Cambridgeshire ACRE respects your privacy and takes the protection of your personal information seriously.

This privacy notice explains what personal information we collect, why we collect it, how we use and protect it, how long we keep it and the rights you have over your information.

Who we are

Cambridgeshire ACRE is a registered charity (no. 1074032) and company limited by guarantee (no. 03690881).

Our registered address is:

e-space North
181 Wisbech Road
Littleport
Ely
CB6 1RA

For questions about this privacy policy or how we use your personal information, please email enquiries@cambsacre.org.uk.

What personal information we collect

The information we collect depends on how you interact with us. It may include:

• your name;
• postal address;
• email address;
• telephone number;
• the organisation or community you represent;
• information you give us when you make an enquiry or ask us for advice or support;
• information you provide when you become a member, attend an event, complete a survey or take part in one of our projects;
• information about services, events or activities you have participated in;
  payment and transaction information where you pay for membership, training, events or other services;
• your communication preferences; and
• information you choose to provide when communicating with us.

In some areas of our work we may need to collect more sensitive information, for example information about someone’s health, ethnicity or other personal circumstances. This is known as special category data. Where we collect this information, we will only do so where there is a clear need and we have an appropriate lawful basis and an additional legal condition for processing it.

We aim to collect only the information we genuinely need for the purpose for which it is being used.

How we collect your information

We usually collect personal information directly from you. For example, when you:

• contact us for information, advice or support;
• apply for or renew membership;
• book or attend an event or training session;
• sign up to receive information from us;
• complete a survey or consultation;
• apply for funding or take part in a project;
• visit our website or interact with us through social media; or
• work with us as a partner, supplier, volunteer or other stakeholder.

We may sometimes receive information about you from another organisation or individual. Where this happens, we will only use the information where we have an appropriate lawful basis for doing so.

How and why we use your information

Data protection law requires us to have a lawful basis for using personal information. The basis we use depends on why we need the information.

What we use your information for and our usual lawful basis

• Responding to enquiries and requests for advice or information – Legitimate interests in responding to people who contact us and providing our charitable services
• Providing services, advice, training, events and other activities  – Contract, where we need the information to provide something you have requested or paid for, or legitimate interests, where appropriate
• Administering membership – Legitimate interests in operating and administering our membership scheme
• Keeping members informed about their membership, membership benefits, services and relevant activities – Legitimate interests in providing an effective membership service
• Processing payments and maintaining financial records – Contract and legal obligation
• Delivering projects, grants and programmes – Contract, legitimate interests or legal obligation, depending on the particular programme
• Carrying out surveys, research, consultations and evaluation – Usually legitimate interests in understanding rural communities, evaluating our work and improving our services. We may use consent where appropriate
• Monitoring and improving our website, services and activities – Legitimate interests in understanding how our services are used and improving our work
• Keeping our IT systems, website and information secure – Legitimate interests in protecting our organisation, systems and information
• Sending news and information about our services, events and activities  – Consent where required, or legitimate interests where it is reasonable and lawful for us to keep you informed
• Meeting legal, regulatory or reporting requirements – Legal obligation
  Establishing, exercising or defending legal rights – Legitimate interests or legal obligation, as appropriate

These bases are not alternatives we choose between after the event. We identify the appropriate lawful basis according to the purpose for which information is being used. This reflects current ICO guidance, which requires organisations to determine and document the appropriate lawful basis for their processing.

Our legitimate interests

Where we rely on legitimate interests, this means we have identified a genuine reason for using personal information that is necessary for our work and have considered the impact on the people concerned.

Our legitimate interests may include:

• providing advice, information and support;
• managing our relationships with members, partners and other people and organisations we work with;
• communicating about our work, services and activities;
• understanding the needs of rural communities;
• evaluating and improving our services and projects;
• operating and improving our organisation and website;
• maintaining the security of our systems and information; and
• establishing or protecting our legal rights.

We will not rely on legitimate interests where our interests are overridden by your rights and interests.

Keeping you informed

We may contact you with information about Cambridgeshire ACRE’s services, events, activities and opportunities that we believe will be relevant to you.

For members, some communications are part of providing and administering your membership. We may also tell you about other activities or initiatives that we believe will be relevant to our members.

Where the law requires your consent before we send marketing communications, we will ask for it.

You can ask us to stop sending you promotional or marketing communications at any time by using the unsubscribe option provided in the communication or emailing enquiries@cambsacre.org.uk.

