Sugar Loaf CIC
Privacy policy
Sugar Loaf Regeneration Farm Partnership CIC
Last updated: 12 August 2026
This policy explains what personal information we collect, why we use it, who we share it with, how long we keep it and the rights available to you.
Who we are
Sugar Loaf Regeneration Farm Partnership CIC is a community interest company. We are the controller of the personal information described in this policy, which means we decide how and why it is used.
Company number: 16327321
Registered office: 7a Nevill Street, Abergavenny, Wales, NP7 5AA
Contact address: c/o Stump Up for Trees, Tindle House, 13 Nevill Street, Abergavenny, NP7 5AA
Email: info@sugarloaf-cic.org
Website: Sugar Loaf website
If another organisation is separately responsible for personal information used in a joint project or activity, it should provide its own privacy information where required.
Who this policy covers
This policy covers visitors to our website, people who contact us, members and prospective members, volunteers, event attendees, supporters, funders, project partners, land managers, suppliers, contractors and people who appear in our news, photographs or videos.
This policy does not apply to websites operated by other organisations, even where we link to them. Those organisations are responsible for their own privacy information.
Personal information we may collect
Contact information. Your name, email address, postal address, telephone number and preferred way to contact you.
Enquiries and correspondence. Information you include in a website form, email, letter, telephone call or other communication, together with our response and any follow-up.
Membership information. Details needed to assess and administer membership, including your connection to the project area, farm, land or organisation, and a record of your membership and participation.
Volunteering and event information. Registration and attendance details, availability, skills, interests, emergency contact information, access requirements and information needed to organise activities safely.
Project and professional information. Your role, organisation, land or project interests, meeting records, contributions, funding or supplier information and other details relevant to our work.
Photographs, video and stories. Images, recordings, comments and case studies created or supplied in connection with our work, events and community activities.
Website and device information. Internet Protocol address, browser and device type, pages viewed, approximate location, referring website, dates and times of access, security logs and cookie choices.
Special category information. We may occasionally need limited health or accessibility information to help someone take part safely. We will explain why it is needed and use an additional legal condition, such as explicit consent or vital interests, where the law requires this.
If an activity involves children, we will provide suitable privacy information and obtain parent or guardian permission where required. Please do not send us sensitive personal information unless we have asked for it and explained why it is needed.
How we collect personal information
We usually collect information directly from you when you use our website, contact us, apply for membership, register for an event, volunteer, attend a meeting, work with us or provide information for a project, story or publication.
We may also receive information from a project partner, referrer, funder or other organisation where you have authorised the disclosure or where another lawful basis applies. We may receive basic technical information automatically when you use our website.
How and why we use personal information
To respond to enquiries. We use contact details and messages to answer questions and manage follow-up. We normally rely on our legitimate interests in communicating about the CIC and its work, or on steps requested before entering into an agreement.
To administer membership. We use membership information to assess eligibility, maintain records, communicate with members and enable participation in the CIC. We rely on our legitimate interests, contractual necessity where applicable, and legal obligations arising from the CIC’s governance.
To organise volunteering, events and activities. We use registration, contact and relevant safety information to plan activities, communicate arrangements and protect participants. We rely on legitimate interests, contractual necessity, consent or vital interests, depending on the circumstances.
To run and develop the project. We use information to coordinate with farmers, land managers, community members, partners, advisers, suppliers and funders, administer grants, keep project records and report on progress. We rely on legitimate interests, contractual necessity and legal obligations.
To send news and updates. Where we offer email updates, we will use consent unless another lawful basis is clearly available. You can unsubscribe at any time using the link in an email or by contacting us.
To publish news, photographs and video. We may use content to explain and promote the CIC’s work. Depending on the context, we rely on consent or our legitimate interests in documenting and communicating our activities. We will take additional care with children and sensitive situations.
To operate and protect our website and systems. We use technical information to deliver the website, maintain security, prevent misuse, diagnose faults and understand how the site is used. We rely on legitimate interests and, where required for non-essential cookies or similar technologies, consent.
To meet legal and regulatory requirements. We may use information for accounting, governance, safeguarding, data protection, fraud prevention, legal claims and requests from regulators or public authorities. We rely on legal obligations and legitimate interests.
Our legitimate interests include running and improving the CIC, administering membership and activities, maintaining relationships, protecting people and systems, and communicating the value of our work. We consider the likely effect on your rights before relying on legitimate interests.
If you do not provide information
You do not generally have to give us personal information. However, if information is needed to answer an enquiry, assess membership, organise an activity, meet a legal requirement or perform an agreement, we may be unable to proceed without it. We will explain this when collecting the information where it is not obvious.
Who we may share information with
We only share personal information when there is a proper reason and limit what is shared to what is reasonably necessary. Recipients may include the following.
