Data Protection and Privacy Policy
Benefact Trust is committed to the privacy and confidentiality of information that you provide to us. This privacy notice describes our current policies and practices with regard to personal information collected and used by us. Please take your time to read this notice carefully. When using our website, this notice should be read alongside the website terms of use.
1. About us
2. Our processing of your personal information
2.1 Grant Applications
2.2 Users of our Website
2.3 Physical Visitors to our Sites
3. How will we use your personal data for marketing?
4. Automated Decision-Making, Profiling & Use of Artificial Intelligence (Ai)
5. How long do we keep your personal information for?
6. What is our approach to sending your personal information overseas?
7. How do we protect your personal information?
8. Your rights
9. Contacting us
10. Updates to this Notice
1. About us
Benefact Trust Limited ("we", "us", "our") is a registered independent charity and one of the UK's largest grant-making Trusts. We grant funds to support the repair, restoration and wider community use of churches and cathedrals of all denominations and we support charities. Our funds come from our ownership of the Benefact Group, and we are the parent company of the Ecclesiastical group of companies.
In providing grants, we need to collect and process data so that we can review your application for a grant and to administer funding for any successful grants. This makes us a "data controller".
If you are unsure about who the data controller of your personal information is, you can also contact us at any time by e-mailing our Group Data Protection Team at dataprotection@benefactgroup.com or by writing to Data Protection Officer at Benefact Trust Limited, Benefact House, 2000, Pioneer Avenue, Gloucester Business Park, Brockworth, Gloucester, GL3 4AW, United Kingdom.
Depending on our relationship with you (for example if you enquire about a grant or if you are a recipient of an existing grant with us or whether you are a user of our website) we will collect different types of personal information about you and use it for different purposes set out in Sections 2.1 – 2.3 below.
Where you provide personal information to us about other individuals, we will also be data controller of and responsible for their personal information. You should refer them to this notice.
2. Our processing of your personal information
2.1 Grant Applications
This section is applicable to you if you have contacted us to enquire about the grants we offer, you have submitted a grant application and if you have or conversely have not been successful in an application.
2.1.1 What personal information will we collect?
Your name and title, address, telephone numbers and email addresses
Information which is related to your enquiry/application such as your position, the organisation you work for and circumstances behind a grant application
Additional information (such as your image) which may be used in our marketing material about your successful grant award.
2.1.2 What sensitive personal information will we collect?
We may also collect information because it is relevant to your enquiry, which reveals or is likely to reveal your religious or philosophical beliefs, for example you are a member of an Anglican Church and are enquiring about grants for your Church.
2.1.3 How will we collect your personal information?
Directly from you:
when you have approached us because you are enquiring about a grant;
when you have submitted a grant application
during any communications we have, such as by telephone or email.
2.1.4 What will we use your personal information for?
We use your information as part of our overall grants programme. For every use, we must be able to demonstrate a purpose and a "lawful basis" to support that purpose. When using your "personal information", we will rely on the "lawful basis" set out in Section 2.1.5 below.
2.1.5 What are lawful bases do we use to process your personal information?
What is the purpose for using your personal information? | Lawful basis for using your personal information | Lawful basis/Condition for using your sensitive personal information |
|---|---|---|
Administering our charitable funds; assessing eligibility; preventing fraud and misuse of funds; ensuring proper stewardship of charitable assets; and measuring impact. | • We rely upon legitimate interest as a lawful basis. • We rely upon performance of a contract as a lawful basis i.e. the terms and conditions you agree to when applying for a grant. | • You have made this information public knowledge. |
Promoting our charitable activities across the public domain | • We rely upon legitimate interest as a lawful basis. • We rely upon performance of a contract as a lawful basis i.e. the terms and conditions you agree to when applying for a grant. | • You have made this information public knowledge. |
2.1.6 Who will we share your personal information with?
Your personal information relating to your grant application is shared internally as part of the grant management process – for example our finance department in order to make payment to your organisation.
Additionally, we will share elements of your personal information should we publish promotional material across our websites and other public platforms.
2.2 Users of the Benefact Trust website
If you use or access the Benefact Trust website, this section will be applicable to you and will provide key information about how we use your personal information.
2.2.1 What personal information will we collect?
Information collected automatically through cookies and similar technologies, including information about your device, browser, website usage, preferences, and online interactions – please refer to our Cookie Policy here.
2.2.2 How will we collect your personal information?
We collect your information directly from our website and where you have submitted any information on our website.
2.2.3 What will we use your personal information for?
We use your information in as part of our overall grants programme. For every use, we must be able to demonstrate a purpose and that there is a "lawful basis" to support that purpose. When using your "personal information", we will rely on the "lawful basis" set out in Section 2.1.5 below.
