Three Guineas Trust privacy notice

Version 1.2 – 1 July 2025

Introduction

The Three Guineas Trust (“Three Guineas/we/us/our”) is one of 20 different independent, grant-making trusts established by members of five generations of the Sainsbury family.

We fund charitable projects to support the autonomy, liberty and civil rights of autistic, neurodivergent and Disabled people.

We share an office with other Sainsbury Family Charitable Trusts. The office is located at The Peak, 5 Wilton Road, London SW1V 1AP.

We are registered as a data controller with the Information Commissioner’s Office. Our registration number is Z6144390.

Three Guineas is committed to the protection of your personal data we process in line with the data protection principles set out in the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act (2018).

We have policies, procedures, and training to ensure our trustees and employees
understand their data protection responsibilities and our data protection principles.

We have a nominated member of staff who serves as our Data Protection Manager. If you have any questions regarding how we collect, store and process your personal data, please email dataprotection@sfct.org.uk. We have also appointed an independent Data Protection Officer at data protection consultants Evalian Limited who can be contacted by email at dpo@evalian.co.uk.

This privacy notice explains what personal data we collect from individuals who visit our offices or contact us by email, phone, or apply for a grant or send us other communications.

We place great importance on ensuring the quality, confidentiality, integrity and availability of the data we hold. We also place great importance on meeting our data protection obligations when processing your personal data. We use a variety of technical and organisational measures to help protect your personal data from unauthorised access, use or disclosure.

If you have applied for a job with us or another trust or sent us your CV or similar information about your work record, we process your personal data as set out in the Sainsbury Family Charitable Trusts’ privacy notice for job applicants.

We update this privacy notice in response to changes in laws and regulations, or if we change how we process your data. When changes are made, we will update the date at the bottom of this document.

What information do we process?

Information you provide to us

We process all information you give us, by post, telephone, email or otherwise. This includes information you provide when your register your details with us, are invited to apply for a grant, or attend social functions.

We also process information you provide when you join us as a grants panel member. In addition to your contact details, this may include special category personal data (personal information that requires a higher level of protection by us) about your access requirements to take part in meetings, travel or for overnight accommodation.

Information processed following an enquiry from you or when you submit a grant application to us

We process the following information:

  • Your name (first and last)
  • Organisation name
  • Organisation address
  • Your job title/position
  • Organisation telephone number
  • Organisation email address

We use your name, organisation address, business email address and business phone number to respond to your enquiry and/or process your grant application. Information we obtain from other sources.

Indirectly, we may record or receive additional details about you from:

  • Public information sources, for example your organisation’s website, social media, news articles and public registers, for example the Charity Commission.
  • People who think that you may be interested in applying for a grant.
  • External sources such as research publications, clinical trials, external
    reviewers or advisors.

To ensure the safety of all our visitors, contractors and staff, SFCT and the Landlord’s property managers capture and record CCTV images at the main entrances to our offices.

Purposes and bases for processing your data

We will only use your personal information for the purpose which it was provided to us for and in ways that you would reasonably expect.

The purposes for processing your data and lawful bases for each of these are as follows:

Responding to correspondence from you

It is in our legitimate interest to respond to enquiries made by phone, by email, through our social channels or any other means.

For assessing the suitability of a grant application

When you submit a grant application to us we are processing it with your consent.

Sending you information such as newsletters, research reports, and other news about Three Guineas and information which may be of interest

When you agree to be contacted for further information, we will rely on your consent, which may be withdrawn at any time by emailing dataprotection@sfct.org.uk.

Fulfilment of our obligations, as set out in our grant awards or other agreements

This is necessary for the performance of the grant award or other agreement we have entered with you.

For grants panel members taking part in the grant application review process, including online and face-to-face meetings

When you apply to become a panel member, we process your personal data with your consent which may be withdrawn at any time by emailing dataprotection@sfct.org.uk.

