Privacy Policy

Introduction

This policy describes how and why Tree Shepherd Limited (“Tree Shepherd”, “we”, “us”, “our”) uses your personal information, how we protect your privacy when doing so, and your rights and choices regarding that information.

We are a small charity that works with supporters, freelancers, volunteers, funders, partners and the people we support across SE16, South London and the wider capital. We use personal information on a day-to-day basis in order to operate. Our use of personal information allows us to make better decisions, run our programmes effectively, and helps us reach our goal of growing local economies that work for the whole community.

We promise to respect any of your personal information that is under our control, to keep it safe, and to be clear when we collect your information about what we will do with it.

By using our website or signing up to Tree Shepherd’s services, you acknowledge that you have read this policy and understand how we use your information. We may update this policy from time to time and will always show the latest version on our website.

This policy reflects our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and the Data (Use and Access) Act 2025 as it is brought into force.

How we collect information about you

We collect information in the following ways.

Information you provide to us directly

You may give us your information when you:

book a place at a business clinic, market stall or workspace tour

request one-to-one mentoring, business support or workspace membership

complete a contact, enquiry or feedback form on our website

subscribe to our newsletter or mailing list

make a donation or support a fundraising activity

apply for a job with us

complete an evaluation form, survey or monitoring questionnaire

Information you provide to us indirectly

Your information may be shared with us by third parties, for example:

funders, commissioners or professional funding agencies

partner organisations we deliver a programme with (such as local authorities, the Greater London Authority, developers or community organisations)

event or ticketing platforms (such as Eventbrite) where you sign up to an event, course or business clinic we run

employment agencies and referees, where you have applied for a job with us

introducers, intermediaries or credit reference agencies, where relevant to a contract.

You should check the privacy policy provided to you where you give your data to a third party.

Information from your use of our website and digital services

When you visit our website we may collect:

technical information such as IP address, device type, browser type and version

information about how you use our site, such as the pages you visit, how you arrived at the site and how long you stay

information collected by cookies and similar technologies (see Section 4 below).

If you submit an enquiry form, booking form, newsletter signup or business clinic request online, we will collect the information you enter so we can respond to you and manage your request.

Information from social media

Depending on your settings or the privacy policies for social media and messaging services like Facebook, Instagram, LinkedIn, WhatsApp or X (Twitter), you might give us permission to access information from those services. For example, when you publicly tag Tree Shepherd in an event photo, send us a direct message or comment on our posts.

Information available publicly

We may supplement information we hold about funders, partners or businesses with information from publicly available sources such as:

annual reports and accounts

Companies House

the Charity Commission

public professional profiles or public social media accounts.

This helps us understand someone’s interests and relationship with Tree Shepherd and to meet due-diligence requirements set by funders.

Who we collect information about

We may collect and hold information about:

people who attend our courses, mentoring sessions, business clinics, markets or other events

workspace members and market traders

people receiving business advice or other support from us

people who book or use our meeting rooms, makerspace or workspaces

volunteers and mentors

trainers, freelancers and contractors

job applicants, employees and former employees

trustees

suppliers and professional advisers

funders, commissioners and partner organisations

people who contact us with enquiries, feedback or complaints

people who sign up to hear more about our work via email or other channels.

Cookies and similar technologies

Our website uses cookies and similar technologies. A cookie is a small text file stored on your device when you visit a website.

We use the following categories of cookies:

Strictly necessary cookies — required for the site to function (for example, to remember items in a booking form). These do not require your consent.

Analytics cookies — help us understand how visitors use the site so we can improve it. We will only set these where you have given consent.

Functional cookies — remember your preferences (such as language or accessibility settings).

When you first visit our site you will see a cookie banner that lets you accept, reject or manage non-essential cookies. You can change your choice at any time via the “Cookie settings” link in the footer. You can also control cookies through your browser settings; however, blocking some cookies may affect how the site works.

We do not use cookies to build advertising profiles of you or to share your information with advertising networks.

