requests

Our lawful bases for processing your information

We only process your personal information when we have a valid legal reason to do so (known as a “lawful basis”).

We rely on the following lawful bases for the personal information we collect from you:

Legitimate interests: it is in our legitimate interests to run our grant scheme efficiently, prevent fraud, keep records of our decisions, manage repeat applications, make helpful referrals, carry out proportionate follow-up, and take proportionate protective steps where safeguarding concerns arise.
Legal obligation: we are required by law to keep certain records, for example for accounting and charity law purposes.
Health information (special category data): sometimes you may choose to tell us about your health or disability so we can understand your circumstances and assess your application. We will usually only use this health information if you give us your explicit permission. If you do, we will use it to assess your application, to administer any grant that is approved, and to refer you other organisations that may be able to help you (such as St Albans Citizens Advice or other local support providers). In limited safeguarding situations, however, we may also use or share relevant special category data without consent where this is necessary and proportionate to protect an individual from neglect or physical, mental or emotional harm, or to protect their physical, mental or emotional well-being, and where the law allows us to do so.
Vital interests: in a genuine emergency, we may process personal information where this is necessary to protect someone’s life.

Who we share your information with

We may share your information with:

Staff, seconded from Health & Independent Living Support, who help us receive, organise and process applications and support trustee decision-making so we can assess eligibility and administer grants, under our instructions.
Independent contractors who help us receive, organise and process applications and support trustee decision-making so we can assess eligibility and administer grants, under our instructions.
Trustees and other authorised Trust personnel, including administrative or governance support contractors, where they need the information to assess applications, make decisions, administer grants, manage the Trust, or meet legal, regulatory and governance obligations.
Suppliers involved in delivering an approved grant (for example, a retailer or installer), so they can deliver the item or service you have been granted. We only share what they need to deliver the item or service (eg your name, address, contact details, and delivery requirements). Where necessary, and where you have provided explicit consent, we may share relevant health or disability details with suppliers (eg to assess suitability of beds and mobility equipment).
IT service providers, so we can securely store and manage information, operate our email and document systems, and maintain the security and resilience of our systems.
Professional advisers (eg accountants, legal advisers), so we can obtain professional advice and meet our legal, financial and governance obligations, and only where necessary and subject to confidentiality.
Regulators, law enforcement or other authorities where we are required to disclose information by law, or where disclosure is necessary to respond to a lawful request or to protect the Trust or others (eg to prevent fraud or safeguard individuals).

We may also share your name and contact details with organisations that may be able to help you (eg St Albans Citizens Advice or other local support providers) so they can contact you. We will only share what is necessary for the referral (including health or disability details where you have provided explicit consent).

Separately, we may share relevant information with Hertfordshire County Council, the police, or another appropriate safeguarding body where this is necessary, lawful and proportionate in order to protect you or another person. We will usually seek consent where this is appropriate and practicable, but we may share information without consent where a lawful safeguarding basis applies. We will only share what is necessary.

International Transfers

We don’t intentionally transfer personal information outside the UK. We do use Microsoft 365 and Intuit QuickBooks Online, which may store or allow access to information from locations outside the UK (for example, for hosting, support, and security). If personal information is transferred outside the UK and the country is not recognised as providing adequate protection, we use UK GDPR transfer safeguards (such as recognised contractual clauses) to protect it.

How long we keep your information

We keep personal information only for as long as we need it to administer grants, keep an appropriate audit trail, and meet our legal and accounting obligations as follows:

Full grant application case files (including supporting evidence and any health details you choose to provide): 3 years from the date the case is closed (grant decision).
Summary grant application information used for decision and accounting records: 7 years from the end of the relevant financial year.

Your rights

You have rights over how your personal information is used. These include the right to:

Ask for a copy of the personal information we hold about you
Ask us to correct inaccurate or incomplete information
Ask us to delete your information in some circumstances
Ask us to restrict how we use your information in some circumstances
Object to how we use your information in some circumstances (including where we rely on legitimate interests)
Ask us to transfer certain information to you or another organisation in some circumstances
Withdraw your consent (where we rely on consent)

To exercise any of these rights, please contact us by email at administration@staopt.org or write to us at the address above.

We may need to confirm your identity before we respond. If your request is unclear, we may ask you for more information so we can deal with it properly.

We normally respond within one calendar month. If your request is complex or you make multiple requests, we may take longer (up to a maximum of three months in total). If we need more time, we’ll tell you within the first month and explain why. If we need proof of identity or more information to understand your request, the time limit starts when we receive what we need.

Complaints

If you want to complain about how we have used your personal information, please email us at complaints@staopt.org or write to us at the address above.

We will acknowledge your complaint within 30 days and respond without undue delay.

If you are not satisfied with our response, you can complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, via its website.

How we keep your information safe

We use secure systems and access controls so that only people who need your information to administer grants or manage the Trust can see it.

We also have procedures for handling sensitive documents (such as bank statements) securely and for reporting any suspected data incidents.