top of page

Privacy Policy

Iceni Partnership is committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains how we collect, use, store and share personal information when you use our website, contact us, use our services, hire our facilities, volunteer with us, or otherwise interact with Iceni Partnership.

This policy should be read alongside our Data Protection Policy, which sets out our wider approach to data protection across the organisation.

1. Who we are

Iceni Partnership is the data controller responsible for personal information processed by the organisation.

Iceni Partnership
Swaffham Community Centre
The Campingland
Swaffham
Norfolk
PE37 7RB

Company No: 4257830
Charity No: 1101814
VAT No: GB800057775

Telephone: 01760 722800
Email: enquiries@iceni.info

Our Data Protection Officer is responsible for overseeing data protection, managing data protection requests and responding to data breaches. Our Data Protection Policy was last updated in June 2026 and is reviewed annually. 2026 Data Protection Policy 2026 Data Protection Policy

2. What personal information do we collect?

Depending on how you interact with Iceni Partnership, we may collect and process information such as:

  • Your name

  • Address

  • Telephone number

  • Email address

  • Date of birth or age

  • Financial information

  • Employment or volunteer information

  • Education information

  • Safeguarding information

  • Benefits or welfare information

  • Photographs and CCTV images

  • Identification documents, where necessary

  • Login details

  • IP addresses and other digital information

  • Other information necessary to provide our services or manage our relationship with you

We will only collect information that is necessary for the particular purpose for which it is being used. 2026 Data Protection Policy

In some circumstances, we may process special category data, such as information relating to health or disability, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, or sex life or sexual orientation. Where this information is processed, it will be handled with additional care and in accordance with applicable data protection requirements. 2026 Data Protection Policy

3. How do we use your information?

We may use personal information where necessary to:

  • Provide services to you

  • Respond to enquiries

  • Manage room and facility hire

  • Manage contracts and agreements

  • Communicate with service users, hirers, volunteers and partners

  • Manage volunteering and employment

  • Meet safeguarding responsibilities

  • Meet legal and regulatory obligations

  • Maintain the security of our premises and people

  • Operate CCTV

  • Administer our organisation and projects

  • Communicate information about services and activities where permitted

  • Manage financial and administrative records

  • Meet the requirements of funders and public bodies

  • Protect individuals in emergency situations

We will only use your information for specific and legitimate purposes and will not collect more information than is necessary. 2026 Data Protection Policy

4. Our lawful bases for processing

Depending on the circumstances, we may process your personal information on one or more of the following lawful bases:

  • Consent – where you have given us permission to use your information for a specific purpose.

  • Contract – where processing is necessary to enter into or fulfil an agreement with you, such as a room hire agreement.

  • Legal obligation – where we are required to process information to comply with the law, including safeguarding, financial and health and safety requirements.

  • Vital interests – where processing is necessary to protect someone's life or prevent serious harm, such as emergency contact information.

  • Public task – where we are commissioned to provide a public service.

  • Legitimate interests – where processing is necessary for our legitimate organisational purposes, such as maintaining security through CCTV, provided those interests do not override your rights. 2026 Data Protection Policy

5. Who do we share information with?

We will only share personal information where there is a lawful and necessary reason to do so.

Depending on the circumstances, information may be shared with:

  • Local authorities

  • Police and emergency services where required

  • Safeguarding partners

  • Contractors providing IT, building or other services

  • Relevant organisations involved in delivering services on our behalf

  • Funders, where appropriate and in accordance with our obligations

Where information is provided to funders, this may be provided in an anonymised form where appropriate.

We will never sell your personal information to third parties. 2026 Data Protection Policy

6. How do we keep your information secure?

We take appropriate measures to protect personal information against unauthorised access, loss, accidental destruction, alteration or disclosure.

Our organisation uses:

  • Microsoft 365 for email, SharePoint and OneDrive

  • Microsoft SharePoint as a primary document repository

  • Role-based access controls

  • Locked storage for paper records

  • Restricted access to CCTV systems

Access to personal information is limited to people who need it for their role. 2026 Data Protection Policy

7. How long do we keep your information?

We do not keep personal information for longer than is necessary.

Iceni Partnership maintains a Record Retention Schedule, which sets out how long different types of records should be retained before they are securely disposed of. 2026 Data Protection Policy

When information is no longer required:

  • Paper records are securely destroyed using cross-cut shredding.

  • Digital records are deleted from relevant systems, including recycling bins, where appropriate.

  • Automated deletion processes may be used where practicable. 2026 Data Protection Policy

8. Your rights

Under UK data protection legislation, you may have the right to:

  • Ask us for a copy of the personal information we hold about you

  • Ask us to correct inaccurate or incomplete information

  • Request deletion of your personal information where there is no lawful reason for us to continue processing it

  • Ask us to restrict how we process your information

  • Object to certain processing

  • Request data portability in applicable circumstances

  • Withdraw consent where we rely on consent to process your information

You can make a data protection request in writing, by email or verbally.

Our Data Protection Policy states that requests should be acknowledged within 5 working days and completed within one month, subject to applicable legal requirements and any permitted extensions. 2026 Data Protection Policy

To exercise your rights, please contact:

Data Protection Officer
Iceni Partnership
Swaffham Community Centre
The Campingland
Swaffham
Norfolk
PE37 7RB

Email: [CONFIRM DPO EMAIL ADDRESS]

9. Website information and cookies

When you use our website, certain technical information may be collected automatically, such as your IP address and other digital information.

Our Data Protection Policy recognises IP addresses and other digital information as personal data where they relate to an identifiable individual. 2026 Data Protection Policy

Cookies:
Our website may use cookies or similar technologies. Information about the specific cookies used by our website, their purposes and how you can manage them should be provided in our website's cookie notice/cookie settings.

Important: I have deliberately not listed specific cookies here because your Data Protection Policy does not identify which cookies your Wix website currently uses. That should be checked in Wix before publishing this section.

10. Photographs and CCTV

We may use photographs and CCTV images as part of our activities and for security purposes.

CCTV is stored securely with restricted access. 2026 Data Protection Policy

Where photographs are used for publicity, communications or other purposes, we will handle them in accordance with applicable data protection requirements.

11. What happens if there is a data breach?

We take data breaches seriously.

A data breach can include personal information being:

  • Accessed by someone who should not have access

  • Lost

  • Accidentally destroyed

  • Altered without permission

  • Damaged

  • Disclosed to an unauthorised person

Where a breach occurs, we will assess the risk to affected individuals and take appropriate steps to contain and investigate it.

Where required, the Information Commissioner's Office (ICO) will be notified within the applicable timeframe, including within 72 hours where the breach presents a risk to individuals' rights and freedoms. Affected individuals will also be informed where required. 2026 Data Protection Policy

12. Complaints about how we use your information

If you have concerns about how Iceni Partnership has handled your personal information, please contact our Data Protection Officer in the first instance.

You also have the right to raise a concern with the Information Commissioner's Office (ICO).

Information Commissioner's Office (ICO)

bottom of page