What personal information we collect

The personal information we collect depends on how you interact with us, but may include:

name and title

contact details (postal address, email address, telephone number and/or social media handle)

date of birth and age

gender

nationality and ethnicity (where requested for monitoring)

information about disability, health, learning difficulties or access needs (for example so we can make reasonable adjustments at courses, mentoring sessions or events)

religious or other beliefs (only where relevant to a specific programme or monitoring requirement)

family information such as number and age of children where this is relevant to childcare or programme design

education and training history

employment status and employment history

right-to-work documentation (for job applicants, employees, volunteers and contractors where required)

financial details relevant to our programmes (e.g. approximate household income, benefit status or business turnover where required by funders)

information about your business (type of business, trading activities, business registration details)

proof of business registration (e.g. HMRC registration number, company number)

engagement information such as which courses, events, markets or mentoring sessions you have attended

information about your progress in relation to the support we provide (for example, changes in confidence, trading status, income or business plans)

feedback you provide through surveys, evaluations or emails

bank details where we need to make or receive a payment

next-of-kin or emergency contact details (for volunteers, employees and, where relevant, programme participants)

driving licence details (where relevant to a role)

CCTV footage and building access records at our premises

references and information about previous experience (for volunteers, contractors and job applicants)

records of communications with us (emails, notes of phone calls, meeting notes, messages).

Special category data

Certain types of personal information are treated as “special category” data under UK data protection law because they are more sensitive. Examples include information about:

health and disability (including learning difficulties/disabilities)

racial or ethnic origin

religious or philosophical beliefs

sexual orientation

trade union membership

genetic and biometric data.

We only collect this type of information where there is a clear reason for doing so – for example to:

make reasonable adjustments so you can take part in a programme or event

meet equality and diversity monitoring requirements set by funders

understand who our services are reaching and whether there are gaps.

Where possible, we use this information in an anonymised or aggregated way for monitoring, so individual people are not identified in published reports. We will explain why we are collecting this information and how it will be used at the point we ask for it. Where we rely on your consent to process special category data, you can withdraw that consent at any time.

Criminal convictions data

We will only collect information about criminal convictions or offences where it is appropriate given the nature of a role (for example, certain mentoring, volunteering or employed roles where a DBS check is required) and where the law permits us to do so. Where we collect this data we will tell you why and what lawful basis we are relying on.

Children’s data

Our services and website are not directed at children under 13. Where a programme involves anyone under 18 (for example a family-focused enterprise activity), we collect only the minimum data needed, ask a parent or guardian to consent where appropriate, and apply additional safeguards in line with the ICO’s Age Appropriate Design Code.

How we use your information

We use your information so that we can carry out our work as a charity and provide services to you. Depending on how you interact with us, we may use your information to:

provide you with the services, products or information you have requested

respond to enquiries submitted through our website contact form

manage bookings for meeting rooms, makerspace, workspaces and market stalls

administer your membership of our workspaces or markets

administer payments to or from you, including processing Gift Aid on donations

send our newsletter and other marketing communications where you have signed up (see Section 7)

keep a record of your relationship and engagement with us

respond to enquiries, requests, feedback or complaints

understand how we can improve our services by analysing engagement and outcomes

report on project outcomes and achievements to relevant funders and commissioners (often using anonymised or aggregated data)

generate internal reports on our work, services and events

process funding bids and demonstrate the need for, and results of, our work

safeguard our staff, volunteers and the people we work with

conduct due diligence and ethical screening where required by funders or regulators

process applications for jobs, volunteering, mentoring and contractor roles

carry out training and quality monitoring (for example reviewing anonymised case notes or survey responses)

audit and administer our accounts and meet our legal obligations (for example to HMRC, the Charity Commission or Companies House)

detect and prevent fraud or other misuse of our services

establish, exercise or defend legal claims.

Information, advice and guidance services

Where we provide information, advice and guidance, enterprise support or one-to-one mentoring:

advisers may receive personal information about you when you speak to them, email them, meet them in person or contact them via social media

advisers will use this information to answer your questions and support you

information may be recorded for training, quality monitoring and evaluation and stored securely.

Information you provide in these settings will not be used for marketing unless you have explicitly agreed to this, and it will not be shared with others unless you give permission or we are required to do so by law.

