Privacy Notice

This privacy notice tells you what to expect us to do with your personal information when you make contact with us or use one of our services.

Who we are

Corra Foundation is a charity registered in Scotland (No SC009481) and is also a company limited by guarantee (No SC096068).

Corra Foundation is the controller for the personal information we process, unless otherwise stated.

Contact details

Our registered address is Office Suite 30, Pure Offices, 4 Lochside Way, Edinburgh, EH12 9DT.

You can contact us by email or phone at hello@corra.scot or on 0131 444 4020.

Our main contact for data protection matters is Seonaid Tennent, Corporate Services Officer (GDPR), who can be contacted by email at corporateservices@corra.scot .

Data we collect and how we use it

Simply by browsing the website, Corra Foundation collects only information that will help us make the site better for you.

We do not record any personal data about you except your IP (Internet Protocol) address. Your IP address is the individual identification number that is assigned to your computer when it is connected to the internet. This is required to enable you to browse the website. The lawful basis we rely on to process this personal data is legitimate interests, ie, to ensure our website is functional.

We also use Google Analytics cookies to understand how people use the site so we can keep improving it, but personal data is not recorded and your IP address is anonymised. Find out more about how we use cookies and how to control their use in our Cookies Policy. The lawful basis we rely on to process this data is consent. You have the right to withdraw consent at any time, as explained in the Cookies Policy.

You may use one of our services through the website and choose to give us additional personal information, e.g. applying for a grant or signing up to receive our funding bulletins. These services are covered in the following sections.

We collect and store personal information that you give us when applying to any of our grant programmes.

We collect information about your organisation and the name, address, phone, and email details of relevant contacts within your organisation. We also record details of our interactions with you – for example, when asking for additional information to help us understand your request. We use this data to:

  • Assess your application for a grant.
  • Monitor any grant made to your organisation and to perform any other requirements set out in the grant agreement between us.
  • Allow us to perform our part of the grant agreement and to allow us to report to any other organisation involved in the funding of the grant, such as our funders, where applicable.

We may also use personal data that identifies you, such as names and photographs, in our reports to our funders.

We will retain your personal data for a period specified in the grant application form and/or grant agreement. This will be deleted thereafter, unless you consent for us to retain it for another purpose, e.g. to receive our funding bulletins. The lawful basis we rely on to process this personal data is contract, ie, you are applying to enter into a grant contract with us.

When you make an enquiry to us – by phone, by email or in person – your enquiry and contact details will be recorded and stored.

We will use this data to respond to your enquiry. We may also use it for reporting purposes - to monitor the level and nature of enquiries we receive.

Your enquiry will be stored for 2 years and then deleted, unless we have another reason to keep the data, e.g. your enquiry relates to a subsequent grant application.  The lawful basis we rely on to process this personal data is legitimate interests, ie, you would reasonably expect us to use this information to deal with your enquiry.

When you sign up to receive our funding bulletins and updates on funding opportunities and events – by completing our online sign-up form or providing consent in a grant application form – we collect and store your name and email address.

We will use this data to email you our funding bulletins and updates. The lawful basis we rely on to process this personal data is consent. You have the right to withdraw consent at any time, by using the ‘unsubscribe’ link in the footer of our funding bulletins or contacting us by email or phone at comms@corra.scot or 0131 444 4020.

We collect and store personal data that you provide when applying for a role with us. We’ll use the information you provide during the recruitment process to progress your application with a view to offering you an employment contract with us, or to fulfil legal or regulatory requirements if necessary.

We’ll use the contact details you give us to contact you to progress your application. We may also contact you to request your feedback about our recruitment process.

We may share your application information with third parties who are involved in the recruitment process, e.g. representatives from other organisations we work with who are part of the interview panel for a role. Following completion of the recruitment process, we ensure your data is securely deleted or disposed of by these third parties and not used for any other purpose.

If you are unsuccessful in your application, we will retain your application data for 6 months in order to contact you should other suitable opportunities arise, and it will be deleted thereafter. If you are successful in your application, we will retain your application data, in line with employment law requirements, for 7 years after your employment ends.

The lawful basis we rely on to process this personal data is contract, ie, you are applying to enter into an employment contract with us.