2.2.4 What are lawful bases do we use to process your personal information?
What is the purpose for using your personal information? | Legal grounds for using your personal information | Legal grounds for using your sensitive personal information |
|---|---|---|
To provide you with access to the services or information you have requested. | • We rely upon legitimate interest as a lawful basis. • We have your consent. | • We have your consent. |
To respond to any enquiries or complaints you make, and to generally communicate with you. | • We rely upon legal obligation as a lawful basis. • We rely upon legitimate interest as a lawful basis. | • Establishing, exercising, or defending legal rights. • Compliance with legal and regulatory obligations. |
To comply with legal or regulatory obligations including, for example, responding to personal data breaches or requests relating to your data protection rights. | • We rely upon legal obligation as a lawful basis. • We rely upon legitimate interest as a lawful basis. | • Establishing, exercising, or defending legal rights. • Compliance with legal and regulatory obligations. |
For business purposes such as systems development, migration of systems, diagnosing any problems with our servers and website, improving our business, performing internal audits, analysing usage of our services and products. | • We rely upon legitimate interest as a lawful basis. |
|
To contact you to inform you about products and services we think you might be interested in. | • We rely upon legitimate interest as a lawful basis. • We have your consent. | • We have your consent. |
2.2.5 Who will we share your personal information with?
We do not share or distribute your personal information other than to the following third parties and only under the limited circumstances we have set out above:
Other companies in the Benefact Group.
Service providers we have contracted with relating to the website such as our subcontractors and agents and website providers.
2.3 Physical Visitors to our Sites
This section is applicable to you if you have reason to visit any of our physical sites or office locations through the course of our business with you.
2.3.1 What personal information will we collect?
Your name and title, telephone numbers and email address
Your vehicle details
Your image through security camera footage.
2.3.2 What sensitive personal information will we collect?
We may collect information relating to any disability you may have so that we are able to make necessary adjustments or review accessibility arrangements for your visit.
2.3.3 How will we collect your personal information?
Information may be collected by your Benefact Trust visit sponsor ahead of your visit to our Site. In some limited cases your personal information may be collected directly from your through our automated visitor management systems.
2.3.4 What will we use your personal information for?
We use your information in as part of our effective building & site management process. For every use, we must be able to demonstrate that there is a "lawful basis" to do so. When using your "personal information", we will rely on the "lawful basis" set out in Section 2.1.5 below.
2.3.5 What are lawful bases do we use to process your personal information?
What is the purpose for using your personal information? | Lawful basis for using your personal information | Lawful basis/Condition for using your sensitive personal information |
|---|---|---|
To provide a safe a secure environment of our physical sites and offices for visitors. | • We rely upon legal obligation as a lawful basis under the Health & Safety at Work Act 1974 & the Workplace Regulations 1992 • We rely upon legitimate interest as a lawful basis to deploy security cameras in order to maintain a safe and secure environment protecting our people, physical assets, confidential information, and business operations. | • We rely upon your explicit consent based upon you notifying us of any disability you have in order for us to make necessary adjustments. |
2.3.6 Who will we share your personal information with?
Information regarding your visit will only be shared with internal front of house staff and our visitor management systems.
3. How will we use your personal data for marketing?
Our outbound marketing includes our website, e-Newsletter, Christmas card, Benefact Trust activity updates, social media, and hosting special interest group meetings to which we may invite you if we think they are of interest to you.
We may use your personal information to provide you with information about our services which may be of interest to you where you are an existing contact or where you have provided your consent for us to do so.
We are committed to only sending you marketing communications that you have clearly expressed an interest in receiving. If you no longer wish to receive information from us and want to be removed from our standard mailing list, you can "unsubscribe" by clicking the link that appears in all emails or post by contacting using the details set out in section 9.
Please note that, even if you opt out of receiving marketing messages, we may still send you communications which are relevant to any grant application you have made or grant you have received.
4. Automated Decision-Making & Use of Artificial Intelligence (AI)
We do not carry out any automated decision-making or profiling. Similarly, we are not leveraging any AI or machine learning (ML) technology on the processing activities we undertake. Any changes to this will be reflected in future updates to this notice.
5. How long do we keep personal information for?
We will only keep your personal information for as long as reasonably necessary to fulfil the purposes set out in section 2 above and to comply with our legal and regulatory obligations.
Information about applicants for grants are retained for seven years. Personal information is then removed but general, non-identifiable information is retained on an anonymous, aggregated basis for trend analysis and reporting.
If you would like further information about how long we will keep your personal information for, please contact us using the details set out in section 9.
6. What is our approach to sending your personal information overseas
There may be some instances where your personal information is transferred outside of the United Kingdom (UK) such as when we transfer information to our companies in the Benefact Group or to third party suppliers who are based outside the UK or when third parties who act on our behalf transfer your personal information to countries outside the UK.