How we use your information to tell you about our work

We would like to keep you up to date with our work and with opportunities that may be relevant to you. Our communications may include:

updates on Tree Shepherd’s work in SE16, South London and across the capital

invitations to courses, workshops, business clinics, markets and networking events

information, advice and guidance relevant to starting or growing a business

workspace availability and market stall opportunities

funding, tender or trading opportunities that may interest you

stories and case studies from people and businesses we work with

opportunities to take part in research, surveys or consultations

information about how you can support Tree Shepherd.

We operate an opt-in approach to marketing. This means we will normally only send you marketing communications where you have explicitly told us we can – for example by ticking a consent box on our newsletter signup or booking form. We use a third-party email platform (Mailchimp) to send our newsletter and Eventbrite to manage event and business clinic bookings; both are data processors acting on our behalf. You can unsubscribe from marketing at any time via the link in any marketing email or by contacting us using the details in Section 16.

If you tell us you do not wish to receive marketing communications, we may still need to contact you for administrative or service-related reasons, for example to:

confirm a booking or change to an event, business clinic or course you are attending

update you about a workspace membership, market booking or mentoring relationship

respond to a question, complaint or safeguarding concern.

Legal basis for processing

Data protection law requires us to have a legal basis for each way we use personal information. Depending on the context, we rely on the following legal bases.

Consent

We rely on consent when we:

send you marketing communications by email, text or other electronic means

collect certain types of special category data (for example where not required by law or funder conditions)

set non-essential cookies on our website.

Where we rely on consent, you can withdraw it at any time.

Legal obligation

We use your information where we need to do so to comply with a legal or regulatory obligation, for example:

reporting to HMRC, the Charity Commission, Companies House or other regulators

evidence required for audit or statutory record-keeping

responding to lawful requests from the police or other authorities

right-to-work and safeguarding checks.

Performance of a contract, or to take steps at your request

We use your information where this is necessary to:

enter into or perform a contract with you (for example a workspace licence, stallholder agreement, contractor agreement or employment contract)

process your application to work or volunteer with us

provide services that you have signed up for under our terms and conditions.

Vital interests

In rare cases we may need to use your information to protect your life or someone else’s – for example, passing details to emergency services in a crisis, or responding to a serious safeguarding concern.

Legitimate interests

We use your information where it is reasonably necessary to achieve our legitimate interests as a charity and these are not overridden by your rights and interests. Our legitimate interests include:

delivering and improving our programmes and services

understanding who uses our services and how effective they are

maintaining accurate records of engagement and outcomes

keeping in touch with people who have taken part in our work so we can understand longer-term impact

managing our relationships with partners, funders, trainers and suppliers

ensuring network and information security

preventing fraud and misuse of our services.

We will always consider any potential impact on you and your rights before relying on legitimate interests. Where we need to process special category data we will also ensure an additional condition under data protection law is met (for example explicit consent, substantial public interest or monitoring equality of opportunity).

Automated decision-making

We do not use your personal information to make decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects on you. If this ever changes, we will update this policy and tell you in advance.

How we keep your information safe

We take the security of your information seriously. We use appropriate technical and organisational measures to protect personal information from unauthorised access, unlawful processing, accidental loss, destruction or damage. These include:

storing digital records on secure systems with access limited to staff and contractors who need it

using strong passwords, multi-factor authentication and regular security updates

encrypting devices where appropriate

secure storage and disposal of paper records

staff and volunteer training on data protection and confidentiality

working with trusted IT and platform suppliers who meet appropriate security standards.

Where we use third-party platforms (for example for surveys, event bookings, newsletters, payments or file storage) we choose providers who meet appropriate data protection and security standards, and we put written data processing agreements in place with them.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it, and notify you directly where the law requires us to do so.

How long we keep your information

We keep your information only for as long as we need it for the purposes described in this policy, including meeting any legal, accounting or reporting requirements. We review our retention schedules regularly.

