Privacy Policy

The Redcar Fundseekers privacy policy — how we use your data when you visit the site, your UK GDPR rights, and how to reach our data protection lead.

This privacy policy explains how Redcar Fundseekers uses your personal data when you visit our website. It also sets out your rights under the UK General Data Protection Regulation (UK GDPR) and how to reach us if you have a concern.

Redcar & Cleveland Voluntary Development Agency (RCVDA) is the data controller for this site. We are responsible for the personal data described here. Tees Valley Rural Action (TVRA) is our delivery partner. TVRA is not a joint controller; we cover their role under “Who we share data with” below.

Who we are

Redcar & Cleveland Voluntary Development Agency is a registered charity in England and Wales (charity no. 1135959) and a company limited by guarantee (company no. 2720382). Our registered office is The Palace Hub, 28-29 Esplanade, Redcar, North Yorkshire TS10 3AE. Our Information Commissioner’s Office registration number is Z8779915. You can reach our data protection lead at [email protected].

What this privacy policy covers

This policy covers the public Redcar Fundseekers website at https://redcarfundseekers.org.uk and the contact channels we publish on it. However, it does not cover the websites we link out to — funders, partner organisations, regulators, or data publishers — each of which has its own privacy notice.

The data we collect

Overall, we keep the data we collect about visitors to a minimum. In fact, you can browse most of this site without giving us anything.

Site usage data via Google Analytics. We use Google Analytics through the Site Kit by Google plugin to understand how people find and use the site. With your consent, Google Analytics sets cookies on your device and reports anonymised usage back to us — pages visited, approximate location, device and browser type. We use this specifically to improve the site. Google Analytics is blocked entirely until you give consent — it does not run in any form before you accept analytics cookies. You can refuse these cookies through the Complianz consent banner on your first visit and change your mind at any time.
Email enquiries. When you write to us at [email protected] or [email protected], we hold the message — your name, email address, and the content — for as long as we need to respond and to keep a record of the matter.
Contact form submissions. If you use a contact or enquiry form on the site, we receive the information you type into it — typically your name, email address, and message. These forms are provided by the WPForms plugin and stored in our website database. We use your submission to respond to your enquiry. Each form is also protected by Cloudflare Turnstile (an automated bot check that runs when the form loads) and each submission passes through Akismet for spam filtering — see “Who we share data with” below.
Server logs. Our web host keeps short-term server logs of requests to the site. In particular, these logs include IP addresses, timestamps, the page requested, and the browser string. We use them to investigate technical errors and to defend the site against abuse.
Cookies. Our cookie policy lists every cookie set on the site and how to control them. The privacy policy here covers what we do with data; the cookie policy covers how cookies set that data.
Voluntary user accounts. You can register for a free account on the site to save grants to a personal shortlist and to record your organisation’s profile. Account creation is entirely optional — all browsing, searching, and filtering works without an account. If you do register, we hold: your email address and the display name you choose; your organisation profile (type, registration number, postal address, and activity-area preferences — including UKCAT category, subcategory, and specific-focus selections); your saved funding shortlist (a list of programme record IDs, not the programme text itself); your beneficiary group preferences; and the date and time of your last sign-in. We use this information solely to personalise the site for you and to let you retrieve your saved data across sessions and devices. You can delete your account at any time from your account page, which permanently removes all of the above.
Searches within your account. When you are signed in and use the funding directory, we record the searches and filters you run — the words you search for, the filter options you select, the number of results returned, and the date and time — together with your account ID and a snapshot of your organisation type, registration reference, and area. We use this to improve the directory and, as an infrastructure organisation, to understand what funding the local sector is looking for. We do not record searches made when you are not signed in. After 12 months — or straight away if you delete your account — each record is anonymised to organisation level: the link to you is permanently removed, and the anonymised, organisation-level data is then kept indefinitely for sector analysis. You can switch this recording off at any time from your account page. See “How long we keep data” and “Your rights” below.

What we don’t collect

We don’t accept public comments. This site does not collect payment information. We don’t profile visitors for advertising. No visitor data is ever sold to third parties.

We draw the funder and funding-programme information on this site from public registers and open datasets. That information describes organisations, not visitors — it is not personal data about you. Our data sources page lists those datasets and their licences in full.

Specifically, we process personal data on three lawful bases:

Consent for non-essential cookies and analytics. You give consent through the Complianz consent banner on your first visit, and you can withdraw it at any time.
Contract for voluntary user accounts. When you register for an account, we process the profile and shortlist data you provide in order to deliver the account service you have asked for. If you delete your account, we stop processing it.
Legitimate interest for responding to enquiries you send us, for security logging, and for protecting the site against abuse. We also rely on legitimate interest to record the searches you run while signed in (see “Searches within your account” above) — as an infrastructure organisation, understanding what the sector looks for is core to improving the service. We have weighed our interest against your rights and consider this proportionate, given the bounded 12-month identifiable window, the opt-out, and the anonymisation that follows. You can opt out or object to processing on this basis at any time — see “Your rights” below. Once a search record has been anonymised it is no longer personal data, so it falls outside these lawful bases.

