Privacy Policy | The Lawson Trust

Privacy & Data Protection Policy

The Lawson Trust ("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, store and protect your personal data, and the rights you have, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

Who we are

The Lawson Trust is a Charitable Incorporated Organisation (registered charity number 1171822) and is the data controller responsible for your personal data. Our day-to-day administration, including the processing of grant applications, is carried out on our behalf by Hayley Corker of Corker Charity Consulting, the Trust Administrator, who acts as our data processor.

You can contact us about this policy or your personal data at:
The Lawson Trust, Riverside Business Centre, Riverside House, River Lawn Road, Tonbridge, Kent TN9 1EP
Email: enquiries@lawsontrust.org

The information we collect

We collect personal data when you contact us, correspond with us by email, post or telephone, or submit a grant application. This may include your name, job role, organisation details, email address, postal address and telephone number, together with the information you provide in support of an enquiry or application.

When you visit our website we may also collect limited technical information through cookies, such as your IP address and how you use the site. Please see "Cookies and analytics" below.

How we use your information

We use your personal data to:

respond to your enquiry and provide information or advice relevant to it;
assess and process your grant application;
enable our trustees to make funding decisions;
make and administer grant payments to your organisation;
obtain updates on how a grant we have awarded has been used; and
meet our legal, accounting and regulatory obligations.

Our lawful bases for processing under Article 6 of the UK GDPR are: legitimate interests (administering grants and responding to enquiries in pursuit of our charitable objects); consent (for example, where you opt in to non-essential cookies); and legal obligation (where we are required to keep records for accounting, regulatory or legal reasons).

Who we share your information with

We share your information only where necessary. We may share your application details with Kent Community Foundation and Sussex Community Foundation to help identify the most appropriate route for your organisation to apply for funding. We also use trusted service providers to operate our grant-management platform and website; these providers act on our instructions as data processors and are bound by appropriate data-protection terms. We do not sell your data or use it for marketing, and we will not pass your details to any other third party without your consent unless we are required to do so by law.

International transfers

Some of our service providers may process data outside the UK. Where this happens, we ensure an appropriate safeguard is in place – such as an adequacy decision, the UK International Data Transfer Agreement, or equivalent contractual clauses – so that your data continues to receive a comparable level of protection.

How long we keep your information

We keep personal data only for as long as necessary for the purposes described above. Grant and financial records are retained in line with our legal and regulatory obligations (generally for at least seven years), after which they are securely deleted or anonymised.

How we protect your information

Our website is served over a secure, encrypted connection (HTTPS/TLS). We store personal data on access-controlled, password-protected systems and apply appropriate technical and organisational measures to protect it against loss, misuse, alteration or unauthorised access.

Cookies and analytics

This website uses cookies and similar technologies. Cookies are small files stored on your device that help the site work and, with your consent, help us measure how it performs. We group them as follows:

Strictly necessary – required for the site to function and to remember your privacy choices. These are always active and cannot be switched off.
Analytics / performance – help us understand how the site is used so we can improve it. These are only ever set with your consent.

We do not use marketing or advertising cookies at all, and the banner does not offer them as an option.

When you first visit, a banner lets you Accept all, Reject all, or choose which categories to allow. No non-essential cookies are set until you make a choice. You can change or withdraw your consent at any time using the "Manage cookie settings" link in the footer of every page. We use Google Consent Mode v2 so that Google services respect your choices. We use Google Analytics 4 to measure performance, which may set cookies such as _ga and _ga_*; if you reject or opt out of analytics, these are not set (and any existing ones are deleted).

Your rights

Under the UK GDPR you have the right to:

Be informed about how your personal data is used – as set out in this policy.
Access your data – obtain confirmation that we are processing your data and a copy of it.
Rectification – ask us to correct data that is inaccurate or incomplete.
Erasure – ask us to delete your data in certain circumstances.
Restrict processing – ask us to limit how we use your data in certain circumstances.
Data portability – receive your data in a structured, commonly used format.
Object – object to processing based on our legitimate interests.
Withdraw consent at any time where our processing relies on consent.

How to exercise your rights or make a complaint

To exercise any of these rights, please contact us using the details above. We will respond within one month, and there is normally no charge.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. We would, however, welcome the opportunity to resolve your concerns first.

Changes to this policy

We review this policy regularly and will publish any updates on this page.