Privacy & data protection
Your information deserves the same care and respect as you do.
Project40Seven is operated by Creative Leiston C.I.C., company number 14588288. Our Data Protection Policy sets out how we handle personal information under the UK GDPR and Data Protection Act 2018. This page summarises that policy and explains how to contact us about your information.
Who to contact
For a privacy question, a request about your information or a concern about how it has been handled, email info@project40seven.co.uk and mark your message “Data protection”. You can also write to the Directors, Creative Leiston C.I.C., Project40Seven, 47 High Street, Leiston, Suffolk, IP16 4EL.
Why we hold information
We use information to run our services safely and responsibly. Depending on how you are involved, this can include contact and household details for Pantry or Food Bank support, membership and loan records for the Library of Things, volunteer and training records, event or trader bookings, donation records and correspondence. We may also hold information needed for accessibility, safeguarding or incident reporting.
Our policy requires a lawful basis for using personal information. These can include consent, contracts, legal obligations, vital interests or legitimate interests, depending on the purpose. Sensitive information requires additional protection.
Respecting confidentiality
Access is limited to people who need the information for their role. Paper and digital records must be kept securely. Information may be shared where there is an appropriate reason, including your consent, requested support, safeguarding, emergencies or a legal obligation. Only the information needed for that purpose should be shared.
Photographs and videos are used with appropriate consent and in accordance with our procedures. Particular care is required when children or adults at risk are involved.
How long records are kept
Retention depends on the record. The current policy sets these normal periods:
- Pantry, Food Bank and Library of Things records: while active, then 24 months.
- Volunteer, training and Crafted records: while active, then three years.
- Work experience and accident or incident records: three years.
- Safeguarding records: seven years.
- CCTV: normally 90 days, with exceptions where footage is needed for an investigation, insurance, legal proceedings or safeguarding.
Your rights
Depending on the circumstances, you may ask to access or correct your information, request its deletion or restrict its use, object to processing or ask for portable data. Where we rely on your consent, you can withdraw it. Contact us using the details above so we can consider your request.
You also have the right to raise a concern with the Information Commissioner’s Office.
Our policy and your privacy notice
This summary is based on Data Protection Policy version 003, dated 8 June 2026, alongside our Confidentiality Policy. A privacy notice explains the details for a particular service or use of information; please ask us for the notice relevant to your involvement and for a copy of the full policy.
This website is hosted by WordPress.com. For information about the platform’s own handling of visitors’ data, see Automattic’s privacy notice for visitors to its users’ sites. External services, including Facebook and PayPal, have their own privacy notices when you follow their links.