In general, we use a small number of trusted third parties to keep the site running. Overall, we share only what each of them needs to do their job, and each has its own contract or terms with us.

Google LLC — Google Analytics processes anonymised site-usage data on the lawful basis of your consent. Additionally, the site includes a translation widget powered by Google Translate: if you choose a language from the widget, your browser loads Google’s translation script and Google processes the content of the page you are viewing in order to return a translated version. Translation only takes place when you actively select a language.
Our web host — receives server requests and stores short-term technical logs.
Microsoft 365 — processes email correspondence sent to and from @rcvda.org.uk addresses.
Brevo (Sendinblue SAS) — our transactional email delivery service, used to send account welcome messages and password-reset emails. We share your email address with Brevo to deliver these emails; it acts as our data processor. Brevo is EU-based and benefits from the UK’s adequacy decision for the EEA.
Automattic Inc. (Akismet and Jetpack Statistics) — each contact form submission is passed to Akismet’s spam-filtering service before we see it. Akismet receives the sender’s name, email address, IP address, and message content. We use this to protect the site against spam, on the lawful basis of legitimate interest. We also use Jetpack Statistics — another Automattic service — to record anonymised page-view counts. Jetpack Statistics uses server-side analytics only; it sets no cookies in your browser. We process this data on the lawful basis of legitimate interest (understanding how the site is used in order to improve it). We have nonetheless surfaced Jetpack in the consent banner as a transparency measure. Automattic operates both services under its own privacy policy.
Cloudflare, Inc. (Turnstile) — every contact form on the site uses Cloudflare’s Turnstile service to confirm the submission is from a real visitor rather than an automated bot. When you load a form, your browser exchanges a short verification token with Cloudflare. Cloudflare receives connection metadata (your IP address and browser headers) for the duration of the check, sets no cookies on your device, and does not see the contents of the form. We use Turnstile to protect the site against abuse, on the lawful basis of legitimate interest. Cloudflare operates the service under its own privacy policy.
TVRA — receives forwarded enquiries from the site where the enquiry concerns the rural voluntary sector or is otherwise within their remit. They act on the forwarded enquiry as an independent recipient. TVRA is not a joint controller of this site.

Furthermore, we do not transfer personal data to any third party for marketing or advertising purposes.

International transfers

Some of our suppliers operate outside the United Kingdom — Google, Automattic, and Cloudflare in particular. Where we transfer personal data to a country without a UK adequacy decision, our suppliers apply UK-approved safeguards (standard contractual clauses and additional measures). However, you can ask us for a copy of the safeguards by writing to [email protected].

How long we keep data

Analytics data: retained at the default Google Analytics 4 data-retention period.
Email correspondence and contact form submissions: kept for as long as we need to respond and provide a record of the matter, then deleted on a rolling basis. Where a query develops into a longer-running engagement — a partnership, an application enquiry, a complaint — we keep records for the life of that engagement plus seven years.
Server logs: held for up to 30 days, then rotated out.
User account data: held until you delete your account. Deleting your account permanently removes your email address, display name, organisation profile, activity-area preferences, saved shortlist, and login history from our systems. Your in-account search history is anonymised at this point rather than deleted — the link to you is removed and only organisation-level data remains.
In-account search history: held in a form linked to you for up to 12 months, then automatically anonymised to organisation level. We keep the anonymised, organisation-level data indefinitely for sector analysis; once anonymised it can no longer be traced back to you. If you switch search recording off, or ask us to erase your data, we delete the records still linked to you.

You have the right to:

Access the personal data we hold about you.
Rectify inaccurate personal data we hold about you.
Erase your personal data where we no longer have a lawful basis to hold it.
Restrict how we process your data in certain circumstances.
Receive your data in a structured, machine-readable format (data portability).
Object to processing based on our legitimate interest.
Withdraw consent at any time, where consent is the lawful basis.

To exercise any of these rights, please write to [email protected]. We will respond within one calendar month. Indeed, there is no charge for a reasonable request.

How to make a complaint

If you are not happy with how we have handled your personal data, you can complain to the Information Commissioner’s Office (ICO). Specifically, the ICO is the UK’s independent regulator for data protection. Their address is Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, and their helpline is 0303 123 1113.

We would prefer to put the matter right first — please contact us at [email protected] before going to the ICO, so we have the chance to fix it.

Children

This site serves adults working in or running voluntary, community, and charity organisations. In general, we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data to us, please contact [email protected] and we will delete it.

Changes to this privacy policy

We may change this privacy policy as the site develops. Where the changes are material, we will say so in the “last updated” line at the foot of this page. Still, the current version always lives at this URL.

Contact

For any question about how we use your personal data, please write to [email protected]. For general enquiries about Redcar Fundseekers, [email protected] is the right address.

Last updated: 21 June 2026