Privacy Policy – North Devon Biosphere Foundation 

Introduction 

At the North Devon Biosphere, we are committed to protecting and respecting your privacy and personal data. This Policy explains when and why we collect personal information about people who engage with us, how we use it, the conditions under which we may disclose it to others and how we keep it secure.  

We may change this Policy from time to time so please check our website occasionally to ensure that you are happy with any changes. By using our website, you agree to be bound by this Policy. Any questions regarding this Policy and our privacy practices should be sent by email to [email protected] or by writing to North Devon Biosphere, Taw View, North Walk, Barnstaple, Devon EX31 1EE.   

Our Commitment to your privacy 
The North Devon Biosphere is committed to protecting personal and sensitive data in support of our charitable mission and community networks. 

We collect and process personal data to: 

• Build and maintain relationships 
• Secure resources to deliver our mission 
• Ensure the safety of staff, volunteers, supporters, and service users 
• Meet legal and contractual obligations 

We comply fully with the General Data Protection Regulations (GDPR) and the Privacy and Electronic Communications Regulations (PECR), upholding principles of transparency, fairness, security, and individual choice. 

Data is only shared when necessary, under strict controls and agreements. We never sell personal data. We are dedicated to keeping your information safe, informed, and under your control. For more details or to view our full policies, please contact us or visit the Information Commissioner’s Office. 

How we collect information from you 
You may provide us with information when you use our website, for example, when you contact us about our services, upcoming events and signing up for our services such as volunteering. You may also supply us with information when contacting us via email, phone, internet forms or speaking with a member of staff.  

In addition, you may also supply us with information when involved with a specific project and if you are subscribed to our newsletter. 

What type of information is collected from you 
The personal information we collect might include your name, address, email address, phone number and IP address. Some of our other services and events may require additional information that requires your consent, such as any medical conditions and next-of-kin details. In cases of land management, the extent of land and use may be held as part of our advisory services. 

Your rights and GDPR 
The General Data Protection Regulation (GDPR) is a legal framework that governs how personal data is collected, processed, and stored. It requires organisations to handle data lawfully, fairly, and transparently, ensuring it is accurate, secure, and retained only as long as necessary. Organisations must implement safeguards, report data breaches within 72 hours, and maintain accountability through policies and records. GDPR applies to all entities processing personal data of individuals in the UK and EU. 

Unless subject to an exemption under the data protection laws, you have the following rights with respect to your personal data:  

• The right to request a copy of the personal data which we hold about you;  
• The right to request that we correct any personal data if it is found to be inaccurate or out of date;  
• The right to request your personal data is erased where it is no longer necessary to retain such data;  
• The right to withdraw your consent to the processing at any time, where consent was the lawful basis for processing your data;  
• The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), where applicable (i.e. where our processing is based on consent or is necessary for the performance of our contract with you or where we process your data by automated means);  
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;  
• The right to object to our processing of personal data, where applicable i.e. where processing is based on our legitimate interests (or in performance of a task in the public interest/exercise of official authority); direct marketing or processing for the purposes of scientific/historical research and statistics). 

How is your information used 
We may use your information to:  

• keep you up to date with matters you have expressed an interest in, such as events, services, projects, processing a job application process a payment that you have made.  
• process applications that you have submitted.  
• process comments and feedback you have submitted.  
• seek your views or comments on the services we provide.  
• notify you of changes to our services.  

We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations (for example finance, HR). We will only hold your personal information on our systems for as long as is necessary for the relevant activity, or as long as is set out in any relevant contract you hold with us. GDPR does not set exact timeframes for data retention. When data is no longer needed, it will be securely deleted or anonymised. 

Who has access to your information 
We will never sell or rent your information to third parties.  

We will never share your information with third parties for marketing purposes.  

Third Party Service Providers working on our behalf:  
We may pass your information on to our third-party service providers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf. However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we will have a contract in place that requires them to keep your information secure and not to use it for their own direct marketing purposes. Please be reassured that we will not release your information to third parties beyond the North Devon Biosphere and Devon County Council Network for them to use for their own direct marketing purposes, unless you have requested us to do so, or we are required to do so by law. 

Your choices 
You have a choice about whether or not you wish to receive information from us. If you do not want to receive direct communications from us about services or activities you have previously expressed an interest in, then you can contact us to ask us to remove you from our database. At the time of signing up for any services or events, you will always be given the choice to positively opt-in; with the exception of matters that carry a statutory objective. 

Data breaches 
If an employee, contractor or volunteer suspects or becomes aware of a security incident or data breach they must report it immediately to the CEO. They shall upload any relevant information to the form if available. 

Incidents that pose a high risk to individuals must be reported to the Information Commissioners Officer (ICO) within 72 hours, so prompt reporting is essential—even if details are incomplete. The CEO and Operations Manager will investigate, gather further details, and, if required, notify the ICO. A report will outline findings and actions to improve security. Quick containment and recovery are vital.  

How you can access and update your information 
If you wish for us to update or rectify information we hold about you, such as a change email address, or any information we hold that is inaccurate or out of date, please email us at: [email protected], or write to us at: North Devon Biosphere, Taw View, North Walk, Barnstaple, Devon EX31 1EE.  

You have the right to ask for a copy of the information the North Devon Biosphere holds about you.   

Other relevant information 
Security precautions in place to protect the loss, misuse or alteration of your information  

Systems and practices are in place to ensure your personal data is used and stored in a secure manner. We use email encryption services for sensitive data. All of our staff are trained in respect of data protection laws and Devon County council employs its own Data Protection Officer.  

Non-sensitive details (your email address etc.) are transmitted normally over the Internet, and this can never be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk. Once we receive your information, we will make our best effort to ensure its security on our systems. Where we have given (or where you have chosen) a password which enables you to access certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. 

Sensitive data is stored securely on Council servers with dual access protection. Employees must enter passwords to access their computers, and data on Microsoft SharePoint is further restricted. Access to sensitive SharePoint areas is granted only to individuals who require it for their roles, ensuring confidentiality and compliance with data protection standards. 

Commercial or proprietary data is treated with the same level of protection as sensitive data. It is stored securely and access is restricted to those who need it for their roles. We will only release commercial data to third parties where a formal Data Sharing Agreement is in place, ensuring compliance and safeguarding confidentiality and commercial value. 

Use of AI 
Artificial Intelligence (AI) enables computers to simulate human intelligence. We recognize the benefits of using AI to reduce the time spent on simple tasks but also recognize the potential cost of using AI if data is lost or stolen.  

North Devon Council which hosts our computer systems has approved Microsoft Copilot for AI use, ensuring data remains secure and under Council control.  

Biosphere staff must therefore only use Microsoft Copilot and limit personal data input to the minimum necessary and avoid processing sensitive information. We do not use Copilot to create code for live systems or make automated decisions affecting staff or the public. We always review outputs for accuracy and bias, and test functionality to confirm expected results.  

Copilot must only be used for work-related purposes. These steps ensure responsible, secure, and ethical use of AI within the North Devon Biosphere. 

Links to other websites 
Our website may contain links to other websites run by other organisations. This privacy policy applies only to the North Devon Biosphere Foundation‚ so we encourage you to read the privacy statements on the other websites you visit.  

We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from our website. In addition, if you linked to our website from a third-party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the policy of that third-party site. 

Review of this policy 

This policy is approved by the Trustees and will be reviewed biennially or upon material changes in relevant legislation. 

Dated: November 2025