For charitable trust / fund management, forecasting and statistical purposes

It is our legitimate interest to identify areas for improving charitable relationships, developing new award opportunities and managing the charitable trust.

Processing relevant personal information about trustees and committee members of the grant recipients for governance purposes

It is our legal obligation to comply with governance requirements of the Charities Act 2011, Charities (Protection and Social Investment) Act 2016, the Trustees Acts 1925, 2000.

Publicising the positive impact of the trust by publishing case studies

Publication of your details, including photographs and recordings in our case studies is with your consent which can be withdrawn at any time.

Publishing our annual reports

Publication of your details in our case studies is with your consent which can be withdrawn at any time.

Sharing your information

We will not sell or exchange your personal information. We will only share your personal information in order to fulfil our obligations under the grant award agreement with you, or for legitimate interest purposes, or where we have your consent, or we are required to do so by law. Three Guineas works closely with other Sainsbury family charitable trusts and may share personal details with the other trustees, trust staff, but only if it helps support your grant application.

We may share your personal information with third party organisations who will process it on our behalf. This is strictly governed by data processing terms which confirms that the personal information we provide will only be used for the purposes we specify and will be processed in line with data protection legislation.

Other third parties we may share your personal data with include:

  • Public bodies, for example the Charity Commissions in the UK, Inland Revenue, or the police. The legal basis is to comply with our legal obligations.
  • In case of an emergency we may also share your information with the relevant
    public health and emergency services and contact your next of kin. The legal basis is to protect your vital interests.

We are committed to transparency and publish a report annually about the trust’s
activities. We publicise data about our grants on the 360 Giving website. Our annual reports do not contain personal data.

International transfers

Three Guineas only operates in the UK. All grant application processing and award administration takes place in the UK.

Three Guineas works with several advisors and suppliers and it is possible that we will share your data with other third-party suppliers that process your data in countries outside the UK where the data protection laws are not equivalent to those within the UK. Where this applies, we do so, either on the basis of an “adequacy decision” or documented in an International Data Transfer Agreement (IDTA) approved by the UK Information Commissioner’s Office (ICO) which contractually oblige companies in those countries to the standard expected within the UK. More information about these is available on the ICO website.

Your rights

The UK GDPR provides you with certain rights in relation to the processing of your personal data, including to:

  • Request access to personal data about you (this is called a “data subject access request”). This enables you to receive a copy of the personal data we hold about you, and to check that we are lawfully processing it.
  • Request correction or updating any personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.

Request personal data provided by you to be transferred in machine-readable format (this is called “data portability”).

  • Request erasure of personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove personal data where you have exercised your right to object to processing (see below).
  • Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you (for example, if you want us to establish its accuracy or the reason for processing it).
  • Object to the processing of your personal data in certain circumstances (for example, to correct the situation where the processing based on the legitimate interests
    of Three Guineas overrides your rights and freedoms).

These rights are not absolute. They are subject to conditions set out in data protection and privacy legislation, and other laws and regulations that we must follow.

If at any time you decide that you no longer wish to be contacted, or if you would like to exercise any of your rights as set out above, you can contact us by email. Contact information is at the end of this policy.

We will not charge you to access your personal data, or to exercise any other data-related rights). We may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

You have the right to make a complaint at any time to the Information Commissioner’s Office if you are concerned about the way in which we are handling your personal data.

Data retention period

We will retain your personal data for as long as it necessary for the purpose of our relationship or until you object to us processing it or withdraw your consent. We will not retain your personal information if it is no longer required. In some circumstances, we may legally be required to retain your personal information, for example for finance or audit purposes.

Contact us

You can contact Three Guineas in relation to data protection and this privacy notice by writing to:

Data Protection Manager,
The Three Guineas Trust,
The Peak,
5 Wilton Road,
London SW1V 1AP

Alternatively, you can email us at dataprotection@sfct.org.uk.

Last updated: 1 July 2025.