Privacy policy v 2.0
We are the charity of John and Nathaniel Carter c/o Community Action Norwich, 2 Martineau Lane, Norwich, Norfolk, NR1 2HX registered with the Charity Commission under the number 225849, and below we shall explain how we both use the personal information which you entrust to us and how we protect that information.
If you would like to know more about how we process your information, would like to request a copy of that information, or to enforce any of your rights, please contact our Clerk to the Trustees whose details can be found at the end of this policy.
Purpose and Scope
This policy outlines how the charity of John and Nathaniel Carter (the Charity) will use and protect any information that you provide to us either in a manual or electronic format or captured by us while you are using our website.
About us
The charity of John and Nathaniel Carter is an independent grant making trust. We support the descendants of our founders John and Nathaniel Carter, and local charitable organisations near to where they used to live and work in Norfolk.
Why we need your information
We need your personal information to allow us to offer our services to you and to comply with our legal and fiduciary duties. We will only collect the minimum amount of information necessary to provide our service to you or to comply with our legal obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA18).
Kindred
We maintain a register of all descendants of John and Nathaniel Carter to help identify individuals who may benefit from our support. To do this, we use both online and offline family tree services, genealogy websites, and public records such as those held by the Probate Office and the General Register Office. These sources help us verify relationships and applications. We refer to this descendant information as ‘Kindred’ data.
If you apply for a grant, we will collect only the information necessary to process your application. This may include copies of documents and certificates to confirm your identity, details of your financial situation, and personal circumstances—some of which may be sensitive, such as medical information. Additional relevant details that support your application may also be processed.
As with all personal data, we will keep this information secure and never share it with unauthorised third parties. If you would like more information about how we collect, process, and use this data, please contact the Clerk to the Trustees using the details provided at the end of this policy.
Trustees
We process Trustees’ personal information to meet our legal obligations, comply with Charity Commission requirements, and maintain regular communication. Additionally, we keep a record of Retired Trustees to share newsletters and send invitations to events.
Finance
Where there is a need to make financial transactions, such as processing payment of grants for individuals, we will hold details such as name, contact details and bank details within our finance system. These details are used only for the purpose of making these transactions and for holding a record of these transactions.
Photographs
We may use photographs of past beneficiaries for publicity purposes. Where these photographs include pictures of people, we request confirmation that those people in the picture have given their consent for the picture to be used in this way.
How we use your data and how long we keep it
We will only use your personal data for the purpose for which it was provided. It will not be retained longer than necessary and will be securely destroyed in line with our data retention policy.
Below is an overview of the legal basis for processing your information, along with guidance on how long we retain personal data:
| Area | Purpose | Lawful basis | How long we keep |
| Kindred data | Genealogy information | Legitimate interests | Indefinitely |
| Kindred data | Grant Applications | Explicit consent/Legal & Contractual obligations & legal obligations | 7 years |
| Visitors to our website | Website analytics | Legitimate interests | 7 years |
| Finance | Bank details, individual payment records, contact details | Legal obligation | 7 years |
| Trustees | Contact details, public information, meet our legal obligations | Legitimate interests and legal obligations. | 1 year after trustee role ends |
| Trustees | Essential contact details for keeping in touch | Explicit consent | Indefinitely |
| General | Emails | Legitimate interest/consent | Up to 2 years |
Data Security
We are committed to keeping your information safe. To prevent unauthorised access or disclosure, we have implemented appropriate physical, electronic, and managerial measures to protect the data we collect.
All information we hold about you is stored within the UK or the European Economic Area (EEA).
Please note that we cannot guarantee that any email sent to us will be received or remain private during transmission. If this concerns you, consider using an alternative method of communication. You are responsible for ensuring that any electronic message or file you send is free from viruses or defects that could harm our systems.
While we take every precaution to safeguard your data, no method of transmission or electronic storage over the internet is completely secure. Therefore, we cannot guarantee absolute security.
Third party sharing
We will not share your personal data with third parties unless you have been informed in advance. For example, in relation to Kindred, we may need to share your details to help you access external assistance or support.
In some cases, we are legally required to share your information—for instance, with HMRC for tax purposes or with law enforcement agencies for the prevention or detection of crime.