People working for the CIC. Directors, project team members, authorised volunteers and contractors who need the information for their role.
Service providers. Organisations that provide website hosting and support, contact form delivery, email, cloud storage, communications, event administration, professional advice and other operational services. They must handle information under our instructions or their own legal responsibilities, as applicable.
Project partners and funders. Partners, advisers, land managers, funders and public bodies where sharing is needed to deliver, administer or report on a project. We aim to use aggregated or anonymised information for reporting where individual details are not required.
Authorities and professional advisers. Regulators, courts, law enforcement bodies, insurers, accountants and legal advisers where disclosure is required by law or reasonably necessary to protect rights, people or property.
We do not sell personal information.
International transfers
Some technology providers may process personal information outside the UK. Where UK data protection law applies to a restricted transfer, we use providers and transfer arrangements that offer an appropriate level of protection, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard.
You can contact us if you would like more information about the safeguards relevant to your personal information.
Security
We use appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration and disclosure. Access is limited to people who need the information for an authorised purpose. No online service or method of transmission can be guaranteed to be completely secure.
How long we keep personal information
We keep personal information only for as long as it is needed for the purpose for which it was collected, including legal, accounting, funding, governance, safeguarding and reporting requirements. Our usual retention periods are set out below, but we may keep information for longer where a dispute, claim, investigation or legal obligation requires it.
Enquiries and routine correspondence. Normally up to two years after the last meaningful contact, unless the matter leads to an ongoing relationship, agreement or claim.
Membership records. For the duration of membership and normally for six years after it ends, subject to governance and legal requirements. Permanent company records may be kept for longer where the law requires this.
Volunteer and event records. Normally up to three years after the activity or event. Records relating to an incident, safeguarding concern, insurance matter or claim may be kept longer.
News and email updates. Until you unsubscribe or we stop the service. We may keep a minimal suppression record to make sure we respect an opt-out.
Contracts, grants, suppliers and financial records. Normally six years after the relevant financial period, agreement or project ends, or longer where a law or funding condition requires it.
Data protection requests and complaints. Normally three years after closure, or longer where a dispute or claim remains possible.
Website security logs. Normally up to 12 months, unless they are needed for an investigation or security incident.
Photographs, video and published content. For as long as the content remains relevant to the CIC’s work or archive. Where use is based on consent, we will stop future use following withdrawal where this is reasonably possible, but this may not affect material already printed or lawfully used.
When information is no longer required, we delete it securely or anonymise it so it can no longer be linked to an identifiable person.
Cookies and third-party website services
Our website uses cookies and similar technologies for essential functions and may use them to remember choices, understand use of the site or provide embedded content. Where the law requires consent, we ask before using non-essential technologies. You can change your choices through the cookie settings available on the website.
The site may load services supplied by third parties, including Vimeo for video and Google Fonts for typography. When these services load, the provider may receive technical information such as your IP address, browser details and the page you visited. Further detail should be provided in our cookie policy, including the technologies in use, their purpose and duration.
Your data protection rights
Depending on the circumstances, you may have the following rights. These rights are not absolute and exemptions may apply.
Access. Ask for a copy of the personal information we hold about you and information about how we use it.
Correction. Ask us to correct inaccurate information or complete information that is incomplete.
Erasure. Ask us to delete your personal information where there is no continuing lawful reason to keep it.
Restriction. Ask us to limit how we use your personal information in certain circumstances.
Objection. Object to processing based on legitimate interests and object at any time to direct marketing.
Data portability. Ask to receive certain information in a structured, commonly used and machine-readable format, or have it sent to another organisation, where the right applies.
Withdraw consent. Withdraw consent at any time where we rely on it. This will not affect processing that took place before consent was withdrawn.
Automated decisions. Ask for safeguards in relation to a solely automated decision that has legal or similarly significant effects. We do not currently make decisions of this kind.
To exercise a right, email info@sugarloaf-cic.org or write to our contact address. We may ask for information needed to confirm your identity and locate the relevant records. We normally respond within one month, although the law allows more time for complex requests. There is usually no charge.
Data protection complaints
If you are concerned about how we have used your personal information, please contact us at info@sugarloaf-cic.org or write to our contact address. We will acknowledge a data protection complaint within 30 days. We will take appropriate steps to investigate, keep you informed where necessary and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office. The ICO will usually expect you to have raised the matter with us first so that we have an opportunity to respond.
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: Make a complaint to the ICO
Changes to this policy
We review this policy and update it when our activities, services or legal responsibilities change. The latest version will be published on our website with the date it was last updated. If a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of people affected.
Contact us
For questions, rights requests or data protection complaints, contact:
Sugar Loaf Regeneration Farm Partnership CIC
c/o Stump Up for Trees, Tindle House, 13 Nevill Street, Abergavenny, NP7 5AA