Data Protection for Donors


Dartmoor Zoological Society, a Charity Incorporated Organisation (Company Number: CE001718) and a charity registered with the Charity Commission for England and Wales (Charity Number: 1158422) and its trading company Dartmoor Zoo Enterprises Limited, a company limited by shares, Company Number: 09362054 both of which have their registered office at Dartmoor Zoological Park, Sparkwell, Plymouth, PL7 5DG (together DZS) Process your Personal Data in accordance with the UK Data Protection laws, specifically GDPR as defined below and the Data Protection Act 2018 (together the DPL) and the information set out in this information statement.

1. Background

1.1. Dartmoor Zoological Society (the Charity) is a charity which operates a zoo, supports vulnerable animals and undertakes conservation and research projects (which includes the affects on animals when engaging with vulnerable people). The Charity undertakes trading activities through Dartmoor Zoo Enterprises Limited (DZE).

1.2. For the avoidance of doubt GDPR means EU Regulation 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation) which has been directly imported into the law of England and Wales, Scotland and Northern Ireland (UK Law) by virtue of section 3 of the European Union (Withdrawal) Act 2018 as amended by the Data Protection, Privacy and Electronic Communications (Amendment Etc.) (EU Exit) Regulations 2019.

1.3. You have made a donation to DZS and, as a donor, this statement sets out how DZS processes your Personal Data.

2. Purposes and Legal Basis

2.1. DZS Processes your Personal Data and, where you have provided it, your Special Categories of Personal Data, for the following purposes:

2.1.1. acknowledging and processing any donations made by you;
2.1.2. providing you with information about the activities of DZS and its partners;
2.1.3. administration in relation to the support that you provide to DZS;
2.1.4. statutory and regulatory compliance;
2.1.5. processing any enquiries or complaints raised by you and responding to any communications from you;
2.1.6. sharing your information to third parties with whom we have a relationship under which your Personal Data are protected;
2.1.7. transferring your Personal Data to HMRC in respect of any Gift Aid claims; and
2.1.8. sending electronic communications to you keeping you informed about the activities falling into any of the above categories.

2.2. The legal basis on which the above Processing takes place is the legitimate interests shared by DZS and you as set out below.

2.3. The legitimate interests which permit the Processing set out above to take place are:

2.3.1. you have made a donation to the Charity and as a result have shown a willingness to support the work of DZS;
2.3.2. the need to comply with regulatory requirements in relation to your donation, for example, the need to keep donation records for a minimum of seven years for accounting purposes;
2.3.3. that the Processing is reasonable in relation to the activities to which they relate;
2.3.4. the Processing is such as you would reasonably expect to be undertaken by DZS in respect of the management of your donation;
2.3.5. that the Processing is necessary in respect of the activities that are undertaken and is in the interests of DZS and the relevant third parties and does not limit your interests or fundamental freedoms guaranteed by the DPL;
2.3.6. that if you sought to terminate your consent to DZS Processing your Personal Data, we would still be required to retain information on your donation for at least seven years, meaning that consent is not freely available.

2.4. When making your donation to DZS you created a relationship between us. Where you did not opt out of receiving electronic communications from us, we have treated your action as consent to send you communications electronically (commonly called “a soft opt in”). As the legal basis of the processing DZS undertakes in relation to electronic communications is your consent, please note that you may withdraw this consent at any time. Should you withdraw your consent DZS shall cease to send you electronic marketing information. You may revoke your consent to receive such updates by using the unsubscribe function included in each communication.

2.5. You may notify us at any time if you wish us to stop contacting you. We will stop all further contact, however, we will be required to continue to Process your Personal Data in relation to any donation made by you until the period where we are required to keep donor information. This is seven years from the date of the final donation was made.

3. Source

3.1. You are the source of all of the Personal Data about you which we Process.

4. Recipients

4.1. DZS may transfer your Personal Data to the following organisations or category of organisations:

4.1.1. HMRC;
4.1.2. third parties with whom we have a relationship including our sub-contractors providing services to us.

5. International Transfers

5.1. It is the intention of DZS that your Personal Data will remain within the countries forming the European Economic Area (the EEA) and countries where the European Union has decided that the country has adequate data protection laws in line with those in the European Union.

5.2. Your Personal Data will only be transferred outside of the EEA or a country which has been declared as having adequate data protection laws, where:

5.2.1. the transfer is necessary for the performance of any contract with you;
5.2.2. you have entered the information into our Website and the information has been transmitted from your server to our server using systems based outside of the EEA;
5.2.3. we have entered into an appropriate contract protecting your rights and freedoms, which is enforceable by you or the data protection authorities; or
5.2.4. we have obtained your explicit consent.

5.3. Generally, we do not expect that your Personal Data will be transferred outside of the EEA.

6. Storage

6.1. We will generally store the Personal Data that we hold in relation to you for the duration of our relationship with you and for seven years after that relationship ends.

7. Your Rights

7.1. You have a right to obtain from DZS conformation as to whether or not your Personal Data are being Processed and, if your Personal Data are being Processed by DZS, to access the Personal Data and for the specific information set out in Article 15 of the GDPR. To access your Personal Data please contact the person specified in Paragraph 11 below. Please note that we will not provide any Personal Data to you until you have provided evidence to us to establish your identity. This may include a copy of your passport or other identification document. We will only provide information to you at an address which we have verified as belonging to you.

7.2. You have a right to rectification of any inaccurate Personal Data which we Process about you, or where Personal Data is completed to have the information completed. To obtain rectification or completion you will need to provide the correct information to DZS, an explanation of why you believe the information is inaccurate or implement would also be of assistance.

7.3. Where certain grounds, as set out in Article 17(1) of the GDPR, apply you will be entitled to have DZS erase certain Personal Data relating to you. Where you wish to exercise your right of erasure, please contact the Data Protection Team setting out the grounds under which you would like the Personal Data DZS holds about you erased.

7.4. Where certain grounds, as set out in Article 12(1) of the GDPR, apply you will be entitled to have DZS restrict the Process of certain Personal Data relating to you. Where you wish to exercise your right to restrict processing, please contact the Data Protection Team setting out the grounds under which you would like the Personal Data DZS holds about you restricted.

8. Complaints

8.1. If you have any complaint about the Processing of your Personal Data undertaken by DZS, please contact the Head of Compliance.

8.2. Please note that you have a right to lodge any compliant about the Processing of your Personal Data by DZS by contacting the Information Commissioner’s Office.

8.3. DZS is not required to have a data protection officer under the DPL and one has not been appointed, therefore please address all communications in relation to personal data to the Data Protection Team.

9. Provision of Personal Data

9.1. Please note that DZS is Processing your Personal Data to manage your donation and DZS’s legal obligations, as set out in paragraph 2 above. If you do not provide your Personal Data, we will not be able to undertake our obligations and you will not be permitted to claim Gift Aid on your donation.

10. Definitions

10.1. The following terms have the following meaning in this Statement:

10.1.1. Personal Data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
10.1.2. Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
10.1.3. Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
10.1.4. Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
10.1.5. Special Categories of Personal Data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

11. Contact

11.1. The Data Protection Team can be contacted:

11.1.1. in writing at Dartmoor Zoological Park, Sparkwell, Plymouth, Devon, PL7 5DG;
11.1.2. by email at dataprotection@dartmoorzoo.co.uk; or
11.1.3. by telephone by calling 01752 837645

12. Further Information

12.1. It is not intended that DZS will undertaking any further Processing of your Personal Data other than that which is set out in this statement. However, if this position does change DZS will provide you with further information.

12.2. This statement was last updated on 1 September 2020.