We also have a responsibility to prevent fraudulent claims. To support this, we may share information with other grant-making organisations where necessary.
Cookie Policy
This website uses cookies. A cookie is a small text file stored in your computer containing text data. We use cookies for certain functions to improve the usability of the website. We may use both “session” cookies and “persistent” cookies on the website. We will use the session cookies to keep track of you whilst you navigate the website. We will use the persistent cookies to enable our website to recognise you when you visit. Session cookies will be deleted from your computer when you close your browser. Persistent cookies will remain stored on your computer until deleted, or until they reach a specified expiry date. Most browsers allow you to reject all cookies, whilst some browsers allow you to reject just third party cookies. Most web browsers allow some control of most cookies through the browser settings.
For more information about cookies and instructions on how to adjust your browser settings to restrict or disable cookies, please see https://ico.org.uk/for-the-public/online/cookies/.
Google Analytics
This website uses Google Analytics (GA) to track site user interaction by means of cookies which are stored on users’ devices. We use this data to determine the number of people using our site, to better understand how they find and use our web pages and to see their journey through the website. Although GA records data such as your geographical location, device, internet browser and operating system, none of this information personally identifies you to us. GA also records your computer’s IP address which could be used to personally identify you but Google do not grant us access to this. We consider Google to be a third party data processor.
Please review the following information Google Analytics Privacy Policy. Google has developed a browser add-on to allow users to opt-out of Google Analytics across all websites which use this popular analytics product
Links to other websites
Our website may contains links to other websites which are outside our control and are not covered by this Privacy Policy. We are not responsible for the privacy policies or practices of third party websites.
Your rights
Under the Data Protection Act 2018 and UK GDPR, you have specific rights regarding your personal data. These include:
- Right of Access – You can request a copy of the personal information we hold about you by submitting a Data Subject Access Request (DSAR) via email or in writing to the Clerk to the Trustees (contact details are provided at the end of this Privacy Policy). We will need to verify your identity before processing your request.
- Right to Rectification – You can ask us to correct or update your personal information to ensure our records remain accurate and up to date.
- Right to Erasure (‘Right to be Forgotten’) – You may request the deletion or removal of your personal data where there is no compelling reason for its continued processing by the Charity.
- Right to Restrict Processing – You can request that we limit the processing of your personal data if it is no longer necessary for service provision or legal, contractual, or financial obligations. We may store your data but will not process it further, retaining only enough information to respect the restriction in future.
- Right to Data Portability – You can request to obtain and reuse your personal data across different services. This allows you to move, copy, or transfer your data securely between IT environments. Please note this right does not apply to data held by the Charity.
- Right to Object – You can object to the processing of your personal data where it is based on consent, legitimate interests, or tasks carried out in the public interest, including profiling, direct marketing, and research activities.
- Rights Regarding Automated Decision-Making and Profiling – You have the right to be informed about any automated decisions made without human involvement. The Charity does not carry out automated decision-making or profiling.
- Right to Withdraw Consent – Where processing is based on your consent, you may withdraw it at any time. However, in some cases, this may not apply. For example, if you applied for a grant, we would process your request with your consent. If you later withdraw consent, we cannot delete related information until the seven-year retention period ends, as we process this under legitimate interests and legal obligations.
- Right to Stop Direct Marketing – You have an absolute right to ask us to stop sending direct mail or email. The charity of John and Nathaniel Carter does not send unsolicited marketing communications.
Updates to this policy
The charity of John and Nathaniel Carter may update this policy periodically by revising this page. We encourage you to check this page regularly to ensure you are aware of any changes. This policy takes effect from 2 December 2025.
Our contact details
The Clerk to the Trustees
Charity of John and Nathaniel Carter
c/o Community Action Norwich, 2 Martineau Lane, Norwich, Norfolk, NR1 2HX
Email: welcome@carterstrust.org
Charity Registration Number: 225849
ICO Registration No: ZA319098
Complaints
If you are unhappy with how we have processed your personal information please firstly contact the Clerk to the Trustees, if you are still unhappy you may contact the following:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 (local rate) or +44 1625 545 745