In general:

records linked to funded learning or skills programmes are kept for up to 6 years after the end of the financial year in which the provision concludes, in line with common education and skills funding requirements

records linked to other programmes or projects are normally kept for up to 6 years after the end of the project, unless a funder requires a longer period

sensitive monitoring information (such as ethnicity or disability) is normally kept for 3 years from the point of your most recent engagement with us, after which we will seek your consent to keep basic contact information for a further period; otherwise the information is anonymised or deleted

job application information is kept for 6 months after the end of the recruitment process where we have not asked for, or you have not given, consent to keep it for future vacancies; where you have consented, we keep it for up to 9 months before deletion

if your job application is successful, your data becomes part of your personnel file and is governed by our employee privacy notice

volunteer and contractor records are kept for the duration of the engagement and for a defined period afterwards in line with our retention schedule

financial and tax records are kept for at least 6 years as required by HMRC

CCTV footage from our premises is kept for a short period (normally no more than 30 days) unless required for an investigation.

When information is no longer needed we will delete it securely or anonymise it so that it can no longer be linked to an identifiable person.

Sharing your information with otherorganisations

We will never sell or rent your personal information to third parties for marketing purposes.

We may share your information with trusted third parties where this is necessary for the purposes set out in this policy, for example:

funders and commissioners such as local authorities (including Southwark, Lambeth and other London boroughs), the Greater London Authority or charitable foundations, where this is required by a funding agreement

partner organisations we are working with to deliver a programme, event or service

independent trainers, mentors or contractors delivering services on our behalf

IT and platform providers who host our website, CRM, email and booking systems (including, currently, Mailchimp for email marketing and Eventbrite for event and business clinic bookings)

professional advisers such as accountants, auditors, lawyers and IT consultants

payment processors and banks to process payments or refunds

regulators, government bodies and law-enforcement agencies where we are required to do so

prospective employers or reference requesters, where you have asked us to provide a reference

a third party that acquires substantially all of Tree Shepherd’s assets or activities, as part of that transfer.

Where we share information with funders or commissioners, this will often be in anonymised or aggregated form. Where identifiable information is required (for example for audit, compliance or evidence) this will be clearly explained on your enrolment or consent form.

We have written data processing agreements in place with our key suppliers, and we require them to apply appropriate technical and organisational measures to protect your information.

International transfers

Our suppliers are normally based in the UK or European Economic Area (EEA). If we ever need to transfer your personal data outside the UK or EEA, we will make sure that appropriate safeguards are in place, such as an adequacy decision (including the UK–US Data Bridge where applicable), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

Keeping your information up to date

We want to make sure that the information we hold about you is accurate and up to date. If your contact details or circumstances change, please let us know using the contact details in Section 16.

Where appropriate, and where we are confident you have been informed about this, we may use external sources such as change-of-address databases to update your contact details so we can stay in touch and avoid duplicate records. You can opt out of this at any time.

You can ask us at any time to correct information we hold about you that you believe is inaccurate or incomplete.

Your rights

Under UK data protection law you have a number of rights in relation to your personal information. These include the right to:

be informed about how we use your data (which is what this policy explains)

access a copy of the personal information we hold about you (a “subject access request”)

rectification – ask us to correct inaccurate or incomplete information

erasure – ask us to delete your information in certain circumstances

restrict processing – ask us to limit how we use your information in certain circumstances

object to our use of your information where we are relying on legitimate interests, or to direct marketing at any time

data portability – obtain and reuse your personal data across different services, where certain conditions are met

withdraw consent at any time where we rely on consent

not be subject to decisions based solely on automated processing that significantly affect you.

These rights do not apply in every situation. For example, we may need to keep certain information to comply with the law or where we have a strong legitimate interest that overrides your request.

To exercise any of these rights, please contact us using the details in Section 16. We may need to confirm your identity before responding. We will respond to all valid requests within one month, although we may extend this by a further two months for complex requests, in which case we will tell you why. There is normally no fee for exercising your rights.

Complaints

If you are unhappy with how we have used your personal information, please contact us first using the details in Section 16 so we can try to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK data protection regulator:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk

Contact us

If you have any questions, comments or concerns about this policy or how we use your personal information, please contact:

Tree Shepherd
1A Greenleaf Close
Tulse Hill
London SW2 2HB

Email: info@treeshepherd.org.uk
Phone: 020 3948 3020

If you prefer, you can also contact our data protection lead at the same address, marking your communication “FAO: Data Protection”.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our activities or in data protection law. When we make significant changes we will update the “Last updated” date at the top of this page and, where appropriate, may notify you directly (for example by email or via our website).