Stopping marketing communications will not prevent us from contacting you where we need to do so for another reason, for example to administer your membership, respond to an enquiry or provide a service you have requested.

Who we share your information with

We do not sell your personal information.

We may share it where this is necessary with:

• organisations that provide IT, website, database, email, communications or other technology services to us;
• organisations that process payments on our behalf;
• accountants, auditors, insurers, legal advisers and other professional advisers;
• organisations we work with to deliver a particular project or service, where sharing information is necessary;
• funders or commissioning organisations where we are required to report on work they have funded, although we will use anonymised or aggregated information wherever this is sufficient;
• regulators, government bodies, law enforcement agencies or other public authorities where we are legally required to do so; and
• other organisations where this is necessary to establish, exercise or defend our legal rights.

Where another organisation processes personal information on our behalf, we require it to use the information appropriately and to protect it.

Where information needs to be shared for a particular project, service or activity in a way that is not reasonably covered by this policy, we will provide further privacy information at the point we collect it.

International transfers

Some organisations providing technology or other services to us may process personal information outside the UK.

Where personal information is transferred internationally, we will take appropriate steps to make sure it receives an appropriate level of protection and that the transfer complies with UK data protection law.

How long we keep your information

We do not keep personal information for longer than we need it.

How long we retain particular information depends on:

• why we collected it;
• how long we need it to provide a service or manage our relationship with you;
• any legal, financial, regulatory, contractual or funder requirements that apply; and
• whether we need the information to establish, exercise or defend legal rights.

Different types of information are therefore kept for different periods.

For example, information relating to financial transactions may need to be retained for longer than routine correspondence, while project information may need to be retained for the period specified by a particular funder or contract.

When we no longer need personal information, we will securely delete or anonymise it.

How we protect your information

We take appropriate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

These measures include appropriate access controls, security measures for our IT systems and procedures governing how staff and others working on our behalf handle personal information.

Access to personal information is limited to people who need it for their work.

Your rights

Data protection law gives you a number of rights over your personal information. Which rights apply depends on the circumstances and the lawful basis we are relying on.

You may have the right to:

Access your information

You can ask us for a copy of the personal information we hold about you. This is sometimes called a subject access request.

Correct your information

You can ask us to correct personal information that is inaccurate or complete information that is incomplete.

Ask us to delete your information

In certain circumstances, you can ask us to delete personal information we hold about you.

This right does not apply in every situation. For example, we may need to retain certain information to meet a legal obligation.

Restrict how we use your information

In certain circumstances, you can ask us to restrict the way we use your personal information.

Object to how we use your information

In certain circumstances, you can object to us using your personal information where we rely on legitimate interests.

You have the right to object to your personal information being used for direct marketing.

Ask us to transfer your information

In certain circumstances, you may have the right to receive personal information you have provided to us in a structured, commonly used and machine-readable format, or ask us to transfer it to another organisation.

Withdraw your consent

Where we rely on your consent to use personal information, you can withdraw that consent at any time.

Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

How to exercise your rights

If you would like to exercise any of these rights, please email enquiries@cambsacre.org.uk.

Please tell us what you are asking for and provide enough information for us to identify the relevant records.

We may need to confirm your identity before dealing with your request.

We will normally respond to requests within the timescale required by data protection law.

Automated decision-making

We do not currently use personal information to make solely automated decisions that have legal or similarly significant effects on individuals.

Children’s personal information

Some of our projects or activities may involve children and young people.

Where we collect children’s personal information, we will take particular care to provide appropriate privacy information, collect only the information we need and use an appropriate lawful basis and safeguards. Where appropriate, we may provide a project-specific privacy notice.

Social media

If you interact with us through social media platforms such as Facebook or LinkedIn, information you post or share may also be processed by the organisation providing that platform.

Those organisations have their own privacy policies and settings governing how they use your information. We recommend checking your privacy settings and the privacy information provided by the relevant platform.

Cookies and our website

Our website may use cookies and similar technologies to make the website work, understand how it is used and improve people’s experience of it.

Where required, we will ask for your permission before using non-essential cookies.

Further information about the cookies used on our website is provided in our cookie notice.

If you have a concern

If you have a question or concern about how we use your personal information, please contact us first via enquiries@cambsacre.org.uk

We will do our best to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk

You do not have to contact us before raising a concern with the ICO.

Changes to this privacy notice

We keep this privacy notice under review and will update it when our activities, systems or legal responsibilities change.

Last updated: 12 November 2026