The Rivers Trust (referred to as we, us or our in this Privacy Notice), administers the Catchment Based Approach (CaBA) ESRI hub sites (also referred to as the Project in this Privacy Notice) and as such are responsible for this privacy notice.
CaBA ESRI hub sites are websites which allow collective action by CaBA partners to improve the water security of river catchments.
To help us manage our relationship with you through the Project, we may need to collect, store and use information that can be used to identify you. From a legal point of view, this is known as ‘processing personal information’.
Collecting and processing your personal information is necessary if we are to satisfy the expectations and requirements of our users, e.g. by communicating with you and providing you with an interactive service through the Project.
This Privacy Notice will explain:
Our aim is to respect your privacy and comply with current UK data protection legislation (i.e. EU General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA)). References in this Privacy Notice are made to GDPR, but you should note that GDPR and DPA both apply in the UK.
Who we are?
The Rivers Trust is the umbrella organisation for over 60 local member Trusts, we are the only group of environmental charities in the UK and Ireland, dedicated to protecting and improving river environments for the benefit of people and wildlife.
The Rivers Trust is registered in England & Wales as a company limited by guarantee (Company Registration No: 05136671) and as a charity (Registered Charity No: 1107144).
The Rivers Trust’s registered office is:
Kyl Cober Parc
Telephone: +44 (0)1579 372142
The Rivers Trust takes the privacy of CaBA ESRI hub sites very seriously and is committed to protecting your privacy online. All reasonable endeavours have been used to make sure that the content and accuracy of the CaBA ESRI hub sites are consistent with normally accepted standards and practices.
We aim to safeguard our users’ privacy whilst provide a personalised and valuable service. Collecting personal information is necessary if we are to satisfy the expectations and requirements of our users, e.g. by communicating with them and providing an interactive service.
Transmitting information over the internet is generally not completely secure, and we can’t always guarantee the security of your data. Where possible, we have procedures and security features in place to try and keep your data secure once we receive it, but any data you transmit is at your own risk.
Who does this Privacy Notice apply to?
This Privacy Notice relates to the collection and use of the personal information of individuals, sole traders and individuals in non-limited business partnerships. Although data about larger commercial entities is not considered ‘personal’ information (and therefore not captured by GDPR), where we can identify an individual acting in their professional capacity, either directly or indirectly, the legislation will apply.
For example, if we have the name and number of a business contact on file, or their email address identifies them (e.g. firstname.lastname@example.org), GDPR is relevant.
It is intended that this Privacy Notice covers the following.
What is Personal Information?
Personal information is anything that identifies and relates to a living person. This can include information that, when put together with other information, can then identify a person, for example, your name and contact details.
How do we collect personal data?
We collect personal information in a number of ways and circumstances:
What personal information do we collect and what do we do with it?
The personal information we process may include:
Who we share your personal information with and why?
Our CaBA ESRI hub sites offer you the facility to upload your data and make it available via public facing websites or in some cases to a restricted group of project partners. Where you are uploading data that will be made available, we will make this clear in the forms and provide a mechanism for you to manage and remove your own data.
We work with a number of organisations to manage CaBA ESRI hub sites, and need to share some of your personal data with these parties:
Where we share data with third parties, there will be a legal agreement in place to make sure the organisation complies with applicable data protection legislation.
Who sees or has access to your personal data will depend on why we need to process it, but the organisations we share with may include the following:
Our lawful basis for processing personal data
GDPR states that a data controller (like The Rivers Trust) must have a lawful basis for processing your information. We have identified the lawful bases for which we process your information listed in the Privacy Notice as follows:
|Data collection activity||Lawful basis|
|Attendees to the Project events and activities||Legitimate Interest|
Consent, as a lawful basis for processing your personal data means that you have given us your explicit consent by either signing a Consent Form or freely giving us your personal data. Giving us your Consent means you are in charge of what information you give us and what we can do with that information.
Contract, as a lawful basis for processing your personal data means, our processing is necessary for the performance of or to enable us to enter into a contract to which you are a party. We must retain the data (even when a contract is not awarded) as we are required to do so as evidence for the Project’s Audit Authorities. This must be retained for 7 years after the end date of the project.
Legitimate Interest, as a lawful basis for processing your personal data means, we process your data to satisfy our own interests and the interests of a third party, in this case the Project’s funders and audit authorities. This data must be retained for 7 years after the end date of the project.
Protecting your personal information
We are committed to ensuring that your personal information is secure. In order to prevent unauthorised access or disclosure, The Rivers Trust has put in place appropriate technical, physical and organisational procedures to safeguard and secure the information we collect about you.
Where is your personal information processed?
All of The Rivers Trust’s offices and staff are based in the United Kingdom of Great Britain and Northern Ireland.
Occasionally, we may use other suppliers or service providers (e.g. MailChimp®) that normally operates elsewhere in the UK, the Republic of Ireland or further afield (e.g. the wider EU or the USA).
We will not transfer or process your personal data outside the European Economic Area (EEA), unless we have your specific consent or the nature of the processing requires it (for example, because you have chosen to use a service, such as signing up to our project newsletter, that routes data outside the EEA). All processors of personal information relating to EU citizens are required to comply with GDPR.
In this Project we work with other partners organisations based in the UK and in the Republic of Ireland. Information on the Project’s partner organisations can be found here.
How we process your personal information
The Rivers Trust will process the personal information you provide in a manner that complies with current UK data protection legislation.
We will endeavour to:
Personal information that you supply to us may be used in a number of ways. For example, if you have attended an activity or event we have delivered as part of the Project, we need to keep your name and address so we can keep you up-to-date with future events but also to prove attendance to the events to the Project auditors.
What to expect when you contact us in relation to the Project
When you contact us by telephone to, either +44 (0)7948 354026 or +44 (0)7948 354027 you are contacting The Rivers Trust directly. We will only add your telephone number to our database if you give explicit consent for us to do so, so that we can contact you in future in relation to the project. The information is used solely for project information purposes. We do not record calls from customers.
If you email us, we will respond to you using the email address you give us. We may add your email address to our contact database, but only if you give explicit consent for us to do so, so that we can contact you in future in relation to the project. The information is used solely for project information purposes.
Contacting us via social media:
We strongly advise not posting your personal contact or other sensitive information on a public social media site. If you contact us using social media, we will ask you to private message us to gather suitable information. We will suggest an alternative contact method if we think this is more appropriate.
The Rivers Trust only uses the information you provide in connection with a job application and will not disclose your information or use it for any other purpose. All the information we collect is stored securely on a centralised database. .
Your rights as data subject
You have lots of privacy rights. The following explains what your rights are:
You can tell any of the Partners that you want to exercise any of your available rights, and they will promptly pass that request to The Rivers Trust (as controller).
The authority responsible for overseeing data protection matters in the UK and Northern Ireland is the Information Commissioner’s Office (ICO). To learn more about all these rights, please see the ICO’s website:
Please be aware that there may be circumstances when we are unable to comply with your request to exercise your rights. If this is ever the case, we will inform you of the reason and provide details of how you can register a complaint with the relevant authority responsible for data protection in your jurisdiction if you believe we have got this wrong. However, complaints can often be dealt with satisfactorily without the involvement of any authorities, so please let us know if you have any such complaints in the first instance.
Changes to this Privacy Notice
We may update the Privacy Notice from time to time – please ensure you visit the CaBA website for the latest version: https://catchmentbasedapproach.org/caba-hubs-privacy-policy