You will also be asked to provide equal opportunities information. This is not mandatory – if you don’t provide it, it won’t affect your application. We won’t make the information available to anyone outside our HR team, including hiring managers, in a way that can identify you. Any information you provide will be anonymised and used to produce and monitor equal opportunities statistics.

If you are one of our funders, we collect and store personal data provided by you in relation to contacts at your organisation, e.g. names, job titles and contact details. We use this data to contact and report to you regarding the assessment and monitoring of grants made on your behalf, and to meet any other requirements as outlined in our grant agreement with you.

Personal data will be retained as specified in the grant agreement and will be deleted thereafter. The lawful basis we rely on to process this personal data is contract, ie, we have a contractual agreement in place in relation to grants made on your behalf.

If you attend an event or training session run by us, we will collect a range of information from you including (but not limited to) name, job title, organisation, address, phone number, email, and access/dietary requirements.  We use this information to facilitate the event and provide you with an acceptable service.  We may also contact you for feedback after you have attended the event.

Photography and filming may take place at our events. We will let you know if this is the case for the event you are attending as part of the booking process, including a consent request to use the photos or video, if necessary.

We will retain your personal data for one year after the event, unless we specify a different period in the event booking system.  The lawful basis we rely on for processing your personal data is consent.  This means you have the right to withdraw your consent at any time. If at any point you want to withdraw your consent please email or call us at hello@corra.scot or 0131 444 4020.

Photography and filming may take place at our events for use in promotional materials in print, multimedia, or web form, including social media. If you are attending an event, we will ask for your consent to use photos or video of you for this purpose. If you consent, your image and words may appear in any of our promotional material in printed or electronic form.

Photos/videos will only be used for purposes related to Corra Foundation. We will not share your information with any third parties unless you ask us to do so, or we have asked for your consent in advance.

We will normally store photographs and film securely on our systems for no longer than five years, however your photograph, film, words and quotes may be selected for inclusion in our historical archive and be retained indefinitely.
The lawful basis we rely on to process this personal data is consent. This means you have the right to withdraw your consent at any time. If at any point you want to withdraw your consent please email or call us at hello@corra.scot or 0131 444 4020.

Your rights over your information

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at hello@corra.scot or 0131 444 4020 or in writing to the address above to make a request.

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. Click here to read more about this right.

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. Click here to read more about this right.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances. Click here to read more about this right.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances. Click here to read more about this right.

Your right to object to processing

You have the right to object to the processing of your information for direct marketing purposes and in certain other circumstances. Click here to read more about this right.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under a contract and the processing is automated. Click here to read more about this right.

Sharing your information

We’ll never share or sell your information to other organisations for marketing, market research or commercial purposes.

Links to other websites

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

Children, young people and vulnerable adults

Our principal services are for an adult audience over the age of 16 years. However, grants are provided to charities who work with children, young people and vulnerable adults. We will not use or disclose personal information regarding children, young people or vulnerable adults without the agreement of the child, young person or vulnerable adult and prior consent of the parent or guardian.

Protection of information and international transfers

We use reasonable physical, technical and administrative measures to safeguard information in our possession. Please note however that no data transmission or storage can be guaranteed to be 100% secure. We use electronic data storage systems (cloud, disk) that are managed by third parties.

Those UK or EU third parties are confirmed to be GDPR compliant. On occasion we may use third parties who store electronic data who are based in other countries or territories. In these circumstances, we ensure there are adequate regulations in the country or territory to comply with GDPR or that there are appropriate safeguards in place to protect your personal data.

Examples of third parties we work with are:

  • CRM Systems (Customer Relationship Management) to log our business activity.
  • Marketing companies who assist us in making electronic communications.
  • Online survey forms for feedback on services we provide.

Right to withdraw consent

If we are relying on consent as our lawful basis for processing your personal data, you have the right to withdraw your consent at any time. If at any point you want to withdraw your consent please email or call us at hello@corra.scot or 0131 444 4020. If you do that, we’ll update our records immediately to reflect your wishes.

We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact us at complaints@corra.scot and we’ll respond.

You also have the right to lodge a complaint with the Information Commissioner’s Office online at https://ico.org.uk/concerns or by phone on 0303 123 1113.

Changes to this privacy policy

We keep our privacy notice under regular review to make sure it is up to date and accurate.

This privacy notice was last updated May 2023.