Where such a transfer takes place, we will take the appropriate safeguarding measures to ensure that your personal information is adequately protected. We will do so in a number of ways including:
We will only transfer personal information to countries who have been deemed to provide an adequate level of protection for personal information. You can find out more about this here;
in the event a country is not deemed adequate we will enter into data transfer contracts and using specific contractual provisions that have been approved for use in the UK which give personal data the same protection as it has in the UK. For further details see here; or
We are also entitled under data protection laws to transfer your personal information to countries outside the United Kingdom in the following circumstances:
it is necessary for the performance of the contract we have with you; and/or
it is necessary to protect your vital interests i.e. it is a life-or-death situation.
7. How do we protect your information?
We strive to maintain the reliability, accuracy, completeness and currency of Personal Data in our databases and to protect the privacy and security of our databases. The security measures in place on our website and computer systems, aim to protect the loss, misuse or alteration of the information you provide to us. We keep your Personal Data only for as long as reasonably necessary for the purposes for which it was collected or to comply with any applicable legal or regulatory requirements.
We adopt a framework of information security controls operating at different levels within the company to restrict access and safeguard systems, in accordance with a ‘defence in depth’ methodology (which is the coordinated use of multiple security controls to protect the integrity of the information and assets in our IT network);
We have an established documented information security and data protection policy framework which is regularly reviewed to consider changes in technology, regulations and threats;
We maintain encryption technologies to encrypt data stored on portable computers and portable media, and ensure security when data is transferred;
We maintain awareness and education on information security and data protection;
We conduct risk based due diligence on our suppliers;
We operate a programme of testing the effectiveness of our information security measures.
8. Your rights
You have several data protection rights which entitle you to request information about your personal information, to dictate what we do with it or to stop us using it in certain ways.
If you wish to exercise the rights set out below, please contact us at any time using the details set out in section 9. There will not normally be a charge for this.
We respect your rights in relation to personal information we hold about you, however we cannot always comply with your requests, for example:
we may not be able to delete your information if we are required by law to keep it for a longer period of time; or
if we delete your information we would not have the necessary information we need to assess your grant application or communicate with you in respect of a grant.
In some circumstances, complying with your request may result in your grant being suspended or your application not being considered. Please refer to the grant terms and conditions which will explain what will happen in the event that we cannot provide your grant. However, we will always inform you why we cannot comply with your request.
The right to access your personal information
You can request a copy of the personal information we hold about you and certain details of how we use it.
Your personal information will normally be provided to you in writing unless you request otherwise or where you have made a request by electronic means such as email, we will provide such information in electronic form where possible.
The right to withdraw your consent
Where we rely on consent as the legal ground to use your personal information, you are entitled to withdraw that original consent. We will inform you of these consequences when you withdraw your consent.
The right to rectification
We make reasonable efforts to keep your personal information where necessary up to date, complete and accurate. We encourage you to ensure that your personal information is accurate so please regularly let us know if you believe that the information we hold about you may be inaccurate or not complete. We will correct and amend any such personal information and notify any third-party recipients of necessary changes.
The right to restriction of processing
Subject to the circumstances in which you exercise this right, you can request that we stop using your personal information, such as where you believe that we no longer need to use your personal information.
The right to data portability
Subject to the circumstances in which you exercise this right, you can request that we port across personal information you have provided to us to a third party in a commonly used and machine-readable format.
The right to erasure
You can request that we delete your personal information. For example, where we no longer need your personal information for the original purpose we collected it for or where you have exercised your right to withdrawn consent.
Whilst we will assess every request, this request is subject to legal and regulatory requirements that we are required to comply with.
The right to object to direct marketing
You can request that we stop sending you marketing messages at any time by clicking on the "unsubscribe" button in any emails that we send to you or by contacting us using the details set out in section 9.
Rights relating to automated decision-making
We do not currently carry out any automated decision-making. In the event that this changes, we will notify you and inform you about your rights relating to automated decision-making.
The right to make a complaint
If you have concerns about how we have handled your personal information, we encourage you to contact us first by contacting us via this email to allow us the opportunity to investigate and resolve your concerns.
You also have the right to complain to the Information Commission (IC) at any time if you believe we have breached data protection law. For more information, visit the IC's website. Exercising this right does not affect any other legal rights or remedies available to you.
9. Contacting us
If you would like further information about the ways we use your personal information, further clarity on how we use your personal information or anything referred to in this notice, please contact our Data Protection Team at dataprotection@benefactgroup.com or by writing to Data Protection Officer at Benefact Trust, Benefact House, 2000, Pioneer Avenue, Gloucester Business Park, Brockworth, Gloucester, GL3 4AW, United Kingdom
10. Updates to this notice
We are continually improving our methods of communication and alongside with changes in the law and the changing nature of technology, our data practices and how we use your data will change from time to time. If and when our data practices change, we will notify you and we will provide you with the most up-to-date notice.
This notice was last updated on 5th October 2026.