Privacy Policy

1. Who We Are

Data Controller

The Rayners Penn Foundation
el@theraynersfoundation.com

The organisation above is the data controller responsible for personal information collected through this website and application process.

Website and Technical Services Provider (Data Processor)

Francis Bros Limited
oli@franciscreative.co.uk

The website and technical systems supporting this application process are managed on behalf of the Foundation by the Data Processor named above.

2. Information We Collect

We may collect the following information:

• Personal information (name, contact details, address, date of birth)
• Background information relating to your circumstances
• Information about the support you are seeking
• Details of any relevant community involvement or initiatives
• Supporting documents you choose to upload (for example PDF or Word files)
• Any additional information you choose to provide

While you complete the form, answers may be saved temporarily in your web browser so you can return to them on the same device. You can clear this at any time using the option on the application page.

3. How We Use Your Information

Information is used to:

• Assess applications for support
• Communicate regarding application outcomes
• Send a confirmation email once your submission and any uploaded documents have been received and checked
• Improve our processes and understanding of need
• Meet legal and regulatory obligations

When you submit an application, your answers are stored securely. If you upload documents, they are checked automatically for malware before they are passed to the Foundation for review. This check is usually completed within a few minutes. You will receive a confirmation email after this process finishes successfully.

4. Data Sharing and Disclosure

We do not sell or rent personal information.

Information may be shared only:

• With authorised members of The Rayners Penn Foundation
• With our website and technical services provider (Francis Bros Limited), who process data on our instructions
• With trusted service providers who support the application process on our behalf (see sub-processors below)
• Where required by law or legal process
• In the event of an organisational change

Sub-processors

We use the following categories of service provider to operate the application form. They process personal data only as needed to provide their service and under appropriate contractual safeguards:

• Amazon Web Services (AWS) — secure hosting, email delivery, document storage, and automated malware scanning of uploaded files (Amazon GuardDuty). Data is processed in the United Kingdom (London region) where possible.
• Google reCAPTCHA — helps protect the form from abuse. Google may process technical information about your device and interaction with the form. See Google's Privacy Policy.

Our technical operator may receive automated operational alerts (for example if a document fails a security check or a system error occurs). These alerts contain only limited technical details — such as a reference to the application folder — and do not include the full text of your answers.

5. Data Security

We take reasonable steps to protect personal information, though no online system can be guaranteed to be completely secure. Measures include:

• Encrypted connections (HTTPS) when you use this website
• Private, access-controlled storage for applications and documents
• Automated malware scanning of uploaded files before they are released for review
• Separate handling of files that fail a security check (they are not kept with your main application archive)

If an uploaded document cannot be accepted for security reasons, the rest of your written application is still received. We will tell you in your confirmation email if any file could not be accepted.

6. Retention of Information

Application information and supporting documents submitted through this website are retained securely for up to five years from the date of submission, unless a shorter period is required by law or agreed with you. After that period, archived records are deleted automatically. Files that fail a security check are kept separately for a short period only for investigation, then deleted automatically.

You may request access to, correction of, or deletion of your personal information during the retention period, subject to legal obligations. Contact the Data Controller using the details in section 1.

7. Your Rights

You may request access to, correction of, or deletion of your personal information, subject to legal obligations.

8. Changes to This Policy

This policy may be updated periodically. Any changes will be published on the website with an updated effective date.

9. Contact Us

For questions relating to this Privacy Policy or your data, please contact:

The Rayners Penn Foundation
el@theraynersfoundation.com